WatchGuard System Manager Fireware Configuration Guide

WatchGuard System Manager Fireware Configuration Guide
WatchGuard®System Manager
Fireware Configuration Guide
WatchGuard Fireware Pro v8.1
Notice to Users
Information in this guide is subject to change without notice. Companies, names, and data used in examples
herein are fictitious unless otherwise noted. No part of this guide may be reproduced or transmitted in any
form or by any means, electronic or mechanical, for any purpose, without the express written permission of
WatchGuard Technologies, Inc.
Copyright, Trademark, and Patent Information
Copyright© 1998 - 2005 WatchGuard Technologies, Inc. All rights reserved.
Complete copyright, trademark, patent, and licensing
information can be found in the WatchGuard System
Manager User Guide. A copy of this book is automatically
installed into a subfolder of the installation directory
called Documentation. You can also find it online at:
http://www.watchguard.com/help/documentation/
All trademarks or trade names mentioned herein, if any, are the property of their respective owners.
Guide Version: 8.1-050627
ADDRESS:
ABOUT WATCHGUARD
WatchGuard is a leading provider of network security solutions for small- to midsized enterprises worldwide, delivering integrated products and services that are
robust as well as easy to buy, deploy and manage. The company’s Firebox X family of
expandable integrated security appliances is designed to be fully upgradeable as an
SUPPORT:
organization grows and to deliver the industry’s best combination of security,
www.watchguard.com/support
[email protected]
performance, intuitive interface and value. WatchGuard Intelligent Layered Security
U.S. and Canada +877.232.3531
architecture protects against emerging threats effectively and efficiently and provides
All Other Countries +1.206.613.0456
the flexibility to integrate additional security functionality and services offered
through WatchGuard. Every WatchGuard product comes with an initial LiveSecurity
SALES:
U.S. and Canada +1.800.734.9905 Service subscription to help customers stay on top of the security landscape with
All Other Countries +1.206.521.8340 vulnerability alerts, software updates, expert security instruction and superior
customer care. For more information, please call (206) 521-8340 or visit
www.watchguard.com.
505 Fifth Avenue South
Suite 500
Seattle, WA 98104
ii
WatchGuard System Manager
Contents
PART I Introduction to Fireware Pro
CHAPTER 1 Introduction
...........................................................................3
Fireware Features and Tools ..................................................................3
Fireware User Interface ........................................................................4
Policy Manager window ........................................................................5
Firebox System Manager window ...........................................................6
CHAPTER 2 Monitoring Firebox Status
.....................................................9
Starting Firebox System Manager ..........................................................9
Connecting to a Firebox .......................................................................9
Opening Firebox System Manager ........................................................10
Firebox System Manager Menus and Toolbar ........................................10
Setting refresh interval and pausing the display ......................................12
Seeing Basic Firebox and Network Status ............................................12
Using the Security Traffic Display .........................................................13
Monitoring status information .............................................................13
Setting the center interface ................................................................13
Monitoring traffic, load, and status .......................................................14
Firebox and VPN tunnel status .............................................................14
Monitoring Firebox Traffic ....................................................................16
Setting the maximum number of log messages .......................................16
Using color for your log messages ........................................................17
Copying log messages .......................................................................17
Learning more about a traffic log message .............................................17
Clearing the ARP Cache ......................................................................18
Fireware Configuration Guide
i
Using the Performance Console ..........................................................18
Types of counters .............................................................................18
Defining counters .............................................................................19
Viewing the performance graph ...........................................................21
Viewing Bandwidth Usage ...................................................................21
Viewing Number of Connections by Policy .............................................22
Viewing Information About Firebox Status ............................................24
Status Report ..................................................................................24
Authentication List ............................................................................25
Blocked Sites ...................................................................................26
Security Services ..............................................................................27
Using HostWatch ...............................................................................28
The HostWatch window ......................................................................28
Controlling the HostWatch window .......................................................29
Changing HostWatch view properties ....................................................30
Adding a blocked site from HostWatch ..................................................30
Pausing the HostWatch Display ............................................................30
CHAPTER 3 Setting Up Your Firebox
.......................................................31
Working with Licenses ........................................................................31
Adding licenses ................................................................................32
Deleting a license .............................................................................32
Seeing the active features ..................................................................33
Seeing the properties of a license ........................................................34
Downloading a license key ..................................................................34
Working with Aliases ..........................................................................34
Creating an alias ..............................................................................35
Using Logging ....................................................................................35
Categories of log messages ................................................................36
Designating log servers for a Firebox ....................................................36
Adding a log server ...........................................................................37
Setting log server priority ...................................................................37
Activating Syslog logging ....................................................................38
Enabling advanced diagnostics ............................................................38
Using Global Settings .........................................................................39
VPN ...............................................................................................40
ICMP error handling ..........................................................................40
TCP SYN checking .............................................................................41
TCP maximum segment size adjustment ...............................................41
Setting NTP Servers ...........................................................................42
Working with SNMP ............................................................................42
Using MIBs ......................................................................................43
ii
WatchGuard System Manager
PART II Protecting Your Network
CHAPTER 4 Basic Firebox Configuration
.................................................47
Opening a Configuration File ...............................................................47
Opening a working configuration file .....................................................47
Opening a local configuration file .........................................................48
Making a new configuration file ...........................................................49
Saving a Configuration File .................................................................49
Saving a configuration to the Firebox ....................................................49
Saving a configuration to a local hard drive ............................................50
Changing the Firebox passphrases ......................................................50
Setting the Time Zone ........................................................................51
Setting a Firebox Friendly Name ..........................................................51
Creating Schedules ............................................................................52
CHAPTER 5 Network Setup and Configuration
........................................55
Making a New Configuration File .........................................................55
Configuring the external interface ........................................................58
Adding Secondary Networks ................................................................60
Adding WINS and DNS Server Addresses .............................................61
Configuring Routes .............................................................................62
Adding a network route ......................................................................62
Adding a host route ...........................................................................63
Setting Firebox Interface Speed and Duplex .........................................63
CHAPTER 6 Configuring Policies
.............................................................65
Creating Policies for your Network .......................................................65
Adding Policies ..................................................................................66
Changing the Policy Manager View .......................................................66
Adding a policy ................................................................................67
Making a custom policy template .........................................................68
Adding more than one policy of the same type ........................................69
Deleting a policy ...............................................................................69
Configuring Policy Properties ...............................................................70
Setting access rules, sources, and destinations .......................................70
Setting logging properties ...................................................................71
Configuring static NAT .......................................................................73
Setting advanced properties ................................................................74
Setting Policy Precedence ...................................................................75
Using automatic order .......................................................................75
Setting precedence manually ..............................................................77
Fireware Configuration Guide
iii
CHAPTER 7 Configuring Proxied Policies
................................................79
Defining Rules ...................................................................................79
Adding rulesets ................................................................................80
Using advanced rules view ..................................................................81
Customizing Logging and Notification for proxy rules .............................82
Configuring log messages and notification for a proxy policy ......................82
Configuring log messages and alarms for a proxy rule ..............................82
Using dialog boxes for alarms, log messages, and notification ....................82
Configuring the SMTP Proxy ................................................................83
Configuring general settings ................................................................84
Configuring ESMTP parameters ............................................................85
Configuring authentication rules ..........................................................86
Defining content type rules .................................................................87
Defining file name rules .....................................................................87
Configuring the Mail From and Mail To rules ...........................................87
Defining header rules ........................................................................87
Defining antivirus responses ...............................................................87
Changing the deny message ...............................................................88
Configuring the IPS (Intrusion Prevention System) ....................................88
Configuring proxy and antivirus alarms for SMTP .....................................89
Configuring the FTP Proxy ...................................................................89
Configuring general settings ................................................................90
Defining commands rules for FTP .........................................................90
Setting download rules for FTP ............................................................90
Setting upload rules for FTP ................................................................91
Enabling intrusion prevention for FTP ....................................................91
Configuring proxy alarms for FTP .........................................................91
Configuring the HTTP Proxy .................................................................91
Configuring settings for HTTP requests .................................................92
Configuring general settings for HTTP responses ......................................94
Setting header fields for HTTP responses ...............................................94
Setting content types for HTTP responses ..............................................94
Setting cookies for HTTP responses ......................................................94
Setting HTTP body content types ..........................................................95
Changing the deny message ...............................................................95
Configuring intrusion prevention for HTTP ...............................................96
Defining proxy alarms for HTTP ............................................................96
Configuring the DNS Proxy ..................................................................96
Configuring general settings for the DNS proxy ........................................97
Configuring DNS OPcodes ...................................................................97
Configuring DNS query types ...............................................................98
Configuring DNS query names .............................................................99
Enabling intrusion prevention for the DNS proxy ......................................99
Configuring DNS proxy alarms .............................................................99
iv
WatchGuard System Manager
Configuring the TCP Proxy
...................................................................99
Configuring general settings for the TCP proxy ........................................99
Enabling intrusion prevention for the TCP proxy .....................................100
CHAPTER 8 Working with Firewall NAT
..................................................101
Using Dynamic NAT ..........................................................................102
Adding global dynamic NAT entries .....................................................102
Reordering dynamic NAT entries ........................................................103
Policy-based dynamic NAT entries ......................................................103
Using 1-to-1 NAT ..............................................................................103
Configuring Global 1-to-1 NAT ............................................................104
Configuring policy-based 1-to-1 NAT ....................................................105
Configuring static NAT for a policy ......................................................105
CHAPTER 9 Implementing Authentication
.............................................107
How User Authentication Works ........................................................107
Using authentication from the external network ....................................107
Using authentication through a gateway Firebox to another Firebox ...........108
Authentication server types ..............................................................108
Using a backup authentication server .................................................108
Configuring the Firebox as an Authentication Server ...........................108
Setting up the Firebox as an authentication server .................................109
Configuring RADIUS Server Authentication .........................................110
Configuring SecurID Authentication ....................................................112
Configuring LDAP Authentication .......................................................113
Configuring Active Directory Authentication .......................................115
Configuring a Policy with User Authentication .....................................116
CHAPTER 10 Firewall Intrusion Detection and Prevention
....................119
Using Default Packet Handling Options ..............................................119
Spoofing attacks ............................................................................120
IP source route attacks ....................................................................120
“Ping of death” attacks ....................................................................120
Port space and address space attacks ................................................120
Flood attacks .................................................................................121
Unhandled Packets .........................................................................121
Distributed denial of service attacks ...................................................121
Setting Blocked Sites .......................................................................121
Blocking a site permanently ..............................................................122
Using an external list of blocked sites .................................................122
Creating exceptions to the Blocked Sites list .........................................122
Setting logging and notification parameters .........................................123
Blocking sites temporarily with policy settings ......................................124
Fireware Configuration Guide
v
Blocking Ports
.................................................................................124
Blocking a port permanently .............................................................125
Automatically blocking IP addresses that try to use blocked ports .............125
Setting logging and notification for blocked ports ..................................126
CHAPTER 11 Using Signature-Based Security Services
........................127
Installing the Software Licenses ........................................................127
Configuring Gateway AntiVirus for E-mail ............................................128
Configuring Gateway AntiVirus for E-mail in the SMTP Proxy .................129
Adding an SMTP Proxy with AntiVirus ..................................................130
Using Gateway AntiVirus for E-mail with more than one proxy ...................131
Getting Gateway AntiVirus for E-mail Status and Updates ....................131
Seeing service status ......................................................................131
Updating signatures manually ...........................................................132
Updating the antivirus software .........................................................132
Monitoring Gateway AntiVirus for E-mail .............................................133
Configuring Gateway AntiVirus for E-mail to record log messages ..............133
Configuring the Signature-Based Intrusion Prevention Service ..............134
Configuring Intrusion Prevention Service in a Proxy .............................134
Adding a proxy with Intrusion Prevention Service ...................................134
Using advanced HTTP proxy features ...................................................136
Getting Intrusion Prevention Service Status and Updates ....................137
Seeing service status ......................................................................137
Updating signatures manually ...........................................................138
PART III Using Virtual Private Networks
CHAPTER 12 Introduction to VPNs
.......................................................141
Tunneling Protocols ..........................................................................142
IPSec ...........................................................................................142
PPTP ...........................................................................................142
Encryption ....................................................................................142
Selecting an encryption and data integrity method ................................143
Authentication ...............................................................................143
Extended authentication ...................................................................143
Selecting an authentication method ....................................................143
IP Addressing ..................................................................................143
Internet Key Exchange (IKE) ..............................................................144
NAT and VPNs ..................................................................................144
Access Control ................................................................................144
Network Topology .............................................................................145
Meshed networks ...........................................................................145
Hub-and-spoke networks ..................................................................146
vi
WatchGuard System Manager
Tunneling Methods ...........................................................................147
WatchGuard VPN Solutions ...............................................................147
RUVPN with PPTP ...........................................................................148
Mobile User VPN .............................................................................148
Branch Office Virtual Private Network (BOVPN) .....................................148
VPN Scenarios .................................................................................149
Large company with branch offices: System Manager .............................150
Small company with telecommuters: MUVPN ........................................150
Company with remote employees: MUVPN with extended authentication ....151
CHAPTER 13 Configuring BOVPN with Manual IPSec
............................153
Before You Start ..............................................................................153
Configuring a Gateway ......................................................................153
Adding a gateway ...........................................................................153
Editing and deleting a gateway ..........................................................156
Making a Manual Tunnel ...................................................................156
Editing and deleting a tunnel .............................................................159
Making a Tunnel Policy .....................................................................160
CHAPTER 14 Configuring IPSec Tunnels
...............................................161
Management Server .........................................................................161
WatchGuard Management Server Passphrases ..................................162
Setting Up the Management Server ...................................................163
Adding Devices ................................................................................164
Updating a device’s settings ..............................................................165
Configuring a Firebox as a Managed Firebox Client (Dynamic Devices only) 165
Adding Policy Templates ...................................................................166
Get the current templates from a device ..............................................166
Make a new policy template .............................................................166
Adding resources to a policy template .................................................167
Adding Security Templates ................................................................167
Making Tunnels Between Devices ......................................................167
Drag-and-drop tunnel procedure .........................................................168
Using the Add VPN Wizard without drag-and-drop ..................................168
Editing a Tunnel ...............................................................................168
Removing Tunnels and Devices .........................................................169
Removing a tunnel ..........................................................................169
Removing a device ..........................................................................169
CHAPTER 15 Configuring RUVPN with PPTP
..........................................171
Configuration Checklist .....................................................................171
Encryption levels ............................................................................171
Configuring WINS and DNS Servers ...................................................172
Fireware Configuration Guide
vii
Adding New Users to Authentication Groups ......................................173
Configuring Services to Allow Incoming RUVPN Traffic .........................174
By individual policy .........................................................................174
Using the Any policies ......................................................................174
Enabling RUVPN with PPTP ................................................................175
Enabling extended authentication ......................................................175
Adding IP Addresses for RUVPN Sessions ..........................................175
Preparing the Client Computers .........................................................176
Installing MSDUN and Service Packs ...................................................176
Creating and Connecting a PPTP RUVPN on Windows XP .....................177
Creating and Connecting a PPTP RUVPN on Windows 2000 .................177
Running RUVPN and accessing the Internet ..........................................178
Making outbound PPTP connections from behind a Firebox .....................178
PART IV Increasing the Protection
CHAPTER 16 Advanced Networking
......................................................181
About Multiple WAN Support .............................................................181
Configuring multiple WAN support ......................................................182
Creating QoS Actions .......................................................................183
Using QoS in a multiple WAN environment ...........................................185
Dynamic Routing ..............................................................................185
Using RIP ........................................................................................185
RIP Version 1 .................................................................................186
RIP Version 2 .................................................................................188
Using OSPF .....................................................................................190
OSPF Daemon Configuration .............................................................190
Configuring Fireware to use OSPF .......................................................193
Using BGP .......................................................................................194
CHAPTER 17 Controlling Web Site Access
...........................................201
Getting Started with WebBlocker .......................................................201
Adding a WebBlocker Action to a Policy ..............................................202
Configuring a WebBlocker action .......................................................202
Scheduling a WebBlocker Action ........................................................207
CHAPTER 18 High Availability
...............................................................209
High Availability Requirements ..........................................................209
Installing High Availability .................................................................210
Configuring High Availability ..............................................................210
Manually Controlling HA ....................................................................211
Backing up an HA configuration .........................................................212
viii
WatchGuard System Manager
Upgrading Software in an HA Configuration ........................................212
Using HA with Signature-based Security Services ...............................212
APPENDIX A Types of Policies
...............................................................213
Packet Filter Policies ........................................................................213
Proxied Policies ...............................................................................230
Fireware Configuration Guide
ix
x
WatchGuard System Manager
PART I
Introduction to Fireware Pro
Fireware Configuration Guide
1
2
WatchGuard System Manager
CHAPTER 1
Introduction
WatchGuard® Fireware™ Pro is the next generation of security appliance software available from WatchGuard. Appliance software is a software application that is kept in the memory of your firewall hardware.
The Firebox uses the appliance software with a configuration file to operate.
Your organization’s security policy is a set of rules that define how you protect your computer network
and the information that passes through it. Fireware Pro appliance software has advanced features to
manage security policies for the most complex networks.
Fireware Features and Tools
WatchGuard® Fireware™ Pro includes many features to improve your network security.
Policy Manager for Fireware
Policy Manager gives you one user interface for basic firewall configuration tasks. Policy Manager
includes a full set of preconfigured packet filters and proxies. For example, to apply a packet filter for all
Telnet traffic, you add a Telnet packet filter. You can also make a custom packet filter for which you set
the ports, protocols, and other parameters. Careful configuration of IPS options can stop attacks such as
SYN Flood attacks, spoofing attacks, and port or address space probes.
Firebox System Manager
Firebox® System Manager gives you one interface to monitor all components of your Firebox. From Firebox System Manager, you can monitor the current condition of the Firebox or connect directly to get an
update on its configuration.
Network Address Translation
Network address translation (NAT) is a term used for one or more methods of IP address and port translation. Network administrators frequently use NAT to increase the number of computers which can to operate off one public IP address. It also hides the private IP addresses of computers on your network.
Fireware Configuration Guide
3
Fireware User Interface
Firebox and third-party authentication servers
With Fireware, there are five methods to do authentication: Firebox, RADIUS, SecurID, LDAP, and Active
Directory.
Signature-based intrusion detection and prevention
When a new intrusion attack is identified, the qualities that make the virus or attack unique are identified
and recorded. These features are known as the signature. WatchGuard® Gateway AntiVirus for E-mail™
and Signature-Based Intrusion Prevention Service use these signatures to find viruses and intrusion
attacks. The Intrusion Prevention Service operates with all WatchGuard proxies. Gateway AntiVirus for Email operates with the SMTP Proxy.
VPN creation and management
Fireware technology makes it easier to configure, manage, and monitor many IPSec VPN tunnels to
branch offices and end users.
Advanced networking features
Fireware lets you configure a maximum of four Firebox interfaces as external, or WAN, interfaces. You can
control the flow of traffic through more than one WAN interface to balance the volume of outgoing traffic. The QoS feature in Fireware lets you set priority and bandwidth restrictions on each policy. The Firebox can also use the dynamic route protocols RIP, OSPF, and BGP. These protocols allow network devices
to update route tables dynamically.
Web traffic control
The WebBlocker feature uses the HTTP Proxy to apply a filter to Web traffic. You can set the hours in the
day that users can get access to the Web. You can also set categories of Web sites that users cannot
browse to.
High availability
High Availability supplies stateful failover for firewall and VPN connections. With High Availability, you
can have one Firebox operating in standby mode while the other Firebox continues to operate. The
standby Firebox automatically takes over firewall operations if the primary Firebox is unable to communicate with the Internet.
Fireware User Interface
The primary components of the Fireware user interface are Policy Manager and Firebox System Manager.
4
WatchGuard System Manager
Fireware User Interface
Policy Manager window
Policy Manager includes menus you use to manage your Firebox and build your configuration file. The
major menus and their options are as follows.
File menu
•
•
•
•
•
•
•
Create a new configuration file
Open a configuration file
Save a configuration file to disk or to the Firebox
Back up a Firebox
Restore a Firebox
Update the firmware on the Firebox
Change passphrases
Edit menu
• Change, add, and delete policies
Setup menu
•
•
•
•
•
•
•
•
•
•
•
•
Give the Firebox model, name, location, contact, and time zone
View, add, and download licenses
Add, edit, or remove aliases
Set up log hosts
Use internal and third-party authentication servers
Create actions: a procedure to follow when a data stream matches an applicable specification
Configure intrusion detection and prevention settings
Blocked sites and blocked ports settings
Update signatures and engine settings for signature-based intrusion prevention
Enable Network Time Protocol and add NTP servers
Enable SNMP traps and add SNMP management stations
Configure global settings for the Firebox
Fireware Configuration Guide
5
Fireware User Interface
Network menu
•
•
•
•
•
Configure Firebox interfaces
Configure dynamic NAT and 1-to-1 NAT
View and add routes
Configure dynamic routing using the RIP, OSPF, and BGP protocols
Configure High Availability
VPN menu
•
•
•
•
View and add gateways
View and configure tunnels; change authentication, encryption, and advanced IPSec settings
Add remote users using PPTP or MUVPN
Enable the Firebox as a managed client
Firebox System Manager window
You use Firebox System Manager to see:
• Status of the Firebox interfaces and the traffic that goes through the interfaces
• Status of VPN tunnels and management certificates
• Real-time graphs of Firebox bandwidth use or of the connections on specified ports
• Status of any other security services you use on your Firebox
View menu
• See the certificates on the Firebox
• See the license on the Firebox
6
WatchGuard System Manager
Fireware User Interface
• Open the communication log file
Tools menu
•
•
•
•
•
•
•
•
Open Policy Manager with the configuration of the Firebox
Open HostWatch and connect to the Firebox
Monitor the performance aspects of the Firebox
Synchronize the time of the Firebox with the system time
Clear the ARP cache of the Firebox
Clear the alarms on the Firebox
Configure High Availability options
Change the status and configuration passphrases
Fireware Configuration Guide
7
Fireware User Interface
8
WatchGuard System Manager
CHAPTER 2
Monitoring Firebox Status
WatchGuard® Firebox® System Manager gives you one interface to monitor all components of your Firebox and the work it does. From the Firebox System Manager window, you can monitor the current condition of the Firebox, or connect to the Firebox directly to update its configuration. You can see:
• Status of the Firebox interfaces and the traffic that is going through the interfaces
• Status of VPN tunnels and management certificates
• Real-time graphs of Firebox bandwidth use or of the connections on specified ports
• Status of any other security services you use on your Firebox
Starting Firebox System Manager
Before you start using Firebox® System Manager, you must add a Firebox to WatchGuard® System Manager.
Connecting to a Firebox
1
From WatchGuard System Manager, click the Connect to Device icon.
Or, you can select File > Connect To > Device.
The Connect to Firebox dialog box appears.
2
Use the Firebox drop-down list to select a Firebox.
3
Type the Firebox status (read-only) passphrase.
4
Click OK.
You can also type the IP address or name of the Firebox.
The Firebox appears in the WatchGuard System Manager window.
Fireware Configuration Guide
9
Firebox System Manager Menus and Toolbar
Opening Firebox System Manager
1
From WatchGuard System Manager, select the Device tab.
2
Select a Firebox to examine with Firebox System Manager.
3
Click the Firebox System Manager icon.
Firebox System Manager appears. Then it connects to the Firebox to get information about the status
and configuration.
Firebox System Manager Menus and Toolbar
Firebox® System Manager commands are in the menus at the top of the window. The most common tasks
are also available as buttons on the toolbar. The following tables tell what the menus and toolbar buttons
do.
10
WatchGuard System Manager
Firebox System Manager Menus and Toolbar
Firebox System Manager Menus
Menu
Command
Function
File
Settings
Changes how Firebox System Manager shows
status information in the displays.
Disconnect
Disconnects from the current Firebox.
Connect
Connects to a Firebox.
Reset
Resets Firebox System Manager statistics.
Reboot
Starts the current Firebox again.
Shutdown
Stops the Firebox.
Close
Closes the Firebox System Manager window.
Certificates
Lists the certificates on the Firebox.
Licenses
Lists the current licenses on the Firebox.
Communication Log
Opens the communication log.
Policy Manager
Opens Policy Manager with the configuration of
the current Firebox.
HostWatch
Opens HostWatch connected to current Firebox.
Graphs
Shows graphs of performance aspects of the
Firebox.
Synchronize Time
Synchronizes the time of the Firebox with the
system time.
Clear ARP Cache
Empties the ARP cache of the current Firebox.
Clear Alarm
Empties the alarm list on the current Firebox
High Availability
Configures High Availability options.
Change Passphrases
Changes the status and configuration
passphrases.
Firebox System
Manager Help
Opens the online help files for this application.
About
Shows version and copyright information.
View
Tools
Help
Firebox System Manager Toolbar
Icon
Function
Starts the display again. This icon appears only
when you are not connected to a Firebox.
Stops the display. This icon appears only when
you are connected to a Firebox.
Shows the management and VPN certificates
kept on the Firebox.
Shows the licenses registered and installed for
this Firebox.
Starts Policy Manager. Use Policy Manager to
make or change a configuration file.
Starts HostWatch, which shows connections for
this Firebox.
Fireware Configuration Guide
11
Seeing Basic Firebox and Network Status
Icon
Function
Opens the Performance Console where you can
configure graphs that show Firebox status.
Opens the Communication Log dialog box to show
connections between Firebox System Manager
and the Firebox.
Setting refresh interval and pausing the display
All tabs on Firebox System Manager have, at the bottom of the screen, a drop-down list for setting the
refresh interval, and a button to pause the display:
Refresh Interval
The refresh interval is the time between refreshes. You can change the interval of time (in
seconds) that Firebox System Manager gets the Firebox information and sends updates to
the user interface.
You must balance how frequently you get information and the load on the Firebox. Be sure
to check the refresh interval on each tab. When a tab is getting new information for its
display, the text “Refreshing...” appears adjacent to the Refresh Interval drop-down list. A
shorter time interval gives a more accurate display, but makes more load on the Firebox.
From Firebox System Manager, use the Refresh Interval drop-down list to select a new
interval. Select the duration between window refreshes for the bandwidth meter. You can
select 5 seconds, 10 seconds, 30 seconds, 60 seconds, 2 minutes, or 5 minutes. You can also
type a custom value into this box.
Pause/Continue
You can click the Pause button to temporarily stop Firebox System Manager from refreshing
this window. After you click the Pause button, this button changes to a Continue button.
Click Continue to continue refreshing the window.
Seeing Basic Firebox and Network Status
The Front Panel tab of Firebox® System Manager shows basic information about your Firebox, your network, and network traffic.
12
WatchGuard System Manager
Seeing Basic Firebox and Network Status
Using the Security Traffic Display
Firebox System Manager initially has a group of indicator lights to show the direction and volume of the
traffic between the Firebox interfaces. The display can be a triangle (below left) or a star (below center
and right).
Triangle display
If a Firebox has only three interfaces configured, each node of the triangle is one interface. If
a Firebox has more than three interfaces, each node of the triangle represents one type of
interface. For example, if you have six configured interfaces with one external, one trusted,
and four optional interfaces, the “All-Optional” node in the triangle represents all four of the
optional interfaces.
Star display
The star display shows all traffic in and out of the center interface. An arrow moving from
the center interface to a node interface shows that traffic is flowing through the Firebox
coming in through the center interface and going out through the node interface. For
example, if eth1 is at the center and eth2 is at a node, a green arrow shows that traffic
flowed from eth1 to eth2. There are two star displays — one for a Firebox X Core with 6
interfaces and one for Firebox X Peak with 10 interfaces.
To change the display, right-click it and select Triangle Mode or Star Mode.
Monitoring status information
The points of the star and triangle show the traffic that flows through the interfaces. Each point shows
incoming and outgoing connections with different arrows. When traffic flows between the two interfaces,
the arrows come on in the direction of the traffic.
In the star figure, the location where the points come together can show one of two conditions:
• Red (deny)—The Firebox denies a connection on that interface.
• Green (allow)—There is traffic between this interface and a different interface (but not the center)
of the star. When there is traffic between this interface and the center, the point between these
interfaces shows as green arrows.
In the triangle, the network traffic shows in the points of the triangle. The points show only the idle or
deny condition. One exception is when there is a large quantity of VPN tunnel switching traffic. “Tunnel
switching” traffic refers to packets being sent through a VPN to a Firebox configured as the default gateway for the VPN network. In this case, the Firebox System Manager traffic level indicator can show very
high traffic, but you do not see moving green lights as tunnel switching traffic comes in and goes out of
the same interface.
Setting the center interface
If you use the star figure, you can customize which interface appears in its center. Click the interface
name or its point. The interface then moves to the center of the star. All the other interfaces move in a
clockwise direction. Moving an interface to the center of the star allows you to see all traffic between that
interface and all other interfaces. The default display shows the external interface in the center.
Fireware Configuration Guide
13
Seeing Basic Firebox and Network Status
Monitoring traffic, load, and status
Below the Security Traffic Display are the traffic volume indicator, processor load indicator, and basic status information (Detail).
The two bar graphs show the traffic volume and the Firebox capacity.
Firebox and VPN tunnel status
The section in Firebox System Manager to the right side of the front panel shows:
• The status of the Firebox
• The branch office VPN tunnels
• The mobile user and PPTP VPN tunnels
Firebox Status
In the Firebox Status section, you see:
• Status of the High Availability feature. When it has a correct configuration and is available, the IP
address of the standby Firebox appears. If High Availability is installed, but there is no network
connection to the secondary Firebox, “Not Responding” appears.
• The IP address of each Firebox interface and the configuration mode of the external interface.
• Status of the CA (root) certificate and the IPSec (client) certificate.
If you expand the entries in the Firebox System Manager main window, you can see:
• IP address and netmask of each configured interface
• The Media Access Control (MAC) address of each interface
• Number of packets sent and received since the last Firebox restart
• End date and time of CA and IPSec certificates
14
WatchGuard System Manager
Seeing Basic Firebox and Network Status
• CA fingerprint. Use this to find man-in-the-middle attacks
• Status of the physical link (a dark icon indicates the connection is down)
Branch Office VPN Tunnels
Below the Firebox Status section is a section on BOVPN tunnels. There are two types of IPSec BOVPN
tunnels: tunnels created manually and tunnels created with the Management Server. The figure below
shows an expanded entry for a BOVPN tunnel.
The information that shows, from the top to the bottom, is:
• The tunnel name, the IP address of the destination IPSec device (a different Firebox, Firebox X
Edge, SOHO), and the tunnel type. If the tunnel was created by the Management Server, the IP
address refers to the full remote network address.
• The volume of data sent and received on the tunnel in bytes and packets.
• The time before the key expires and when the tunnel must be set up again. This appears as a time
limit or as the volume of bytes. If you configure a VPN tunnel to expire using time and volume
limits, the two expiration values appear.
• Authentication and encryption settings set for the tunnel.
• Routing policies for the tunnel.
Mobile User VPN Tunnels
After the branch office VPN tunnels are entries for Mobile User VPN tunnels. The entry shows the same
information as for Branch Office VPN. This includes the tunnel name, destination IP address, tunnel type,
packet information, key expiration date, authentication, and encryption data.
PPTP User VPN Tunnels
For PPTP User VPN tunnels, Firebox System Manager shows only the quantity of sent and received packets. The volume of bytes and total volume of bytes are not applicable to PPTP tunnels.
Expanding and closing tree views
To expand a part of the display, click the plus sign (+) adjacent to the entry, or double-click the name of
the entry. To close a part, click the minus sign (–) adjacent to the entry. When no plus or minus sign
shows, no more information is available.
Fireware Configuration Guide
15
Monitoring Firebox Traffic
Monitoring Firebox Traffic
To see Firebox® log messages, click the Traffic Monitor tab.
Setting the maximum number of log messages
You can change the maximum number of log messages that you can keep and see on Traffic Monitor.
When you get to the maximum number, the new log messages replace the first entries. A high value in
this field puts a large load on your management system if you have a slow processor or a small quantity
of RAM. If it is necessary to examine a large volume of log messages, we recommend that you use Log
Viewer.
1
From Firebox System Manager, select File > Settings.
The Settings dialog box appears.
2
Use the Maximum Log Messages drop-down list to change the number of log messages that
appear in Traffic Monitor. Click OK.
The value you type gives the number of log messages in thousands.
16
WatchGuard System Manager
Monitoring Firebox Traffic
Using color for your log messages
In Traffic Monitor, you can make log messages appear in different colors that refer to the types of information they show.
1
From Firebox System Manager, select File > Settings. Click the Traffic Monitor tab.
2
To enable the display of colors, select the Show Logs in Color check box.
3
On the Alarm, Traffic Allowed, Traffic Denied, Event, or Debug tab, click the field to appear in
a color.
The Text Color field on the right side of the tabs shows the color in use for the field.
4
To change the color, click the color control adjacent to Text Color. Select a color. Click OK to
close the color control dialog box. Click OK again to close the Settings dialog box.
The information in this field appears in the new color on Traffic Monitor. A sample of how Traffic Monitor will look
appears at the bottom of the dialog box.
5
You can also select a background color for the traffic monitor. Click the color control arrow
adjacent to Background Color. Select a color. Click OK to close the color control dialog box.
Click OK again to close the Settings dialog box.
You can cancel the changes you make in this dialog box. Click Restore Defaults.
Copying log messages
To make a copy of a log message and paste it in a different tool, right-click the message and select Copy
Selection. If you select Copy All, Firebox System Manager copies all the log messages. Open the other
tool and paste the message or messages.
To copy more than one, but not all messages, bring up the file using Log Viewer and use the Log Viewer
copy function, as described in the WatchGuard® System Manager User Guide.
Learning more about a traffic log message
To learn more about a traffic log message, you can:
Fireware Configuration Guide
17
Clearing the ARP Cache
Copy the IP address of the source or destination
Make a copy of the source or destination IP address of a traffic log message, and paste it
into a different software application. To copy the source IP address, right-click the message,
and select Source IP Address > Copy Source IP Address. To copy the destination IP address,
right-click the message, and select Destination IP Address > Copy Destination IP Address.
Ping the source or destination
To ping the source or destination IP address of a traffic log message, do this: Right-click the
message, and select Source IP Address > Ping or Destination IP Address > Ping. A pop-up
window shows the results.
Trace the route to the source or destination
To use a traceroute command to the source or destination IP address of a traffic log
message, do this: Right-click the message, and select Source IP Address > Trace Route or
Destination IP Address > Trace Route. A pop-up window shows you the results of the
traceroute.
Temporarily block the IP address of the source or destination
To temporarily block all traffic from a source or destination IP address of a traffic log
message, do this: Right-click the message, select Source IP Address > Block: [IP address] or
Destination IP Address > Block: [IP address]. The length of the time an IP address is
temporarily blocked by this command is set in Policy Manager. To use this command you
must give the configuration password.
Clearing the ARP Cache
The ARP (Address Resolution Protocol) cache on the Firebox® keeps the hardware addresses (also known
as MAC addresses) of TCP/IP hosts. Before an ARP request starts, the system makes sure a hardware
address is in the cache. You must clear the ARP cache on the Firebox when your network has a drop-in
configuration.
1
From Firebox System Manager, select Tools > Clear ARP Cache.
2
Type the Firebox configuration passphrase.
3
Click OK.
This flushes the cache entries.
Using the Performance Console
The Performance Console is a Firebox® utility that you use to prepare graphs that show how various parts
of the Firebox are functioning. To gather the information you define counters that identify the information that is used in preparing the graph.
Types of counters
You can monitor these types of performance counters:
System Information
Show how the CPU is used.
18
WatchGuard System Manager
Using the Performance Console
Interfaces
Monitor and report on the activities of selected interfaces. For example, you can set up a
counter that monitors the number of packets received by a specific interface.
Policies
Monitor and report on the activities of selected policies. For example, you can set up a
counter that monitors the number of packets that a specific policy examines.
VPN Peers
Monitor and report on the activities of selected VPN policies.
Tunnels
Monitor and report on the activities of selected VPN tunnels.
Defining counters
To define a counter for any of the categories:
1
From Firebox System Manager, select the Performance Console icon.
The Performance Console window appears.
1
From the Performance Console window, expand one of the counter categories listed under Available
Counters.
Click the + sign adjacent to the category name to see the counters available in that category. When you click a
counter, the Counter Configuration fields automatically refresh, related to the counter you select.
Fireware Configuration Guide
19
Using the Performance Console
2
From the Chart Window drop-down list, select New Window if the graph is to be shown in a
new window. Or, select the name of an open window to add the graph to a window that is open.
3
From the Poll Interval drop-down list, select a time interval between 5 and 60 seconds.
This is the frequency that Performance Console checks for updated information from the Firebox.
4
Add configuration information specific to the selected counter. These fields show automatically
when you select specified counters.
- Type — Use the drop-down list to select the type of graph to create.
- Interface — Use the drop-down list to select the interface to graph data for.
- Policy — Use the drop-down list to select a policy from your Firebox configuration to graph
data for.
- Peer IP — Use the drop-down list to select the IP address of a VPN endpoint to graph data
for.
- Tunnel ID — Use the drop-down list to select the name of a VPN tunnel to graph data for.
5
Click Add Chart to start the real-time graphing of this counter.
Note
This performance graph shows CPU usage. You create graphs for other functions in the same way.
To edit the polling interval of an active counter:
1
Select the counter name in the Active Counters dialog box in the lower-right corner of the
Performance Console window.
2
Use the Poll every drop-down list to select a new polling interval.
3
Click Apply.
The real-time chart window updates with the new polling interval.
20
WatchGuard System Manager
Viewing Bandwidth Usage
To remove an active counter:
1
Select the counter name in the Active Counters dialog box in the lower-right corner of the
Performance Console window.
2
Click Remove.
Viewing the performance graph
Graphs are shown in a real-time chart window. You can show one graph in each window, or show many
graphs in one window. Graphs scale dynamically to fit the data.
Click Stop Monitoring to stop the Performance Console from collecting data for this counter. You can
stop monitoring to save system resources and restart it again later.
Click Close to close the chart window. The data in the chart will not be saved.
Viewing Bandwidth Usage
Select the Bandwidth Meter tab to see the real-time bandwidth for all the Firebox® interfaces. If you
click any place on the chart, you can get more detailed information in a pop-up window about bandwidth use at this point in time.
Fireware Configuration Guide
21
Viewing Number of Connections by Policy
To change the way the bandwidth is displayed:
1
From Firebox System Manager, select File > Settings. Click the Bandwidth Meter tab.
2
Do one or more of the steps in the following sections.
Changing the scale of the bandwidth display
You can change the scale of the Bandwidth Meter tab. Use the Graph Scale drop-down list to select the
value that is the best match for the speed of your network. You can also set a custom scale. Type the
value in kilobits for each second in the Custom Scale text box.
Adding and removing lines in the bandwidth display
• To add a line to the Bandwidth Meter tab, select the interface from the Hide list in the Color
Settings section. Use the Text Color control to select a color for the line. Click Add. The interface
name appears in the Show list with the color you selected.
• To remove a line from the Bandwidth Meter tab, select the interface from the Show list in the
Color Settings section. Click Remove. The interface name appears in the Hide list.
Changing colors in the bandwidth display
You can also change the colors of the display of the Bandwidth Meter tab. Use the Background and Grid
Line color control boxes to select a new color.
Changing how interfaces appear in the bandwidth display
One option is to change how the interface names appear on the left side of the Bandwidth Meter tab.
The names can show as a list. The display can also show an interface name adjacent to the line it identifies. Use the Show the interface text as a drop-down list to select List or Tags.
Viewing Number of Connections by Policy
Select the Service Watch tab of Firebox® System Manager to see a graph of the configured policies on a
network. The Y axis (vertical) shows the number of connections. The X axis (horizontal) shows the time. If
22
WatchGuard System Manager
Viewing Number of Connections by Policy
you click any place on the chart, you can get more detailed information in a pop-up window about policy
use at this point in time.
1
To change the way the policies are displayed, select File > Settings. Click the Service Watch tab.
2
Do one or more of the steps in the following sections.
Changing the scale of the policies display
You can change the scale of the Service Watch tab. Use the Graph Scale drop-down list to select the
value that is the best match for the volume of traffic on your network. You can also set a custom scale.
Type the number of connections in the Custom Scale text box.
Adding and removing lines in the policies display
• To add a line to the Service Watch tab, select the policy from the Hide list in the Color Settings
section. Use the Text Color control to select a color for the line. Click Add. The interface name
appears in the Show list with the color you selected.
• To remove a line from the Service Watch tab, select the policy from the Show list in the Color
Settings section. Click Remove. The interface name appears in the Hide list.
Fireware Configuration Guide
23
Viewing Information About Firebox Status
Changing colors in the policies display
You can change the colors of the display of the Service Watch tab. Use the Background and Grid Line
color control boxes to select a new color.
Changing how policy names appear in the policies display
You can change how the policy names appear on the left side of the Service Watch tab. The names can
show as a list. The tab can also show an interface name adjacent to the line it identifies. Use the Show
the policy labels as a drop-down list to select List or Tags.
Showing connections by policy or rule
The Service Watch tab can show the number of connections by policy or rule. The policy setting lets you
put together more than one rule into a single line. Use the Show connections by drop-down list to select
a display setting.
Viewing Information About Firebox Status
There are four tabs that tell about Firebox® status and configuration: Status Report, Authentication List,
Blocked Sites, and Security Services.
Status Report
The Status Report tab provides statistics about Firebox traffic.
The Firebox Status Report contains this information:
Uptime and version information
The Firebox uptime, the WatchGuard® Firebox System software version, the Firebox model,
and appliance software version. There is also a list of the status and version of the product
components operating on the Firebox.
24
WatchGuard System Manager
Viewing Information About Firebox Status
Log hosts
The IP addresses of the log host or hosts.
Logging options
Logging options configured with either the Quick Setup Wizard or Policy Manager.
Memory and load average
Statistics on the memory usage (shown in bytes of memory) and load average of the
currently running Firebox.
Processes
The process ID, the name of the process, and the status of the process, as shown in the figure
on the next page. (These codes appear under the column marked “S.”)
Network configuration
Information about the network cards in the Firebox: the interface name, its hardware and
software addresses, and its netmask. The display also includes local routing information and
IP aliases.
Blocked Sites list
The current manually blocked sites and any current exceptions. Temporarily blocked site
entries appear on the Blocked Sites tab.
Interfaces
Each network interface appears in this section, along with information about what type of
interface it is configured as (external, trusted, or optional), its status and packet count.
Routes
The Firebox kernel routing table. You use these routes to find which interface the Firebox
uses for each destination address.
ARP table
The ARP table on the Firebox. The ARP table is used to match IP addresses to hardware
addresses.
Dynamic Routing
This shows which, if any, dynamic routing components are in use on the Firebox.
Refresh interval
This is the rate at which this display updates the information.
Support
Click Support to open the Support Logs dialog box. This is where you set the location to
which you save the diagnostic log file. You save a support log in tarzipped (*.tgz) format.
You create this file for troubleshooting, when requested by your support representative.
Authentication List
The Authentication List tab of Firebox System Manager gives the IP addresses and user names of all the
persons that are authenticated to the Firebox. If you use DHCP, an IP address can appear as a different
user name when the computer starts again.
Fireware Configuration Guide
25
Viewing Information About Firebox Status
You can sort users by IP address or user name by clicking the column header. You can also remove an
authenticated user from the list by right-clicking their user name and closing their authenticated session.
Blocked Sites
The Blocked Sites List tab of Firebox System Manager shows the IP addresses of all the external IP
addresses that are temporarily blocked. Many events can cause the Firebox to add an IP address to the
Blocked Sites tab: a port space probe, a spoofing attack, an address space probe, or an event you configure.
Adjacent to each IP address is the time when it comes off the Blocked Sites tab. You can use the Blocked
Sites dialog box in Policy Manager to adjust the length of time that an IP address stays on the list.
Adding and removing sites
The Blocked Sites tab is in continuous refresh mode if the Continue button on the toolbar is
enabled. Add allows you to temporarily add a site to the blocked sites list. Click Change Expiration to change the time at which this site is deleted from the list. Delete removes the site from
the blocked sites list.
If you open the Firebox with the status passphrase, you must type the configuration passphrase before
you can remove a site from the list.
26
WatchGuard System Manager
Viewing Information About Firebox Status
Security Services
The Security Services tab lists information about the Gateway AntiVirus and Intrusion Prevention services.
Gateway AntiVirus
This area of the dialog box gives information about the Gateway AntiVirus for E-mail feature.
Activity since last restart
- Files scanned: Number of files that have been scanned for viruses since the last Firebox
restart.
- Viruses found: Number of viruses found in scanned files since the last Firebox restart.
- Viruses cleaned: Number of files removed that were infected by viruses since the last
Firebox restart.
Signatures
- Installed version: Version number of the installed signatures.
- Last update: Date of the last signature update.
- Version available: Whether a newer version of the signatures is available.
- Server URL: URL that the Firebox visits to see if updates are available, and the URL that
updates are downloaded from.
- History: Click to show a list of all of the historical signature updates.
- Update: Click to update your virus signatures. This button is active only if a newer version
of the virus signatures is available.
Intrusion Prevention Service
This area of the dialog box gives information about the Signature-Based Intrusion Prevention Service feature.
Activity since last restart
Fireware Configuration Guide
27
Using HostWatch
- Scans performed: Number of files that have been scanned for viruses since the last Firebox
restart.
- Intrusions detected: Number of viruses found in scanned files since the last Firebox restart.
- Intrusions prevented: Number of files removed that were infected by viruses since the last
Firebox restart.
Signatures
- Installed version: Version number of the installed signatures.
- Last update: Date of the last signature update.
- Version available: If a newer version of the signatures is available.
- Server URL: URL that the Firebox visits to see if updates are available, and the URL that
updates are downloaded from.
- History: Click to show a list of all of the historical signature updates.
- Update: Click this button to update your intrusion prevention signatures. This button is
active only if a newer version of the intrusion prevention signatures is available.
Using HostWatch
HostWatch is a graphic user interface that shows the network connections between the trusted and external networks. HostWatch also gives information about users, connections, and network address translation (NAT).
The line that connects the source host and the destination host uses a color that shows the type of connection. You can change these colors. The default colors are:
• Red — The Firebox® denies the connection.
• Blue — The connection uses a proxy.
• Green — The Firebox uses NAT for the connection.
• Black
Icons that show the type of service appear adjacent to the server entries for HTTP, Telnet, SMTP, and FTP.
Domain name server (DNS) resolution does not occur immediately when you first start HostWatch. When
HostWatch is configured do DNS resolution, it replaces the IP addresses with the host or user names. If
the Firebox cannot identify the host or user name, the IP address stays in the HostWatch window.
Using DNS resolution with HostWatch can cause the management station to send a large number of NetBIOS packets (UDP 137) through the Firebox. To only method of preventing this is to turn off NetBIOS
over TCP/IP in Windows.
To start HostWatch, click the HostWatch icon in Firebox System Manager.
The HostWatch window
The top part of the HostWatch window has two sides. You can set the interface for the left side. The right
side represents all other interfaces. HostWatch shows the connections to and from the interface configured on the left side. To select an interface, right-click the current interface name. Select the new interface.
Double-click an item on one of the sides to get the Connections For dialog box. The dialog box shows
information about the connection, and includes the IP addresses, port number, time, connection type,
and direction.
28
WatchGuard System Manager
Using HostWatch
While the top part of the window only shows connections to and from the selected interface, the bottom
part of the HostWatch window shows all connections to and from all interfaces. The information is shown
in a table with the ports and the time the connection was created.
Controlling the HostWatch window
You can change the HostWatch window to show only the necessary items. You can use this feature to
monitor specified hosts, ports, or users.
1
From HostWatch, select View > Filter.
Fireware Configuration Guide
29
Using HostWatch
2
Click the tab to monitor: Policy List, External Hosts, Other Hosts, Ports, or Authenticated
Users.
3
On the tab for each item you do not want to see, clear the check boxes in the dialog box.
4
On the tab for each item you do want to see, type the IP address, port number, or user name to
monitor. Click Add.
5
Click OK.
Do this for each item that HostWatch must monitor.
Changing HostWatch view properties
You can change how HostWatch shows information. For example, HostWatch can show host names as an
alternative to addresses.
1
From HostWatch, select View > Settings.
2
Use the Display tab to change how the hosts appear in the HostWatch window.
3
Use the Line Color tab to change the colors of the lines between NAT, proxy, blocked, and
normal connections.
4
Click OK to close the Settings dialog box.
Adding a blocked site from HostWatch
To add an IP address to the blocked sites list from HostWatch, right-click on the connection and use the
pop-up window to select the IP address from the connection to add to the blocked sites list. You must set
the time for the IP address to be blocked, and give the configuration passphrase.
Pausing the HostWatch Display
You can use the Pause and Continue icons on the toolbar to temporarily stop and then restart the display.
Or, use File > Pause and File > Continue.
30
WatchGuard System Manager
CHAPTER 3
Setting Up Your Firebox
To operate correctly, your Firebox® must have the information necessary to apply your security policy to
the traffic that goes through your network. Policy Manager gives you one user interface to configure your
security policy. This chapter shows you how to:
• Add, delete and view licenses
• Use aliases
• Set up a log host
• Configure logging
• Configure Firebox global settings
• Set up the Firebox to use an NTP server
• Configure the Firebox for SNMP
Working with Licenses
You increase the functionality of your Firebox® when you purchase an option and add the license key to
the configuration file. When you get a new key, make sure to follow the instructions that come with the
key. These instructions send you to a URL where you will see prompts to enter the key and the serial number from your Firebox. The Web site will create the license key that you will paste into Policy Manager as
described in this section.
Fireware Configuration Guide
31
Working with Licenses
Adding licenses
1
From Policy Manager, select Setup > Licensed Features.
The Firebox License Keys dialog box appears. This dialog box shows the licenses that are available.
2
Click Add.
The Add Firebox License Key dialog box appears.
3
4
Click Import and browse to the location of the license file.
You can also paste the contents of the license file into the dialog box.
Click OK two times.
At this time, the features are available on the management station. In many conditions, new dialog boxes and
menu commands to configure the feature appear in Policy Manager.
5
Save the configuration to the Firebox.
The feature does not operate on the Firebox until you save the configuration file to the Firebox.
Deleting a license
1
From Policy Manager, select Setup > Licensed Features.
The Firebox License Keys dialog box appears.
32
WatchGuard System Manager
Working with Licenses
2
Expand Licenses, select the license ID you want to remove, and click Remove.
3
Click OK.
4
Save the configuration to the Firebox.
Seeing the active features
To see a list of all features for which licenses have been entered, select the license key and click Active
Features. The Active Features dialog box shows each feature along with its capacity and expiration.
Fireware Configuration Guide
33
Working with Aliases
Seeing the properties of a license
To see the properties of a license, select the license key and click Properties. The License Properties dialog box shows the serial number of the Firebox this license applies to, along with its ID and name, the
Firebox model and version number, and the features available for the Firebox.
Downloading a license key
If your license file is not current, you can download a copy of any license file from the Firebox to your
management station. To download license keys from a Firebox, select the license key and click Download.
A dialog box appears for you to type the status passphrase of the Firebox.
Working with Aliases
An alias is a shortcut that identifies a group of hosts, networks, or interfaces. When you use an alias, it is
easier to create a security policy because the Firebox® allows you to use aliases when you create policies.
There are some default aliases included in Policy Manager for your use, including:
Any-Trusted
This is an alias for all Firebox interfaces of type “trusted” (as defined in Policy Manager >
Network > Configuration), and any network accessible through these interfaces.
Any-External
This is an alias for all Firebox interfaces of type “external” (as defined in Policy Manager >
Network > Configuration), and any network accessible through these interfaces.
Any-Optional
This is an alias for all Firebox interfaces of type “optional” (as defined in Policy Manager >
Network > Configuration), and any network accessible through these interfaces.
Using an alias is different from using user authentication. With user authentication, you can monitor a
connection with a name and not as an IP address. The person authenticates with a user name and a password to get access to Internet tools, for example HTTP or FTP. For more information about user authentication, see “How User Authentication Works” on page 107.
34
WatchGuard System Manager
Using Logging
Creating an alias
1
From Policy Manager, select Setup > Aliases.
The Aliases dialog box appears.
2
Click Add.
The Add Alias dialog box appears.
3
In the Alias Name text box, type a unique name to identify the alias.
4
Click Add to add an IP address, subnet, interface, or a different alias to the list of alias members.
This name appears in lists when you configure a security policy.
The member appears in the list of Alias Members.
5
Click OK two times.
Using Logging
The WatchGuard® System Manager installation utility can install Policy Manager and the WatchGuard Log
Server on the same computer. Or, you can also install the Log Server on one or more other computers. You
use Policy Manager and the Log Server to set up and manage logging.
Use Policy Manager to:
- Add the log hosts.
Fireware Configuration Guide
35
Using Logging
- Change the configuration of policies and packet handling
- Save the configuration file to the Firebox®
Use WatchGuard Log Server to:
- Select the global logging and the notification configuration for the host
- Set the log encryption key on the local log server.
Categories of log messages
The Firebox sends four types of log messages: Traffic, Alarm, Event, and Diagnostic.
Traffic logs
The Firebox sends traffic logs as it applies packet filter and proxy rules to traffic that goes through the
Firebox.
Alarm logs
Alarm logs are sent when an event occurs that causes the Firebox to do an action in response to an event.
When the alarm condition occurs, the Firebox sends an alarm log to Traffic Monitor and log server and
causes the specified action to occur.
Some alarms are set in your Firebox configuration. For example, you can use Policy Manager to configure
an alarm when a specified threshold occurs. Other alarms are set in a default configuration. The Firebox
sends an alarm log when a network connection on one of the Firebox interfaces goes down. You cannot
change this in your configuration.
There are eight categories of alarm logs: System, IPS, AV, Policy, Proxy, Counter, Denial of service, and
Traffic.
Event logs
Event logs are created because of Firebox user actions. Events that cause event logs include:
• Firebox start up/shut down
• Firebox and VPN authentication
• Process start up/shut down
• Problems with the Firebox hardware components
• Any task done by the Firebox administrator
Diagnostic logs
Diagnostic (debug) logs are log messages with more information sent by the Firebox that you can use to
help troubleshoot problems. There are 27 different product components that can send diagnostic logs.
Designating log servers for a Firebox
It is recommended that you have a minimum of one log server to use WatchGuard System Manager. You
can select a different primary log server and more than one backup log server.
To set a log server:
1
From Policy Manager, select Setup > Logging.
The Logging Setup dialog box appears.
36
WatchGuard System Manager
Using Logging
2
Select the log server or servers you want to use. Click the Send log messages to the log servers
at these IP addresses check box.
Adding a log server
1
From Policy Manager, select Setup > Logging.
The Logging Setup dialog box appears.
2
Click Configure. Click Add. Type the IP address and the log server encryption key. The permitted
range for the encryption key is 8–32 characters.
3
Click OK.
Setting log server priority
If the Firebox cannot connect to the log server with the highest priority, it connects to the subsequent log
server in the priority list. If the Firebox checks each log server in the list and cannot connect, it will try to
connect to the first log server in the list again. You can create a priority list for log servers.
1
From Policy Manager, select Setup > Logging.
2
Click Configure.
The Logging Setup dialog box appears.
The Configure Log Servers dialog box appears.
3
Select a log host in the Configure Log Servers dialog box. Use the Up and Down buttons to
change order.
Fireware Configuration Guide
37
Using Logging
Activating Syslog logging
You can configure the Firebox to send log information to a Syslog server. A Firebox can send log messages to a log server and a Syslog server at the same time, or send logs to one or the other. Syslog logging
is not encrypted. Do not select a host on the external interface as the Syslog server because this is not
secure.
1
From Policy Manager, select Setup > Logging.
2
Select the Send Log Messages to the Syslog server at this IP address check box.
3
Type the IP address of the Syslog server.
4
Click Configure.
5
For each type of log message, select the Syslog facility to assign. For information on types of log
messages, see “Categories of log messages” on page 36.
The Logging Setup dialog box appears.
The Configure Syslog dialog box appears.
The Syslog facility refers to one of the fields in the Syslog packet and to the file the Syslog is sent to. You can use
Local0 for high priority Syslog messages, such as alarms. You can use Local1- Local 7 to assign priorities for other
types of log messages (with lower numbers having greater priority).
6
Click OK.
7
Save your changes to the Firebox.
Enabling advanced diagnostics
You can select the level of diagnostic logging to write to your log file or to Traffic Monitor. We do not
recommend that you set the logging level to the highest level unless a technical support representative
requests it to troubleshoot a problem. It can cause the log file to fill up very quickly.
1
From Policy Manager, select Setup > Logging.
The Logging Setup dialog box appears.
38
WatchGuard System Manager
Using Global Settings
2
Click Advanced Diagnostics.
The Advanced Diagnostics dialog box appears.
3
Select a category from the left side of the screen.
A description of the category appears in the Description box.
4
Use the slider below Settings to set the level of information that a log of each category will
include in its log message. When the lowest level is set, diagnostic messages for that category are
turned off.
5
To show diagnostic messages in Traffic Manager, select the Display diagnostics messages in
Traffic Monitor check box.
6
To have the Firebox collect a packet trace for IKE packets, select the Enable IKE packet tracing
to Firebox internal storage check box. To see the packet trace information the Firebox collects,
open Firebox System Manager and click the Status tab. Click Support to have Firebox System
Manager get the packet trace information from the Firebox.
Using Global Settings
In Policy Manager you select settings that control the actions of many Firebox® features with the Global
Settings tool.
You set basic parameters for:
• VPN
• ICMP error handling
• TCP SYN checking
Fireware Configuration Guide
39
Using Global Settings
• TCP maximum size adjustment
1
From Policy Manager, select Setup > Global Settings.
2
Configure the different categories of global settings as shown in the sections below.
The Global Settings dialog box appears.
VPN
The global VPN settings are:
Ignore DF for IPSec
Ignore the setting of the Don’t Fragment bit in the IP header.
IPSec pass through
If a user must make IPSec connections to a Firebox from behind a different Firebox, you
must enable the IPSec passthrough setting. For example, if mobile employees are at a
customer location that has a Firebox, they can make IPSec connections to their network
using IPSec. For the local Firebox to correctly allow the outgoing IPSec connection, you
must add an IPSec policy to Policy Manager.
ICMP error handling
Internet Control Message Protocol (ICMP) is used to control errors during connections. It is used for two
types of operations:
• To tell about error conditions.
• To probe a network to find general characteristics about the network.
The Firebox sends an ICMP error message each time an event occurs that matches one of the selected
parameters. The global ICMP error handling parameters and their descriptions are:
Fragmentation req (PMTU)
The IP datagram must be fragmented, but this is prevented because the Don’t Fragment bit
in the IP header is set.
40
WatchGuard System Manager
Using Global Settings
Time exceeded
The datagram was dropped because the Time to Live field expired.
Network unreachable
The datagram could not get to the network.
Host unreachable
The datagram could not get to the host.
Port unreachable
The datagram could not get to the port.
Protocol unreachable
The protocol piece of the datagram could not be delivered.
TCP SYN checking
The global TCP SYN checking setting is:
Enable TCP SYN checking
This feature makes sure that the TCP three-way handshake is done before the Firebox allows
a data connection to be made.
TCP maximum segment size adjustment
The TCP segment can be set to a specified size for a connection that must have more TCP overhead (like
PPPoE, ESP, AH, and so on). If this size is not correctly configured, users cannot get access to some Web
sites. The global TCP maximum segment size adjustment settings are:
Auto adjustment
The Firebox examines all maximum segment size (MSS) negotiations and changes the MSS
value to the applicable one.
No adjustment
The Firebox does not change the MSS.
Limit to
You set a size adjustment limit.
Fireware Configuration Guide
41
Setting NTP Servers
Setting NTP Servers
Network Time Protocol (NTP) synchronizes computer clock times across a network. NTP operates on TCP
and UDP port 123. The Firebox® can synchronize its clock to an internet NTP server to help you keep all
devices on your network synchronized to the same time.
1
From Policy Manager, select Setup > NTP.
2
Select Enable NTP and type the IP addresses of the NTP servers to use. The Firebox can use up to
three NTP servers.
3
Click OK.
Working with SNMP
Simple Network Management Protocol (SNMP) is a set of protocols for managing networks. SNMP uses
management information bases (MIBs) that have management information that is available from network
devices. With Fireware appliance software, the Firebox supports SNMPv1 and SNMPv2c.
You can configure the Firebox® as an SNMP device. It can then receive SNMP polls from an SNMP server.
42
1
From Policy Manager, select Setup > SNMP.
2
Type the IP address of the SNMP server and click Add.
WatchGuard System Manager
Working with SNMP
3
To enable the Firebox to send SNMP traps, select Enable SNMP Trap. You must also edit the
policy that will trigger a trap. Open a policy configuration for edit and select the Properties tab.
Click Logging and select the check box Enable SNMP Trap.
An SNMP trap is an event notification the Firebox sends to the SNMP management system. The trap identifies
when a condition occurs, such as a value that is more than its predefined threshold.
4
Type the Community String the Firebox must use when connecting to the SNMP server.
The community string is like a user ID or password that allows access to the statistics of a device. This community
string must be included with all SNMP requests. If the community string is correct, the device gives the requested
information. If the community string is not correct, the device discards the request and does not respond.
5
Click OK.
Using MIBs
WatchGuard System Manager with Fireware appliance software supports two types of Management Information Bases (MIBs):
• Public MIBs, including IETF standards and MIB2
• Private MIBs, such as those created by WatchGuard
You can download these MIBs from the LiveSecurity Web site. You can see the MIBs easily if you use a
MIB browser (such as HP OpenView or MG-Soft’s MIB browser). The Firebox supports these read-only
object MIBs:
- RFC1155-SMI
- SNMPv2-SMI
- RFC1213-MIB
- RAPID-MIB
- RAPID-SYSTEM-CONFIG-MIB
Fireware Configuration Guide
43
Working with SNMP
44
WatchGuard System Manager
PART II
Protecting Your Network
Fireware Configuration Guide
45
46
WatchGuard System Manager
CHAPTER 4
Basic Firebox Configuration
After your Firebox® is installed on your network and operating with a basic configuration file, you can
begin to add custom configuration settings to meet the needs of your organization. This chapter shows
you how to do some basic configuration and maintenance tasks. Some of these tasks you will do over and
over again as you work with your Firebox. Other tasks you will only do one time.
These basic configuration tasks include:
• Open a configuration file on a local computer or from the Firebox
• Save a configuration file to a local computer or the Firebox
• Change the Firebox passphrases
• Set the Firebox time zone
• Give the Firebox a name to use (instead of an IP address)
• Set basic schedules to use in your policies later
Opening a Configuration File
Policy Manager for Fireware is a software tool that lets you make, change, and save configuration files. A
configuration file, with the extension.cfg, contains all configuration data, options, addresses, and other
information that makes up your Firebox® security policy. When you use Policy Manager, you see a version
of your configuration file that is easy to examine and change.
When you work with a configuration file, you can:
• Open the working configuration file on your Firebox
• Open a configuration file stored on your local hard drive
• Make a new configuration file
Opening a working configuration file
A common task for a network administrator is to make a change to your current security policy. For
example, your business purchases a new software application, and you need to open a port and protocols
to a server at a vendor location. For this task, you must modify your configuration file with Policy Manager.
Fireware Configuration Guide
47
Opening a Configuration File
Using WatchGuard System Manager
1
From the Windows desktop, click Start > Programs > WatchGuard System Manager 8 >
WatchGuard System Manager.
WatchGuard System Manager 8 is the default name of the folder for the Start menu icons. You can change this
folder name during installation.
2
From WatchGuard System Manager, select File > Connect To > Device.
Or,
click the Connect to Device icon on the WatchGuard System Manager toolbar. The Connect to Firebox
dialog box appears.
3
Use the drop-down list to select your Firebox, or type its trusted IP address. Type the status
passphrase. Click OK.
The device appears in the WatchGuard System Manager Device tab.
4
Select the Firebox on the Device tab. Then, select Tools > Policy Manager.
Or,
click the Policy Manager icon on the WatchGuard System Manager toolbar. Policy Manager opens, and it
loads the configuration file in use on the selected Firebox.
Using Policy Manager
1
From Policy Manager, click File > Open > Firebox.
The Open Firebox dialog box appears.
If you get an error that the connection could not be established, try again.
2
From the Firebox Address or Name drop-down list, select a Firebox.
You can also type the IP address or host name.
3
In the Passphrase text box, type the Firebox status (read-only) passphrase.
Use the status passphrase here. You must use the configuration passphrase to save a new configuration to the
Firebox.
4
Click OK.
Policy Manager opens the configuration file and displays the settings.
Opening a local configuration file
Some network administrators find it useful to save more than one version of a Firebox configuration file.
For example, if you have a new security policy to implement, you might want to save the old configuration file to a local hard drive first. Then if you do not like the new configuration, you can restore the old
48
WatchGuard System Manager
Saving a Configuration File
version. You can open configuration files that are on any network drive to which your management station can connect.
1
From Policy Manager, select File > Open > Configuration File.
Or,
click the Open File icon on the Policy Manager toolbar. A standard Windows open file dialog box appears.
2
Use the Open dialog box to locate and to select the configuration file. Click Open.
Policy Manager opens the configuration file and displays the settings.
Making a new configuration file
The Quick Setup Wizard makes a basic configuration file for your Firebox. We recommend that you use
this as the base for all your configuration files. You can also use Policy Manager to make a new configuration file with only the default configuration properties.
1
From Policy Manager, select File > New.
The Select Firebox Model and Name dialog box appears.
2
Use the Model drop-down list to select your Firebox model. Because there are features that match
each model, it is important that you select the same model as your hardware device.
3
4
Type a name for the Firebox.
Click OK.
Policy Manager makes a new configuration with the file name <name>.xml, where <name> is the name you gave
the Firebox.
Saving a Configuration File
After you make a new configuration file or change an existing configuration file, you can save it directly
to the Firebox®. You can also save it to a local hard disk.
Saving a configuration to the Firebox
1
From Policy Manager, click File > Save > To Firebox.
The Save to Firebox dialog box appears.
2
From the Firebox Address or Name drop-down list, select a Firebox.
When you type an IP address, type all the numbers and the periods. Do not use the TAB key or arrow key.
3
Type the Firebox configuration passphrase. You must use the configuration passphrase to save a file
to the Firebox.
4
Click OK.
Fireware Configuration Guide
49
Changing the Firebox passphrases
Saving a configuration to a local hard drive
1
From Policy Manager, click File > Save > As File.
You can also use CTRL-S. A standard Windows save file dialog box appears.
2
Type the name of the file.
The default procedure is to save the file to the WatchGuard® directory. You can also browse to any folder to which
you can connect from the management station. For better security, we recommend that you save the files in a safe
folder with no access to other users.
3
Click Save.
The configuration file saves to the local hard drive.
Changing the Firebox passphrases
A Firebox® uses two passphrases:
• Status passphrase
The read-only password that allows access to the Firebox
• Configuration passphrase
The read-write password that allows an administrator full access to the Firebox
To create a secure passphrase, we recommend that you:
• Do not use a word from standard dictionaries, even if you use it in a different sequence or in a
different language. Make a new acronym that only you know.
• Do not use a name. It is easy for an attacker to find a business name, familiar name, or the name
of a famous person.
• Use a selection of uppercase and lowercase characters, numbers, and special characters (for
example, [email protected]).
An additional security measure is to change the Firebox passphrases at regular intervals. To do this, you
must have the configuration passphrase.
1
From Policy Manager, open the configuration file on the Firebox.
For more information, see “Opening a working configuration file,” on page 47.
2
Click File > Change Passphrases.
An Open Firebox dialog box appears.
3
From the Firebox drop-down list, select a Firebox or type the IP address of the Firebox. Type the
Firebox configuration (read/write) passphrase. Click OK.
The Change Passphrases dialog box appears.
4
50
Type and confirm the new status (read-only) and configuration (read/write) passphrases. The status
passphrase must be different from the configuration passphrase.
WatchGuard System Manager
Setting the Time Zone
5
Click OK.
The new flash image and the new passphrases save to the Firebox. The Firebox automatically starts again.
Setting the Time Zone
The Firebox® time zone controls the date and time that appear in the log file and on tools that include
LogViewer, Historical Reports, and WebBlocker. You should set the Firebox time zone to the time zone for
the physical location of the Firebox. This time zone setting allows for the time to appear correctly in the
log messages. The Firebox system time is set to Greenwich Mean Time (GMT) by default.
1
From Policy Manager, click Setup > System.
The Device Configuration dialog box appears.
2
Select a time zone from the drop-down list. Click OK.
Setting a Firebox Friendly Name
You can give the Firebox® a special name to use in your log files and reports. If you do not do this procedure, the log files and reports use the IP address of the Firebox external interface. Many customers use a
Fully Qualified Domain Name if they register such a name with the DNS system. You must give the Firebox a special name if you use the Management Server to configure VPN tunnels and certificates with the
Firebox.
1
From Policy Manager, click Setup > System.
The Device Configuration dialog box appears.
2
In the Name text box, type the special name you want for the Firebox. Click OK.
You can use all characters but spaces and slashes (/ or \).
Fireware Configuration Guide
51
Creating Schedules
Creating Schedules
You can use schedules to automate certain Firebox® actions such as WebBlocker routines. You can create
a schedule for each day of the week or a different schedule for certain days. You can then use these
schedules in policies that you create.
1
From Policy Manager, select Setup > Actions > Schedules.
The Schedules dialog box appears.
2
Click Add.
The New Schedule dialog box appears.
3
Type a schedule name and description. The schedule name appears in the Schedule dialog box. You
should make it easy to recognize.
4
From the Mode drop-down list, select the time increment for the schedule: one hour, 30 minutes, or
15 minutes.
The chart on the left of the New Schedule dialog box reflects your entry in the drop-down list.
52
5
The chart in the dialog box shows days of the week along the x-axis (horizontal) and increments of
the day on the y-axis (vertical). Click cells in the chart to switch them between operational hours
(when the policy is active) and nonoperational hours (when the policy is not in effect).
6
Click OK to close the New Schedule dialog box. Click Close to close the Schedules dialog box.
WatchGuard System Manager
Creating Schedules
To edit an existing schedule, select the schedule name in the Schedule dialog box and click Edit.
To create a new schedule from an existing one, select the schedule name and click Clone.
Fireware Configuration Guide
53
Creating Schedules
54
WatchGuard System Manager
CHAPTER 5
Network Setup and Configuration
When you install the Firebox® in your network and complete the QuickSetup Wizard, you have a basic
configuration file. You then use Policy Manager to make a new configuration file or to change the one
you made with the QuickSetup Wizard.
If you are new to network security, we recommend that you do all the procedures in this chapter to make
sure you configure all the components of your network. In this chapter, you learn how to use Policy Manager to:
• Make a new configuration file
• Configure the Firebox interfaces
• Add a secondary network
• Add DNS and WINS server information
• Configure network and host routes
Making a New Configuration File
The first step to start a new configuration file is to connect to a Firebox® and open Policy Manager. There
are two methods to do this.
Connecting to the Firebox from WSM
1
From WatchGuard® System Manager, select File > Connect To > Device.
Or,
click the Connect to Device icon on the WatchGuard System Manager toolbar. The Connect to Firebox
dialog box appears.
2
Use the drop-down list to select your Firebox, or type its trusted IP address. Type the status
passphrase. Click OK.
The device appears in the WatchGuard System Manager Device tab.
3
Select the Firebox on the Device tab. Then, select Tools > Policy Manager.
Or,
Click the Policy Manager icon on the WatchGuard System Manager toolbar. Policy Manager opens, and
it opens the configuration file in use on the selected Firebox.
Fireware Configuration Guide
55
Making a New Configuration File
Connecting to the Firebox from Policy Manager
1
From WatchGuard System Manager, select Tools > Policy Manager.
Or,
click the Policy Manager icon on the WatchGuard System Manager toolbar. The Policy Manager dialog
box appears.
2
Use the Firebox drop-down list to select the model of Firebox to which you are connected. Click OK.
The new configuration file contains the default parameters for the specified Firebox model.
Note
We recommend that you save the configuration file frequently. Select File > Save > As File.Changing
Firebox Interface IP Addresses
1
From Policy Manager, select Network > Configuration.
The Network Configuration dialog box appears.
2
Select the interface you want to configure. Click Configure.
The Interface Settings dialog box appears.
3
56
(Optional) Type a description of the interface in the Interface Description field.
WatchGuard System Manager
Making a New Configuration File
4
You can change the interface type from the Interface Type drop-down list.
5
You can change the interface IP address. Type the IP address in slash notation.
When you type an IP addresses, type all the numbers and the periods. Do not use the TAB or arrow key.
6
If you are configuring a trusted or optional interface, select Disable DHCP, DHCP Server, or DHCP
Relay.
See “Configuring the Firebox as a DHCP server” for the DHCP server option, and see “Configuring a DHCP relay” on
page 58 for the DHCP relay option. If you are configuring the external interface, see “Configuring the external
interface” on page 58.
7
Click OK.
Configuring the Firebox as a DHCP server
Dynamic Host Configuration Protocol (DHCP) is an Internet Protocol that makes it easier to control a
large network. A computer you configure as the DHCP server automatically gives IP addresses to the computers on your network. You set the range of addresses. You can configure the Firebox® as a DHCP server
for networks behind the firewall.
If you have a configured DHCP server, we recommend that you continue to use that server for DHCP.
1
Select Network > Configuration.
The Network Configuration dialog box appears.
2
3
4
Select the trusted or an optional interface.
Click Configure and select DHCP Server.
To add an IP address range, click Add and type the first and last IP addresses.
You can configure a maximum of six address ranges.
Fireware Configuration Guide
57
Making a New Configuration File
5
Use the arrow buttons to change the Default Lease Time.
This is the time interval that a DHCP client can use an IP address that it receives from the DHCP server. When the
time is near its limit, the client transmits data to the DHCP server to get a new lease.
Configuring a DHCP relay
One method to get IP addresses for the computers on the Firebox trusted or on an optional network (or
through a VPN tunnel) is to use a DHCP server on a different network. The Firebox can send a DHCP
request to a DHCP server at a different location for the DHCP client. It gives the reply to the computers
on the Firebox trusted or optional network. This option lets computers in more than one office use the
same network address range.
1
Select Network > Configuration.
The Network Configuration dialog box appears.
2
3
4
Select the trusted or an optional interface.
5
Click OK. You must restart the Firebox to complete the change.
Click Configure and click DHCP Relay.
Type the IP address of the DHCP server in the related field. If necessary, make sure to add a route to
the DHCP server.
Configuring the external interface
The Firebox can get a dynamic IP address for the external interface with Dynamic Host Configuration
Protocol (DHCP) or Point-to-Point Protocol over Ethernet (PPPoE). With DHCP, the Firebox uses a DHCP
server which is controlled by your Internet Service Provider (ISP) to get an IP address, gateway, and netmask. With PPPoE, the Firebox makes a PPPoE protocol connection to the PPPoE server of your ISP. Fireware Pro supports unnumbered and static PPPoE. This connection automatically configures your IP
address, gateway, and netmask. If you configure your external interface using DHCP or PPPoE, you cannot add external secondary networks or use external aliases in Policy Manager.
Note
If you configure more than one interface as an external interface, only the lowest-order external
interface can serve as an IKE gateway or an IPSec tunnel endpoint. If this interface is down, all IPSec
tunnels to and from the Firebox will be removed.
Using a static IP address
1
58
From the Interface Settings dialog box, select Static.
WatchGuard System Manager
Making a New Configuration File
2
3
4
Type the IP address of the default gateway.
(Optional) Configure aliases. For more information, see “Working with Aliases” on page 34.
Click OK.
Using PPPoE
1
2
From the Interface Settings dialog box, select PPPoE.
3
4
Select one of the two options:
- Get an IP address automatically
- Use IP address (supplied by your network administrator).
If you selected Use IP Address, enter the IP address in the text box to the right.
Type the User Name and Password. You must type the password two times.
5
Click Property to configure PPPoE parameters.
The PPPoE parameters dialog box appears. Your ISP can tell you if it is necessary to change the timeout or LCP
values.
6
Use the radio buttons to select when the Firebox connects with the PPPoE server.
- Always On — The Firebox keeps a constant PPPoE connection. It is not necessary that network
traffic go through the external interface.
- Dial-on-Demand — The Firebox connects t o the PPPoE server only when it gets a request to
send traffic to an IP address on the external interface.
7
In the PPPoE initialization time field, use the arrows to set the time allowed to start a PPPoE
connection.
8
In the LCP echo failure field, use the arrows to set the number of failed LCP echo requests allowed
before the PPPoE connection is closed.
9
In the LCP echo timeout field, use the arrows to set the length of time in seconds that the response
to each echo timeout must be received.
Using DHCP
1
2
From the Interface Settings dialog box, select DHCP.
In the Host ID text box, type the name of the DHCP server.
Fireware Configuration Guide
59
Adding Secondary Networks
Note
If you configure more than one external interface on a Firebox, map the Fully Qualified Domain Name
to the external interface IP address of the lowest order.
Using more than one external interface
You can configure a Firebox with a maximum of four external interfaces, but VPN tunnels only go
through the lowest-order external interface. When you add the Firebox to the Management Server, all of
the IP address properties must match the properties of the lowest-order interface. For example, if the
interface uses a static IP address, you must configure the Management Server with the same IP address as
the lowest-order external interface.
The default configuration sets eth0 as the lowest-order external interface. If you change the interface
type, a different interface can be the lowest-order external interface. For example, if you change eth0
from an external interface to a trusted or optional interface. The interface you set as external becomes
the lowest-order interface.
Adding Secondary Networks
When you add a secondary network, you make a route from an IP address from the secondary network to
the IP address of the Firebox® interface. Thus, you make (or add) an IP alias to the interface. This IP alias
is the default gateway for all the computers on the secondary network. The secondary network also tells
the Firebox that there is one more network on the Firebox interface.
To use Policy Manager to configure a secondary network:
1
Select Network > Configuration.
The Network Configuration dialog box appears.
60
WatchGuard System Manager
Adding WINS and DNS Server Addresses
2
Select the interface for the secondary network and click Configure.
The Interface Settings dialog box appears.
3
Click Secondary Networks.
The Secondary Networks dialog box appears.
4
Click Add. Type an unassigned IP address from the secondary network.
When you type IP addresses, type all the numbers and the stops. Do not use the TAB or arrow key.
5
Click OK. Click OK again.
Note
Be careful to add secondary network addresses correctly. Policy Manager does not tell you if the
address is correct. WatchGuard® recommends that you do not enter a subnet on one interface that is a
component of a larger network on a different interface. If you do this, spoofing can occur and the
network cannot operate correctly.
Adding WINS and DNS Server Addresses
A number of the features of the Firebox® must have shared Windows Internet Name Server (WINS) and
Domain Name System (DNS) server addresses. These features include DHCP and Remote User VPN. Access
to these servers must be available from the trusted interface of the Firebox.
Fireware Configuration Guide
61
Configuring Routes
Make sure that you use only an internal WINS and DNS server for DHCP and Remote User VPN. This helps
to make sure that you do not make policies which have configuration properties that prevent users from
connecting to the DNS server.
1
From Policy Manager, select Network > Configuration. Click the WINS/DNS tab.
The WINS/DNS tab appears.
2
Type the primary and secondary addresses for the WINS and DNS servers. If necessary, type a domain
name for the DNS server.
Configuring Routes
A route is the sequence of devices through which network traffic must go to get from its source to its
destination. A router is the device in a route that finds the subsequent network point through which to
send the network traffic to its destination. Each router is connected to a minimum of two networks. A
packet can go through a number of network points with routers before it gets to its destination.
The Firebox® lets you create static routes to send traffic from its interfaces to a router. The router can
then send the traffic to the applicable destination in the specified route.
The WatchGuard® Users Forum is also a good source of data about network routes and routers. Use your
LiveSecurity service to find information.
Adding a network route
Add a network route if you have a full network behind a router on your local network. Type the network
IP address, with slash notation.
1
From Policy Manager, select Network > Routes.
The Setup Routes dialog box appears.
62
WatchGuard System Manager
Setting Firebox Interface Speed and Duplex
2
Click Add.
The Add Route dialog box appears.
3
4
Select Network IP from the drop-down list.
In the Route To text box, type the IP address. Use slash notation.
For example, type 10.10.1.0/24.
5
In the Gateway text box, type the IP address of the router.
Make sure that you enter an IP address that is on one of the same networks as the Firebox.
6
Click OK to close the Add Route dialog box.
The Setup Routes dialog box shows the configured network route.
7
Click OK again to close the Setup Routes dialog box.
Adding a host route
Add a host route if there is only one host behind the router or you want traffic to go to only one host.
Type the IP address of that specified host, with no slash notation.
1
From Policy Manager, select Network > Routes.
The Setup Routes dialog box appears.
2
Click Add.
The Add Route dialog box appears.
3
4
5
Select Host IP from the drop-down list.
In the Route To text box, type the host IP address.
In the Gateway text box, type the IP address of the router.
Make sure that you enter an IP address that is on one of the same networks as the Firebox.
6
Click OK to close the Add Route dialog box.
The Setup Routes dialog box shows the configured host route.
7
Click OK again to close the Setup Routes dialog box.
Setting Firebox Interface Speed and Duplex
You can set the speed and duplex parameters for Firebox® interfaces to automatic or manual configuration. WatchGuard® recommends you set the speed and duplex parameters to match the device the Firebox
is connecting to. Use manual when you must override the automatic Firebox interface parameters to
operate with other devices on your network.
1
Select Network > Configuration. Click the interface you want to configure.
Fireware Configuration Guide
63
Setting Firebox Interface Speed and Duplex
2
Click Advanced Settings.
The Advanced Settings dialog box appears.
3
From the MTU spin control, select the maximum packet size, in bytes, that can be transmitted
through the interface.
A typical value is 1,500 bytes.
64
4
From the Link Speed drop-down list, select Auto Negotiate or one of the half-duplex or full-duplex
speeds.
5
Click OK to close the Advanced Settings dialog box. Click OK again to close the Network
Configuration dialog box.
WatchGuard System Manager
CHAPTER 6
Configuring Policies
In Policy Manager, there are two categories of policies: packet filters and proxies.
A packet filter examines each packet’s IP header and is the most basic feature of a firewall. It controls the
network traffic into and out of your Firebox®. If the packet header information is valid, then the firewall
allows the packet. If the packet header information is not valid, the Firebox drops the packet. It can also
record a log message or send an error message to the source.
A proxy uses the same procedure to examine the header information as a packet filter, but it also examines the content. If the content does not match the criteria you set, it denies the packet. A proxy operates
at the application layer, while a packet filter operates at the network and transport protocol layer. When
you activate a proxy, the Firebox:
• Removes all the network data
• Examines the contents for RFC compliance and content type
• Adds the network data again
• Sends the packet to its destination
A proxy uses more resources and bandwidth then a packet filter. But, a proxy catches dangerous content
types that a packet filter cannot.
In this guide, we refer to packet filters and proxies together as policies. Unless we tell you differently, the
procedures refer to both proxies and packet filters.
Policy Manager shows each packet filter and proxy as an icon. The traffic is allowed or denied, and you
can configure the source and destination. You also set rules for logging and notification and configure
the ports, protocols, and other parameters of the packet filter or proxy.
WatchGuard® Fireware includes many pre-configured packet filters and proxies. For example, if you want
a packet filter for all Telnet traffic, you add a Telnet packet filter. You can also make a custom packet filter for which you set the ports, protocols, and other parameters.
Creating Policies for your Network
The security policy of your organization is a set of rules that define how you protect your computer network and the information that goes through it. The Firebox® denies all packets that are not specially
approved. This security policy helps to protect your network from:
Fireware Configuration Guide
65
Adding Policies
• Attacks using new or different IP protocols
• Unknown applications
When you configure the Firebox with the Quick Setup Wizard, you set only the basic packet filters (DNS
client, FTP, and TCP outgoing proxy) and interface IP addresses. If you have more software applications
and network traffic for the Firebox to route, you must:
• Configure the policies on the Firebox to let necessary traffic through
• Set the approved hosts and properties for each policy
• Balance the requirement to protect your network against the requirements of your users to get
access to external resources
We recommend that you set limits on outgoing access when you configure your Firebox.
Adding Policies
You add policies with Policy Manager. Policy Manager shows icons or listings to identify the policies that
you configure on the Firebox®. For each policy you can:
• Set allowed traffic sources and destinations
• Make filter rules and policies
• Enable or disable the policy
• Configure properties such as QoS, NAT, schedules, and logging
Changing the Policy Manager View
Policy Manager has two views: Large Icons and Details. The Large Icons view shows each policy as an
icon. To change to the Large Icons view, select Large Icons from the View menu.
Large Icons View
66
WatchGuard System Manager
Adding Policies
To change to the Details view, select Details from the View menu. In the Details view, each policy is a
row. You can see configuration information such as source and destination and logging and notification
parameters.
Details View
Adding a policy
You use Policy Manager to add a packet filter or proxy to your configuration. To add a policy:
1
In Policy Manager, right-click an empty location and select New Policy.
You can also select Edit > Add Policies. The Policies dialog box appears.
2
Click the plus (+) sign on the left side of the folder to expand the Packet Filters or Proxies folders.
A list of packet filters or proxies appears.
3
Single-click the name of the policy to add.
When you select a policy, the policy icon appears in the area below the New, Edit, and Remove buttons. Also, the
Details box shows the basic information about the policy.
4
Click Add.
The New Policy Properties dialog box appears.
5
You are able to change the name of the policy here. This information appears in the Policy Manager
Details view. If you want to change the name, type a new name in the Name text box.
6
Click OK to close the Properties dialog box.
You can add more than one policy while the Policies dialog box is open.
Fireware Configuration Guide
67
Adding Policies
7
Click Close.
The new policy appears in Policy Manager. You can now set policy properties, as described in “Configuring Policy
Properties” on page 70.
Making a custom policy template
Policy Manager includes many packet filter policy templates. You can also make a custom policy template.
A template includes ports and protocols that identify one type of network traffic. It could be necessary to
make a customer policy template if you add a new software application behind your firewall.
1
In Policy Manager, right-click and select New Policy.
You can also select Edit > Add Policies. The Policies dialog box appears.
2
Click New.
The New Policy Template dialog box appears.
3
In the Name text box, type the name of the policy template.
This name must not be the same as names in the list in the Add Policy dialog box. The name appears in Policy
Manager as the policy type. It helps you to find the policy when you want to change or remove it.
4
In the Description text box, type a description of the policy.
This appears in the Details section when you click the policy name in the list of User Filters.
5
Select the type of policy: Packet Filter or Proxy.
The Proxy option provides these options:
- DNS
- FTP
- HTTP
- TCP
- SMTP
6
To add protocols for this policy, click Add.
The Add Protocol dialog box appears.
68
WatchGuard System Manager
Adding Policies
7
8
9
From the Type drop-down list, select Single Port or Port Range.
From the Protocol drop-down list, select the protocol for this new policy. For more information about
network protocols, see the Reference Guide or online help system. When you select Single Port, you
can select:
- TCP
- UDP
- GRE
- IP
- AH
- ESP
- ICMP
- IGMP
- OSPF
- Any
When you select Port Range, you can select TCP or UDP.
From the Server Port drop-down list, select the client port for this new policy. If you selected Port
Range, select a starting server port and an ending server port.
10 Click OK.
Policy Manager adds the values to the New Policy Template dialog box. Make sure that the name, information, and
configuration of this policy are correct. If necessary, click Add to configure more ports for this policy. Do the Add
Port procedure again and again until you configure all ports for the policy.
11 Click OK.
The Add Policy dialog box appears with the new policy in the Custom folder.
Adding more than one policy of the same type
If your security policy lets you, you can add the same policy more than one time. For example, you can
set a limit on the Web access for most users, while you give full Web access to your management. To do
this, you make two different policies with different properties for outgoing traffic:
1
2
Add the first policy.
Change the name of the policy to give the function in your security policy and add the related
information.
In the example of the different policies given before, you can name the first policy “restricted_web_access.”
3
Click OK. The Properties dialog box of the policy appears. Set the properties as described in
“Configuring Policy Properties” on page 70.
4
5
Add the second policy.
Click OK. The Properties dialog box of the policy appears. Set the properties.
Deleting a policy
As your security policy changes, it is sometimes necessary to remove one or more policies. To remove a
policy, you first remove it from Policy Manager. Then you save the new policy to the Firebox.
1
2
From Policy Manager, click the icon of the policy.
Right-click and select Delete.
You can also select Edit > Delete Policy.
3
4
When asked to confirm, click Yes.
Save the configuration to the Firebox and start the Firebox again. Select File > Save > To Firebox.
Type the configuration passphrase. Select the Save to Firebox check box. Click Save.
Fireware Configuration Guide
69
Configuring Policy Properties
Configuring Policy Properties
If you added a policy and want to change its properties, double-click the policy icon to open the Edit
Policy Properties dialog box.
Setting access rules, sources, and destinations
You use the Policy tab to configure access rules for a given policy.
The Policy tab shows:
• If traffic using this policy is allowed or denied.
• Who uses this policy to start a connection with the users, hosts, and networks reachable through
the Firebox®.
• The destinations for the traffic for this policy.
On the From list, you add the computers and networks that can send (or cannot send) network traffic
with this policy. On the To list, you add computers and networks to which the Firebox routes traffic if it
matches the policy specifications. For example, you could configure a ping packet filter to allow traffic
from all computers on the external network to one Web server on your optional network.
You can use the following settings to determine how traffic is handled:
Allowed
The Firebox allows traffic using this policy if it obeys the rules you set for source and destination.
Denied
The Firebox denies all traffic that matches this policy. You can configure it to record a log
message when a computer tries to use this policy. It can also automatically add a computer or
network that tries to start a connection with this policy to the Blocked Sites list (configured on
the Properties tab).
Denied (send reset)
The Firebox denies all traffic that matches this policy. It can also automatically add a computer
or network that tries to start a connection with this policy to the Blocked Sites list (configured on
70
WatchGuard System Manager
Configuring Policy Properties
the Properties tab). The Firebox also sends a reset (RST) packet to tell the client that the session
is refused and closed. This is usually because the port is blocked.
1
2
3
4
From the Policy tab, specify whether connections are Allowed, Denied, or Denied (send reset).
To add members for the policy, click Add for the From or the To member list.
Use the Add Address dialog box to add a network, IP address, or specified user to a policy. Click either
Add User or Add Other.
If you selected Add Other, from the Choose Type drop-down list, select the host range, host IP, or
network IP to add. In the Value text box, type the correct address, range, or IP. Click OK.
The member or address appears in the Selected Members and Addresses list.
5
If you selected Add User, select the type of user or group, select the authentication server, and
whether you are adding a user or group.
6
Click OK.
Setting logging properties
Use the Properties tab of the Policy Properties dialog box to set logging properties for a policy. You can
configure the Firebox to make a log entry when a policy denies packets. You can also set up notification
when packets are allowed or denied.
1
From the Properties tab, click Logging.
The Logging and Notification dialog box appears.
2
Set the parameters and notification:
Fireware Configuration Guide
71
Configuring Policy Properties
Enter it in the log
When you enable this check box, the Firebox sends a log message when it sees traffic of the type
selected in the Category list. Domain name resolution on the Firebox can slow the time for the
Firebox to send the log message to the log file. The default configuration of all policies is for the
Firebox to send a log message when it denies a packet.
Send SNMP Trap
When you enable this check box, the Firebox sends an event notification to the SNMP
management system. The trap identifies the occurrence of a condition such as a threshold that
has exceeded its predetermined value.
Send notification
When you enable this check box, the Firebox sends a notification when it sees traffic of the type
select in the Category list. You set the notification parameters with the Log Server. For more
information on the Log Server, refer to the WatchGuard System Manager Configuration Guide.
You can configure the Firebox to do one of these actions:
- E-mail The Firebox sends an e-mail message when the event occurs. Set the e-mail address in
the Notification tab of the Log Server user interface.
- Pop-up Window The Firebox makes a dialog box appear on the management station when
the event occurs.
You can control the time of notification, together with the Repeat Count. For information how
to use the Launch Interval and Repeat Count settings, see the next section.
Setting Launch Interval and Repeat Count
You can control the time of the notification, together with the Repeat Count, as follows:
Launch Interval
The minimum time (in minutes) between different notifications. This parameter prevents multiple
notifications in a short time for the same event.
Repeat Count
This counts how frequently an event occurs. When this gets to the selected value, a special repeat
notifier starts. This notifier makes a repeat log entry about that specified notification.
Notification starts again after this number of events.
Here is an example of how to use these two values. The values are set up as follows:
• Launch interval = 5 minutes
• Repeat count = 4
A port space probe starts at 10:00 a.m. and continues each minute. This starts the logging and notification mechanisms. These are the times and the actions that occur:
1 10:00—Initial port space probe (first event)
2 10:01—First notification starts (one event)
3 10:06—Second notification starts (reports five events)
4 10:11—Third notification starts (reports five events)
5 10:16—Fourth notification starts (reports five events)
The launch interval controls the time intervals between the events 1, 2, 3, 4, and 5. This was set to 5 minutes. Multiply the repeat count by the launch interval. This is the time interval an event must continue to
start the repeat notifier.
If the policy you configured is a proxy, a Proxy drop-down list appears along with the View/Edit Proxy
and Clone Proxy icons. For information on how to use these options, see the “Configuring Proxied Policies” chapter in this guide.
72
WatchGuard System Manager
Configuring Policy Properties
Note
A single policy manages either allowed or denied traffic, but not both. If you want to log both
allowed and denied traffic, you must use different policies for each.
Configuring static NAT
Static NAT is also known as port forwarding. Static NAT is a port-to-host NAT. A host sends a packet
from the external network to a specified public address and port. Static NAT changes this address to an
address and port behind the firewall. For more information on NAT, see the “Working with Firewall NAT”
chapter in this guide.
Because of how static NAT operates, it is available only for policies that use a specified port, which
includes TCP and UDP. A policy that has another protocol cannot use incoming static NAT. And the NAT
button in the Properties dialog box of the policy does not work. You also cannot use Static NAT with the
Any policy.
1
2
In Policy Manager, double-click the policy icon.
From the Connections are drop-down list, select Allowed.
To use static NAT, the policy must let incoming traffic through.
3
Below the To list, click Add.
The Add Address dialog box appears.
4
Click NAT.
The Add Static NAT dialog box appears.
Note
Mail servers must use the correct external address of the Firebox for incoming NAT. If not, mail
problems can occur.
5
6
From the External IP Address drop-down list, select the “public” address to use for this policy.
Type the internal IP address.
The internal IP address is the destination on the trusted network.
7
If necessary, select the Set internal port to different port than service check box.
You usually do not use this feature. It enables you to change the packet destination not only to a specified internal
host but also to a different port. If you select the check box, type the different port number or use the arrow
buttons in the Internal Port box.
8
Click OK to close the Add Static NAT dialog box.
The static NAT route appears in the Members and Addresses list.
9
Click OK to close the Add Address dialog box. Click OK to close the Properties dialog box of the
policy.
Fireware Configuration Guide
73
Configuring Policy Properties
Setting advanced properties
You use the Advanced tab of the Edit Policy Properties dialog box to set the schedule, implement Quality of Service (QoS) settings, apply NAT rules, implement ICMP error handling for this policy, and implement a custom idle timeout.
Setting a schedule
You can set an operating schedule for the policy. You can use the schedule templates in the drop-down
list or create a custom schedule. For information, see “Creating Schedules” on page 52.
Note that schedules can be shared by more than one policy.
Applying a Quality of Service (QoS) action
You can assign a Quality of Service action to the policy. Use the button on the far right to create a new
QoS action. After you create a new QoS action, it appears in the QoS drop-down list. For more information, see “Creating QoS Actions” on page 183.
Note that these actions can be shared by more than one policy.
Applying NAT rules
You can apply Network Address Translation (NAT) rules to a policy:
1-to-1 NAT
With this type of NAT, the Firebox uses private and public IP ranges that you set, as described in
“Using 1-to-1 NAT” on page 103.
Dynamic NAT
With this type of NAT, the Firebox maps private IP addresses to public IP addresses. Select Use
global table if you want to use the dynamic NAT rules set for the Firebox. Select All traffic in
this policy if you want to apply NAT to all traffic in this policy.
1-to-1 NAT rules have higher precedence than dynamic NAT rules.
74
WatchGuard System Manager
Setting Policy Precedence
Setting ICMP error handling
You can set the ICMP error handling settings associated with the policy.
From the drop-down list, select:
Use global setting
Use the global ICMP error handling setting set for the Firebox. For information on this global
setting, see “ICMP error handling” on page 40.
Specify setting
Specify a setting that overrides the global setting. Click ICMP Setting. From the ICMP Error
Handling Settings dialog box, select the check boxes to configure individual settings. For
information on these settings, see “ICMP error handling” on page 40.
Setting a custom idle timeout
To set an idle time-out, click Specify Custom Idle Timeout and click the arrows to set the number of
seconds before time-out. This setting overrides the idle time-out of the policy.
Setting Policy Precedence
Precedence is the sequence in which the Firebox® examines network traffic and applies a policy rule. The
Firebox routes the traffic using the rules for the first policy that the traffic matches. Fireware Policy Manager automatically sorts policies from the most detailed to the most general. You can also manually set
the precedence.
Using automatic order
Fireware Policy Manager automatically sorts policies from the most detailed to the most general. Each
time you add a policy, Policy Manager compares the new rule with all the rules in your configuration file.
To set the precedence, Policy Manager uses these criteria:
1
2
3
4
5
6
7
Protocols set for the policy type
Traffic rules of the To field
Traffic rules of the From field
Firewall action
Schedule
Alphanumeric sequence based on policy type
Alphanumeric sequence based on policy name
Fireware Configuration Guide
75
Setting Policy Precedence
Comparing policy type
Policy Manager uses these criteria in sequence to compare two policies until it finds that the policies are
equal or that one is more detailed than the other:
1
An Any policy always has the lowest precedence. For more information about the Any policy, see
“Any” on page 213.
2
Check for the number of TCP 0 (any) or UDP 0 (any) protocols. The policy with the smaller number
has higher precedence.
3
Check for the number of unique ports for TCP and UDP protocols. The policy with the smaller
number has higher precedence.
4
Count the number of unique ports for TCP and UDP protocols. The policy with the smaller number
has higher precedence.
5
Score the protocols based on their IP protocol value. The policy with the smaller score has higher
precedence.
If Policy Manager cannot set the precedence when it compares the policy type, it examines traffic rules.
Comparing traffic rules
Policy Manager uses these criteria in sequence to compare the most general traffic rule of one policy with
the most general traffic rule of a second policy. It assigns higher precedence to the policy with the most
detailed traffic rule. The list of traffic rules from most detailed to the most general:
1
2
3
4
5
6
7
8
9
Host address
IP address range (smaller than the subnet being compared to)
Subnet
IP address range (larger than the subnet being compared to)
Authentication user
Authentication group
Interface, Firebox
Any-External, Any-Trusted, Any-Optional
Any
For example, compare these two policies:
HTTP-1
From: Trusted, user1
HTTP-2
From: 10.0.0.1, Any-Trusted
“Trusted” is the most general entry for HTTP-1. “Any-Trusted” is the most general entry for HTTP-2.
Because “Trusted” is within “Any-Trusted,” HTTP-1 is the more detailed traffic rule. This is correct despite
the fact that HTTP-2 includes an IP address.
If Policy Manager cannot set the precedence when it compares the traffic rules, it examines the firewall
actions.
Comparing firewall actions
Policy Manager compares the firewall actions of two policies to set precedence. Precedence of firewall
actions from highest to lowest is:
1
76
Denied or Denied (send reset)
WatchGuard System Manager
Setting Policy Precedence
2
3
Allowed Proxy
Allowed Filter
If Policy Manager cannot set the precedence when it compares the firewall actions, it examines the schedules.
Comparing schedules
Policy Manager compares the schedules of two policies to set precedence. Precedence of schedules from
highest to lowest is:
1
2
3
Always off
Sometimes on
Always on
If the Policy Manager cannot set the precedence when it compares the schedules, it examines the policy
names.
Comparing type and names
If the two policies do not match any other precedence criteria, Policy Manager sorts the policies in alphanumeric sequence. First it uses the policy type. Then it uses the policy name. Because no two policies can
be the same type and have the same name, this is the last criteria for precedence.
Setting precedence manually
To switch to manual-order mode, select View > Auto-order mode so that the check disappears. You are
asked to confirm whether you want to switch to auto-order mode.
To change the order of policies:
• Select the policy whose order you want to change. Click either the up or down arrow on the far
right side of the Policy Manager toolbar.
or
• Select the policy whose order you want to change and drag it to its new location.
Fireware Configuration Guide
77
Setting Policy Precedence
78
WatchGuard System Manager
CHAPTER 7
Configuring Proxied Policies
Proxy filters do much more than packet filters. A proxy examines the contents of a packet, not only the
header. As a result, the proxy finds forbidden content hidden or embedded in the data payload. For example, an SMTP proxy examines all incoming SMTP packets (e-mail) to find forbidden content, such as executable programs or files written in scripting languages. Attackers frequently use these methods to send
computer viruses. The SMTP proxy knows these content types are not allowed, while a packet filter cannot detect the unauthorized content in the packet’s data payload.
WatchGuard proxies also look for application protocol anomalies and stop packets that are not made correctly. If an SMTP packet is not made correctly or contains unexpected content, it cannot go through the
Firebox.
Proxy policies operate at the application, network, and transport protocol levels. Packet filter policies
operate at only the network and transport protocol level. In other words, a proxy gets each packet,
removes the network layer, and examines its payload. The proxy then puts the network information back
on the packet and sends it to its destination on your trusted and optional networks. This adds more work
for your firewall for the same volume of network traffic. But a proxy uses methods that packet filters cannot to catch dangerous packets.
Defining Rules
A ruleset is a group of rules based on one feature of a proxy. When you configure a proxy, you can see the
rulesets for that proxy in the Categories list. The rulesets you see change when you change the proxy
action on the Properties tab of a proxy configuration window.
A proxy can have more than one proxy action associated with it. For example, you can use one ruleset for
packets sent to an e-mail server protected by the Firebox and a different ruleset to apply to e-mail messages being sent out through the Firebox to the Internet. You can use the existing proxy actions, or clone
an existing proxy action to create a new proxy action.
A rule includes a type of content, pattern, or expression and the action the Firebox® does when a component of the packet’s content matches a rule. Rules also include settings for when the Firebox sends alarms
or if it sends events to the log file.
For most proxy features, the Firebox has a preinstalled ruleset. But you can edit the rules in a ruleset to
change the action for the rules. You can also add your own rules.
Fireware Configuration Guide
79
Defining Rules
The fields you use for these rule definitions look the same for each category of ruleset. The simple view is
shown below. You can also select Change View to see the advanced view.
Use the advanced view to improve the matching function of a proxy. In advanced view, you can configure
exact match and Perl-compatible regular expressions. In simple view, you can configure wildcard pattern
matching with simple regular expressions.
Adding rulesets
From the simple view, do these steps to add new rules:
1
In the Pattern text box, type a pattern that uses simple regular expression syntax.
The wildcard for zero or more than one characters is “*”.
The wildcard for one character is “?”.
2
Click Add.
The new rule appears in the Rules box.
3
In Actions to take section, the If matched drop-down list sets the action to do if the contents of a
packet match one of the rules in the list. The None matched drop-down list sets the action to do if
the contents of a packet do not match a rule in the list. Below is a list of all possible actions. The
actions Strip and Lock apply only to signature-based intrusion prevention actions.
Allow
Allows the connection.
Deny
Denies a specific request but keeps the connection if possible.
Drop
Denies the specific request and drops the connection.
Block
Denies the request, drops the connection, and adds the source host to the Blocked Sites list. For
more information on blocked sites, see “Setting Blocked Sites” on page 135.
Strip
Removes an attachment from a packet and discards it. The other parts of the packet are sent
through the Firebox to its destination.
Lock
Locks an attachment, and wraps it so that it cannot be opened by the user. Only the
administrator can unlock the file.
80
WatchGuard System Manager
Defining Rules
4
An alarm is a mechanism to tell users when a proxy rule applies to network traffic. Use the Alarm
check box to configure an alarm for this event. To set the options for the alarm, select Proxy Alarm
from the Categories list on the left side of a Proxy Configuration window. You can send an SNMP
trap, send e-mail, or open a pop-up window.
5
Use the Log check box to write a traffic log for this event.
Using advanced rules view
To see a detailed view of the current rules, click Change View. The advanced view shows the action for
each rule. It also has buttons you can use to edit, clone (use an existing rule definition to start a new
one), delete, or reset rules. To go back to the simple view, click Change View again. You cannot go back
to simple view if the enabled rules have different action, alarm, and log settings. In this case, you must
continue to use the advanced view.
Changing the precedence of rules
The Firebox uses these guidelines to apply rules:
• It does the rules in sequence from the top to the bottom of the window.
• When a filtered item matches a rule, the Firebox does the related traffic action.
• Content can match more than one of the rules or the default rule, but only the first rule is used.
• The Firebox uses the default rule if no other rule applies. It is always the last rule that the Firebox
applies to the content.
To change the sequence of rules, you must use the advanced view:
1
2
Click Change View to see the advanced view of created rules.
Select a rule to move up or down in the list. Click the Up or Down button to move the rule up or
down in the list.
Fireware Configuration Guide
81
Customizing Logging and Notification for proxy rules
Customizing Logging and Notification for proxy rules
An alarm, log message, or notification is a mechanism to tell a network administrator about network traffic that does not match the criteria for allowed traffic. For example, if traffic is more than a threshold
value, you can configure the Firebox to send you an e-mail message. You can set alarm, log message, and
notification properties for each packet filter and proxy policy. You can also set alarm and log message
properties for a proxy rule.
Configuring log messages and notification for a proxy policy
1
2
Double-click the policy icon to open the Policy Properties dialog box.
Click the Properties tab. Click Logging.
The Logging and Notification dialog box appears.
3
Set the parameters to agree with the requirements of your security policy.
Configuring log messages and alarms for a proxy rule
1
2
3
Double-click the policy icon to open the Policy Properties dialog box.
Click the Properties tab. From the Proxy drop-down list, select the proxy action to configure.
Select Proxy Alarms from the Category list. For more information about the parameters, see the
subsequent section.
There are more log messages and notification options available with signature-based intrusion prevention services.
These options are examined in the chapter “Using Signature-Based Security Services.”
Using dialog boxes for alarms, log messages, and notification
The dialog boxes for alarms, log messages, and notification in proxy definitions have most or all of these
fields:
Enter it in the log
When you enable this check box, the Firebox® sends a traffic log message to the Log Server when
this event occurs. The default configuration of all policies is for the Firebox to send a log
message when it denies a packet.
Send SNMP Trap
When you enable this check box, the Firebox sends an event notification to the SNMP
management system. The SNMP trap shows when the traffic matches a condition such as a
property that is more than its threshold value. Note that the bindings section in the SNMP trap is
blank if the trap occurs when SNMP starts or stops, such as with a reset, restart, or failover.
Send notification
When you enable this check box, the Log Server sends a notification when this event occurs. You
can configure the Log Server to do one of these actions:
82
WatchGuard System Manager
Configuring the SMTP Proxy
- E-mail The Log Server sends an e-mail message when the event occurs. Set the e-mail address
in the Notification tab of the Log Server user interface.
- Pop-up Window The Log Server makes a dialog box appear on the management station when
the event occurs.
Setting Launch Interval and Repeat Count
You can control the time of the notification, together with the Repeat Count, as follows:
Launch Interval
The minimum time (in minutes) between different notifications. This parameter prevents more
than one notification in a short time for the same event.
Repeat Count
This counts how frequently an event occurs. When this gets to the selected value, a special repeat
notifier starts. This notifier makes a repeat log message about that specified notification.
Notification starts again after this number of events.
Here is an example of how to use these two values. The values are set up as follows:
• Launch interval = 5 minutes
• Repeat count = 4
A port space probe starts at 10:00 AM and continues each minute. This starts the log and notification
mechanisms. These are the times and the actions that occur:
1
2
3
4
5
10:00—Initial port space probe (first event)
10:01—First notification starts (one event)
10:06—Second notification starts (reports five events)
10:11—Third notification starts (reports five events)
10:16—Fourth notification starts (reports five events)
The launch interval controls the time intervals between the events 1, 2, 3, 4, and 5. This was set to 5 minutes. Multiply the repeat count by the launch interval. This is the time interval an event must continue to
start the repeat notifier.
Configuring the SMTP Proxy
You use the SMTP proxy to block suspicious e-mail messages and e-mail content. The proxy scans SMTP
messages for a number of filtered parameters, and compares them against the rules set in the proxy configuration. To configure the SMTP proxy:
1
Add the SMTP proxy to Policy Manager. To learn how to add policies to Policy Manager, see “Adding
Policies” on page 66.
2
Double-click the SMTP icon and select the Properties tab.
The Edit Policy Properties dialog box appears and shows the General Settings information.
3
In the Proxy drop-down list, select to configure SMTP-Incoming or SMTP-Outgoing.
You can also clone a proxy action to create a new proxy action.
Fireware Configuration Guide
83
Configuring the SMTP Proxy
4
Click the View/Edit Proxy icon.
Configuring general settings
You use the General Settings fields to configure basic SMTP proxy parameters such as idle time-out and
message limits.
Idle timeout
You can set the length of time an incoming SMTP connection can idle before the connection is
timed out. The default value is 600 seconds (10 minutes). For no time-out, clear the Set the
timeout to check box.
84
WatchGuard System Manager
Configuring the SMTP Proxy
Maximum e-mail recipients
With the Set the maximum e-mail recipients to check box, you can set the maximum number
of e-mail recipients to which a message can be sent. The Firebox counts and allows the specified
number of addresses through, then drops the other addresses. For example, if you use the default
value of 50 and there is a message for 52 addresses, the first 50 addresses get the e-mail message.
The last two addresses do not get a copy of the message. A distribution list appears as one SMTP
e-mail address (for example, [email protected]). The Firebox counts this as one address.
You can use this feature to decrease spam e-mail because spam usually includes a large recipient
list. Be careful when you do this because you can also deny legitimate e-mail.
Maximum e-mail size
With the Set the maximum e-mail size to check box, you can set the maximum length of an
incoming SMTP message. Most e-mail is sent as 7-bit ASCII text. The exceptions are Binary
MIME and 8-bit MIME. 8-bit MIME content (for example, MIME attachments) is encoded with
standard algorithms (Base64 or quote-printable encoding) to enable them to be sent through 7bit e-mail systems. Encoding can increase the length of files by as much as one third. To allow
messages as large as 1000 bytes, you must set this field to a minimum of 1334 bytes to make
sure all e-mail gets through. The default value is 3,000,000 bytes (3 million bytes).
Maximum e-mail line length
With the Set the maximum e-mail line length to check box, you can set the maximum line
length for lines in an SMTP message. Very long line lengths can cause buffer overflows on some
e-mail systems. Most e-mail clients and systems send short line lengths, but some Web-based email systems send very long lines. The default value is 1024.
Hide E-mail Server
Select the Message ID and Server Replies check boxes to replace MIME boundary and SMTP
greeting strings in e-mail messages. These are used by hackers to identify the SMTP server vendor
and version.
Send a log message
Select the Send a log message check box to send a log message for each connection request
through SMTP. For Historical Reports to create accurate reports on SMTP traffic, you must select
this check box.
Greeting rules
The proxy examines the initial HELO/EHLO responses during the SMTP session initialization. The
default rules for the SMTP-Incoming proxy action make sure that packets with greetings that are
too long, or include characters that are not correct or expected, are denied.
Configuring ESMTP parameters
You use the ESMTP Settings fields to set the filtering for ESMTP content. Although SMTP is widely
accepted and widely used, some parts of the Internet community have found a need to extend SMTP to
Fireware Configuration Guide
85
Configuring the SMTP Proxy
allow more functionality. ESMTP gives a method for functional extensions to SMTP, and for clients who
support extended features to know each other.
1
From the Categories section, select ESMTP parameters.
Allow BDAT/CHUNKING
Select to allow BDAT/CHUNKING. This enable large messages to be sent more easily through
SMTP connections.
Allow ETRN (Remote Message Queue Starting)
This is an extension to SMTP that allows an SMTP client and server to interact to start the
exchange of message queues for a given host.
Allow 8-Bit MIME
Select to allow 8-bit MIME, if the client and host give support to the extension. The 8-bit MIME
extension allows a client and host to exchange messages made up of text that has octets which
are not of the US-ASCII octet range (hex 00-7F, or 7-bit ASCII) that uses SMTP.
Allow Binary MIME
Select to allow the Binary MIME extension, if the sender and receiver accept it. Binary MIME
prevents the overhead of base64 and quoted-printable encoding of binary objects sent that use
the MIME message format with SMTP. WatchGuard does not recommend you select this option
as it can be a security risk.
Configuring authentication rules
This ruleset allows a number of ESMTP authentication types. The default rule denies all other authentication types. The RFC that tells about the SMTP authentication extension is RFC 2554.
1
2
86
From the Categories section, select Authentication.
Do the steps used to create rules. For more information, see “Defining Rules” on page 79.
WatchGuard System Manager
Configuring the SMTP Proxy
Defining content type rules
You use the ruleset for the SMTP-Incoming proxy action to set values for incoming SMTP content filtering. You use the ruleset for the SMTP-Outgoing proxy action to set values for outgoing SMTP content filtering.
1
2
From the Categories section, select Content Types.
Do the steps used to create rules. For more information, see “Defining Rulesets” on page 79.
Defining file name rules
You use the ruleset for the SMTP-Incoming proxy action to put limits on file names for incoming e-mail
attachments. You use the ruleset for the SMTP-Outgoing proxy action to put limits on file names for outgoing e-mail attachments.
1
2
From the Categories section, select Filenames.
Do the steps used to create rules. For more information, see “Defining Rules” on page 79.
Configuring the Mail From and Mail To rules
The Mail From ruleset can put limits on e-mail to only allow e-mail into your network from specified
senders. The default configuration is to allow e-mail from all senders.
The Mail To ruleset can put limits on e-mail to only allow e-mail out of your network to specified recipients. The default configuration allows e-mail to a recipient out of your network.
You can also use the Rewrite As feature included in this rule configuration dialog box to have the Firebox
change the From and To components of your e-mail address to a different value. This feature is also
known as “SMTP masquerading.”
1
2
From the Categories section, select Mail From or Mail To.
Do the steps used to create rules. For more information, see “Defining Rules” on page 79.
Defining header rules
Header rulesets allow you to set values for incoming or outgoing SMTP header filtering.
1
2
From the Categories section, select Headers.
Do the steps used to create rules. For more information, see “Defining Rules” on page 79.
Defining antivirus responses
The fields on this dialog box set the actions necessary if a virus is found in an e-mail message. It also sets
actions for when an e-mail message contains an attachment that is too large or that the Firebox cannot
scan.
1
2
From the Categories section, select Antivirus.
For Virus found, Attachment too large, and Unable to Scan use these settings:
Action
Allow - Allows the connection.
Lock - Locks the file so it cannot be opened by the recipient.
Strip - Content is dropped. All applicable filtered content is removed and dropped, but the
remainder of the message is allowed through, subject to more proxy filtering.
Drop - Denies the specific request and drops the connection.
Block - Denies the request, drops the connection, and adds the originating host to the Blocked
Sites list. For more information on blocked sites, see “Setting Blocked Sites” on page 135.
Alarm
Select the check box to use an alarm for this event.
Fireware Configuration Guide
87
Configuring the SMTP Proxy
Log
Select the check box to write this event to the log file.
Changing the deny message
The Firebox® gives a default deny message that replaces the denied content. You can replace that deny
message with one that you write. You can write a custom deny message with standard HTML. The first
line of the deny message is a section of the HTTP header. There must be an empty line between the first
line and the body of the message.
1
2
From the Categories section, select Deny Message.
Type the deny message in the deny message box. You can use these variables:
%(type)%
Puts the type of content that was denied.
%(filename)%
Puts the file name of the denied content.
%(action)%
Puts the name of the action taken: lock, strip, and so on.
%(reason)%
Puts the cause for the Firebox to deny the content.
%(recovery)%
Allows you to set the text to fill this sentence: “Your network administrator %(recovery)% this
attachment.
%(virus)%
Puts the name or status of a virus, for Gateway AntiVirus for E-mail™ users only.
Configuring the IPS (Intrusion Prevention System)
Hackers use many methods to attack computers on the Internet. The function of these attacks is to cause
damage to your network, get sensitive information, or use your computers to attack other networks.
These attacks are known as intrusions.
WatchGuard® System Manager supplies a number of tools to protect your network against attack. For
more information, see “Using Signature-Based Security Services” on page 127. The SMTP proxy operates
with Gateway AntiVirus for E-mail and the Intrusion Prevention Service.
1
From the Categories section, select Intrusion Prevention.
2
3
To enable intrusion prevention, select the Enable Intrusion Prevention check box.
In the Actions section, use the drop-down lists to select the Firebox action for each severity level.
Allow
You allow a packet so it can get to its recipient, even if the content matches a signature.
88
WatchGuard System Manager
Configuring the FTP Proxy
Deny
You deny a packet to stop the packet and send a deny message to the sender.
Drop
You drop a packet to stop the packet silently, and not tell the sender.
Block
You block a message to drop the packet, and to add the IP address that the packet started from
to the Blocked Sites list.
Note
If you set the configuration to allow packets for one of these three severity levels, your configuration
is less secure.
4
To configure log messages and notification for each severity level, click Logging and Notification.
For information on fields in the Logging and Notification dialog box, see “Using dialog boxes for
alarms, log messages, and notification” on page 82.
Configuring proxy and antivirus alarms for SMTP
You can set the action the Firebox does when proxy or antivirus (AV) alarm events occur:
1
2
From the Categories section, select Proxy and AV Alarms.
For information on fields in the Proxy/AV Alarm Configuration section, see “Using dialog boxes for
alarms, log messages, and notification” on page 82.
Configuring the FTP Proxy
File Transfer Protocol (FTP) is the protocol used to move files on the Internet. Like SMTP and HTTP, FTP
uses TCP/IP protocols to enable data transfer. You usually use FTP to download a file from a server that
uses the Internet or to upload a file to a server.
1
Add the FTP proxy to Policy Manager. To learn how to add policies to Policy Manager, see “Adding
Policies” on page 66.
2
3
4
5
6
Double-click the FTP icon and select the Policy tab.
Select Allowed from the FTP proxy connections are drop-down list.
Select the Properties tab.
In the Proxy drop-down list, select to configure the proxy action for FTP-Client or FTP-Server.
Click the View/Edit Proxy icon.
Fireware Configuration Guide
89
Configuring the FTP Proxy
Configuring general settings
You use the General fields to configure basic FTP parameters including maximum user name length.
1
From the Categories section, select General.
2
To set limits for FTP parameters, select the applicable check boxes. These settings help to protect your
network from buffer overflow attacks. If you set a check box to 0 bytes, the Firebox does not use the
parameter. Use the arrows to set the limits:
Maximum user name length
Sets a maximum length for user names on FTP sites.
Maximum password length
Sets a maximum length for passwords used to log into FTP sites.
Maximum file name length
Sets the maximum file name length for files to upload or download.
Maximum command line length
Sets the maximum length for command lines used on FTP sites.
3
To create a log message for each FTP request, select the Send a log message for each connection
request check box.
Defining commands rules for FTP
FTP has a number of commands to manage files. You can write rules to put limits on some FTP commands. Use FTP-Server to put limits on commands that can be used on an FTP server protected by the
Firebox. Use FTP-Client to put limits on commands that users protected by the Firebox can use when it
connects to external FTP servers. The default configuration of the FTP-Client is to allow all FTP commands.
1
2
From the Categories section, select Commands.
Do the steps used to create rules. For more information, see “Defining Rules” on page 79.
Setting download rules for FTP
Download rules control the file names, extensions, or URL paths that users can use FTP to download. Use
the FTP-Server proxy action to control download rules for an FTP server protected by the Firebox. Use the
90
WatchGuard System Manager
Configuring the HTTP Proxy
FTP-Client proxy action to set download rules for users connecting to external FTP servers. To add download rulesets:
1
2
From the Categories section, select Download.
Do the steps used to create rules. For more information, see “Defining Rules” on page 79.
Setting upload rules for FTP
Upload rulesets control the file names, extensions, or URL paths that users can use FTP to upload. Use the
FTP-Server proxy action to control upload rules for an FTP server protected by the Firebox. Use the FTPClient proxy action to set upload rules for users connecting to external FTP servers. The default configuration of the FTP-Client is to allow all files to be uploaded. To create upload rulesets:
1
2
From the Categories section, select Upload.
Do the steps used to create rules. For more information, see “Defining Rules” on page 79.
Enabling intrusion prevention for FTP
You can use the FTP proxy to enable and configure the WatchGuard Intrusion Prevention System. For
information on how to this, see the procedure for SMTP in “Configuring the IPS (Intrusion Prevention
System)” on page 88.
Configuring proxy alarms for FTP
An alarm is a mechanism to tell a network administrator when network traffic matches criteria for suspicious traffic or content. When an alarm event occurs, the Firebox does an action that you configure. For
example, you can set a threshold value for file length. If the file is larger than the threshold value, the
Firebox can send a log message to the Log Server.
1
2
From the Categories section, select Proxy Alarms.
For information on fields in the Proxy Alarm Configuration section, see “Using dialog boxes for
alarms, log messages, and notification” on page 82.
Configuring the HTTP Proxy
The HTTP proxy is a high performance content filter. It examines Web traffic to identify suspicious content which can be a virus, spyware, or other type of attack. It can also protect your Web server from
attacks from the external network. You can configure the HTTP proxy to:
• Only allow content that matches RFC requirements for Web server and clients
• Select which types of MIME content the Firebox allows into your network
• Block Java, ActiveX, and other code types
• Examine the HTTP header to make sure it is not from a known source of suspicious content
1
Add the HTTP proxy to Policy Manager. To learn how to add policies to Policy Manager, see“Adding
Policies” on page 66.
2
3
Select the Properties tab.
4
Click the View/Edit Proxy icon.
In the Proxy drop-down list, select to configure the HTTP-Client or HTTP-Server proxy action. Use
the HTTP-Server proxy action (or an incoming proxy action you create based on the HTTP-Server
proxy action) to protect a Web server. Use HTTP-Client, or an outgoing proxy action, to filter HTTP
requests from users behind the Firebox.
You can also clone a proxy action to create a new proxy action.
Fireware Configuration Guide
91
Configuring the HTTP Proxy
Configuring settings for HTTP requests
You can configure general settings for HTTP requests. You can also see and edit the HTTP request rulesets
included in a proxy action. To get access to these settings, click HTTP Request in the Categories list on
the left of the proxy configuration.
Configuring general settings for HTTP requests
You use the General Settings fields to configure basic HTTP parameters such as idle time-out and URL
length.
Idle Timeout
Controls how long the HTTP proxy waits for the Web client to make a request for something
from the external Web server after it starts a TCP/IP connection or after the earlier request, if
there was one, for the same connection. If it goes longer than the setting, the HTTP proxy closes
the connection. The default value is 600 seconds.
URL Length
Sets the maximum length of the path component of a URL. This does not include the “http:\\” or
host name. Control of the URL length can help to prevent buffer overflow attacks.
Send a log message for each HTTP connection request
Creates a traffic log message for each request. This option creates a large log file, but this
information is very important if your firewall is attacked.
Setting HTTP request methods
Most browser HTTP requests are in one of two categories: GET and POST operations. Browsers usually use
GET operations to download objects such as a graphic, HTML data, or Flash data. More than one GET is
usually sent by a client computer for each page, because Web pages usually contain many different elements. The elements are put together to make a page that appears as one page to the end user.
Browsers usually use POST operations to send data to a Web site. Many Web pages get information from
the end user such as location, e-mail address, and name. If you enable the POST command, the Firebox
92
WatchGuard System Manager
Configuring the HTTP Proxy
denies all POST operations to Web servers on the external network. This features prevents your users from
sending information to a Web site on the external network.
The HTTP proxy supports request methods: GET, POST, HEAD, OPTIONS, PUT, and DELETE. If you configure a rule to allow other request methods, you get an error with the text: “Method unsupported.”
1
2
From the Categories section, select Request Methods.
Do the steps used to create rules. For more information, see “Defining Rules” on page 79.
Setting HTTP request URL paths
You use URL path rules to filter the content of the host, path, and query-string components of a URL.
Here are examples of how to block content using HTTP request URL paths:
• To block all pages that have the host name www.test.com, type the pattern:
www.test.com*
• To block all paths containing the word “sex”, on all Web sites: *sex*
• To block URL paths ending in “*.test”, on all Web sites: *.test
Note
Usually, if you filter URLs with the HTTP request URL path ruleset, you must configure a complex
pattern using full regular expression syntax and the advanced view of a ruleset. It is easier and gives
better results to filter based on header or body content type than it is to filter by URL path.
1
2
From the Categories section, select URL paths.
Do the steps used to create rules. For more information, see “Defining Rules” on page 79.
Setting HTTP request header fields
This ruleset supplies content filtering for the full HTTP header. By default, the Firebox uses exact matching rules to strip Via and From headers, and allows all other headers. This ruleset matches against the full
header, not only the name. Thus, to match all values of a header, type the pattern: “[header name]:*”. To
match only some values of a header, replace the * wildcard with a pattern. If your pattern does not start
with a * wildcard, include one space between the colon and the pattern when typing in the Pattern text
box. For example, type: [header name]: [pattern] and not [header name]:[pattern].
Note that the default rules do not strip the Referer header, but do include a disabled rule to strip this
header. To enable the rule, select Advanced View. Some Web browsers and software applications must use
the Referer header to operate correctly.
1
2
From the Categories section, select Header Fields.
Do the steps used to create rules. For more information, see “Defining Rules” on page 79.
Setting HTTP request authorization
This rule sets the criteria for content filtering of HTTP Request Header authorization fields. When a Web
server starts a “WWW-Authenticate” challenge, it sends information about which authentication methods
it can use. The proxy puts limits on the type of authentication sent in a request. It uses only the authentication methods that the Web server accepts. With a default configuration, the Firebox allows Basic,
Digest, NTLM, and Passport1.4 authentication, and strips all other authentication.
1
2
From the Categories section, select Authorization.
Do the steps used to create rules. For more information, see “Defining Rules” on page 79.
Fireware Configuration Guide
93
Configuring the HTTP Proxy
Configuring general settings for HTTP responses
You use the General Settings fields to configure basic HTTP parameters such as idle time-out and limits
for line and total length. If you set a check box to 0 bytes, the Firebox does not check the parameter.
1
2
From the Categories section, select General Settings.
To set limits for HTTP parameters, select the applicable check boxes. Use the arrows to set the limits:
Idle timeout
Controls how long the Firebox HTTP proxy waits for the Web server to send the Web page. The
default value is 600 seconds.
Maximum line length
Controls the maximum allowed length of a line of characters in the HTTP response headers. Use
this property to protect your computers from buffer overflow exploits.
Maximum total length
Controls the maximum length of the HTTP response headers. If the total header length is more
than this limit, the HTTP response is denied. The default value is 0 (no limit).
Setting header fields for HTTP responses
This property controls which HTTP response header fields the Firebox allows. RFC 2616 includes many of
the HTTP response headers that are allowed in the default configuration. For more information, see:
http://www.ietf.org/rfc/rfc2616.txt
1
2
From the Categories section, select Header Fields.
Do the steps used to create rules. For more information, see “Defining Rules” on page 79.
Setting content types for HTTP responses
When a Web server sends HTTP traffic, it usually adds a MIME type to the response. The HTTP header on
the data stream contains this MIME type. It is added before the data is sent.
This ruleset sets rules for looking for content type (MIME type) in HTTP response headers. By default the
Firebox allows some safe content types, and denies MIME content that has no specified content type.
Some Web servers supply incorrect MIME types to get around content rules.
1
2
From the Categories section, select Content Types.
Do the steps used to create rulesets. For more information, see “Defining Rules” on page 79.
Setting cookies for HTTP responses
HTTP cookies are small files of alphanumeric text put by Web servers on Web clients. Cookies monitor the
page a Web client is on to enable the Web server to send more pages in the correct sequence. Web servers
also use cookies to collect information about an end user. Many Web sites use cookies for authentication
and other legitimate functions and cannot operate correctly without cookies.
This ruleset gives you control of the cookies in HTTP responses. You can configure rules to strip cookies,
based on your network requirements. The default rule for the HTTP-Server and HTTP-Client proxy action
allows all cookies.
The Cookies ruleset looks for packets based on the domain associated with the cookie. The domain can be
specified in the cookie. If there is no domain in the cookie, the proxy uses the host name in the first
request. Thus, to block all cookies for nosy-adware-site.com, add a rule with the pattern: “*.nosy-adwaresite.com”.
1
2
94
From the Categories section on the left, select Cookies.
Do the steps used to create rules. For more information, see “Defining Rules” on page 79.
WatchGuard System Manager
Configuring the HTTP Proxy
Setting HTTP body content types
This ruleset gives you control of the content in an HTTP response. The Firebox is configured to deny Java
applets, Zip archives, Windows EXE/DLL files, and Windows CAB files. The default proxy action for outgoing HTTP requests (HTTP-Client) allows all other response body content types. WatchGuard recommends
that you examine the file types that are used in your organization and allow only those file types that are
necessary for your network.
1
2
From the Categories section, select Body Content Types.
Do the steps used to create rules. For more information, see “Defining Rules” on page 79.
Changing the deny message
The Firebox gives a default deny message that replaces the content that is denied. You can replace that
deny message with one that you write. You can customize the deny message with standard HTML. The
first line of the deny message is a component of the HTTP header. There must be an empty line between
the first line and the body of the message.
1
From the Categories section, select Deny Message.
2
Type the deny message in the deny message box. You can use these variables:
%(method)%
Puts the request method from the denied request.
%(reason)%
Puts the reason the Firebox denied the content.
%(transaction)%
Puts “Request” or “Response” to show which side of the transaction caused the packet to be
denied.
%(url-host)%
Puts the server host name from the denied URL. If no host name was included, the IP address of
the server is given.
%(url-path)%
Puts the path component of the denied URL.
Fireware Configuration Guide
95
Configuring the DNS Proxy
Configuring intrusion prevention for HTTP
You can use the HTTP proxy to enable and configure the WatchGuard® Intrusion Prevention Service. The
HTTP proxy and the TCP proxy each include options to prevent Instant Messaging (IM) and Peer to Peer
(P2P) use. These options can give more protection against new P2P and IM services.
If you use the TCP proxy and the HTTP proxy, you must be sure to configure actions for IM and P2P in
the two proxies to apply actions to all IM and P2P traffic.
1
From the Categories section, select Intrusion Prevention.
2
To enable intrusion prevention that uses the HTTP proxy, select the Enable Intrusion Prevention
check box.
3
For information on the settings in this dialog box, see the“Using advanced HTTP proxy features” on
page 136.
Defining proxy alarms for HTTP
Use these settings to set criteria for a notification event:
1
2
From the Categories section, select Proxy Alarms.
Do the steps in “Using dialog boxes for alarms, log messages, and notification” on page 82.
Configuring the DNS Proxy
With the Domain Name System (DNS), you can get access to a Web site with an easy-to-remember “dotcom” name. DNS finds the Internet domain name (for example WatchGuard.com) and changes it to an IP
address. The DNS proxy protects your DNS servers from TSIG, NXT, and other DNS attacks. To add the
DNS proxy to your Firebox® configuration:
96
1
Add the DNS proxy to Policy Manager. To learn how to add policies to Policy Manager, see
“Adding Policies” on page 66.
2
3
Double-click the DNS icon and select the Policy tab.
Select Allowed from the DNS proxy connections are drop-down list.
WatchGuard System Manager
Configuring the DNS Proxy
4
5
6
Select the Properties tab.
In the Proxy drop-down list, select to configure the NS-Outgoing or DNS-Incoming proxy action.
Click the View/Edit Proxy icon.
You can also clone an existing proxy action to create a new proxy action.
Configuring general settings for the DNS proxy
The general settings for the DNS Proxy include two protocol anomaly detection rules
Not of class Internet
Select the action to do when the proxy examines DNS traffic that is not of the Internet (IN) class.
The default action is to deny this traffic. WatchGuard recommends that you do not change this
default action. Use the Alarm check box to use an alarm for this event. Use the Log check box to
write this event to the log file.
Badly formatted query
Select the action when the proxy examines DNS traffic that does not use the correct format. Use
the Alarm check box to use an alarm for this event. Use the Log check box to write this event to
the event log file.
Send a log message for each connection request
Select this check box to record a log message for each DNS connection request. Note that this
creates a large number of log messages and traffic.
Configuring DNS OPcodes
DNS OPcodes are commands given to the DNS server that tell it to do some action, such as a query
(Query), an inverse query (IQuery), or a server status request (STATUS). You can allow, deny, drop, or block
specified DNS OPcodes.
1
2
From the Categories section, select OPCodes.
For the rules listed, select the Enabled check box to enable a rule. Clear the Enabled check box to
disable a rule.
Note
If you use Active Directory and your Active Directory configuration requires dynamic updates, you
must allow DNS OPcodes in your DNS-Incoming proxy action rules. This is a security risk, but can be
necessary for Active Directory to operate correctly.
Fireware Configuration Guide
97
Configuring the DNS Proxy
Adding a new OPcodes rule
1
Click Add.
The New OPCodes Rule dialog box appears.
2
Type a name for the rule.
Rules can have no more than 31 characters.
3
DNS OPcodes have an integer value. Use the arrows to set the OPCode value.
For more information on the integer values of DNS OPcodes, see RFC 1035.
4
Set an action for the rule and configure to send an alarm or enter the event in the log file. For more
information, see “Adding rules” on page 80.
Configuring DNS query types
A DNS query type can configure a resource record by type (such as a CNAME or TXT record) or a custom
type of query operation (such as an AXFR Full zone transfer). You can allow, deny, drop, or block specified
DNS query types.
1
From the Categories section, select Query Types.
2
To enable a rule, select the Enabled check box adjacent to the action and name of the rule.
Adding a new query types rule
1
To add a new query types rule, click Add.
The New Query Types Rule dialog box appears.
2
Type a name for the rule.
Rules can have no more than 31 characters.
3
DNS query types have a resource record (RR) value. Use the arrows to set the value.
For more information on the values of DNS query types, see RFC 1035.
4
98
Set an action for the rule and configure to send an alarm or enter the event in the log file. For more
information, see “Defining Rules” on page 79.
WatchGuard System Manager
Configuring the TCP Proxy
Configuring DNS query names
A DNS query name refers to a specified DNS domain name, shown as a fully qualified domain name
(FQDN).
1
From the Categories section, select Query Names.
2
To add more names, do the steps used to create rules. For more information, see “Defining Rules” on
page 79.
Enabling intrusion prevention for the DNS proxy
You can use the DNS proxy to enable and configure the WatchGuard® Intrusion Prevention System.
1
2
From the Categories section, select Intrusion Prevention.
To enable intrusion prevention, select the Enable Intrusion Prevention check box.
Configuring DNS proxy alarms
Use these settings to set criteria for a notification event:
1
2
From the Categories section, select Proxy Alarms.
Do the procedure in “Using dialog boxes for alarms, log messages, and notification” on page 82.
Configuring the TCP Proxy
Transmission Control Protocol (TCP) is the primary protocol in TCP/IP networks. The IP protocol controls
packets while TCP enables hosts to start connections and to send and receive data. A TCP proxy monitors
TCP handshaking to see if a TCP session is legitimate.
Configuring general settings for the TCP proxy
HTTP Proxy
Select the HTTP proxy action to use for TCP connections. The TCP proxy applies the HTTP proxy
ruleset to all traffic that it identifies as HTTP traffic.
Fireware Configuration Guide
99
Configuring the TCP Proxy
Send a log message for each connection request
Select this check box to record a log message for all TCP connection requests. This feature creates
a large number of log messages and traffic.
Enabling intrusion prevention for the TCP proxy
You can use the TCP proxy to enable and configure the WatchGuard Intrusion Prevention System.
1
2
100
From the Categories section, select Intrusion Prevention.
To enable intrusion prevention, select the Enable Intrusion Prevention check box.
WatchGuard System Manager
CHAPTER 8
Working with Firewall NAT
Network Address Translation (NAT) was originally designed as one of several solutions for organizations
that could not obtain enough registered IP network numbers from Internet Address Registrars for their
growing population of hosts and networks.
NAT is generically used to describe any of the several forms of IP address and port translation. Its primary
purposes are to stretch the number of computers able to work off of a publicly routable IP address, and to
hide the private IP addresses of hosts on your LAN.
At its most basic level, NAT changes the address of a packet from one value to a different value. The type
of NAT refers to how NAT changes the network address:
Dynamic NAT
Dynamic NAT is also known as IP masquerading. The Firebox can apply its public IP address
to the outgoing packets for all connections or for specified services. This hides the real IP
address of the computer that is the source of the packet from the external network. Dynamic
NAT is generally useful for hiding addresses of internal hosts when they access public
services.
1-to-1 NAT
The Firebox uses private and public IP ranges that you set for NAT. With 1-to-1 NAT, you
bind a public address for each Web and other (DNS, mail) server to the private address you
assigned to each server located on your trusted or optional networks. 1-to-1 NAT is useful
for giving public hosts access to internal servers.
Static NAT for a policy
Also known as port forwarding, you define static NAT when you define policies, as described
in “Configuring Policies,” on page 65. Static NAT is a port-to-host NAT. A host sends a
packet from the external network to a port on an external interface. Static NAT changes this
address to an address and port behind the firewall.
Select the type of NAT that is best for you after you identify the problem you have. Problems can include
address security or a small number of public IP addresses. NAT can be applied as a global setting, or as a
setting in a policy. Note, however, that global NAT settings do not apply to BOVPN or MUVPN policies.
Fireware Configuration Guide
101
Using Dynamic NAT
Using Dynamic NAT
Dynamic NAT is the most frequently used type of NAT. It changes the source IP address of an outbound
connection to the public IP address of the Firebox. Outside the Firebox, you only see the IP address of the
Firebox on outgoing packets.
Many computers can connect to the Internet from one public IP address. Dynamic NAT gives more security for the internal hosts that use the Internet, because it can hide hosts on your network.
In most networks, the recommended security policy is to apply NAT to all outgoing packets. With Fireware, dynamic NAT is enabled by default. Policy-based dynamic NAT is always enabled, but you can override the global setting in individual policies.
Adding global dynamic NAT entries
The default configuration of dynamic NAT enables dynamic NAT from all private IP addresses to the
external network. The default entries are:
• 192.168.0.0/16 - Any-External
• 172.16.0.0/12 - Any-External
• 10.0.0.0/8 - Any-External
These are the private networks given by RFC 1918. To enable dynamic NAT for private IP addresses other
than these, you must add an entry for them. The Firebox applies the dynamic NAT rules in the sequence
that they appear in the Dynamic NAT Entries list. WatchGuard recommends that you put the entries in a
sequence equivalent to the volume of traffic.
1
From Policy Manager, select Network > Firewall NAT.
The Firewall NAT Setup dialog box appears.
2
On the Dynamic NAT tab of the Firewall NAT Setup dialog box, click Add.
The Add Dynamic NAT dialog box appears.
102
WatchGuard System Manager
Using 1-to-1 NAT
3
Use the From drop-down list to select the source of the outgoing packets.
For example, use the trusted host alias to enable NAT from all of the trusted network. For more information on
built-in Firebox aliases, refer to “Configuring the Firebox as an Authentication Server” on page 108.
4
Use the To drop-down list to select the destination of the outgoing packets.
5
To add a host or a network IP address, click the Add Device button. Use the drop-down list
to select the address type. Type the IP address or the range. You must type a network
address in slash notation.
6
Click OK.
When you type an IP address, type all the numbers and the periods. Do not use the TAB or arrow key.
The new entry appears in the Dynamic NAT Entries list.
Reordering dynamic NAT entries
To change the sequence of the dynamic NAT entries, select the entry to change. Then click Up or Down.
You cannot change a dynamic NAT entry. If a change is necessary, you must erase the entry with Remove.
Use Add to enter it again.
Policy-based dynamic NAT entries
With this type of NAT, the Firebox uses the primary IP address of the outgoing interface (trusted or
optional) for the outgoing packets for this policy. Each policy has dynamic NAT enabled by default, using
the global dynamic NAT table. To use dynamic NAT for all traffic in one policy only:
1
From Policy Manager, right-click the policy to configure policy-based NAT for and select Edit.
2
Click the Advanced tab.
3
Select All traffic in this policy if you want to apply NAT to all traffic in this policy.
4
Click OK. Save the change to the Firebox.
The Edit Policy Properties window appears.
Disabling policy-based dynamic NAT
1
From Policy Manager, right-click a policy and select Edit.
The Edit Policy Properties window appears.
2
Click the Advanced tab.
3
Clear the check box in front of Dynamic NAT to turn NAT off for the traffic this policy controls.
4
Click OK. Save the change to the Firebox.
Using 1-to-1 NAT
1-to-1 NAT uses a NAT policy that changes and routes all incoming and outgoing packets sent from one
range of addresses to a different range of addresses. You can configure many different 1-to-1 NAT
addresses.
You frequently use 1-to-1 NAT to route public IP addresses to internal servers. On those servers, you do
not have to change the IP address. You can also use 1-to-1 NAT for VPN tunnels when the IP addresses of
the remote network are the same as the local network. The local network addresses change to a range
that is not the same as the remote addresses, and a VPN tunnel can connect. Both gateways must be configured in this way.
A 1-to-1 NAT rule always takes precedence over dynamic NAT.
In each NAT policy you are able to configure four items. You can also specify a single host, a range of
hosts, or a subnet.
Fireware Configuration Guide
103
Using 1-to-1 NAT
Interface
The name of the Firebox Ethernet interface where the 1-to-1 NAT action is applied. The 1to-1 NAT action is applied when packets from the real base travel through this interface or
when packets from the NAT base travel through this interface.
NAT base
An IP address not assigned to a Firebox Ethernet interface that corresponds to the Real Base
IP address. The NAT Base IP address you type is associated with the real base IP address you
type, and it is the first in a range of IP addresses. The other NAT base IP addresses in the
range go up by one in the last octet until the “Number of hosts to NAT” is reached. The NAT
base IP address is the address that the real base IP address changes to when the 1-to-1 NAT
is applied. When packets with a NAT Base IP address go through the Interface, the 1-to-1
action is applied.
Real base
The IP address assigned to the physical Ethernet interface of the computer that uses 1-to-1
NAT. The real base IP address you type is associated with the NAT Base address you type, and
it is the first IP address in a range of IP addresses. The other real base IP addresses in the
range go up by one in the last octet until the “Number of hosts to NAT” is reached. When
packets from a computer with a real base address go through the Interface specified, the 1to-1 action is applied.
Number of hosts to NAT (for ranges only)
The number of subsequent NAT Base and Real Base IP addresses that 1-to-1 NAT associates
together. The number of IP addresses to which the 1-to-1 NAT applies. The first real base IP
address is translated to the first NAT Base IP address when 1-to-1 NAT is applied. The second
real base IP address in the range is translated to the second NAT base IP address when 1-to1 NAT is applied. This is repeated until the “Number of hosts to NAT” is reached.
You set a NAT policy in a “from” and “to” range of IP addresses. For example, consider this policy:
210.199.6.1–192.168.69.1:254 (NAT base to real base range)
All the traffic that is sent to hosts between 210.199.6.1 and 210.199.6.254 changes to the related IP
address between 192.168.69.1 and 192.168.69.254.
There is a 1-to-1 address change from each NAT address to the destination (real) IP address: 210.199.6.1
becomes 192.168.69.1.
Configuring Global 1-to-1 NAT
1
104
From Policy Manager, click Setup > Firewall NAT. Click the 1-to-1 NAT tab.
WatchGuard System Manager
Using 1-to-1 NAT
2
Click Add.
The 1-1 Mapping dialog box appears.
3
In the Map Type drop-down list, select Single IP, IP range, or IP subnet to specify whether you
want to map to a single host, a range of hosts, or a subnet.
4
In the NAT base text box, type the address for the NAT range to see externally.
5
Complete all the information. Click OK.
6
Repeat steps 2 - 4 for each 1-to-1 NAT entry. When you are done, click OK to close the Firewall
NAT Setup dialog box. Save the change to the Firebox.
Configuring policy-based 1-to-1 NAT
With this type of NAT, the Firebox uses the private and public IP ranges that you set when configuring
global 1-to-1 NAT, but the rules are applied to an individual policy. 1-to-1 NAT is enabled in the default
configuration of each policy. If a policy has both 1-to-1 and Dynamic NAT enabled, 1-to-1 NAT has precedence.
Disabling policy-based 1-to-1 NAT
1
From Policy Manager, right-click a policy and select Edit.
2
The Edit Policy Properties window appears.
3
Click the Advanced tab.
4
Clear the 1-to-1 NAT check box to turn NAT off for the traffic this policy controls.
5
Click OK. Save the change to the Firebox.
Configuring static NAT for a policy
Because of how static NAT operates, it is available only for policies that use a specified port, which
includes TCP and UDP. A policy that has another protocol cannot use incoming static NAT. And the NAT
button in the Properties dialog box of the policy does not work. You also cannot use Static NAT with the
Any policy.
1
Double-click a policy icon in the Policies Arena.
2
From the Connections are drop-down list, select Allowed.
To use static NAT, the policy must let incoming traffic through.
3
Below the To list, click Add.
The Add Address dialog box appears.
Fireware Configuration Guide
105
Using 1-to-1 NAT
4
Click NAT.
The Add Static NAT dialog box appears.
Note
Mail servers must use the correct external address of the Firebox for incoming NAT. If not, mail
problems can occur.
5
From the External IP Address drop-down list, select the “public” address to use for this service.
6
Type the internal IP address.
The internal IP address is the destination on the trusted or optional network.
7
If necessary, select the Set internal port to different port than this policy check box.
You usually do not use this feature. It enables you to change the packet destination not only to a specified internal
host but also to a different port. If you select the check box, type the different port number or use the arrow
buttons in the Internal Port box.
8
Click OK to close the Add Static NAT dialog box.
The static NAT route appears in the Members and Addresses list.
9
106
Click OK to close the Add Address dialog box. Click OK to close the Properties dialog box of the
service.
WatchGuard System Manager
CHAPTER 9
Implementing Authentication
With user authentication you can see user names when you monitor the connections through the Firebox®. This gives you more information than if you can see only the IP addresses in the connection. The IP
address or the computer that the person uses is not important. While the user is authenticated, all the
connections that the user starts from the IP address also transmit the session name. This lets you monitor
not only the computers from which the connections start, but also the user.
The Firebox allows you to create policies with groups and user names. A person can use more than one
computer or IP address with the same user name. Monitor by user name:
• If you use the Dynamic Host Configuration Protocol (DHCP), because the IP address of a computer
can change.
• If many different users can use the same IP address in a day.
In these cases, authentication gives you more information about the activities of the people in your organization.
How User Authentication Works
A special HTTPS server operates on the Firebox® to accept authentication requests. To authenticate, a
user must connect to the authentication Web page on the Firebox. The address is:
https://IP address of a Firebox interface:4100/
An authentication Web page appears. The user must type a user name and password. The page sends the
name and password to the authentication server using a challenge and response protocol (known as PAP).
When the user is authenticated, the user is then allowed to use the approved network resources. The user
can close the browser window. The user is authenticated for two hours after the last connection to a network resource for which authentication is necessary.
To stop an authentication session before the two-hour timeout, click the Logout button on the authentication Web page. If the window is closed, you must open it again to disconnect. To prevent an account
from authenticating, you must disable the account on the authentication server.
Using authentication from the external network
The primary function of the authentication tool is for outgoing traffic. You can also use it for incoming
network traffic. When you have an account on the Firebox, you can always do external authentication.
Fireware Configuration Guide
107
Configuring the Firebox as an Authentication Server
For example, you can type this address in your browser at home:
https://public IP address of a Firebox interface:4100/
After authentication, you can get access to the services that are configured on the Firebox (FTP, Telnet).
Use this procedure to let a remote user authenticate from the external interface. This gives the user access
to resources through the Firebox.
1
In Policy Manager, double-click the WatchGuard® authentication policy icon (WG-Auth). This policy
appears after you add a user or group to a policy configuration.
2
On the Policy tab, select Allowed.
3
Below the From box, click Add.
4
Click Add User, and then type the IP addresses of the remote users that have approval to
authenticate externally.
Using authentication through a gateway Firebox to another Firebox
To send an authentication request through a gateway Firebox to a different Firebox, you must add a policy allowing the authentication traffic on the gateway Firebox. On the gateway Firebox, use Policy Manager to add the WG-Auth policy. This policy controls traffic on TCP port 4100. Configure the policy to
allow traffic to the IP address of the destination Firebox.
Authentication server types
With Fireware, there are five methods to do authentication:
• Firebox
• RADIUS
• SecurID
• LDAP
• Active Directory
You can configure one or more authentication server types for a Firebox. Authentication to different
server types is almost the same for the user. For the Firebox administrator, the difference is that the user
database can be on the Firebox or on a dedicated authentication server.
When you use an authentication server, you configure it with the instructions from its manufacturer. You
install the server with access to the Firebox and put it behind the Firebox for security.
Using a backup authentication server
You can configure a backup authentication server with any type of third-party authentication. If the Firebox cannot connect to the primary authentication server (after three attempts), it connects to the backup
authentication server. If the Firebox cannot connect to the backup authentication server, it waits ten
minutes, and then tries to connect to the primary authentication server again. This cycle continues until
a connection can be made.
Configuring the Firebox as an Authentication Server
If you do not use a third-party authentication server, you can use the Firebox® as an authentication
server. This procedure divides your company into groups and users for authentication. Assign members to
groups because of tasks, functions, or access requirements. For example, you can have an accounting
group, a marketing group, and a research and development group. You can also have a new persons
group, with limits on Internet access.
108
WatchGuard System Manager
Configuring the Firebox as an Authentication Server
In a group, you set the authentication procedure for the users, the type of system they use, and the information to which they have access. A user can be a network or a computer. If your company changes, you
can add or remove users or systems from groups.
Use Policy Manager to:
• Add, change, or erase the groups in the configuration
• Add or change the users in a group
Setting up the Firebox as an authentication server
1
From Policy Manager, select Setup > Authentication Servers.
The Authentication Servers dialog box appears. The default configuration enables the Firebox authentication
server.
2
To add a new user group, click Add below the User Groups list.
The Add Firebox Group dialog box appears.
3
Type the name of the group. Click OK.
Fireware Configuration Guide
109
Configuring RADIUS Server Authentication
4
To add a new user, click Add below the Users list.
The Setup Firebox User dialog box appears.
5
Type the name and the passphrase that the user will use to authenticate to the Firebox.
When this passphrase is set, you cannot see the passphrase in plain text again. If the passphrase is lost, you must
set a new passphrase.
6
To add the user to a group, select the group name in the Available list. Click the double arrow
that points to the left side to move the name to the Member list.
You can also double-click the Group name.
7
After you add the user to selected groups, click OK.
The user adds to the User list. You can then add more users.
8
To close the Setup Firebox User dialog box, click OK.
9
After you add all necessary users and groups, click OK.
The Firebox Users tab appears with a list of the new users.
At this time, you can use the users and groups to configure policies and authentication.
Configuring RADIUS Server Authentication
Remote Authentication Dial-In User Service (RADIUS) authenticates the local and remote users on a company network. RADIUS is a client/server system that keeps the authentication information for users,
remote access servers, and VPN gateways in one database.
The authentication messages to and from the RADIUS server always use an authentication key. This
authentication key, or shared secret, must be the same on the RADIUS client and server. Without this key,
hackers cannot get to the authentication messages. Note that the key is sent, and not a password, during
authentication. For Web authentication RADIUS gives support only to PAP (not CHAP) authentication.
For authentication using PPTP, RADIUS gives support only to MSCHAPv2.
To use RADIUS server authentication with the Firebox®, you must:
• Add the IP address of the Firebox to the RADIUS server, as explained in the RADIUS
documentation.
• Enable and specify the RADIUS server in your Firebox configuration.
• Add RADIUS user and/or group names into the policies in Policy Manager.
110
WatchGuard System Manager
Configuring RADIUS Server Authentication
To enable RADIUS Server Authentication:
1
From Policy Manager, select Setup > Authentication Servers. Click the RADIUS Server tab.
The RADIUS configuration appears.
2
Type the IP address of the RADIUS server.
3
Make sure that the port number RADIUS uses for authentication appears.
The default port number is 1812. Older RADIUS servers may use port 1645.
4
Type the “shared secret” between the Firebox and the RADIUS server.
5
Select the time-out value.
The shared secret is case-sensitive and must be the same on the Firebox and the RADIUS server.
This sets the time the Firebox waits for a response from the authentication server before it tries to connect again.
6
Set the number of retry attempts.
This is the number of times the Firebox tries to connect to the authentication server (using the time-out specified
above) before it reports a failed connection for one authentication attempt.
7
Select the group attribute.
The group attribute value is used to set which attribute carries the User Group information. When the RADIUS
server sends a message to the Firebox that a user is authenticated, it also sends a User Group string, for example
“engineerGroup” or “financeGroup”. This information is then used for access control.
8
Type the IP address and the port of the backup RADIUS server. The shared secret must be on the
primary and backup RADIUS server.
9
Click OK.
Fireware Configuration Guide
111
Configuring SecurID Authentication
Configuring SecurID Authentication
To operate SecurID authentication, you must configure RADIUS and ACE/Server servers correctly. The
users must also have an approved SecurID token and a PIN (personal identification number). Refer to the
SecurID instructions for more information.
Note
Do not use Steel Belted RADIUS with SecurID. Use the RADIUS software application with RSA
SecurID software.
1
From Policy Manager, select Setup > Authentication Servers. Select the SecurID Server tab.
2
Type the IP address of the SecurID server.
3
Type or accept the port number for SecurID authentication.
4
Type the secret shared between the Firebox® and SecurID server.
The default number is 1812.
The shared secret is case-sensitive and must be the same on the Firebox and SecurID server.
5
Select the time-out value.
6
Set the number of retry attempts.
This sets the time the Firebox waits for a response from the authentication server before it tries to connect again.
This is the number of times the Firebox tries to connect to the authentication server (using the time-out specified
above) before it reports a failed connection for one authentication attempt.
7
Select the group attribute.
The group attribute value is used to set which attribute carries the User Group information. When the SecurID
server sends a message to the Firebox that a user is authenticated, it also sends a User Group string, for example
“engineerGroup” or “financeGroup”. This information is then used for access control.
8
112
Type the IP address and the port of the backup SecurID server. The shared secret must be on the
primary and backup SecurID server.
WatchGuard System Manager
Configuring LDAP Authentication
9
Click OK.
Configuring LDAP Authentication
You can use an LDAP authentication server to authenticate your users to the Firebox®. You must configure both the Firebox and the LDAP server.
1
From Policy Manager, select Setup > Authentication Servers. Select the LDAP tab.
2
Select the Enable LDAP Server check box.
3
Type the IP address of the primary LDAP server for the Firebox to contact with authentication
requests.
4
Select the TCP port number for the Firebox to use to connect to the LDAP server. The default
port number is 389.
5
Select the Search Base.
6
Select the Group String.
Supply an LDAP search base to identify the organizational unit to search for authentication matches.
The attribute string that is used to hold user group information on the LDAP server.
7
If necessary, change the time-out value. This is the time the Firebox waits for a response from the
authentication server.
8
Add information for a backup LDAP Server, if you have one.
9
To configure MUVPN users to get authentication information from the LDAP Server, click the
Optional Settings button. You can enter MUVPN client information in the user properties of your
LDAP Server, such as the IP address, subnet mask, or DNS and WINS servers. Then, you can map these
Fireware Configuration Guide
113
Configuring LDAP Authentication
fields to the fields listed in Optional Settings. When the MUVPN user initiates a VPN tunnel though
the Firebox, the Firebox sets the IP address, subnet mask, or DNS and WINS servers for the user
with the information contained in the LDAP user properties.
IP Attribute String
Type the name of the LDAP user property field name that contains the IP address
assignment.
Netmask Attribute String
Type the name of the LDAP user property field name that contains the subnet mask
assignment.
DNS Attribute String
Type the name of the LDAP user property field name that contains the DNS server IP address.
WINS Attribute String
Type the name of the LDAP user property field name that contains the WINS server IP
address.
Lease Time Attribute String
Type the name of the LDAP user property field name that contains the total time allowed for
the MUVPN connection session.
Idle Timeout Attribute String
Type the name of the LDAP user property field name that contains the idle timeout
assignment.
114
WatchGuard System Manager
Configuring Active Directory Authentication
Configuring Active Directory Authentication
You can use an Active Directory authentication server to authenticate your users to the Firebox. You must
configure both the Firebox® and the Active Directory server.
1
From Policy Manager, select Setup > Authentication Servers. Select the Active Directory tab
2
Select the Enable Active Directory Server check box.
3
Type the IP address of the primary Active Directory server for the Firebox to contact with
authentication requests.
4
Select the TCP port number for the Firebox to use to connect to the Active Directory server. The
default port number is 389.
5
Select the Search Base. The standard format for the search base setting is: cn=common
name,dc=first part of distinguished server name,dc=any part of the distinguished server name
appearing after a “dot”. For example, if your server name is HQ_main, type
“cn=users,dc=HQ,dc=main”.
You set a search base to put limits on the directories on the authentication server the Firebox searches in for an
authentication match.
6
Select the Group String.
The attribute string that is used to hold user group information on the Active Directory server.
7
If necessary, change the time-out value. This is the time the Firebox waits for a response from the
authentication server.
8
Add information for a backup Active Directory Server, if you have one.
9
To configure MUVPN users to get authentication information from the Active Directory Server,
click the Optional Settings button. You can enter MUVPN client information in the user
properties of your Active Directory Server, such as the IP address, subnet mask, or DNS and WINS
Fireware Configuration Guide
115
Configuring a Policy with User Authentication
servers. Then, you can map these fields to the fields listed in Optional Settings. When the
MUVPN user initiates a VPN tunnel though the Firebox, the Firebox sets the IP address, subnet
mask, or DNS and WINs servers for the user with the information contained in the Active
Directory user properties.
IP Attribute String
Type the name of the Active Directory user property field name that contains the IP address
assignment.
Netmask Attribute String
Type the name of the Active Directory user property field name that contains the subnet
mask assignment.
DNS Attribute String
Type the name of the Active Directory user property field name that contains the DNS server
IP address.
WINS Attribute String
Type the name of the Active Directory user property field name that contains the WINS server
IP address.
Lease Time Attribute String
Type the name of the Active Directory user property field name that contains the lease time
assignment.
Idle Timeout Attribute String
Type the name of the Active Directory user property field name that contains the idle
timeout assignment.
Configuring a Policy with User Authentication
After you have configured the Firebox® to use an authentication server, you can start to use user names
when creating policies in Policy Manager. One method you can use is to put a limit on all policies that
connections are allowed only for authenticated users. This is useful when you use DHCP on your network.
1
2
Create a group on your third-party authentication server that contains all the user accounts.
In Policy Manager, add or open your Outgoing policy. Under the From field, click Add User.
The Add User or Group dialog box appears.
116
3
Use the Choose Type drop-down list to select firewall, MUVPN, or PPTP authentication.
4
Use the Auth Server drop-down list to select the type of authentication server to use.
5
Use the User/Group drop-down list to configure a user or a group.
6
Type the user or group name you created on the authentication server. Click OK.
WatchGuard System Manager
Configuring a Policy with User Authentication
7
Configure the From fields on all policies in Policy Manager the same way.
8
After you add a user or group to a policy configuration, use the WG-Auth policy that appears in
Policy Manager to control access to the authentication Web page.
Fireware Configuration Guide
117
Configuring a Policy with User Authentication
118
WatchGuard System Manager
CHAPTER 10
Firewall Intrusion Detection and
Prevention
WatchGuard® Fireware and the policies you create in Policy Manager give you strict control over access to
your network. A strict access policy helps to keep hackers out of your network. But, there are other types
of attacks that a strict policy cannot defeat. Careful configuration of the Firebox® default packet handling options can stop attacks such as SYN flood attacks, spoofing attacks, and port or address space
probes.
With default packet handling, a firewall examines the source and destination of each packet it receives. It
looks at the IP address and port number and monitors the packets to look for patterns that show your
network is at risk. If there is a risk, you can set the Firebox to automatically block against the possible
attack. This proactive method of intrusion detection keeps attackers out of your network. You can also
purchase an upgrade to your Firebox to use signature-based intrusion prevention. For more information,
see the chapter “Signature-Based Intrusion Detection and Prevention” in this Configuration Guide.
Using Default Packet Handling Options
The firewall examines the source and destination of each packet it receives. It looks at the IP address and
the port number. The firewall also monitors the packets to look for patterns that can show that your network is at risk.
Default packet handling:
• Rejects a packet that can be a security risk
• Can automatically block all traffic to and from a source IP address
• Adds an event to the log file
• Sends an SNMP trap to the SNMP management server
• Sends a notification of possible security risks
You set all default packet handling options using the Default Packet Handling dialog box.
1
From Policy Manager, select Setup > Intrusion Prevention > Default Packet Handling.
or,
Click the Default Packet Handling icon on the Policy Manager toolbar.
The Default Packet Handling dialog box appears.
Fireware Configuration Guide
119
Using Default Packet Handling Options
2
Select the check box for the traffic patterns you want to prevent, as explained in the sections that
follow. The default configuration sends a log message when one of these events occur. To configure
an SNMP trap or notification for default packet handling, click Logging.
Spoofing attacks
One procedure that attackers use to get access to your network is to make an “electronic false identity.”
With this “IP spoofing” procedure, the attacker sends a TCP/IP packet that uses a different IP address
than the originating host.
With IP spoofing enabled, the Firebox® checks to make sure that the source IP address of a packet is from
a network on that interface.
To protect against spoofing attacks, select the Drop Spoofing Attacks check box from the Default Packet
Handling dialog box.
IP source route attacks
Attackers use IP source route attacks to send an IP packet to find the route that the packet moves
through the network. The attacker can then see the response to the packets and get information about
the operating system of the target computer or network.
To protect against IP source route attacks, select the Drop IP Source Route check box from the Default
Packet Handling dialog box.
“Ping of death” attacks
“Ping of death” is a denial of service (DoS) attack. It is caused by an attacker that sends an IP packet that
is larger than the 65,535 bytes allowed by the IP protocol. This causes some operating systems to crash or
restart.
To protect against ping of death attacks, the Drop Ping of Death feature is always enabled. You cannot
disable this feature.
Port space and address space attacks
Attackers use probes to find information on networks and its hosts. Port space probes examine a host to
find the services that it uses. Address space probes examine a network to see which hosts are on that network.
To protect against port space and address space attacks, select the Block Port Space Probes and the
Block Address Space Probes check boxes from the Default Packet Handling dialog box. You then use the
arrows to select the maximum allowed number of IP address or port probes for each source IP address.
120
WatchGuard System Manager
Setting Blocked Sites
Flood attacks
One type of attack that we see frequently is a flood attack. Attackers send a very high volume of traffic to
a system so it cannot examine and allow permitted network traffic. For example, an ICMP flood attack
occurs when a system receives sufficient ICMP ping commands that it uses all of its resources to send
reply commands. The Firebox can protect against these types of flood attacks:
• IPSec flood attacks
• IKE flood attacks
• ICMP flood attacks
• SYN flood attacks
• UDP flood attacks
Flood attacks are also known as Denial of Service (DoS) attacks. You can use the Default Packet Handling
dialog box to configure the Firebox to protect against these attacks. Select the check boxes for the flood
attacks you want to drop. You then use the arrows to select the maximum allowed number of packets
each second.
Unhandled Packets
An “unhandled” packet is a packet that does not match any rule created in Policy Manager. The Firebox
always denies the packet, but you can select to always automatically block the source. This adds the IP
address that sent the packet to the temporary blocked sites list. You can also send a TCP reset or ICMP
error back to the client when an unhandled packet is received by the Firebox.
Distributed denial of service attacks
Distributed Denial of Service (DDoS) attacks are almost the same as flood attacks. But, with a DD0S the
ICMP ping commands come from many computers. You can use the Default Packet Handling dialog box
to configure the Firebox to protect against DDoS attacks. Use the arrow keys to set the maximum allowed
number of connections that your servers and clients can get each second.
Setting Blocked Sites
The Blocked Sites feature helps to prevent network traffic from systems you know or think are dangerous
or a security risk. After you identify the source of suspicious traffic, you block all the connections with
that IP address. You can also configure the Firebox to send a log message each time the source tries to
connect to your network. From the log file, you identify the services that they use to attack.
A blocked site is an IP address that cannot make a connection through the Firebox. If a packet comes
from a system that is blocked, it does not get through the Firebox®.
There are two different types of blocked IP addresses:
• Permanently blocked sites — on a list in the configuration file that you set manually.
• Auto-blocked sites — The IP addresses that the Firebox adds or removes on a temporary blocked
site list. The Firebox uses the packet handling rules, which are specified for each service. For
example, you configure the Firebox to block the IP addresses that try to connect to a blocked port.
These addresses are then blocked for a specified time.
You can use a list of temporarily blocked sites with log messages to help you make a decision about which
IP addresses to block permanently.
Fireware Configuration Guide
121
Setting Blocked Sites
Blocking a site permanently
You use Policy Manager to permanently block a host that you know is a security risk. For example, a university computer that hackers use frequently is a good host to block.
1
From Policy Manager, select Setup > Intrusion Prevention > Blocked Sites.
The Blocked Sites Configuration dialog box appears.
2
Click Add.
The Add Site dialog box appears.
3
Use the Choose Type drop-down list to select a member type. The selections are Host IP Address,
Network IP Address or Host Range.
4
Type the member value.
The member type shows whether this is an IP address or a range of IP addresses. When you type an IP address, type
all the numbers and the period.
5
Select OK.
The new site appears in the Blocked Sites list.
Using an external list of blocked sites
You can make a list of blocked sites in an external file. This file must be a .txt file. To add an external
file to your blocked sites list:
1
2
In the Blocked Sites Configuration dialog box, select Import.
Find the file. Double-click it, or select it and select Open.
The sites in the file appear in the Blocked Sites list.
Creating exceptions to the Blocked Sites list
A host that is a blocked sites exception does not appear in the list of automatically blocked sites. The
automatic rules do not apply for this host.
1
2
3
From Policy Manager, select Setup > Intrusion Prevention > Blocked Sites.
4
Type the member value.
Click the Blocked Sites Exceptions tab. Click Add.
Use the Choose Type drop-down list to select a member type. The selections are Host IP Address,
Network IP Address or Host Range.
The member type shows whether this is an IP address or a range of IP addresses. When you type an IP address, type
all the numbers and the period. Do not use the TAB or the arrow key.
5
122
Select OK.
WatchGuard System Manager
Setting Blocked Sites
Setting logging and notification parameters
You can configure the Firebox to make a log entry when a host tries to use a blocked site. You can also
set up notification for when a host tries to get access to a blocked site.
1
From the Blocked Sites dialog box, select Logging.
The Logging and Notification dialog box appears.
2
Set the parameters and notification to comply with your security policy:
Enter it in the log
When you enable this check box, the Firebox sends a log message when a packet is denied
because of your blocked port configuration. The default configuration of all services is for the
Firebox to send a log message when it denies a packet.
Send SNMP trap
When you enable this check box, the Firebox sends an event notification to the SNMP
management system. The SNMP trap makes sure that traffic matches allowed values. An example
of a criteria it examines is a threshold limit.
Send notification
When you enable this check box, the Firebox sends a notification when a packet is denied
because of your blocked port configuration. You can configure the Firebox to do one of these
actions:
- E-mail The Firebox sends an e-mail message when the event occurs. Set the e-mail address in
the Notification tab of the Log Server user interface.
- Pop-up Window The Firebox makes a dialog box appear on the management station when
the event occurs.
Setting Launch Interval and Repeat Count
You can control the time of the notification, together with the Repeat Count, as follows:
Launch Interval
The minimum time (in minutes) between different notifications. This parameter prevents more
than one notification in a short time for the same event.
Repeat Count
This counts how frequently an event occurs. When this gets to the selected value, a special repeat
notifier starts. This notifier makes a repeat log entry about that specified notification.
Notification starts again after this number of events.
Here is an example of how to use these two values. The values are set up as follows:
Fireware Configuration Guide
123
Blocking Ports
• Launch interval = 5 minutes
• Repeat count = 4
A port space probe starts at 10:00 a.m. and continues each minute. This starts the logging and notification mechanisms. These are the times and the actions that occur:
1 10:00—Initial port space probe (first event)
2 10:01—First notification starts (one event)
3 10:06—Second notification starts (reports five events)
4 10:11—Third notification starts (reports five events)
5 10:16—Fourth notification starts (reports five events)
The launch interval controls the time intervals between the events 1, 2, 3, 4, and 5. This was set to 5 minutes. Multiply the repeat count by the launch interval. This is the time interval an event must continue to
start the repeat notifier.
Blocking sites temporarily with policy settings
You can use the policy configuration to block sites that try to use a denied service:
1
From Policy Manager, double-click the policy icon.
The Properties dialog box appears.
2
3
On the Policy tab, make sure you set the Connections Are drop-down list to Denied.
On the Properties tab, select the check box Automatically block sites that attempt to connect.
Blocking Ports
You can block the ports that you know can be used to attack your network. This stops specified external
network services. If you block a port, you override all the service configurations.
You can block a port because:
• Blocked Ports protect your most sensitive services. The feature helps protect you from errors in your
Firebox® configuration.
• Probes against sensitive services can make independent log entries.
With the default configuration, the Firebox blocks some destination ports. This gives a basic configuration that you usually do not have to change. It blocks TCP and UDP packets for these ports:
X Window System (ports 6000-6005)
The X Window System (or X-Windows) client connection is not encrypted and is dangerous to use
on the Internet.
X Font Server (port 7100)
Many versions of X-Windows operate X Font Servers. The X Font Servers operate as the super-user
on some hosts.
NFS (port 2049)
NFS (Network File System) is a frequently used TCP/IP service where many users use the same
files on a network. But, the new versions have important authentication and security problems.
To supply NFS on the Internet can be very dangerous.
Note
The portmapper frequently uses the port 2049 for NFS. If you use NFS, make sure that NFS uses
the port 2049 on all your systems.
124
WatchGuard System Manager
Blocking Ports
rlogin, rsh, rcp (ports 513, 514)
These services give remote access to other computers. They are a security risk and many attackers
probe for these services.
RPC portmapper (port 111)
The RPC Services use port 111 to find which ports a given RPC server uses. The RPC services are
easy to attack through the Internet.
port 8000
Many vendors use this port, and there are many security problems related to it.
port 1
The TCPmux service uses Port 1, but not frequently. You can block it to make it more difficult for
the tools that examine ports.
port 0
This port is always blocked by the Firebox. You cannot add this port to the blocked ports list. You
cannot allow traffic on port 0 through the Firebox.
Note
If you must allow traffic through for the types of software applications that use recommended
blocked ports, we recommend that you allow the traffic only through an IPSec VPN tunnel or get
access to the port using ssh for more security.
Avoiding problems with blocked ports
You can have a problem because of blocked ports. You must be very careful if you block port numbers
greater than 1023. Clients frequently use these source port numbers.
Blocking a port permanently
1
From Policy Manager, select Setup > Intrusion Prevention > Blocked Ports.
The Blocked Ports dialog box appears.
2
Type the port number. Click Add.
The new port number appears in the Blocked Ports list.
Automatically blocking IP addresses that try to use blocked ports
You can configure the Firebox to automatically block an external host that tries to get access to a blocked
port. In the Blocked Ports dialog box, select the Automatically block sites that try to use blocked ports
check box.
Fireware Configuration Guide
125
Blocking Ports
Setting logging and notification for blocked ports
You can configure the Firebox to make a log entry when a host tries to use a blocked port. You can also
set up notification or set the Firebox to send an SNMP trap to an SNMP management server when a host
tries to get access to a blocked port.
To set logging and notification parameters for blocked ports, use the same procedure as the one for
blocked sites, as described in “Setting logging and notification parameters” on page 123.
126
WatchGuard System Manager
CHAPTER 11
Using Signature-Based Security
Services
Hackers use many methods to attack computers on the Internet. These attacks are created to cause damage to your network, get sensitive information, or use your computers to attack other networks. These
attacks are known as intrusions.
WatchGuard® supplies Signature-Based Intrusion Prevention Service and Gateway AntiVirus for E-mail™
that can identify and stop possible intrusion attacks. The Intrusion Prevention Service operates with all
WatchGuard proxies. WatchGuard Gateway AntiVirus for E-mail operates with the SMTP proxy.
When a new intrusion attack is found, the features that make the virus or attack unique are identified and
recorded. These features are known as the signature. Gateway AntiVirus for E-mail and Signature-Based
Intrusion Prevention Service use these signatures to find viruses and intrusion attacks.
New viruses and intrusion methods appear on the Internet frequently. To make sure that Gateway AntiVirus for E-mail and the Intrusion Prevention Service give your network the best protection, you must
update the signatures frequently. You can configure the Firebox® to update signatures automatically from
WatchGuard. You can also update signatures manually on your Firebox. These updates are made available
when new viruses and attacks are identified.
Note
You must keep signatures current to get the best protection from Gateway AntiVirus for E-mail and
Intrusion Prevention Service. New virus and intrusion threats appear frequently. WatchGuard cannot
guarantee that the product can stop all viruses or intrusions, or prevent damage to your systems or
networks from a virus or intrusion attack.
Installing the Software Licenses
To install Gateway AntiVirus for E-mail™ or Intrusion Prevention Service, you must have:
• A license key for each feature
Fireware Configuration Guide
127
Configuring Gateway AntiVirus for E-mail
• An SMTP e-mail server behind the Firebox®, for Gateway AntiVirus for E-Mail
1
From Policy Manager, select Setup > Licensed Features.
The Licensed Features dialog box appears.
2
3
Click Add.
In the Add/Import License Keys dialog box, type or paste your license key. You can click Browse to
find it on your computer or network. Click OK.
The license key appears on the Licensed Features dialog box.
Note
The Gateway AntiVirus for E-mail and Intrusion Prevention Service products are available only for
Firebox X devices. These products do not operate on Firebox X Edge devices.
Configuring Gateway AntiVirus for E-mail
WatchGuard® Gateway AntiVirus for E-mail™ stops viruses before they get to computers on your network.
Gateway AntiVirus for E-mail uses the WatchGuard SMTP proxy. When you enable Gateway AntiVirus for
E-mail, the SMTP proxy looks at e-mail messages, finds viruses, and removes them.
Note
Gateway AntiVirus for E-mail with the SMTP proxy examines e-mail for viruses. If your organization
does not use SMTP to get e-mail, Gateway AntiVirus for E-mail does not give virus protection.
Gateway AntiVirus for E-mail finds viruses encoded with frequently used e-mail attachment methods.
These include base64, binary, 7-bit, and 8-bit encoding. Gateway AntiVirus for E-mail does not find
viruses in uuencoded or binhex-encoded messages; the Firebox® strips these types of messages.
Before you use Gateway AntiVirus for E-mail in an SMTP proxy policy, you must configure the feature. To
do this:
1
2
From WatchGuard System Manager, select the Firebox that will use Gateway AntiVirus for E-mail.
Select Tools > Policy Manager.
Or,
you can click the Policy Manager icon on the WatchGuard System Manger toolbar.
128
WatchGuard System Manager
Configuring Gateway AntiVirus for E-mail in the SMTP Proxy
3
From Policy Manager, select Setup > AntiVirus.
The AntiVirus dialog box appears.
4
5
To enable automatic virus signature updates, select the Automatic update check box.
6
To scan inside compressed attachments, select the Uncompress archives check box. Select or type
the number of compression levels to scan.
On the Engine Settings tab, set the maximum file size to scan.
Compressed attachments that cannot be scanned include files that use a type of compression that we do not
support such as a password-protected Zip files.
7
8
9
Click OK.
Select File > Save > To Firebox.
Type your configuration passphrase and click OK.
Configuring Gateway AntiVirus for E-mail in the SMTP Proxy
You use Gateway AntiVirus for E-mail™ to find and stop viruses with the SMTP proxy. The Firebox® uses
the SMTP proxy to examine e-mail messages.
This chapter gives you the basic procedure to add an SMTP proxy, and the procedure for configuring
Gateway AntiVirus for E-mail. For full configuration information for the SMTP proxy, see “Configuring
the SMTP Proxy” on page 83.
Fireware Configuration Guide
129
Configuring Gateway AntiVirus for E-mail in the SMTP Proxy
Adding an SMTP Proxy with AntiVirus
To add an SMTP proxy and configure Gateway AntiVirus for E-mail:
1
2
3
4
5
Start Policy Manager.
6
Click the Properties tab. In the Proxy area, select the proxy configuration to use.
Select Edit > Add Policies, open the Proxies folder, and select SMTP-Proxy.
Click Add.
Type a name for the policy.
Configure the From and To destination information to make the proxy allow traffic between two
destinations.
Default configurations are included for you to select from.
7
8
9
Click the View/Edit icon to see the proxy configuration.
10
11
12
13
In the Actions to Take section, select AV Scan from the drop-down list adjacent to None Matched.
In the Categories section, expand Attachments, and then click Content Types.
In the Actions to Take section at the bottom of the dialog box, select AV Scan from the drop-down
list adjacent to If Matched.
In the Categories section, expand Attachments, and then click Filenames.
Do steps 9 and 10 for the Filenames category.
Under Categories, click Antivirus..
There are three antivirus responses that Gateway AntiVirus can have:
• Attachments that have viruses in them.
• Attachments that are too large for the antivirus service to scan.
• Attachments that the antivirus service cannot scan for other causes.
130
WatchGuard System Manager
Getting Gateway AntiVirus for E-mail Status and Updates
Note
You can configure the maximum size for attachments by configuring engine settings in Policy
Manager. Go to Setup > AntiVirus, and click the Engine Settings tab.
You can select from five actions for attachments.
Allow
Allow the attachment to go to the recipient, even if the content contains a virus.
Lock
Lock the attachment. This is a good option for files that are too large for Gateway AntiVirus or
that cannot be scanned by the Firebox. A file that is locked cannot be opened easily by the user.
Only the administrator can unlock the file. The administrator can use a different antivirus tool to
scan the file and examine the content of the attachment.
Strip
Strip the attachment to remove it from the message and delete it.
Drop
Drop the attachment to stop the message and drop the connection. No information is sent to the
source of the message.
Block
Block a message to drop the attachment, and to add the IP address of the sender to the Blocked
Sites list.
Note
If you set the configuration to Allow attachments, your configuration is less secure.
14 When you have configured the antivirus settings for the proxy, click OK.
If you have made changes to a preconfigured proxy definition, you must save the new configuration with a
different name. Type a name for the proxy definition and click OK.
15 Click OK to close the Add Policy dialog box.
16 Save the configuration to the Firebox. Select File > Save > To Firebox.
17 Click OK to save the file to the Firebox.
Using Gateway AntiVirus for E-mail with more than one proxy
You can use more than one SMTP Proxy to find and remove viruses for different servers in your organization.
Each proxy that uses Gateway AntiVirus for E-mail is configured with options that are special to that
proxy. For example, you can use different proxy antivirus configurations for e-mail that is for different
servers or different destinations. You can strip attachments that are too large to scan for some users, and
allow the same attachments for other users.
Getting Gateway AntiVirus for E-mail Status and Updates
You can see the status and get updates for Gateway AntiVirus for E-mail™ on the Security Services tab in
Firebox® System Manager. For more information on this tab, see “Security Services” on page 27.
Seeing service status
Gateway AntiVirus for E-mail status shows you whether protection is active. You can also see information
about the virus scanner, virus signature versions, and when the signatures were updated.
Fireware Configuration Guide
131
Getting Gateway AntiVirus for E-mail Status and Updates
To see service status:
1
From WatchGuard® System Manager, select the Firebox. Select Tools > Firebox System Manager.
You can also click the Firebox System Manager icon on the WatchGuard System Manager toolbar.
2
Click the Security Services tab.
The window shows the status of the installed security services. Licenses for these features must be
installed to see status information.
Updating signatures manually
Gateway AntiVirus for E-mail can be configured to update signatures automatically. You can also update
signatures manually. If the signatures are not current, you are not protected from the latest viruses and
attacks.
To update the services manually:
1
2
Start Firebox System Manager.
Click the Security Services tab.
Security service status appears.
3
Click Update for the service you want to update. You must type your configuration passphrase.
The Firebox downloads the most recent available signature update for Gateway AntiVirus for E-mail. You see
information about the update in Traffic Monitor.
If no updates are available, the Update button is not active.
Updating the antivirus software
Because there are new types of attacks all the time, you must regularly update your antivirus software.
When it is necessary, WatchGuard releases updates to the antivirus database and to the antivirus software.
When we release an update, you get an e-mail from LiveSecurity. You have access to all updates while
your Gateway Antivirus subscription is active.
To download software updates, log in to your LiveSecurity® account at:
www.watchguard.com/support
132
WatchGuard System Manager
Monitoring Gateway AntiVirus for E-mail
Monitoring Gateway AntiVirus for E-mail
You can use your WatchGuard tools to monitor Gateway AntiVirus for E-mail™. These include: Firebox
System Manager, Historical Reports, and LogViewer.
Configuring Gateway AntiVirus for E-mail to record log messages
Gateway AntiVirus for E-mail can record log messages for all of the three antivirus responses.
To record log messages:
1
2
Start Policy Manager. Double-click the SMTP Proxy icon.
Click the Properties tab.
The Properties tab appears.
3
In the Proxy area, click the Show/Edit icon.
The Proxy configuration appears.
4
To record log messages, select the Log check box for the antivirus response. If you do not want to
record log messages for an antivirus response, clear the Log check box for that antivirus response.
5
To create an alarm for an antivirus response, select the Alarm check box for that antivirus response. If
you do not want an alarm for an antivirus response, clear the Alarm check box for that antivirus
response.
6
Click OK.
If you are editing a preconfigured proxy configuration, Policy Manager requests that you save the proxy with a
new name. Type a name and click OK.
7
Click OK to close the SMTP Proxy Configuration dialog box.
Note
The Proxy and A/V alarms must be configured for notification to occur. See “Customizing Logging and
Notification for proxy rules” on page 82.
Fireware Configuration Guide
133
Configuring the Signature-Based Intrusion Prevention Service
Configuring the Signature-Based Intrusion Prevention Service
Before you use the Signature-Based Intrusion Prevention Service in a proxy policy, you must configure the
feature. To do this:
1
2
From WatchGuard® System Manager, select the Firebox® that uses the service.
Select Tools > Policy Manager.
You can also click the Policy Manager icon on the WatchGuard System Manager toolbar.
3
From Policy Manager, select Setup > Intrusion Prevention > IPS Signature.
The IPS Signature dialog box appears.
4
To get automatic updates to the Intrusion Prevention signatures, select the Automatic update check
box.
5
6
7
8
9
Select or type the frequency of updates, in minutes.
Select or type the number of times to try to connect to the server.
Click OK.
Select File > Save > To Firebox.
Click OK.
Configuring Intrusion Prevention Service in a Proxy
You use Intrusion Prevention Service to find and stop attacks with the WatchGuard® proxies. The Firebox®
Intrusion Prevention Service examines DNS, FTP, HTTP, and SMTP traffic, and also other TCP-based traffic using the TCP proxy.
Adding a proxy with Intrusion Prevention Service
To add a proxy and configure Signature-Based Intrusion Prevention Service:
1
2
3
4
5
6
Start Policy Manager.
Select Edit > Add Policies, expand the Proxies folder, and select the proxy to add.
Click Add.
Type a name for the policy.
Configure the From and To destination information to make the proxy allow traffic between two
destinations.
Click the Properties tab. In the Proxy drop-down list, select the proxy configuration to use.
Some proxies include one default configuration. Some proxies include different default configurations for
incoming and outgoing directions. Other proxies include default configurations for client and server.
134
WatchGuard System Manager
Configuring Intrusion Prevention Service in a Proxy
7
Click the View/Edit icon to see the proxy configuration. In the Categories section, click Intrusion
Prevention.
8
9
To enable intrusion prevention for this proxy, select the Enable Intrusion Prevention check box.
For most proxies, you can configure actions for three intrusion severity levels: High, Medium, and
Low. For more information on intrusion levels, see “About intrusion severity levels” on page 136.
Each severity level has four actions:
Allow
You allow a packet to go to the recipient, even if the content matches a signature.
Deny
You deny a packet to stop the packet and send a deny message to the sender.
Drop
You drop a packet to stop the packet without sending a notification to the sender.
Block
You block the message, drop the packet, and add the IP address that the packet started from to
the temporary blocked sites list.
Note
If you set the configuration to allow packets for one of these three severity levels, your configuration
is less secure.
10 When you have configured the intrusion prevention settings for the proxy, click OK.
If you have made changes to a preconfigured proxy definition, Policy Manager requests that you save the new
configuration with a different name. Type a name for the proxy definition and click OK.
11
12
13
14
Click OK to close the New Policy Properties dialog box.
Save the configuration to the Firebox. Select File > Save > To Firebox.
Type the configuration passphrase in the Save Firebox dialog box.
Click OK to save the file to the Firebox.
Fireware Configuration Guide
135
Configuring Intrusion Prevention Service in a Proxy
About intrusion severity levels
The three intrusion severity levels look for the following:
High
Vulnerabilities that allow remote access or execution of code, such as buffer overflows, remote
command execution, password disclosure, backdoors, and security bypass.
Medium
Vulnerabilities that allow access, disclose source code to attackers, and deny access to legitimate
users. Examples are directory traversal, file/source disclosure, DoS, SQL injection, and cross-site
scripting.
Low
Vulnerabilities that do not allow the attacker to directly get access, but allow the attacker to get
information that can be used in an attack. For example, an attacker can send a command that
gets information about the operating system, IP addresses, or network path of a network.
Signatures that get access to software applications with vulnerabilities (such as signatures that do
not have very specific content) also get this level of severity.
Some signatures that would usually be in the High or Medium level are put in lower levels if their content
is not very detailed. They are also put in lower levels if they have a wide scope that could cause false positives.
Using advanced HTTP proxy features
The HTTP proxy uses more intrusion prevention features for stronger protection.
Signatures
These options allow you to configure the proxy to use a more accurate list of signatures for HTTP client
or HTTP server software applications.
136
WatchGuard System Manager
Getting Intrusion Prevention Service Status and Updates
Client
This set of signatures protects HTTP clients from attacks.
Server
This set of signatures protects HTTP servers from attacks.
Common to both endpoints
Select this check box to use signatures that can protect an HTTP client and an HTTP server.
Preventing Instant Messaging (IM) and Peer to Peer (P2P) use
The HTTP Proxy and the TCP proxy include options to prevent Instant Messaging (IM) and Peer to Peer
(P2P) use. These options can give more protection against new P2P and IM features and services.
The Intrusion Prevention Service finds these types of IM services. This includes their Web versions:
• MSN Messenger
• Yahoo Messenger
• AOL Instant Messenger (AIM)
• ICQ
The Intrusion Prevention Service finds these types of P2P services:
• Napster
• GNUtella
• Kazaa
• Morpheus
• BitTorrent
• eDonkey2000 (ed2k)
• IRC
• Phatbot
These options are given for IM and P2P signatures:
Detect IM (Instant Messaging) with action
Select this check box to enable a set of signatures that detect Instant Messaging traffic. You can
then use the action Allow, Drop, Deny, or Block.
Detect P2P (Peer to Peer) with action
Select this check box to enable a set of signatures that detect Peer to Peer traffic. You can then
use the action Allow, Drop, Deny, or Block.
Getting Intrusion Prevention Service Status and Updates
You can see the status and get updates for Intrusion Prevention Service on the Security Services tab in
Firebox® System Manager. For more information on this tab, see “Security Services” on page 27.
Seeing service status
Intrusion Prevention Service status shows you whether protection is active. You can also see information
about the signature versions.
Fireware Configuration Guide
137
Getting Intrusion Prevention Service Status and Updates
To see service status:
1
From WatchGuard® System Manager, select the Firebox. Select Tools > Firebox System Manager.
You can also click the Firebox System Manager icon on the WatchGuard System Manager toolbar.
2
Click the Security Services tab.
The window shows the status for the installed security services. Licenses for these features must be installed to see
status information.
3
Click History to see the date, version, and status of the signature updates that have occurred.
Updating signatures manually
Intrusion Prevention Service can be configured to update signatures automatically. You can also update
signatures manually. If the signatures are not current, you are not protected from the latest viruses and
attacks.
To update the services manually:
1
2
Start Firebox System Manager.
Click the Security Services tab.
Security service status appears.
3
Click Update for the service to update.
The Firebox downloads the most recent available signature update. You see information about the update in Traffic
Monitor.
If there are no updates available, the Update button is not active.
138
WatchGuard System Manager
PART III
Using Virtual Private Networks
Fireware Configuration Guide
139
140
WatchGuard System Manager
CHAPTER 12
Introduction to VPNs
The Internet is a public network. On this system of computers and networks, one computer can get information from other computers. It is possible for a person to read unsecured data packets that you send on
the Internet. To send secure data on the Internet between offices, networks, and users, you must use
stronger security.
Fireware Configuration Guide
141
Tunneling Protocols
Virtual private networks (VPNs) use encryption technology to decrease security risks, and to secure private
information on the public Internet. A virtual private network lets data flow safely across the Internet
between two networks. VPN tunnels can also secure connections between a host and a network.
The networks and hosts at the endpoints of a VPN can be corporate headquarters, branch offices, and
remote users.
VPN tunnels use authentication, which examines the sender and the recipient. If the authentication information is correct, the data is decrypted. Only the sender and the recipient of the message can read it
clearly.
For more information on VPN technology, see the online information at:
http://www.watchguard.com/support
The WatchGuard® Support Web site contains links to documentation, basic FAQs, advanced FAQs, and
the WatchGuard User’s Forum. You must log in to the Support Web Site to use some features.
Tunneling Protocols
Tunnels allow users to send data in secure packets across a network that is not secure, usually the Internet. A tunnel is a group of security protocols, encryption algorithms, and rules. The tunnel uses this information to send secure traffic from one endpoint to the other. A tunnel allows users to connect to
resources and computers from other networks.
Tunneling protocols supply the infrastructure and set how the data transmission on the tunnel occurs.
The two tunneling protocols that WatchGuard® uses are Internet Protocol Security (IPSec) and Point-toPoint-Tunneling Protocol (PPTP).
IPSec
You use the IPSec protocol to examine IP packets and make sure they are authenticated. IPSec includes
security features such as very strong authentication to protect the privacy of the information that you
transmit on the Internet. IPSec is a standard that works with many systems from different manufacturers.
IPSec includes two protocols that protect data integrity and confidentiality. The AH (Authentication
Header) protocol is the solution for data integrity. The ESP (Encapsulated Security Payload) protocol gives
data integrity and confidentiality.
PPTP
Point to Point Tunneling Protocol (PPTP) is a standard for VPN security that can be used with many systems from different manufacturers. PPTP allows tunnels to corporate networks and to other PPTPenabled systems. PPTP is not as secure as IPSec and cannot secure two networks. PPTP can only secure
one IP address with one other IP address or with a network. PPTP supplies an inexpensive tunnel alternative to a corporate network that is easier to use than IPSec.
Encryption
On a network that is not secure, hackers can find transmitted packets very easily. VPN tunnels use encryption to keep this data secure.
The length of the encryption key, together with the algorithm used, set the encryption strength for the
VPN. A longer key gives better encryption and more security. The level of encryption is set to give the performance and security that is necessary for the organization. Stronger encryption usually gives a higher
level of security, but can have a negative effect on performance.
Basic encryption allows sufficient security with good throughput for tunnels that do not transmit sensitive data. For administrative connections and for connections where privacy is critical, we recommend
strong encryption.
142
WatchGuard System Manager
IP Addressing
The host or the IPSec device that sends a packet through the tunnel encrypts the packet. The recipient at
the other end of the tunnel decrypts the packet. Therefore, the two endpoints must agree on all the tunnel parameters. This includes the encryption and authentication algorithms, the hosts or networks allowed
to send data across the tunnel, the time period for calculating a new key, and other parameters.
Selecting an encryption and data integrity method
Think of security and performance when you select the encryption and data integrity algorithms to use.
We recommend AES, the strongest of the encryption types, for sensitive data. Fireware Pro uses AES 256
as the default encryption algorithm.
Data integrity makes sure that the data a VPN endpoint receives is not changed as it is sent. We give support to two types of data authentication. The first type is 128-bit Message Digest 5 (MD5-HMAC). The
second type is 160-bit Secure Hash Algorithm (SHA1-HMAC).
Authentication
An important part of security for a virtual private network (VPN) is to make sure that the sender and
recipient are authenticated. There are two methods, passphrase authentication (also called a shared secret)
and digital certificates. A shared secret is a passphrase that is the same for the two ends of the tunnel.
Digital certificates use public key cryptography to identify and authenticate the end gateways. You can
use certificates for authentication for any VPN tunnel you create with your WatchGuard Management
Server. For more information on the certificates, see the WatchGuard® System Manager User Guide.
Extended authentication
Authentication for a remote user can occur through a database that is stored on the Firebox, or through
an external authentication server. An example of an external authentication server is the Remote Authentication Dial-In User Service (RADIUS). An authentication server is a safe third party that authenticates
other systems on a network. With Mobile User VPN, the remote user must type a user name and password
each time a VPN is started.
Selecting an authentication method
A primary part of a VPN is its method of user authentication. When you use shared secrets safely, you
must make sure that you:
• Make users select strong passwords.
• Change passwords frequently.
When you use RUVPN with PPTP or Mobile User VPN, it is especially important to use strong passwords.
When you put the security of VPN endpoints at risk, you can put the security of the network at risk. If, for
example, a person steals a laptop computer and finds the password, that person has direct access to the
network.
Digital certificates are electronic records that identify the user. For more information about certificates,
see the WatchGuard System Manager User Guide. The Certificate Authority (CA), a safe third party, manages the certificates. In the WatchGuard System Manager, you can configure a Firebox to operate as a CA.
This type of authentication can be safer than shared secrets.
IP Addressing
Correct use of the IP address is important when you make a VPN tunnel. It is best if the private IP
addresses of the computers at one side of the VPN tunnel are not the same as the private IP addresses you
use at the other side of the VPN tunnel. If you have branch offices, use subnets at each location that are
different from the primary office network. If it is possible, use subnets that are almost the same as the
Firebox® subnet when you set up a branch office.
Fireware Configuration Guide
143
Internet Key Exchange (IKE)
For example, if the primary Firebox network uses 192.168.100.0/24, then for the branch offices use
192.168.101.0/24, 192.168.102.0/24, and so on. This prevents new problems if you expand your network,
and it helps you remember the IP addresses at your branch offices.
For Mobile User VPN and RUVPN tunnels, the Firebox gives each remote user a virtual IP address. The
easiest method to give virtual IP addresses is to give virtual IP addresses that come from the primary network but are not used for any other computer. You cannot use the same virtual IP address for RUVPN and
for Mobile User VPN remote users. You also cannot use a virtual IP address that can be on a computer at
a different location on the primary network.
If your primary network does not have sufficient IP addresses to do this, the safest procedure is to install
a “placeholder” secondary network. Select a range of addresses for it and use an IP address from that
range for the virtual IP address.
This lets you select from a range of addresses. There is no interference from these addresses with real host
addresses in use behind the Firebox. If you use this procedure for RUVPN virtual IP addresses, you must
configure the client computer to use the default gateway on the remote network, or you must manually
add routes after the VPN tunnel is connected. This is not necessary for the MUVPN client computer.
Internet Key Exchange (IKE)
As the number of VPN tunnels in your network increases, it can get more difficult to manage the large
number of session keys that are used by the tunnels. Keys must be replaced frequently for stronger security.
Internet Key Exchange (IKE) is the key management protocol IPSec uses. IKE automates the procedure to
negotiate and replace keys. IKE includes a security protocol, the Internet Security Association, and Key
Management Protocol (ISAKMP). This protocol uses a two-phase procedure to create an IPSec tunnel.
During Phase 1, two gateways create a safe, authenticated channel for communication. Phase 2 includes
an interchange of keys to find out how to encrypt the data between the two.
Diffie-Hellman is an algorithm that IKE uses to make keys that are necessary for data encryption. DiffieHellman groups are collections of parameters. These groups let two peer systems interchange and agree
on a session key. Group 1 is a 768-bit group, and group 2 is a 1024-bit group. Group 2 is more secure
than group 1, but uses more processor time to make the keys.
NAT and VPNs
If you use NAT between two VPN gateways, you must use ESP (not AH) as the authentication protocol
when creating VPN tunnels between the devices.
If you send IPSec or PPTP traffic through a Firebox (IPSec or PPTP pass-through), the Firebox can use
NAT when sending the traffic.
Access Control
VPN tunnels give users access to resources on your computer network. Think which type of access is
applicable for a given type of user. For example, you can give a group of contract employees access to
only one network and your sales people access to all the networks.
144
WatchGuard System Manager
Network Topology
Different VPN technologies can also set your level of trust. Branch office VPNs have a firewall device at
the two ends of the tunnel. They are more safe than Mobile User VPN and RUVPN, which have protection
at only one end.
Network Topology
You can configure the VPN for support of meshed and hub-and-spoke configurations. The topology that
you select sets the types and number of connections that occur. It also sets the flow of data and the flow
of traffic.
Meshed networks
In a fully meshed topology, all servers are connected together to make a web. Each device is only one step
from each other VPN unit. Traffic can go between each unit of the VPN, if necessary.
Fully Meshed Network
This topology is the most error resistant. If a VPN unit goes down, only the connection to the trusted network of that unit is down. But, this topology is more work to set up. Each VPN unit must have a VPN
tunnel configured to each other unit. There can be possible routing problems if it is not done carefully.
The largest problem that you get with fully meshed networks is one of control. Because each unit in the
network must connect with each other unit, the number of necessary tunnels becomes large quickly. The
number of tunnels that are necessary for this configuration is the same as the square of the number of
devices:
[(number of devices) x (number of devices)] -1 ÷ 2 = number of tunnels]
When all the VPN units are WatchGuard® devices, WatchGuard System Manager can make the quantity of
work much less. The Management Server contains all the information for all the tunnels. With WatchGuard System Manager, you make a VPN tunnel between two devices in three steps using a drag-anddrop method.
You can monitor the security of the full system from more than one location, each with a Firebox®. Larger
companies use this configuration with important branch offices, each using a higher capacity Firebox.
Smaller offices and remote users connect with MUVPN, RUVPN, Firebox X Edge, or SOHO 6 devices.
Networks that are not fully meshed have only the necessary inter-spoke VPN tunnels. Refer to the figure
below. Thus the flow through the network is better than fully meshed networks. The limits in all meshed
networks are:
- The number of VPN tunnels that the firewall CPU can operate.
- The number of VPN tunnels allowed by the VPN license on the unit.
Fireware Configuration Guide
145
Network Topology
Partially Meshed Network
Hub-and-spoke networks
In a hub-and-spoke configuration all VPN tunnels stop at one firewall. Smaller companies frequently use
this configuration with a primary Firebox. Many distributed remote users connect with Mobile User VPN,
RUVPN, Firebox X Edge, or SOHO 6 devices to this configuration. Each remote device or remote user
makes a VPN tunnel only to the primary Firebox.
In a simple hub-and-spoke configuration, each remote location can only send and receive data through a
VPN tunnel to the network behind the master server. But, a VPN tunnel to the master server, the primary
hub, can also be configured to send and receive data to a different remote VPN location (tunnel switching). The intensity of traffic in hub-and-spoke can be high if the master server sends packets from one
remote location to a different remote location. Or, the traffic intensity can be low in a simple hub-andspoke, where the remote locations can only send data through a VPN tunnel to the primary hub location.
The master server is the one point where all VPN tunnels can fail, so it can be a problem. If the master
server goes down, you cannot connect any VPN tunnels to the remote locations.
The flow through a simple hub-and-spoke system is far more clear than through a meshed system. You
can control the number of tunnels better. Refer to the sum that follows:
[(number of devices) – 1 = number of tunnels]
If it is necessary to have more spoke capacity, you expand the hub location. But, because all traffic goes
through the hub, it is necessary to have much bandwidth for this installation.
146
WatchGuard System Manager
Tunneling Methods
Hub and Spoke Network
Tunneling Methods
Split tunneling is when a remote user or endpoint has access to the Internet on the same computer as the
VPN connection. But, this user does not put the Internet traffic through the tunnel. The remote user
browses directly through the ISP. This makes the system vulnerable, because Internet traffic is not filtered
or encrypted.
This dangerous configuration is less vulnerable when all of the Internet traffic of the remote user goes
through a VPN tunnel to the Firebox®. From the Firebox, the traffic is then sent back out to the Internet
(tunnel switching). With this configuration the Firebox examines all traffic and gives better security.
When you use tunnel switching, a Dynamic NAT policy must include the outgoing traffic from the remote
network. In Policy Manager, add a policy at Setup > NAT. This allows the remote users to browse the
Internet when they send all traffic to the Firebox.
Split tunneling decreases security, but does increase performance. If you use split tunneling, remote users
must have personal firewalls for computers behind the VPN endpoint.
WatchGuard VPN Solutions
WatchGuard® System Manager includes this software to create tunnels:
• Remote User VPN (RUVPN) with PPTP
• Mobile User VPN (MUVPN) with IPSec
• Branch Office VPN (BOVPN) with IPSec, which uses Policy Manager to manually configure the
tunnel settings
Fireware Configuration Guide
147
WatchGuard VPN Solutions
• Branch Office VPN (BOVPN) with IPSec, which uses WatchGuard System Manager to automatically
configure the tunnel settings.
WatchGuard includes different types of encryption for the different types of VPN tunnels you can create.
Branch Office VPN allows Data Encryption Service (DES) with a 56-bit encryption key for basic encryption, 112-bit key for medium encryption, and a 168-bit encryption key (3DES) for strong encryption. It
also allows the Advanced Encryption Standard (AES), a block data encryption method, using 128-bit,
192-bit, or 256-bit encryption.
RUVPN with PPTP
RUVPN allows remote users or mobile users to connect to the Firebox® network with PPTP. RUVPN with
PPTP allows RC4 40 bit or 128 bit keys.
The basic WatchGuard System Manager package includes RUVPN with PPTP. It allows 50 users, and all
levels of encryption. For information on how to create RUVPN with PPTP tunnels, see the chapter “Configuring RUVPN with PPTP,” on page 171 in this guide.
Mobile User VPN
Note
For information on how to configure and use MUVPN, see the MUVPN Administrator Guide.
Mobile User VPN is an optional software component available for all Firebox models. Remote users are
mobile employees who must have corporate network access. MUVPN creates an IPSec tunnel between a
remote host that is not secure and your corporate network. Remote users connect to the Internet with a
standard Internet dial-up or broadband connection, and then they use the MUVPN software to make a
secure connection to the network or networks protected by the Firebox®. With MUVPN, only one Firebox
is necessary to create the tunnel.
MUVPN uses IPSec with DES or 3DES to encrypt incoming traffic, and MD5 or SHA-1 to authenticate
data packets. You configure a security policy and supply it along with the MUVPN software to each
remote user. The security policy is an encrypted file with the extension wgx. When the software is
installed on the computers of the remote users, they can safely connect to the corporate network. MUVPN
users can change their security policies, or you can give them read-only security policies.
Branch Office Virtual Private Network (BOVPN)
Many companies have offices in more than one location. Offices frequently use data from other locations,
or have access to shared databases.
Because branch office communications include sensitive company data, information interchanges must
be secure. When you use WatchGuard Branch Office VPN (BOVPN), you can connect two or more locations across the Internet without decreasing security. WatchGuard BOVPN supplies an encrypted tunnel
between two networks or between a Firebox and an IPSec-compliant device. You can use WatchGuard
System Manager or Policy Manager to configure BOVPN.
WatchGuard allows certificate-based authentication for BOVPN tunnels. When you use certificate-based
authentication for BOVPN, the two VPN endpoints must be WatchGuard Fireboxes. You cannot use certificate-based authentication for BOVPN with SOHO 6 or Firebox X Edge devices. To use this functionality,
you must configure a Management Server and a certificate authority. For more information, see “Configuring IPSec Tunnels,” on page 161. For instructions on how to use Policy Manager to manually configure
a BOVPN tunnel, see “Configuring BOVPN with Manual IPSec,” on page 153.
BOVPN with Policy Manager
When you build a tunnel with Policy Manager, the Firebox uses IPSec to make encrypted tunnels with
another IPSec-compliant security appliance. One of the two endpoints must have a public static IP
address. Use BOVPN with Policy Manager if:
148
WatchGuard System Manager
VPN Scenarios
• You make tunnels between a Firebox and a non-WatchGuard, IPSec-compliant unit.
• You give different routing policies to different tunnels.
• Not all types of traffic go through the tunnel.
BOVPN with IPSec is available with the medium encryption level of DES (56-bit), or the stronger encryption levels of two DES (112-bit) or 3DES (168-bit). BOVPN is also available with AES at the 112-bit, 192bit, and 256-bit encryption levels. AES with 256-bit encryption is the most secure.
You can create different VPN tunnels for different types of traffic on your network. For example, you can
use a VPN tunnel with DES encryption for traffic from your sales team. At the same time use a VPN tunnel with stronger, 3DES encryption for all data from your finance department.
BOVPN with Manual IPSec
BOVPN with WatchGuard System Manager
With WatchGuard System Manager, you can make fully authenticated and encrypted IPSec tunnels with a
drag-and-drop or menu interface. System Manager uses the Management Server to safely transmit IPSec
VPN configuration information between Fireboxes. When you use the Management Server, you set each
configuration parameter of the VPN. The Management Server stores this information.
Use BOVPN with WatchGuard System Manager if:
• You make tunnels between two or more Fireboxes.
• You give different routing policies to different tunnels.
• Client units have dynamic or static IP addresses.
• You have a large number of tunnels to make.
With WatchGuard System Manager you can configure, manage, and monitor all WatchGuard devices
across a company. You can configure VPN tunnels between two remote devices easily, using the default
settings that System Manager gives you. You do not have to know about the Internet security of branch
offices and remote users. Remote devices connect to the Management Server, and System Manager does
all the work. If you use certificates for tunnel authentication, you can configure the Management Server
as a certificate authority to create certificates automatically.
VPN Scenarios
This section gives three different types of companies and the VPN solutions that best fit each one.
Fireware Configuration Guide
149
VPN Scenarios
Large company with branch offices: System Manager
Large Company with VPNs to Branch Offices
Gallatin Corporation has a head office with approximately 300 users in Los Angeles. It has branch offices
of around 100 users each in Sacramento, San Diego, and Irvine. All locations have high-speed Internet
access and employees at all locations must have secure connections to all other locations.
This company uses Fireboxes® at each location and WatchGuard® System Manager to connect the locations to each other. Each office connects to all other offices. All users at each office have access to the
shared records at all the other locations. The Management Server is behind the Firebox at the main office,
and the Fireboxes at the branch offices are Managed Firebox Clients. When a service stop occurs with
Gallatin’s Internet service provider, it makes the Firebox at headquarters unavailable. But the tunnels in
the other locations stay active.
Small company with telecommuters: MUVPN
River Rock Press is a small publishing house in a specialty market. It has an office with six employees in
Portland, Oregon and five editors who are in other cities. The head office uses a Firebox X Edge as a firewall and as a VPN gateway. The five editors each use a Mobile User VPN client to make a secure connection to the Information Center in Portland. The editors can always safely interchange information if their
computers are connected to the Internet.
150
WatchGuard System Manager
VPN Scenarios
Small Company with Telecommuters Using Mobile User VPN
Company with remote employees: MUVPN with extended authentication
BizMentors, Inc. has 35 trainers to give courses in business-related topics at the locations of client companies. The 75 salespeople of BizMentors must have current information on the schedules of the trainers,
to prevent conflicts.
A database in the data center of BizMentors keeps this information current. The data center uses a Firebox and each salesperson uses an MUVPN client to get access to the inventory and price database. To
authenticate all remote users, BizMentors uses a RADIUS authentication server.
Usually, you must enter the ID and password information on the Firebox and on the authentication server.
But when you use extended authentication, all IDs and passwords are sent to the authentication server.
You do not have to put them in the Firebox. All salespersons can log in to the corporate network with the
ID and password they usually use when inside the network. The Firebox sends the ID and password to the
authentication server, and the authentication server does the authentication of the VPN user credentials.
Fireware Configuration Guide
151
VPN Scenarios
Small Company Using Extended Authentication
152
WatchGuard System Manager
CHAPTER 13
Configuring BOVPN with Manual
IPSec
You use Branch Office VPN (BOVPN) with Manual IPSec to make encrypted tunnels between a Firebox®
and an IPSec-compliant security device. This device can protect a branch office or a different remote
location
BOVPN with Manual IPSec is available with DES (56-bit), 3DES (168-bit), AES 128, AES 192, and AES 256
encryption.
Before You Start
You must have the this information to use BOVPN with Manual IPSec:
• Policy endpoints — IP addresses of special hosts or networks that operate on the tunnel
• Encryption method (the two ends of the tunnel must use the same encryption method)
• Authentication method
Configuring a Gateway
A gateway is a connection point for one or more tunnels. The gateway standard connection method
becomes the standard connection method for tunnels made with the device at the other end of the tunnel. An example is ISAKMP automated key negotiation.
Adding a gateway
To start IPSec tunnel negotiation, one peer must connect to the other. To do this, you can use an IP
address or a DNS name. If the peer is dynamic, select "Any" for the peer ID type.
Fireware Configuration Guide
153
Configuring a Gateway
To configure this, set the ID type of the remote gateway to Domain Name. Set the name of the peer to
the fully qualified domain name. Set the DNS server of the Firebox® to one that can identify the name,
usually an internal DNS server.
1
From Policy Manager, click VPN > Branch Office Gateways.
The Gateways dialog box appears.
2
To add a gateway, click Add.
The New Gateway dialog box appears.
3
Type the gateway name in the Gateway Name text box.
This name identifies the gateway only in the Policy Manager.
4
From the Gateway IP drop-down list, select IP Address or Any.
If the gateway address is a static IP address, enter it adjacent to the Gateway IP drop-down list.
5
From the Remote Gateway Settings ID Type drop-down list, select IP Address, Domain Name, User
Domain Name, or X.500 Name.
Use the domain name as the identification if the Firebox uses DHCP or PPPoE for its external IP address. This
information is in the Firebox configuration. The Firebox uses IP Address and Domain Name to find the VPN
endpoint. User name is a label that you use to identify the user at the VPN endpoint.
154
WatchGuard System Manager
Configuring a Gateway
6
Configure the Local Settings. In the local ID Type text box, select IP address, Domain Name, or User
Domain Name. If you select IP address, you can select the IP address from the drop-down list. All
configured Firebox interface IP addresses are shown.
7
Click Pre-Shared Key or Firebox Certificate to identify the authentication procedure to use. If you
select Pre-Shared Key, type the shared key.
You must use the same pre-shared key at the remote device.
Note
You must start the Certificate Authority if you select to authenticate with certificates. For information
on this, see the Certificate Authority information in the WatchGuard® System Manager User Guide.
Also, if you use certificates you must use the WatchGuard Log Server for log messages. We do not
support third-party certificates.
8
You can use the preconfigured Phase 1 settings, or you can change the settings.
Phase 1 applies to the initial phase of the IKE negotiation. It contains authentication, session negotiation, and key
change information.
9 From the Authentication drop-down list, select the type of authentication: SHA1 or MD5.
10 From the Encryption drop-down list, select the type of encryption: DES or 3DES.
11 From the Mode drop-down list, select Main or Aggressive mode.
Main Mode protects the identities of the VPN endpoints during negotiation, and is more secure than Aggressive
Mode. Main Mode also supports Diffie-Hellman group 2. But, Main Mode must send more messages between
endpoints, and is slower than Aggressive Mode.
12 To change the Diffie-Hellman group settings and other advanced Phase 1 settings, click Advanced.
The Phase1 Advanced Settings dialog box appears.
13 To change the SA (security association) life, type a number in the SA Life field, and select Hour or
Minute from the drop-down list.
14 From the Key Group drop-down list, select the Diffie-Hellman group. WatchGuard supports groups 1
and 2.
Diffie-Hellman refers to a mathematical procedure to safely negotiate secret keys across a public medium.
Diffie-Hellman groups are sets of properties that you use to get this. Group 2 is more safe than group 1, but
uses more time to make the keys.
Note
Diffie-Hellman Group 2 is supported only in Aggressive Mode.
15 Select the NAT Traversal check box to enable NAT traversal if the tunnel is used for NAT devices.
Type a keep-alive to keep the NAT Traversal connection open.
NAT Traversal, or UDP Encapsulation, allows traffic to get to the correct destinations. This continues to operate
when the addresses are changed by NAT or when a router on the path between endpoints does not route IP 50
(ESP) or 51 (AH).
16 Select the IKE Keep-alive check box to send IKE keep-alive messages through the tunnel, and keep
the tunnel open. Type a message interval.
Fireware Configuration Guide
155
Making a Manual Tunnel
17 Use the Max failures field to set the maximum number of times the Firebox tries to negotiate an IKE
Phase 2.
18 Click OK when advanced configuration is complete.
19 Click OK to save the gateway.
20 Close the Gateways dialog box.
Editing and deleting a gateway
To change a gateway, select VPN > Branch Office Gateways. You can also right-click on a tunnel icon in
the BOVPN tab of Policy Manager, and select Gateway Property.
1
Select the gateway and click Edit.
The Edit Gateway dialog box appears.
2
Make the changes and click OK.
To remove a gateway from the Gateways dialog box, select the gateway and click Remove.
Making a Manual Tunnel
Use this method to configure a manual tunnel using a gateway with the Internet Security Association and
Key Management Protocol (ISAKMP) key negotiation type. ISAKMP is a protocol to authenticate network
traffic between two devices. This procedure includes the information on how the devices control security,
including encryption. It also includes how to make the keys that you use to change the encrypted data
into text.
1
From Policy Manager, select VPN > Branch Office Tunnels.
The Branch Office IPSec Tunnels dialog box appears.
156
WatchGuard System Manager
Making a Manual Tunnel
2
Click Add.
The New Tunnel dialog box appears.
3
4
Type a tunnel name.
Select a remote gateway to connect with this tunnel. The gateways you have added to your
configuration show in this drop-down list.
To edit a gateway, select the name and click the Edit button. To create a new Gateway, click the New button.
Edit
New
5
Select the IKE Phase 2 proposal for the tunnel from the Proposal drop-down list. The list contains
predefined phase 2 security proposals.
6
If you using a predefined phase 2 proposal, and not creating or editing a phase 2 proposal, go to Step
13.
You can edit a phase 2 proposal that you created, but you cannot edit a predefined proposal. You
must add a new one. To edit a phase 2 proposal that you created, select the name and click the Edit
button. To create a new proposal, click the New button.
The Phase2 Proposal dialog box appears.
7
Type a name for the new proposal.
Fireware Configuration Guide
157
Making a Manual Tunnel
8
From the Type drop-down list, select ESP or AH as the proposal method.
ESP is authentication with encryption. AH is authentication only. Also, ESP authentication does not include the IP
header, while AH does. The use of AH is rare.
9 From the Authentication drop-down list, select SHA1, MD5, or None for the authentication method.
10 (ESP only) From the Encryption drop-down list, select the encryption method.
The options are DES, 3DES, and AES 128, 192, or 256 bit which appear in the list from the most simple and least
secure to most complex and most secure.
11 You can make the key expire after a quantity of time or a quantity of traffic. To enable key
expiration, select the Force Key Expiration check box.
12 Select a quantity of time and a number of bytes after which the key expires. The key expires when the
time selected or the number of bytes occurs.
13 Click OK to close the Phase2 Proposal dialog box.
14 Select the PFS check box to enable Perfect Forward Secrecy (PFS). If you enable PFS, select the DiffieHellman group.
Perfect Forward Secrecy gives more protection to keys that are created in a session. Keys made with PFS are not
made from a previous key. If a previous key is compromised after a session, your new session keys are secure. DiffieHellman Group 1 uses a 768-bit group to create the new key exchange, and Diffie-Hellman Group 2 uses a 1024bit group.
15 Click Advanced to configure advanced settings.
In this dialog box, you can configure the tunnel to use Any for the policy or for the address. Click OK when you are
done.
158
WatchGuard System Manager
Making a Manual Tunnel
16 Below Addresses, click Add to add a pair of addresses that use the tunnel.
The Local-Remote Pair Settings dialog box appears.
17 Select the local address from the Local drop-down list.
You can also click the button adjacent to the field to use an IP address, network address, or a range of IP addresses.
18 Add the remote network address. Click the button adjacent to the field to open the Add Address
dialog box.
19 Select the type of address from the Choose Type drop-down list.
Select Host IP (one IP address), Network IP (a network IP address with the mask in slash notation), or Host Range (a
range of IP addresses).
20 Type the values in the fields. Click OK.
21 Select the direction for tunnel.
22 You can enable NAT for the tunnel.
The options that you can select for NAT are different for different types of addresses and different tunnel
directions. For 1:1 NAT, type the address to change with NAT in the field.
Dynamic NAT is also available through the VPN. You must set a unidirectional tunnel from LAN1 to LAN2 where
you want all LAN1 to connect to LAN2 servers but only appear as one IP address on LAN2. You must then enable
Dynamic NAT in the phase 2 settings of the LAN2 Firebox.
23 Click OK after you configure the pair.
24 When you complete tunnel configuration, click OK.
Editing and deleting a tunnel
To change a tunnel, select VPN > Branch Office Tunnels. You can also right-click on a tunnel icon in the
BOVPN tab of Policy Manager, and select Tunnel Property.
1
Select the tunnel and click Edit.
The Edit Tunnel dialog box appears.
2 Make the changes and click OK.
To delete a tunnel from the Branch Office IPSec Tunnels dialog box, select the tunnel and click Remove.
Fireware Configuration Guide
159
Making a Tunnel Policy
Making a Tunnel Policy
Tunnel policies are sets of rules for tunnel connections.
The default configuration includes the “Any” policy. This allows all traffic to use the tunnel. You can
delete this policy. Then, create a custom VPN policy to select the ports you allow or to use a proxy for the
traffic.
1
2
3
From Policy Manager, click the Branch Office VPN tab.
Select the tunnel to which you want to add policies from the Show menu.
Right-click in Policy Manager and select New Policy.
If you have not selected a BOVPN tunnel from the Show menu, a dialog box appears with a prompt for you to
select a tunnel. Select the tunnel and click OK.
4
Configure policies. For more information, see “Creating Policies for your Network” on page 65.
Address information for BOVPN policies is different from standard Firebox policies. You configure the addresses
with the Local-Remote Pairs dialog box.
Allow VPN connections for specified policies
To let traffic through from VPN connections only for specified policies, add and configure each policy. It
can be necessary to delete the “Any” policy to create the necessary restrictions.
160
WatchGuard System Manager
CHAPTER 14
Configuring IPSec Tunnels
WatchGuard® System Manager supplies speed and reliability when you create IPSec VPN tunnels through
drag-and-drop tunnels, an automatic wizard, and the use of templates. You can make fully authenticated
and encrypted IPSec tunnels in minutes. You can be sure that they operate with other tunnels and security policies.
From the same interface, you can control and monitor the VPN tunnels. For more information on how to
monitor tunnels, see “Monitoring Your Network” in the WatchGuard System Manager User Guide.
System Manager also allows you to safely manage Firebox® X Edge devices from a distance. For more
information, see “Managing the Firebox X Edge and Firebox SOHO 6” in the WatchGuard System Manager User Guide.
Steps in making VPNs
•
•
•
•
•
•
Configure a WatchGuard Management Server and Certificate Authority (CA)
Add Fireboxes or Firebox X Edge or SOHO devices to the Management Server
(Dynamic devices only) Configure the Firebox as a Managed Client
Make policy templates to configure which networks can connect through VPN tunnels
Make security templates to set the encryption type and authentication type
Make tunnels between the devices
Management Server
The WatchGuard® Management Server software is installed on your management station or a different
computer. This server replaces the DVCP server that operated on the Firebox® X in other software versions.
Use the Management Server to:
• Start and stop the Management/CA server
• Set the Management/Certificate Authority (CA) Server passphrases
• Set the Management Server license key
• Configure the Management/CA Server to record diagnostic log messages
• Set the CA domain name
Fireware Configuration Guide
161
WatchGuard Management Server Passphrases
•
•
•
•
Set the CRL IP address for publication
Set the CRL publication period
Set the time the client certificate is good
Set the time the root certificate is good
WatchGuard Management Server Passphrases
The WatchGuard® Management Server uses a number of passwords to protect sensitive information on
the disk or to secure data with client systems. After you install the WatchGuard Management Server software, you must use the Configuration Wizard to configure the Management/CA server. This wizard
prompts for these passwords:
• Master encryption key
• Management Server passphrase
The Management Server passphrase and other automatically created passphrases are in a passphrase file.
Master encryption key
The first passphrase that the Configuration Wizard prompts for is the master encryption key. This password is used to protect all the passphrases in the passphrase file.
The master encryption key is used to encrypt all other passphrases that are on the disk. This prevents a
person with access to this disk (such as on a backup tape) from getting the passphrases. The passphrases
can be used to get access to other sensitive data on the disk.
Select and secure the master encryption key carefully. Use best practices when you select the passphrases.
In particular, do not use the same string for the master encryption key and the management server passphrase.
You use the master encryption key when you:
• Migrate the management server data to a new system
• Restore a lost or corrupt master key file
• Change the master encryption key
The master encryption key is not used frequently. We recommend that you write it down and lock it in a
secure location.
Management Server passphrase
The second password that the Configuration Wizard prompts for is the Management Server passphrase.
This passphrase is used frequently by the administrator, because it is the one needed to connect to the
Management Server using the WatchGuard System Manager application.
Password and key files
The Management Server passphrase and all the automatically created passphrases are in a passphrase file.
The passphrase data in this file is protected by the master encryption key. The master encryption key is
not on the disk. An encryption key is created from the master encryption key and the key data is on the
disk.
The default locations for the password file and encryption key are:
• C:\Documents and Settings\WatchGuard\wgauth\wgauth.ini
• C:\Documents and Settings\WatchGuard\wgauth\wgauth.key
162
WatchGuard System Manager
Setting Up the Management Server
Note that these files are used by the Management Server software and must not be modified directly by
an administrator.
Microsoft SysKey utility
The password file is protected by the master key. This key is protected by an encryption key, which is protected by the Windows system key.
Windows operating systems use a system key to protect the Security Accounts Management (SAM) database. This is a database of the Windows accounts and passwords on the computer. By default, the system
key data is hidden in the registry. The system is protected, and the system key is created from the registry
during the startup procedure. Although the system key data is on the disk, it is not easy to get.
If you want a more secure system, you can remove the system key data from the registry so that this sensitive data does not reside on the system at all.
You can use the SysKey utility to:
• Move the system key to a floppy disk
• Make the administrator type a password at start time
• Move the system key from the floppy disk to the system
If you move the startup key to a floppy disk, then that disk must be inserted in the drive for the system to
start. If you make the administrator type a startup password, the administrator must type in the password
each time the system starts.
To configure SysKey options, click Start > Run, type syskey, and click OK.
Setting Up the Management Server
The Management Server Setup Wizard creates a new Management Server on your workstation. It can
migrate a Management Server that is installed on a Firebox® to a new Management Server on a workstation. To move a Management Server off a Firebox, see the Migration Guide.
If you change the IP address of the Management Server computer, you must remove the Management
Server and install it again.
This procedure shows the steps you must follow to successfully set up a new Management Server. Follow
this procedure if you do not have a Management Server at this time.
1
Right-click the Management Server icon in the WatchGuard toolbar on the Windows taskbar.
2
3
4
Select Start Service.
The Management Server Setup Wizard starts. Click Next.
A master encryption key is necessary to control access to the WatchGuard management station. Type
a passphrase that has a minimum of eight characters and then type it again to confirm. Click Next.
Make sure you keep this passphrase.
5
Type the passphrase to manage the WatchGuard® Management Server. Click Next.
Type a passphrase that has a minimum of eight characters and then type it again to confirm.
6
Type the IP address and passphrases for your gateway Firebox. Click Next.
The gateway Firebox protects the management server from the Internet.
7
Type the license key for the Management Server. Click Next.
Fireware Configuration Guide
163
Adding Devices
8
Type the name of your organization. Click Next.
An information screen that lists the information for your server appears.
9
Click Next.
The wizard configures the server.
10 Click Finish.
Adding Devices
You must manually add devices to your Management Server configuration.
Note
You must use this procedure to add all devices. A device with a dynamic IP address must also be
configured as a Managed Client from Policy Manager for the device.
1
Open WatchGuard System Manager and select File > Connect to > Server.
Type the passphrase to connect to your Management Server.
2
3
4
From the VPN tab, select Server > Insert Device.
The WatchGuard® Device Wizard appears.
Click Next.
Type a display name for the device.
This is a name that you select. It is not the same as the DNS name of the device.
5
From the Device Type drop-down list, select the device type and address method.
A dynamic device must have a dynamic DNS client name.
6
For a static IP address, type the host name or IP address. For a dynamic IP address, type the client
name.
The host name is the DNS name, not the display name that you created in step 3.
7
8
9
Type the status and configuration passphrases.
If you use a device type with a dynamic IP address, type the shared secret. Click Next.
Type a WINS or DNS server IP address and the domain for your configuration. Click Next.
If you do not use DNS or WINS servers, ignore this page, and click Next.
The wizard shows the Contact Information page.
10 Select or add a contact record. This record gives the contact information for this Firebox. Click Next.
The information on this page is optional.
11 The wizard then shows a page that gives the subsequent steps. Click Next.
When completed, the wizard shows the message New Device Successfully Changed.
12 Click Close.
The wizard uploads the new configuration to the Management Server and exits.
Note
If traffic is heavy, the WatchGuard Device Wizard cannot connect because of SSL timeout. Try again
later when the system has less load.
164
WatchGuard System Manager
Configuring a Firebox as a Managed Firebox Client (Dynamic Devices only)
Updating a device’s settings
You can use the Device Properties dialog box to configure the adjustments of a selected device again.
1
From the VPN tab, right-click a device and select Properties.
The Device Properties dialog box appears.
2
3
Change the properties as necessary.
Click OK.
Configuring a Firebox as a Managed Firebox Client (Dynamic Devices
only)
To allow WatchGuard System Manager to manage a Firebox, Edge, or SOHO with a dynamic IP address,
you must enable it as a managed Firebox client. The instructions here give you the steps to configure a
Firebox III or Firebox X as a managed Firebox client. To configure a Firebox X Edge or Firebox SOHO as a
managed Firebox client, refer to your Edge or SOHO User Guide for information about using the device
with managed VPN.
From the Policy Manager for a Firebox III or Firebox X device:
1
2
3
4
Select VPN > Managed Client.
5
6
To add management servers that the client can connect to, click Add.
Select the check box Enable this Firebox as a Managed Client.
In the Firebox Name field, give the name of the Firebox.
To log messages for the Managed Client, select the check box Enable diagnostic log messages for
the Managed Client. (WatchGuard recommends this option only to do troubleshooting).
Type the IP address. Type the shared secret. Click OK.
Fireware Configuration Guide
165
Adding Policy Templates
7
Start the Firebox again.
The Firebox connects to the Management Server.
Adding Policy Templates
For a VPN, you can configure (and put a limit to) the networks that have access through the tunnel. You
can make a VPN between two hosts or between more networks. To configure the networks available
through a given VPN device, you make policy templates. By default, WSM adds and applies a network
policy template that gives access to the network behind the VPN device, if the device has a static IP
address.
Get the current templates from a device
Before you add more policy templates, get the current templates from the device. This is most important
for dynamic devices because the Firebox automatically adds a network policy template for static devices
Before you update a device, make sure that it is configured as a managed Firebox client.
1
2
3
In WatchGuard System Manager, select a managed client and click Server > Update Device.
Select Download Trusted and Optional Network Policies.
Click OK.
Make a new policy template
To make a policy template, on the VPN tab:
1
Select the device for which to configure a policy template.
2 Right-click and select Insert Policy or click the Insert Policy Template icon.
The Device Policy dialog box for that device appears.
3
4
Type a policy name.
5
Add, edit, or delete resources from the tunnel policy. Click Add to add an IP address or a network
address to the tunnel policy. Click Edit to edit a resource that you have selected in the list. Click
Remove to delete a resource you have selected in the list.
6
Click OK.
Select the actions for this policy. A policy can secure, block, or bypass resources. Use secure if the
tunnel resource is encrypted and shared with tunnel clients. Use bypass if the resource is shared with
tunnel users, but it is not encrypted. This traffic "bypasses" the IPSec routing policy. Use block if the
tunnel clients cannot have access to the resource.
The policy template is configured and is available in the VPN configuration area.
166
WatchGuard System Manager
Adding Security Templates
Adding resources to a policy template
1
From the Device Policy dialog box, click Add.
The Resource dialog box appears, see the figure that follows.
2
Select the type of resource and give its IP or network address. Click OK.
Adding Security Templates
A security template gives the encryption type and authentication type for a tunnel.
Default security templates are supplied for the available encryption types. You can also make new templates. Security templates make it easy to set the encryption type and authentication type with the tunnel
from the Configuration Wizard.
To make a policy template, on the VPN tab:
1 Right-click in the window, and select Insert Security Template or click the Insert
Security Template icon (shown at the right side).
The Security Template dialog box appears.
2
3
Type the template name. Select the authentication and encryption method.
To get end dates for a key, select the related check box, and then give kilobytes, hours, or the two.
If you give two values, the key stops at the event that comes first.
The security template is configured. You can select it in the VPN Wizard when you make a VPN tunnel with that
device.
4
Click OK.
Making Tunnels Between Devices
You can configure a tunnel with the drag-and-drop procedure or the Add VPN Wizard.
Fireware Configuration Guide
167
Editing a Tunnel
Drag-and-drop tunnel procedure
To use the drag-and-drop tunnel procedure, dynamic Fireboxes and Firebox X Edge or SOHO devices must
have networks that are configured before you can use this procedure. You must also get the policies from
any new dynamic devices before you configure drag-and-drop tunnels (use the procedure “Get the current templates from a device” on page 166 to do this).
On the VPN tab:
1
Click the device name of one of the tunnel endpoints. Drag-and-drop it to the device name of the
other tunnel endpoint.
This starts the Add VPN Wizard.
2
3
Click Next to show the next screen.
4
For each device, select a policy template from the drop-down list.
The gateway devices screen shows the two endpoint devices you selected with drag-and-drop, and
the policy templates that the tunnel uses. If necessary, select the devices for the endpoints of the
tunnel.
The policy template configures the resources available through the tunnel. Resources can be a network or a host.
The drop-down list shows the policy templates that you added to WatchGuard System Manager.
5
Click Next.
The wizard shows the Security Policy dialog box.
6
Select the security template applicable for the type of security and type of authentication to use for
this tunnel.
The list shows the templates you added to the Management server.
7
Click Next.
The wizard shows the configuration.
8
Select the check box Restart devices now to download VPN configuration. Click Finish to start the
devices again and deploy the VPN tunnel.
Using the Add VPN Wizard without drag-and-drop
To create tunnels using the Add VPN Wizard without drag-and-drop:
1
From the VPN tab, select Server > Create a new VPN or click the Create New VPN icon.
This starts the Add VPN Wizard.
2
Click Next.
The wizard shows two lists that each show all the devices registered in the Management Server.
3
4
Select a device from each list box to be the endpoints of the tunnel you make.
Select the policy templates for the end of the tunnel of each device.
The list shows the templates added to the Management Server.
5
Click Next.
The wizard shows the Security Template dialog box.
6
Select the applicable security template for this VPN. Click Next.
The wizard shows the configuration.
7
Select the check box Restart devices now to download VPN configuration. Click Finish to start the
devices again and deploy the VPN tunnel.
Editing a Tunnel
You can see all your tunnels on the VPN tab of WatchGuard® System Manager. System Manager lets you
change the tunnel name, security template, endpoints, and the policy used.
168
WatchGuard System Manager
Removing Tunnels and Devices
On the VPN tab:
1
2
3
Expand the tree to show the device and its policy to change.
Select the tunnel to change.
Right-click and select Properties.
The Tunnel Properties dialog box appears.
4
Click OK to save the change.
When the tunnel is renegotiated, the changes are applied.
Removing Tunnels and Devices
To remove a device from WatchGuard® System Manager, you must first remove the tunnels for which that
device is an endpoint.
Removing a tunnel
1
2
3
4
5
From System Manager, click the VPN tab.
Expand the Managed VPNs folder to show the tunnel to remove.
Right-click the tunnel.
Select Remove. Click Yes to confirm
If necessary, give a start again command to the devices from this removal. Click Yes.
Removing a device
1
From System Manager, click the Device or VPN tab.
The Device tab (left side figure below) or the VPN tab (right side figure below) appears.
2
3
4
Device tab (left side) and VPN tab (right side)
If you use the VPN tab, expand the Devices folder to show the device to remove.
Right-click the device.
Select Remove. Click Yes to confirm.
Fireware Configuration Guide
169
Removing Tunnels and Devices
170
WatchGuard System Manager
CHAPTER 15
Configuring RUVPN with PPTP
Remote User Virtual Private Networking (RUVPN) uses Point-to-Point Tunneling Protocol (PPTP) to make
a secure connection. It supports as many as 50 users at the same time for each Firebox and operates with
each type of Firebox® encryption. RUVPN users can authenticate to the Firebox or to a RADIUS authentication server. You must configure the Firebox and the remote host computers of the remote user.
Configuration Checklist
Before you configure a Firebox® to use RUVPN, record this information:
• The IP addresses for the remote client during RUVPN sessions. These IP addresses cannot be
addresses that the network behind the Firebox uses. The safest procedure to give addresses for
RUVPN users is to install a “placeholder” secondary network with a range of IP addresses. Then,
select an IP address from that network range. For example, create a new subnet as a secondary
network on your trusted network 10.10.0.0/24. Select 10.10.0.0/27 for your range of PPTP
addresses. For more information, see “IP Addressing” on page 143.
• The IP addresses of the DNS and WINS servers that resolve IP addresses to host alias names.
• The user names and passwords of users that are approved to connect to the Firebox with RUVPN.
Encryption levels
Because of export limits on high encryption software, WatchGuard Firebox products are put on the installation CD-ROM with only base encryption.
For RUVPN with PPTP, you can select to use 128-bit encryption or 40-bit encryption. U.S. domestic versions of Windows XP have 128-bit encryption enabled. You can get a strong encryption patch from
Microsoft for other versions of Windows. The Firebox always tries to use 128-bit encryption first. It uses
(if enabled) 40-bit encryption if the client cannot use the 128-bit encrypted connection.
For information on how to enable the drop to 40-bit, see “Enabling RUVPN with PPTP” on page 175.
If you do not live in the U.S. and you must have strong encryption on your LiveSecurity Service account,
send an e-mail to [email protected] and include in it:
• Your LiveSecurity Service key number
• Date of purchase
• Name of your company
Fireware Configuration Guide
171
Configuring WINS and DNS Servers
• Company mailing address
• Telephone number and name
• E-mail address to reply to
If you live in the U.S., you must download the strong encryption software from your archive page in the
LiveSecurity Service Web site. Go to www.watchguard.com, click Support, log into your LiveSecurity Service account, and then click Latest Software.
Then, uninstall the initial encryption software, and install the strong encryption software from the downloaded file.
Note
To keep your current Firebox configuration, do not use the Quick Setup Wizard when you install the
new software. Open System Manager, connect to the Firebox, and save your configuration file.
Configurations with a different encryption version are compatible.
Configuring WINS and DNS Servers
RUVPN clients use shared Windows Internet Name Server (WINS) and Domain Name System (DNS) server
addresses. DNS changes host names into IP addresses, while WINS changes NetBIOS names to IP
addresses. The trusted interface of the Firebox® must have access to these servers.
Make sure that you use an internal DNS server. Do not use external DNS servers.
1
From Policy Manager, click Network > Configuration. Click the WINS/DNS tab.
2
In the IP address boxes, type the addresses for the WINS and DNS servers. You can type three
addresses for DNS servers, and two addresses for WINS servers. Type a domain name for the DNS
server.
The information for the WINS and DNS servers appears.
172
WatchGuard System Manager
Adding New Users to Authentication Groups
Adding New Users to Authentication Groups
To get access to Internet services (such as outgoing HTTP or outgoing FTP), the remote user gives a user
name and password as authenticating data. WatchGuard® System Manager software uses this information
to authenticate the user to the Firebox®.
For more information on Firebox groups, see “Implementing Authentication,” on page 107.
1
From Policy Manager, click Setup > Authentication Servers.
The Authentication Servers dialog box appears.
2
Click the Firebox tab.
3
To add a new user, click the Add button below the Users list.
The Setup Firebox User dialog box appears.
4
Type a user name and passphrase for the new user. Type the passphrase again to confirm it.
5
To close the Authentication Servers dialog box, click OK.
The new user is put on the Users list. The Authentication Servers dialog box stays open and you can add more users.
You can use the users and groups to configure the services. Refer to the next section.
Fireware Configuration Guide
173
Configuring Services to Allow Incoming RUVPN Traffic
Configuring Services to Allow Incoming RUVPN Traffic
RUVPN users have no access privileges through a Firebox®. You must add user names or the full PPTPUsers group to policies. This gives remote users access to machines behind the Firebox.
WatchGuard® recommends two procedures to configure the policies for RUVPN traffic: individual policies,
or the Any policy. It is best to configure individual policies to control RUVPN traffic. The Any policy opens
a hole through the Firebox. This lets all the traffic flow between hosts without applying firewall rules and
is a security risk.
By individual policy
In Policy Manager, double-click a policy to enable for your VPN users. It is a good idea to create a new
policy specially for PPTP traffic and keep it separate from your other firewall policies. To set the properties:
For an incoming policy:
- Allowed
- From: PPTP users or groups
- To: trusted, optional, network or host IP address, or alias
For an outgoing policy:
- Allowed
- From: trusted, optional, network or host IP address, or alias
- To: PPTP users or groups
Using the Any policies
Add Any policies with these properties:
Incoming policy:
- Allowed
- From: PPTP users or groups
- To: trusted, optional, network or host IP address, or alias
174
WatchGuard System Manager
Enabling RUVPN with PPTP
Outgoing policy:
- Allowed
- From: trusted, optional, network or host IP address, or alias
- To: PPTP users or groups
Make sure that you save your configuration file to the Firebox after you make these changes.
Note
To use WebBlocker to control the access of remote users, add PPTP users or groups to a proxy
policy that controls WebBlocker, such as HTTP-Proxy. Use this type of policy with any packet filter
or proxy policy as an alternative to the Any policy.
Enabling RUVPN with PPTP
To configure RUVPN with PPTP you must enable the feature. RUVPN with PPTP adds the WatchGuard®
PPTP policy icon to Policy Manager. This sets default properties for PPTP connections and for the traffic
that flows to and from them. WatchGuard recommends you do not change the default properties of the
WatchGuard PPTP service.
1
From Policy Manager, click VPN > Remote Users. Click the PPTP tab.
2
Select the Activate Remote User check box.
3
If necessary, select the Enable Drop from 128-bit to 40-bit check box.
Usually, only customers outside the United States use this check box.
Enabling extended authentication
RUVPN with extended authentication lets users authenticate to a RADIUS authentication server as an
alternative to the Firebox®. For more information on extended authentication, see “Extended authentication” on page 143.
1
Select the Use RADIUS Authentication to authenticate remote users check box. Refer to the figure
in the previous section.
2
Configure the RADIUS server in the Authentication Servers dialog box. Refer to “Implementing
Authentication,” on page 107.
3
On the RADIUS server, create a PPTP-Users group and add names or groups of PPTP users.
Adding IP Addresses for RUVPN Sessions
RUVPN with PPTP gives support to 50 users at the same time, although you can configure a much larger
number of client computers. The Firebox® gives an open IP address to each incoming RUVPN user from a
group of available addresses. This goes on until all the addresses are in use. After a user closes a session,
the address is put back in the available group. The subsequent user who logs in gets this address.
Fireware Configuration Guide
175
Preparing the Client Computers
For more information about how to get IP addresses for RUVPN clients, see “IP Addressing” on page 143.
You must configure a minimum of two IP addresses.
From the PPTP tab on the Remote Users Configuration dialog box:
1
Click Add.
The Add Address dialog box appears.
2
From the Choose Type drop-down list, select Host IP (for a single IP address) or Host Range (for
a range of IP addresses.
You can configure 50 addresses. If you select a range of IP addresses that is larger than 50 addresses, RUVPN with
PPTP uses the first 50 addresses in the range.
3
In the Value text box, type the host IP address. If you chose Host Range, type the first and last
IP address in the range. Click OK.
Type IP addresses that are not in use which the Firebox can give to clients during RUVPN with PPTP sessions. The IP
address appears in the list of addresses available to remote clients.
4
Do the procedure again to configure all the addresses for use with RUVPN with PPTP.
Preparing the Client Computers
You must first prepare each computer that you use as an RUVPN with PPTP remote host, with:
• Internet service provider (ISP) account
• Public IP address.
Then, do these procedures using the instructions in the next sections:
• Install the necessary version of Microsoft Dial-Up Networking and the necessary service packs
• Prepare the operating system for VPN connections
• Install a VPN adapter (not necessary for all operating systems).
Installing MSDUN and Service Packs
It can be necessary to install these options for correct configuration of RUVPN:
• MSDUN (Microsoft Dial-Up Networking) upgrades
• other extensions
• service packs.
For RUVPN with PPTP, it is necessary to install these upgrades::
176
Encryption
Platform
Application
Base
Windows NT
40-bit SP4
WatchGuard System Manager
Creating and Connecting a PPTP RUVPN on Windows XP
Encryption
Platform
Application
Strong
Windows NT
128-bit SP4
Base
Windows 2000
40-bit SP2*
Strong
Windows 2000
128-bit SP2
*40-bit encryption is the default for Windows 2000. If you
upgrade from Windows 98, with strong encryption, Windows
2000 will automatically set strong encryption for the new
installation.
To install these upgrades or service packs, go to the Microsoft Download Center Web site at:
http://www.microsoft.com/downloads/search.asp
Creating and Connecting a PPTP RUVPN on Windows XP
To prepare a Windows XP remote host, you must configure the network connection.
From the Windows Desktop of the client computer:
1
Click Start > Control Panel > Network Connections.
2
Click Create a new connection from the menu on the left. The New Connection Wizard starts.
Click Next.
3
Click Connect to the network at my workplace. Click Next.
4
Click Virtual Private Network Connection. Click Next.
5
Give the new connection a name, such as “Connect with RUVPN.” Click Next.
6
Select to not dial (for a broadband connection), or to automatically dial (for a modem
connection) this connection. Click Next.
The Network Connection wizard appears.
The wizard includes this screen if you are using Windows XP SP2. Not all Windows XP users see this screen.
7
Type the host name or IP address of the Firebox® external interface. Click Next.
8
Select who can use this connection profile. Click Next.
9
Select Add a shortcut to this connection to my desktop. Click Finish.
10 To connect using your new VPN connection, first make an Internet connection through a dial-up
network, or directly through a LAN or WAN.
11 Double-click the shortcut to the new connection on your desktop.
Or, select Control Panel > Network Connections and look under the Virtual Private Network list for the connection
you created.
12 Type the user name and password for the connection.
This information was given when you added the user to the pptp_users group. See “Adding New Users to
Authentication Groups” on page 173.
13 Click Connect.
Creating and Connecting a PPTP RUVPN on Windows 2000
To prepare a Windows 2000 remote host, you must configure the network connection.
Fireware Configuration Guide
177
Creating and Connecting a PPTP RUVPN on Windows 2000
From the Windows Desktop of the client computer:
1
Click Start > Settings > Network Connections > Create a New Connection.
2
Click Next.
3
Select Connect to the network at my workplace. Click Next.
4
Click Virtual Private Network connection.
5
Give the new connection a name, such as “Connect with RUVPN.” Click Next.
6
Select to not dial (for a broadband connection), or to automatically dial (for a modem
connection) this connection. Click Next.
7
Type the host name or IP address of the Firebox® external interface. Click Next.
8
Select Add a shortcut to this connection to my desktop. Click Finish.
9
To connect using your new VPN connection, first make an Internet connection through a dial-up
network, or directly through a LAN or WAN.
The New Connection wizard appears.
10 Double-click the shortcut to the new connection on your desktop.
Or, select Control Panel > Network Connections and look under the Virtual Private Network list for the connection
you created.
11 Type the user name and password for the connection.
This information was given when you added the user to the pptp_users group. See “Adding New Users to
Authentication Groups” on page 173.
12 Click Connect.
Running RUVPN and accessing the Internet
You can enable remote users to get access to the Internet through a RUVPN tunnel. But this option has
an effect on security. See “Tunneling Methods” on page 147.
1
When you set up your connection on the client computer, use the Advanced TCP/IP Settings dialog
box to select the Use default gateway on remote network check box.
To open the Advanced TCP/IP Settings dialog box on Windows XP or Windows 2000, right-click the VPN
connection in Control Panel > Network Connections. Select Properties and click on the Network tab. Find Internet
Protocol in the list box and click Properties. On the General tab, click Advanced.
2
Make sure that the IP addresses you have added to the PPTP address pool are included in your
dynamic NAT configuration. To make sure, from Policy Manager select Network > NAT.
3
Edit your policy configuration to allow connections from PPTP-Users through the external
interface. If you use WebBlocker to control remote user Web access, add PPTP-Users to the
policy that controls WebBlocker (like HTTP-Proxy).
Making outbound PPTP connections from behind a Firebox
If necessary, you can make a PPTP connection to a Firebox from behind a different Firebox. For example,
a remote user goes to a customer office that has a Firebox. The user can make PPTP connections to their
network with PPTP. For the local Firebox to correctly use the outgoing PPTP connection, add the PPTP
policy and allow PPTP to Any-External. (For information on enabling policies, see the “Configuring Policies” chapter of this guide.)
178
WatchGuard System Manager
Increasing the Protection
PART Setup
Fireware Configuration Guide
179
180
WatchGuard System Manager
CHAPTER 16
Advanced Networking
With Fireware appliance software, you get access to an advanced set of networking features. These features are designed to give the Firebox® administrator more control and greater efficiency with a very large
or high-traffic network. Advanced networking features include:
Multiple WAN Support
Fireware enables you to configure up to four Firebox interfaces as external, or WAN, interfaces.
You can control the flow of traffic through multiple WAN interfaces to share the load of
outgoing traffic.
Quality of Service (QoS)
Fireware’s QoS feature lets you set priority queues, bandwidth restrictions, and connection rate
limits on individual policies.
Dynamic routing
In addition to static routing, the Firebox can use the dynamic routing protocols RIP versions 1
and 2, OSPF version 2, and BGP version 4. These routing protocols allow for the dynamic
modifying of routing tables.
About Multiple WAN Support
Fireware™ appliance software gives you the option to configure multiple external interfaces (up to four),
each on a different subnet. This allows you to connect the Firebox® to more than one Internet Service
Provider (ISP). When you configure multiple external interfaces, you have two options to control which
interface outgoing packets use. The options are:
Multi-WAN in round robin order
If you select “round robin” order, you can share the load of outgoing traffic among external
interfaces like this:
- The first host, with IP address x.x.x.x, sends an HTTP request to the Internet. The packets in
this session are sent through the lowest number external interface.
- The second host, with IP address y.y.y.y, sends an HTTP request to the Internet. The packets in
this session are sent through the external interface with the second higher number.
Fireware Configuration Guide
181
About Multiple WAN Support
- The third host, with IP address z.z.z.z, sends an HTTP request to the Internet. The packets in
this session are sent through the lowest number external interface (if there are only two
external interfaces configured) or the third higher number external interface.
- As each IP address initiates a session, the Firebox cycles through external interfaces using the
pattern shown above.
Multi-WAN in backup order
If you select this option, the lowest number external interface configured in your list becomes the
primary external interface. All other external interfaces are backup external interfaces. The
Firebox sends all outgoing traffic to the primary external interface. If the primary external
interface is not active, the Firebox sends traffic to the first backup interface. This interface then
becomes the primary external interface. The Firebox sends new outgoing connections to the new
primary interface. Existing connections continue to use the interface they used before.
As soon as you configure a second external interface, multiple WAN support is automatically enabled
with Multi-WAN in round robin order set as the default. After multiple WAN support is enabled, the
Firebox automatically uses “Any-External” in place of the “External” alias each time it is used in Policy
Manager.
Note that:
• You cannot use 1-to-1 NAT in a multiple WAN configuration.
• Multiple WAN support does not apply to branch office or Mobile User VPN traffic. Branch office
and Mobile User VPN traffic always uses the first external interface configured for the Firebox.
PPTP user VPN operates correctly in a multiple WAN configuration.
• The Multiple WAN feature does not operate correctly if the Firebox with Multiple WAN enabled is a
VPN endpoint in a VPN tunnel created and managed by the Management Server.
Configuring multiple WAN support
1
From Policy Manager, select Network > Configuration.
The Network Configuration dialog box appears.
2
182
Select the interface to configure as external and click Configure. Add an interface description and
select External from the Interface Type drop-down list
WatchGuard System Manager
Creating QoS Actions
3
Type the IP address and default gateway for the interface. Click OK.
When you type an IP address, type all the numbers and the periods. Do not use the TAB or arrow key.
After you configure a second external interface, multiple WAN configuration options appear in the Network
Configuration dialog box.
4
Select the method to use to control the flow of outgoing traffic through your multiple external
interfaces. Use Multi-WAN in round robin order to send traffic sessions through the external
interfaces in sequence. Use Multi-WAN in backup order to set your first external interface as primary
and subsequent external interfaces as backup interfaces.
5
Click OK. Save your changes to the Firebox.
Creating QoS Actions
In a large network with many host computers, the volume of data that moves through the firewall can be
very large. When the traffic is too much for the network, data packets are dropped. It can be necessary for
a business to make traffic such as data exchanges between corporate and branch offices a higher priority
than low-priority such as Web surfing/browsing.
With Fireware Pro, you can set Quality of Service (QoS) actions and apply them to policies to make sure
that bandwidth for important traffic is always available.
You can also define an alarm to occur when network capacity is exceeded according to the QoS action’s
parameters. You can configure the alarm to make the Firebox® send an event notification to the SNMP
Fireware Configuration Guide
183
Creating QoS Actions
management system, or to send a notification in the form of e-mail or a pop-up window on the management station.
1
From Policy Manager, select Setup > Actions > QoS.
The QoS Actions dialog box appears.
2
Click Add.
The New QoS dialog box appears.
3
4
Type the name and description of the QoS action.
Select the Priority to normal or high to give traffic priority treatment.
These categories are often known as queues.
5
Use the Maximum Bandwidth drop-down list to change or remove the bandwidth limits for this
action.
Use No Limits to remove bandwidth restrictions for important traffic, or select a maximum kilobytes per second
bandwidth to allocate a part of the total available bandwidth for less important traffic.
6
Use the Connection Rate drop-down list to control the number of connections per second for this
QoS action.
The default configuration puts no limits on the connection rate. If you select Custom, you can type the maximum
connection rate for this QoS action to control the rate of bandwidth use for any traffic.
7
184
If you want to set an alarm when the bandwidth or connection rate is exceeded, select the Alarm
when capacity exceeded check box. Use this alarm to determine whether a policy has a need for
more bandwidth. Click Notification and set the notification parameters, as described in “Setting
logging and notification parameters” on page 123.
WatchGuard System Manager
Dynamic Routing
8
Click OK.
The new action appears in the QoS Actions dialog box.
Using QoS in a multiple WAN environment
When a QoS action is applied on a multiple WAN policy with multiple WAN set up in round robin mode,
the maximum bandwidth and connection rate settings in the QoS action control the total throughput and
connection rate across all interfaces. This includes all external interfaces that are configured to route traffic, including external interfaces that are down.
When a QoS action is applied on a multiple WAN policy with multiple WAN set up in backup mode, the
maximum bandwidth and connection rate settings in the QoS action control the throughput and connection rate across the one external interface that is currently sending packets.
Dynamic Routing
A routing protocol is the language a router speaks with other routers to share information about the status of network routing tables. With static routing, routing tables are set and do not change. If a router on
the remote-path fails, a packet cannot get to its destination.
Dynamic routing lets routing tables in routers change as the routes change. If the best path to a destination cannot be used, dynamic routing protocols change routing tables when necessary to keep your network traffic moving. Fireware gives support to RIP v1 and v2, OSPF, and BGP v4 dynamic routing
protocols.
Routing daemon configuration files
To use any of the dynamic routing protocols with Fireware, you must import or type a dynamic routing
configuration file for the routing daemon you choose. This configuration file includes information such
as a password and log file name. You can find configuration templates for each of the routing protocols
in the FAQ:
https://www.watchguard.com/support/advancedfaqs/fw_dynroute-ex.asp
You can find a list of supported configuration commands for each routing protocol in the sections below.
The command sections below appear in the order they must go in an operating configuration file.
Notes about configuration files:
• The “!” and the “#” characters are comment characters. If the first character of the word is one of
the comment characters, then the rest of the line is ignored as a comment. If the comment
character is not the first character of the word, it is interpreted as a command.
• Usually, a command can be negated by placing the word “no” at the beginning of the line. For
example: “no network 10.0.0.0/24 area 0.0.0.0”, disables the backbone area on the specified
network.
Using RIP
RIP (Routing Information Protocol) is used to manage router information in a self-contained network,
such as a corporate LAN or a private wide area network. With RIP, a gateway host sends its routing table
to the closest router each 30 seconds. This router, in turn, sends its routing table to the next closest
router. This goes on until all hosts in the network have the same routing tables.
Fireware Configuration Guide
185
Using RIP
RIP is best for small networks. This is because the transmission of the full routing table each 30 seconds
can put a large traffic load on the network, and because RIP tables are limited to 16 hops. OSPF is a better alternative for larger networks.
RIP Version 1
RIP V1 uses a UDP broadcast over port 520 to send updates to routing tables. To create or modify a routing configuration file, here is a table of supported routing commands. The sections must appear in the
configuration file in the same order they appear in this table. You can also use the sample RIP configuration file found in the FAQ:
https://www.watchguard.com/support/advancedfaqs/fw_dynroute-ex.asp
Section
Command
Description
Set simple password or MD5 authentication on an interface
interface eth[N]
Begin section to set
authentication type for interface
ip rip authentication string [PASSWORD]
Set RIP authentication password
key chain [KEY-CHAIN]
Set MD5 key chain name
key [INTEGER]
Set MD5 key number
key-string [AUTH-KEY]
Set MD5 authentication key
interface eth[N]
Begin section to set
authentication type for interface
ip rip authentication mode md5
Use MD5 authentication
ip rip authentication mode key-chain [KEY-CHAIN]
Set MD5 authentication keychain
Configure RIP routing daemon
router rip
Enable RIP daemon
version [1|2]
Set RIP version to 1 or 2 (default
version 2)
ip rip send version [1|2]
Set RIP to send version 1 or 2
ip rip receive version [1|2]
Set RIP to receive version 1 or 2
no ip split-horizon
Disable split-horizon; enabled by
default
Configure interfaces and networks
no network eth[N]
passive-interface eth[N]
passive-interface default
network [A.B.C.D/M]
neighbor [A.B.C.D/M]
Distribute routes to RIP peers and inject OSPF or BGP routes to RIP routing table
186
default-information originate
Share route of last resort (default
route) with RIP peers
redistribute kernel
Redistribute firewall static routes
to RIP peers
redistribute connected
Redistribute routes from all
interfaces to RIP peers
WatchGuard System Manager
Using RIP
redistribute connected routemap [MAPNAME]
Redistribute routes from all
interfaces to RIP peers, with a
route map filter (mapname)
redistribute ospf
Redistribute routes from OSPF to
RIP
redistribute ospf route-map
[MAPNAME]
Redistribute routes from OSPF to
RIP, with a route map filter
(mapname)
redistribute bgp
Redistribute routes from BGP to
RIP
redistribute bgp route-map [MAPNAME]
Redistribute routes from BGP to
RIP, with a route map filter
(mapname)
Configure route redistribution filters with route maps and access lists
access-list [PERMIT | DENY] [LISTNAME] [A.B.C.D/M | ANY]
Create an access list to only
allow or deny redistribution of
an IP address or of any
route-map [MAPNAME] permit [N]
Create a route map with a name
and allow with a priority of N
match ip address [LISTNAME]
Configuring Fireware to use RIP v1
1
From Policy Manager, select Network > Dynamic Routing.
The Dynamic Routing Setup dialog box appears.
2
3
Click Enable Dynamic Routing and Enable RIP.
Click Import to import a routing daemon configuration file, or type your configuration file in the text
box.
If you click Import, you can browse to the location of the RIP daemon configuration template. It is located in
C:\Documents and Settings\My Documents\My WatchGuard.
4
Click OK.
Fireware Configuration Guide
187
Using RIP
Allowing RIP v1 traffic through the Firebox
You must add and configure a policy to allow RIP broadcasts from the router to the network broadcast IP
address. You must also add the IP address of the Firebox interface to the To field.
1
From Policy Manager, select Edit > Add Policies. From the list of packet filters, select RIP. Click Add.
The New Policy Properties window appears for RIP.
2
In the New Policy Properties dialog box, configure the policy to allow traffic from the IP or network
address of the router using RIP to the Firebox® interface it connects to. You must also add the
network broadcast IP address.
3
Click OK.
RIP Version 2
RIP v2 uses multicast to send routing table updates. To create or modify a routing configuration file, refer
to the table of supported RIP routing commands in the section RIP Version 1. Any command that uses a
network IP address must include the subnet mask or RIP v2 will not operate. The sections must appear in
the configuration file in the same order they appear in this table.
188
WatchGuard System Manager
Using RIP
Configuring Fireware to use RIP v2
1
In Policy Manager, select Network > Dynamic Routing.
The Dynamic Routing Setup dialog box appears.
2
3
Click Enable Dynamic Routing and Enable RIP.
Click Import to import a routing daemon configuration file, or type your configuration parameters in
the text box.
If you click Import, you can browse to the location of the RIP daemon configuration file. It is located in
C:\Documents and Settings\My Documents\My WatchGuard.
4
Click OK.
Allowing RIP v2 traffic through the Firebox
You must add and configure a policy to allow RIP v2 multicasts from the routers that have RIP v2 enabled
to the reserved multicast IP address for RIP v2.
1
From Policy Manager, select Edit > Add Policies. From the list of packet filters, select RIP. Click Add.
The New Policy Properties window appears for RIP.
Fireware Configuration Guide
189
Using OSPF
2
In the New Policy Properties window, configure the policy to allow traffic from the IP or network
address of the router using RIP to the multicast address 224.0.0.9.
3
Click OK.
Using OSPF
OSPF (Open Shortest Path First) is a router protocol used in larger networks. With OSPF, a host that sees a
change to its routing table or that detects a change in the network immediately sends a multicast update
to all other hosts in the network. OSPF is different than RIP because:
• OSPF sends only the part of the routing table that has changed out in its transmission. RIP sends
the full routing table each time.
• OSPF sends a multicast only when its information has changed. RIP sends the routing table each
30 seconds.
OSPF Daemon Configuration
To create or modify a routing configuration file, here is a catalog of supported routing commands. The
sections must appear in the configuration file in the same order they appear in this table. You can also
use the sample OSPF configuration file found in the FAQ:
https://www.watchguard.com/support/advancedfaqs/fw_dynroute-ex.asp
Section
Command
Description
Configure Interface
190
ip ospf authentication-key [PASSWORD]
Set OSPF authentication
password
interface eth[N]
Begin section to set properties
for interface
WatchGuard System Manager
Using OSPF
ip ospf message-digest-key [KEY-ID] md5 [KEY]
Set MD5 authentication key ID
and key
ip ospf cost [1-65535]
Set link cost for the interface
(see OSP Interface Cost table
below)
ip ospf hello-interval [1-65535]
Set interval to send hello
packets; default is 10 seconds
ip ospf dead-interval [1-65535]
Set interval after last hello from
a neighbor before declaring it
down; default is 40 seconds
ip ospf retransmit-interval [1-65535]
Set interval between link-state
advertisements (LSA)
retransmissions; default is 5
seconds
ip ospf transmit-delay [1-3600]
Set time required to send LSA
update; default is 1 second
ip ospf priority [0-255]
Set router priority; high value
increases eligibility to become
the designated router (DR)
Configure OSPF Routing Daemon
router ospf
Enable OSPF daemon
ospf router-id [A.B.C.D]
Set router ID for OSPF manually;
router will determine its own ID
if not set
ospf rfc 1583compatibility
Enable RFC 1583 compatibility
(can lead to routing loops)
ospf abr-type [cisco|ibm|shortcut|standard]
More information about this
command can be found in draftietf-abr-alt-o5.txt
passive interface eth[N]
Disable OSPF announcement on
interface eth[N]
auto-cost reference bandwidth [0-429495]
Set global cost (see OSPF cost
table below); do not use with “ip
ospf [COST]” command
timers spf [0-4294967295][0-4294967295]
Set SPF schedule delay and hold
time
Enable OSPF on a Network
*The “Area” variable can be typed in two formats: [W.X.Y.Z]; or as an integer [Z].
network [A.B.C.D/M] area [Z]
Announce OSPF on network
A.B.C.D/M for area 0.0.0.Z
Configure Properties for Backbone Area or Other Areas
*The “Area” variable can be typed in two formats: [W.X.Y.Z]; or as an integer [Z].
area [Z] range [A.B.C.D/M]
Create area 0.0.0.Z and set a
classful network for the area
(range and interface network
and mask settings should match)
area [Z] virtual-link [W.X.Y.Z]
Set virtual link neighbor for area
0.0.0.Z
area [Z] stub
Set area 0.0.0.Z as a stub
area [Z] stub no-summary
Fireware Configuration Guide
191
Using OSPF
area [Z] authentication
Enable simple password
authentication for area 0.0.0.Z
area [Z] authentication message-digest
Enable MD5 authentication for
area 0.0.0.Z
Redistribute OSPF Routes
default-information originate
Share route of last resort (default
route) with OSPF
default-information originate metrics [0-16777214]
Share route of last resort (default
route) with OSPF
default-information originate always
Share route of last resort (default
route) with OSPF
default-information originate always metrics [0-16777214]
Share route of last resort (default
route) with OSPF
redistribute connected
Redistribute routes from all
interfaces to OSPF
redistribute connected metrics
Redistribute routes from all
interfaces to OSPF
Configure Route Redistribution with Access Lists and Route Maps
access-list [LISTNAME] permit [A.B.C.D/M]
Create an access list to allow
distribution of A.B.C.D/M
access-list [LISTNAME] deny any
Restrict distribution of any route
map not specified above
route-map [MAPNAME] permit [N]
Create a route map with name
[MAPNAME] and allow with a
priority of [N]
match ip address [LISTNAME]
OSPF Interface Cost Table
The OSPF protocol finds the most efficient route between two points. To do this, it looks at factors such
as interface link speed, the number of hops between points, and other metrics. By default, OSPF uses the
actual link speed of a device to calculate the total cost of a route. You can set the interface cost manually
to help maximize efficiency if, for example, your gigabyte-based firewall is connected to a 100M router.
Use the numbers in the OSPF Interface Cost table to manually set the interface cost to a value different
than the actual interface cost.
192
Interface Type
Bandwidth in
bits/second
Bandwidth in
bytes/second
OSPF Interface Cost
Ethernet
1G
100M
1
Ethernet
100M
10M
10
Ethernet
10M
1M
100
Modem
2M
200K
500
Modem
1M
100K
1000
Modem
500K
50K
2000
Modem
250K
25K
4000
Modem
125K
12500
8000
Modem
62500
6250
16000
WatchGuard System Manager
Using OSPF
Interface Type
Bandwidth in
bits/second
Bandwidth in
bytes/second
OSPF Interface Cost
Serial
115200
9216
10850
Serial
57600
4608
21700
Serial
38400
3072
32550
Serial
19200
1636
61120
Serial
9600
768
65535
Configuring Fireware to use OSPF
1
From Policy Manager, select Network > Dynamic Routing.
The Dynamic Routing Setup dialog box appears.
2
3
4
Click the OSPF tab.
Click Enable Dynamic Routing and Enable OSPF.
Click Import to import a routing daemon configuration file, or type your configuration parameters in
the text box.
If you click Import, you can browse to the location of the OSPF daemon configuration file. It is located in
C:\Documents and Settings\My Documents\My WatchGuard.
5
Click OK.
Allowing OSPF traffic through the Firebox
You must add and configure a policy to allow OSPF multicasts from the routers that have OSPF enabled
to the reserved multicast addresses for OSPF.
1
From Policy Manager, select Edit > Add Policies. From the list of packet filters, select OSPF. Click
Add.
The New Policy Properties window appears for OSPF.
Fireware Configuration Guide
193
Using BGP
2
In the New Policy Properties window, configure the policy to allow traffic from the IP or network
address of the router using OSPF to the IP addresses 224.0.0.5 and 224.0.0.6.
3
Click OK.
Using BGP
The Border Gateway Protocol (BGP) is a scalable dynamic routing protocol used by gateway hosts to
exchange routing information. BGP is the routing protocol used on the Internet. BGP uses route parameters or “attributes” to define routing policies and create a stable routing environment.
Hosts using BGP use TCP to send updated router table information when one host finds a change. The
host sends only the part of the routing table that has the change. BGP uses classless interdomain routing
(CIDR) to reduce the size of the Internet routing tables. The size of the BGP routing table in Fireware is
set at 32K.
The size of the typical WatchGuard® customer wide area network (WAN) is best suited for OSPF dynamic
routing. A WAN can also use external border gateway protocol (EBGP) when more than one gateway to
the Internet is available. EBGP allows you to take full advantage of the redundancy possible with a multihomed network.
To participate in EBGP with an ISP you must have an autonomous system number (ASN). You must get
an ASN from one of the regional registries in the table below. After you are assigned your own ASN you
must contact each ISP to obtain their AS numbers and other necessary information.
194
Region
Registry Name
Web Site
North America
ARIN
www.arin.net
Europe
RIPE NCC
www.ripe.net
Asia Pacific
APNIC
www.apnic.net
WatchGuard System Manager
Using BGP
Region
Registry Name
Web Site
Latin America
LACNIC
www.lacnic.net
Africa
AfriNIC
www.afrinic.net
BGP Daemon Configuration
To create or modify a routing configuration file, here is a catalog of supported routing commands. The
sections must appear in the configuration file in the same order they appear in this table. You can also
use the sample BGP configuration file found in the FAQ:
https://www.watchguard.com/support/advancedfaqs/fw_dynroute-ex.asp
Section
Command
Description
Configure BGP Routing Daemon
router bgp [ASN]
Enable BGP daemon and set
Autonomous System Number
(ASN); this is supplied by your
ISP
network [A.B.C.D/M]
Announce BGP on network
A.B.C.D/M
no network [A.B.C.D/M]
Disable BGP announcements on
network A.B.C.D/M
Set Neighbor Properties
neighbor [A.B.C.D] remote-as [ASN]
Set neighbor as member of
remote ASN
neighbor [A.B.C.D] ebgp-multihop
Set neighbor on another network
using EBGP multi-hop
neighbor [A.B.C.D] version 4+
Set BGP version (4, 4+, 4-) for
communication with neighbor;
default is 4
neighbor [A.B.C.D] update-source [WORD]
Set the BGP session to use a
specific interface for TCP
connections
neighbor [A.B.C.D] default-originate
Announce default route to BGP
neighbor [A.B.C.D]
neighbor [A.B.C.D] port 189
Set custom TCP port to
communicate with BGP neighbor
[A.B.C.D]
neighbor [A.B.C.D] send-community
Set peer send-community
neighbor [A.B.C.D] weight 1000
Set a default weight for
neighbor’s [A.B.C.D] routes
neighbor [A.B.C.D] maximum-prefix [NUMBER]
Set maximum number of prefixes
allowed from this neighbor
Community Lists
ip community-list [<1-99>|<100-199>] permit AA:NN
Specify community to accept.
Autonomous system number and
network number separated by a
colon are entered as the new
community format.
Peer Filtering
Fireware Configuration Guide
195
Using BGP
Section
Command
Description
neighbor [A.B.C.D] distribute-list [LISTNAME] [IN|OUT]
Set distribute list and direction
for peer
neighbor [A.B.C.D] prefix-list [LISTNAME] [IN|OUT]
To apply a prefix list to be
matched to incoming
advertisements or outgoing
advertisements to that neighbor
neighbor [A.B.C.D] filter-list [LISTNAME] [IN|OUT]
To match an autonomous system
path access list to incoming
routes or outgoing routes
neighbor [A.B.C.D] route-map [MAPNAME] [IN|OUT]
To apply a route map to
incoming or outgoing routes
Redistribute Routes to BGP
redistribute kernel
Redistribute static routes to BGP
redistribute rip
Redistribute RIP routes to BGP
redistribute ospf
Redistribute OSPF routes to BGP
Route Reflection
bgp cluster-id A.B.C.D
To configure the cluster ID if the
BGP cluster has more than one
route reflector
neighbor [W.X.Y.Z] route-reflector-client
To configure the router as a BGP
route reflector and configure the
specified neighbor as its client
Access Lists and IP Prefix Lists
196
ip prefix-list PRELIST permit A.B.C.D/E
Set prefix list
access-list NAME [deny|allow] A.B.C.D/E
Set access list
route-map [MAPNAME] permit [N]
In conjunction with the “match”
and “set” commands, this defines
the conditions and actions for
redistributing routes
match ip address prefix-list [LISTNAME]
Matches the specified access_list
set community [A:B]
Set the BGP community
attribute
match community [N]
Matches the specified
community_list
set local-preference [N]
Sets the preference value for the
autonomous system path
WatchGuard System Manager
Using BGP
Configuring Fireware to use BGP
1
From Policy Manager, select Network > Dynamic Routing.
The Dynamic Routing Setup dialog box appears.
2
3
4
Click the BGP tab.
Click Enable Dynamic Routing and Enable BGP.
Click Import to import a routing daemon configuration file, or type your configuration parameters in
the text box.
If you click Import, you can browse to the location of the BGP daemon configuration file. It is located in
C:\Documents and Settings\My Documents\My WatchGuard.
5
6
Click Select a BGP Configuration file.
Click OK.
Allowing BGP traffic through the Firebox
You must add a policy to allow BGP traffic to the Firebox from the approved networks. These networks
must be the same networks you defined in your BGP configuration file.
1
From Policy Manager, select Edit > Add Policies. Click New to create a new policy.
Fireware Configuration Guide
197
Using BGP
198
2
Give and name and a description for your new BGP policy.
3
Click Add and set the BGP policy to be a single-port, TCP policy on port 179.
4
5
Click OK, then click Add to add the new policy to Policy Manager.
In the New Policy Properties dialog box, configure the policy to allow traffic from the IP or network
address of the router using BGP to the Firebox® interface it connects to.
WatchGuard System Manager
Using BGP
6
Click OK.
Fireware Configuration Guide
199
Using BGP
200
WatchGuard System Manager
CHAPTER 17
Controlling Web Site Access
The WebBlocker feature of WatchGuard® System Manager uses the HTTP proxy to control Web traffic.
You can select the exact hours in the day that users can browse the Web. You can also select categories of
Web sites that users cannot go to. With WebBlocker, it is also possible to have MUVPN and RUVPN users
send their traffic through the outgoing HTTP proxy to apply the WebBlocker rules to these users.
Getting Started with WebBlocker
You can install the WebBlocker server on your WatchGuard® management station when you first do the
setup for WatchGuard System Manager. You can also install the WebBlocker Server software on a different
computer using the same method as installing the System Manager software, but you select only the
WebBlocker Server component.
Note
If you install one of the WSM servers on a computer with a personal firewall other than Windows
Firewall, you must open the ports for the servers to connect through the firewall. To allow connections
to the WebBlocker server, open UDP port 5003. It is not necessary to change your configuration if you
use the Microsoft Windows firewall. See the WatchGuard System Manager User Guide for more
information.
It is also necessary to download the WebBlocker database.
1
2
Right-click the WebBlocker Server icon in the toolbar at the bottom of the screen.
Select Get Full Database.
The Download WebBlocker Database dialog box appears.
Fireware Configuration Guide
201
Adding a WebBlocker Action to a Policy
3
Select Download to download the new database.
Note
The WebBlocker database has more than 70 MB of data. Your connection speed sets the download
speed which can be more than 30 minutes. Make sure the hard disk drive has a minimum of 80 MB of
free space.
You can use the WebBlocker utility at any time to:
•
•
•
•
Download a new version of the database.
Get an incremental update of the database.
See the database status.
Start or stop the server.
Adding a WebBlocker Action to a Policy
You can configure a WebBlocker action for each policy that uses the HTTP proxy. Or, you can use the
same WebBlocker action in each policy that uses the HTTP proxy. After you create an action, you can use
it again and again.
Configuring a WebBlocker action
1
202
From Policy Manager, right-click a policy that uses the HTTP proxy, such as the HTTP proxy policy or
the Outgoing policy. Select Edit.
WatchGuard System Manager
Adding a WebBlocker Action to a Policy
2
Click the Properties tab and select the View/Edit Proxy icon adjacent to the proxy name.
3
Select the View/Edit HTTP proxy icon to the right of the HTTP Proxy name.
The HTTP Proxy Configuration dialog box appears.
Fireware Configuration Guide
203
Adding a WebBlocker Action to a Policy
4
If you have configured a WebBlocker action, you can apply it to this policy by selecting the action
name from the WebBlocker drop-down menu. To create a new action, click the New/Clone icon.
The New WebBlocker Configuration window appears.
204
WatchGuard System Manager
Adding a WebBlocker Action to a Policy
Adding WebBlocker Server information
1
To add a server, click Add.
The Add WebBlocker Server dialog box appears.
2
Type the server IP address and select a port. Click OK.
Allowing WebBlocker server bypass
Outgoing HTTP traffic is automatically denied when the WebBlocker Server does not respond. To let all
outgoing HTTP traffic through when a WebBlocker Server cannot be found, select Allow WebBlocker
Server Bypass on the Server tab. This applies to all HTTP proxy actions that use this WebBlocker action.
Selecting WebBlocker categories
The WebBlocker database contains 14 categories of Web sites that you can block. For more information
on WebBlocker categories, see the Reference Guide.
1
From the New WebBlocker Configuration dialog box, click the Categories tab.
2
Select the category or categories you want to block. Click OK.
Fireware Configuration Guide
205
Adding a WebBlocker Action to a Policy
Defining WebBlocker exceptions
You can override a WebBlocker action with an exception. You can add a Web site that is allowed or
denied as an exception to the WebBlocker categories. The Web sites you add apply only to the HTTP traffic. They are not related to the Blocked Sites list.
The exceptions are a list of URL patterns, not IP addresses. The URL patterns do not include the leading
"http://".
The host in the URL can be the hostname specified in the HTTP request, or the IP address of the server.
Network addresses are not supported at this time, though you can use subnets in a pattern (for example,
10.0.0.*).
To match a URL path on all Web sites, the pattern must have a leading “*/”.
For servers on port 80, do not include the port. For servers on ports other than 80, add “ :port”, for example: 10.0.0.1:8080. You can also use a wildcard for the port -- for example,10.0.0.1:* -- but, note this
does not apply to port 80.
You must use a pattern for the path. To match a full Web site, end the pattern with” /* “-- for example:
10.0.0.1/* or somesite.com/*. If you add a rule in Simple View, Policy Manager automatically adds /* to all
patterns you type. If it becomes necessary to create a rule without the “/*” at the end, you must create the
rule in Advanced View.
You can also give exceptions using any part of a URL. You can set a port number, path name, or string
that must be blocked for a special Web site. For example, if it is necessary to block only www.sharedspace.com/~dave because it has inappropriate photographs, you type “www.sharedspace.com/~dave/*” to
block that directory of sharedspace.com. This gives the users the ability to browse to www.sharedspace.com/~julia, which contains content on increased production.
To block URLs containing the word “sex” in the path, you can type “*/*sex*”. To block URLs containing
“sex” in the path or the hostname, type “*sex*”.
You can block ports in a URL. For example, look at the URL http://www.hackerz.com/warez/
index.html:8080. This URL has the browser use the HTTP protocol on TCP port 8080 instead of the
default method that uses TCP 80. You can block the port by matching *8080.
1
206
To define exceptions to the WebBlocker categories, click the Exceptions tab.
WatchGuard System Manager
Scheduling a WebBlocker Action
2
Type the pattern you want to identify as an exception in the Pattern text box. By default, this pattern
creates an exception that is allowed through the Firebox®. To add an exception to deny a pattern you
must use the advanced rule options. Click Add.
To see the advanced exception rule setup, click Change View.
3
4
Click the Log check box if you want a log message when an exception is allowed through the Firebox.
Click OK.
Scheduling a WebBlocker Action
You can set an operating schedule for the policy. You can use the predefined settings in the drop-down
list or create custom schedules. You use these time periods to set rules for when to block different Web
sites. For example, you can block sports Web sites during usual business hours of operation, but allow
users to browse at lunch time, evenings, and weekends.
To set a schedule for a policy, open the policy to edit it, and click the Advanced tab. Select a schedule
from the drop-down list, or click the New/Clone icon to make a new schedule. To do this, you must configure two HTTP policies, one with a schedule. Each policy uses one of the HTTP proxy actions. Each of
these HTTP proxy actions points to one of at least two WebBlocker actions. For more information, see
“Creating Schedules” on page 52.
Fireware Configuration Guide
207
Scheduling a WebBlocker Action
208
WatchGuard System Manager
CHAPTER 18
High Availability
High Availability (HA) refers to the ability of a network to operate when a hardware or software failure
occurs. When you add redundancy to your network, you remove single points of failure.
The WatchGuard® High Availability feature enables the installation of two Firebox® devices in a failover
configuration. The configuration includes one Firebox known as the primary device and the other known
as the secondary device. One of these devices is always in active mode and the other in standby mode.
These two Fireboxes are known as “peers.” They constantly send messages to each other to communicate
their status.
When a failover event occurs, the standby system becomes active. After a Firebox becomes active, it stays
active until it goes offline and the standby Firebox starts as the active unit.
High Availability Requirements
Here are the requirements for the High Availability feature:
• You must have one High Availability license for each HA pair. We recommend that you use the
Firebox® with the maximum license features and capacities as the primary HA device.
• The two Fireboxes in an HA configuration must be the same model and must use the same
software version. If the software versions are different, you must upgrade the Firebox with the
older version so that it matches the other Firebox. The Firebox with the older software must have
its own license for the upgraded software.
• The two Fireboxes must be connected to your network in the same method. For example, the
external interfaces of each must be connected to the same hub or switch.
• You can configure the High Availability connection on either the eth5 port or on eth5 and eth4.
We recommend that you connect the ports after you configure them. (Each port can be used as a
trusted or external interface if it is not used for HA.)
• HA does not operate correctly if one of the Fireboxes in the HA pair is a VPN endpoint in a VPN
tunnel created and managed by the Management Server.
Note
High availability requires an interface or interfaces dedicated specifically for HA. The HA
interface supports only host-to-host traffic and not network traffic.
Fireware Configuration Guide
209
Installing High Availability
Installing High Availability
When you buy the High Availability upgrade, you receive a certificate. Use the instructions on the certificate to go to the LiveSecurity® Service web site and activate your upgrade. After you activate the upgrade,
you get a High Availability license key. You must add a unique High Availability license key to the primary
Firebox in the High Availability pair. Each Firebox® in the pair must have the same version of WatchGuard
System Manager software and firmware.
You must add all the license keys for the primary Firebox X and the secondary Firebox X to the configuration file for the primary Firebox. This allows each Firebox in the pair to use all of the options you have
when it becomes the active Firebox. Thus, for each upgrade you enable, you enter the license key into the
configuration file for the primary Firebox.
If you use IPSec VPN tunnels that use a VPN certificate for authentication, the secondary Firebox must
get its own IPSec VPN certificate. Only the Management Server certificate is copied from the primary Firebox to the secondary Firebox when a failover occurs.
Configuring High Availability
1
From Policy Manager, select Network > High Availability.
The High Availability dialog box appears.
2
Select the Enable High Availability check box.
3
Select the HA1 check box for the interface to enable for High Availability.
4
In the Primary Box IP text box, you can change the default IP address. This IP address should be
from a reserved or unassigned network. This becomes the permanent IP address for that interface.
5
In the Secondary Box IP text box, type an IP address from the same subnet as the interface with
High Availability enabled on the active Firebox®.
6
Select the HA2 check box to enable the HA2 interface.
The HA2 interface is optional.
210
WatchGuard System Manager
Manually Controlling HA
7
Use the arrows adjacent to Group ID to identify this HA group on the network. If you use more
than one HA pair on the same network, this number must be different for each pair.
8
Select the All Traffic radio button to encrypt all HA traffic between the Fireboxes. This is usually
not necessary, and uses more resources.
9
Select the Sensitive Info Only radio button to encrypt only sensitive information that is sent in
HA traffic between the Fireboxes. This protects passwords and other sensitive information.
10 (If you selected the All Traffic radio button in step 9) In the Shared Secret field, type a shared
secret to encrypt HA traffic between the Fireboxes. Type the shared secret again in the Confirm
field.
11 Save this configuration to the active Firebox.
12 Close Policy Manager.
13 Use a crossover cable to connect the HA1 interface (eth5) on one Firebox to the HA1 interface on
the other Firebox. If HA2 (eth4) is enabled, connect both HA2 interfaces as well.
14 Put the secondary unit in safe mode. To do this, turn the Firebox off, and then turn it back on
while you hold down the up arrow button on the Firebox front panel.
Up arrow button
15 Start Firebox System Manager and connect to the primary Firebox.
16 Select Tools > HA > Synchronize Configuration. When prompted, type the Read/Write
passphrase.
You see a message that says High Availability is enabled.
Manually Controlling HA
Although High Availability operations usually occur automatically, you can do some of the functions
manually.
Forcing a failover
You can cause a forced failover. The standby system becomes the active one immediately.
From Firebox® System Manager, select Tools > HA > Force Failover.
Synchronizing the configuration
You must synchronize the configuration when one Firebox configuration has changed while the other is
disconnected from the HA peer or powered down.
From Firebox System Manager, select Tools > HA > Synchronize Configuration.
Fireware Configuration Guide
211
Upgrading Software in an HA Configuration
Restarting the peer
When you communicate to an HA configuration, you communicate only to the active Firebox. To restart
the peer, you must submit the command from the active Firebox:
From Firebox System Manager, select Tools > HA > Restart Peer.
Note
When the Firebox is in a high CPU or traffic condition and you use Firebox System Manager to
control HA operations, you can get an incorrect “time-out” message. In this case, the operation
could have completed, and it is possible the time-out message is not correct.
Backing up an HA configuration
When a Firebox is in a High Availability pair, you can only back up the flash image of the Firebox when it
is the active Firebox. This is because the backup image includes the system and policy information, certificates, and licenses that do not exist on the secondary Firebox until failover. To create a backup image
(.fbi) of the active Firebox:
1
From Policy Manager, select File > Save > To Firebox.
2
Type the configuration passphrase. Click OK.
3
Select Make backup of current flash image before saving. Type a strong encryption key that is
easy to remember.
4
Continue the operation and make sure the backup is saved to the Backup Image location.
Upgrading Software in an HA Configuration
If you install the software on the active Firebox®, the standby Firebox in the HA configuration does not
automatically upgrade. You must upgrade each Firebox separately. Upgrade the active Firebox first. When
it restarts, the standby becomes the active Firebox. You can then upgrade that Firebox. You cannot
upgrade the software on a Firebox that is currently in standby mode.
For information on how to perform an upgrade, see the Migration Guide.
Using HA with Signature-based Security Services
Gateway AntiVirus for E-mail™ and Intrusion Prevention Service (IPS) signature databases do not automatically synchronize between active and standby HA devices.
If the antivirus and IPS features are enabled and an event occurs that causes the standby Firebox® to
become active, this device can have a version of the AV and IPS signature databases that is not current
(especially if it was in standby mode for a long time). Until an update of the database occurs, there is
some time when a new virus or IPS attack can bypass the Firebox.
To minimize this problem, keep the automatic signature update intervals for Gateway AntiVirus for E-mail
and Intrusion Prevention Service enabled and short. If possible, force a manual signature update on the
new active Firebox immediately after the failover occurs.
212
WatchGuard System Manager
APPENDIX A
Types of Policies
This chapter gives a list of the pre-defined policies included with Fireware appliance software, their protocols, and their ports. It also gives special information that could have an effect on the security of some
policies.
In this chapter, policies are divided into two groups—policies that are controlled by a packet filter and policies that are controlled by a proxy.
Packet Filter Policies
Packet filter policies examine the source and destination headers of each packet. Packets are allowed or
denied based on whether the headers appear to be coming from and going to trusted addresses.
Any
Use an Any policy only to allow all traffic between two specified trusted IP or network addresses. Configuring an Any policy opens a “hole” through the Firebox®, and allows all traffic to flow freely between
specified hosts. WatchGuard® recommends that the Any policy be used only for traffic through a VPN.
The Any policy is different from other policies. For example, if you allow FTP only to a specified host, all
other FTP sessions to other hosts are denied by that policy (unless you have also configured other FTP
policies). The Any policy does not deny like other policies.
You also cannot use an Any policy unless specified IP addresses, network addresses, host aliases, group
names, or user names are used in the From or To lists. If not, the Any policy does not operate.
Characteristics
• Protocol: Any
• Port Number: any port
AOL
The America Online proprietary protocol allows access to AOL through a TCP/IP network. The AOL client
must be specially configured to use TCP/IP and not a modem.
Characteristics
• Protocol: TCP
Fireware Configuration Guide
213
Packet Filter Policies
• Port Number(s): 5190
archie
archie is a search protocol used to find files on FTP servers. WatchGuard recommends that you use the
available web interfaces to archie. A current list of archie servers is available through anonymous FTP
from:
ftp://microlib.cc.utexas.edu/microlib/mac/info/archie-servers.txt
External hosts can be spoofed. The Firebox cannot make sure that these packets were sent from the correct location. You can configure your Firebox to add the source IP address to the Blocked Sites List when
an incoming archie connection is denied. You can use all of the usual log options with archie.
Characteristics
• Protocol: UDP
• Port Number(s): 1525
auth
The Authentication Server protocol (AUTH) has a new name. It is now called the Identification Protocol
(IDENT). Refer to IDENT for more information about this policy.
Citrix ICA
Citrix ICA is a protocol used by Citrix for its software applications, including the Winframe product. Winframe gives access to Windows from different types of clients. Citrix uses TCP port 1494 for its ICA protocol. Citrix MPS 3.0 uses Session Reliability by default. This changes the ICA protocol to use TCP 2598. If
you use Citrix MPS, you must add a policy for TCP port 2598.
Adding the Citrix ICA policy could put your network security at risk because it allows traffic through the
firewall without authentication. In addition, your Winframe server can receive denial-of-service attacks.
WatchGuard recommends using VPN options to give more security for ICA connections. You can use all of
the usual log options with WinFrame.
Characteristics
• Protocol: TCP
• Port Number(s): 1494
For more information on adding the Citrix ICA policy, refer to the Advanced FAQs in the Knowledge Base.
Go to www.watchguard.com/support and log in to the LiveSecurity Service.
Clarent-gateway
Clarent Corporation supplies IP telephone technology to mainstream carriers and service providers. Clarent
products allow voice-over-IP between Clarent gateways across the Internet. This policy gives support to
the Clarent v3.0 product and later.
Clarent products use two sets of ports, one for gateway-to-gateway communications (UDP ports 4040,
4045, and 5010) and one for gateway-to-command center communications (UDP ports 5001 and 5002).
Use the Clarent-command policy for the gateway-to-command center communications.
Allow incoming connections only from specified external gateways to your gateway or command center.
Clarent also gives support for the use of PCAnywhere for management. Refer to the PCAnywhere policy
notes for more information.
Adding the Clarent-gateway policy could put network security at risk because it allows traffic inside the
firewall based only on network address. This is not a trusted method of authentication. In addition, your
Clarent server could receive denial-of-service attacks in this configuration. Where possible, WatchGuard
recommends using VPN options to give more security for Clarent-gateway connections.
214
WatchGuard System Manager
Packet Filter Policies
Characteristics
• Protocol: UDP
• Port Number(s): 4040, 4045, 5010
Clarent-command
Clarent Corporation supplies IP telephone technology to mainstream carriers and service providers. Clarent
products allow voice-over-IP between Clarent gateways across the Internet. This policy gives support to
the Clarent v3.0 product and later.
Clarent products use two sets of ports, one for gateway-to-gateway communications (UDP ports 4040,
4045, and 5010) and one for gateway-to-command center communications (UDP ports 5001 and 5002).
Use the Clarent-command policy for the gateway-to-command center communications.
Allow incoming connections only from specified external gateways to your gateway or command center.
Clarent also gives support for the use of PCAnywhere for management. Refer to the PCAnywhere policy
notes for more information.
Adding the Clarent-command policy could put network security at risk because it allows traffic inside the
firewall based only on network address. This is not a trusted method of authentication. In addition, your
Clarent server could receive denial-of-service attacks in this configuration. Where possible, WatchGuard
recommends using VPN options to give more security for Clarent-command connections.
Characteristics:
• Protocol: UDP
• Port Numbers(s): 5001, 5002
CU-SeeMe
CU-SeeMe is a software application used to do video conferencing through the Internet. For CU-SeeMe to
operate through the Firebox, you must make sure that you are not on a network using outgoing dynamic
NAT. Configure the CU-SeeMe policy for incoming and outgoing access.
The CU-SeeMe protocol makes you configure this policy for incoming and outgoing. The CU-SeeMe policy uses the correct ports to allow the use of CU-SeeMe versions 2.X and 3.X. CU-SeeMe Version 2.X operates on UDP port 7648. Version 3.X operates on UDP port 7648, UDP port 24032 (for H.323 conferences),
and TCP port 7648 (video conference directories).
Characteristics
• Protocol: TCP and UDP
• Port Numbers(s): UDP 7648, UDP 24032, TCP 7648
DHCP-Server/Client
Dynamic Host Configuration Protocol (DHCP) gives a means of allocating dynamic IP addresses to devices
on a network.
Characteristics
•
•
•
•
Policy Name: DHCP-Server or DHCP-Client
Protocol: TCP
DHCP-Server Port Number(s): 68
DHCP-Client Port Number(s): 67
Fireware Configuration Guide
215
Packet Filter Policies
DNS
Domain Name Service (DNS) matches host names to IP addresses. A DNS policy is enabled in the default
configuration. The DNS policy allows UDP DNS traffic, as well as TCP zone transfers to occur as specified.
All of the usual log options can be used with DNS.
Characteristics
• Protocol: Multi: TCP (for server-server zone transfers) and UDP (for client-server lookups)
• Port Number(s): TCP 53 and UDP 53
Entrust
The Entrust Authority Public Key distribution protocol passes public keys to a trusted third-party organization for verification.
Characteristics
• Protocol: TCP
• Port Number(s): 709, 710
finger
finger is a protocol used to get information about users on a given host. It is easy for a hacker to use this
information against you. WatchGuard does not recommend putting finger servers on the trusted interface.
Characteristics
• Protocol: TCP
• Port Number(s): 79
FTP
File Transfer Protocol (FTP) is used to move files across the Internet. Using an FTP packet filter will not
apply the FTP proxy rule set to any traffic. To proxy FTP traffic, use the FTP proxy policy. WatchGuard
recommends that incoming FTP be allowed only to public FTP servers located behind the Firebox.
External hosts can be spoofed. WatchGuard cannot verify that these packets were actually sent from the
correct location. You can configure the Firebox to add the source IP address to the Blocked Sites List
whenever an incoming FTP connection is denied. The packet filter and proxy policy included in WatchGuard Policy Manager handle the data channel for active and passive FTP sessions. All of the usual log
options can be used with FTP.
Characteristics
• Protocol: TCP
• Port Number(s): 21
Gopher
Gopher is a data-retrieval protocol developed at the University of Minnesota. Gopher is not frequently
used, as most users use HTML.
Characteristics
• Protocol: TCP
• Port Number(s): 70, but servers can be configured to use other ports
216
WatchGuard System Manager
Packet Filter Policies
GRE
Generic Routing Encapsultation Protocol (GRE) is used together with Point-to-Point Tunneling Protocol
(PPTP) to create virtual private networks between clients or between clients and servers.
Characteristics
• Protocol: GRE
• Protocol number: 47
HTTP
Using a HTTP packet filter will not result in applying the HTTP proxy rule set to any traffic. To proxy
HTTP traffic, use the HTTP proxy policy. WatchGuard recommends that incoming HTTP be allowed only
to public HTTP servers located behind the Firebox.
External hosts can be spoofed. WatchGuard cannot verify that these packets were actually sent from the
correct location. You can configure the Firebox to add the source IP address to the Blocked Sites List
whenever an incoming HTTP connection is denied. All of the usual log options can be used with HTTP.
Characteristics
• Protocol: TCP
• Port Number(s): 80
HTTPS
HTTPS is a secure and encrypted version of the HTTP protocol. The client and the web server set up an
encrypted session on TCP port 443. Because this session is encrypted, the proxy cannot examine packet
contents using a proxy. This policy uses a packet filter to examine the connection.
Note
The HTTPS policy is needed only if you are hosting an HTTPS server, or if you do not have an HTTP, TCP,
TCP-UDP, or TCP-Proxy policy in your configuration.
Characteristics
• Protocol: TCP
• Port Number(s): 443
HBCI
The Home Banking Computer Interface (HBCI) is a standard created for bank customers and manufacturers of banking products.
Characteristics
• Protocol: TCP
• Port Number(s): 3000
IDENT
The Identification Protocol (IDENT) is a protocol used to match TCP connections to a user name. It is
used most frequently by large public SMTP and FTP servers. It is used for logs, but you cannot trust the
information it gives, as attackers can change their servers to have them send back incorrect information.
IDENT uses “fake” information to hide internal user information.
When using SMTP with incoming static NAT, you must add IDENT to your Policy Manager. Configure
IDENT to allow traffic to the Firebox. This enables mail messages to flow from behind the Firebox to the
Fireware Configuration Guide
217
Packet Filter Policies
many SMTP servers on the Internet that use IDENT to identify other mail servers’ identities, and allows
these servers to return messages through the Firebox to their senders.
If you are not using dynamic NAT, allow IDENT to the IP address of your e-mail server.
WatchGuard recommends that IDENT policies be allowed to and from the Firebox, but know that hackers
can use IDENT to collect user names.
Characteristics
• Protocol: TCP
• Port Number(s): 113
IGMP
The Internet Group Management Protocol (IGMP) is the standard for IP multicasting on the Internet. It is
used to control host memberships in multicast groups on a single network.
Characteristics
• Protocol: IGMP
IKE
The Internet Key Exchange Protocol is a standard protocol for key management.
Characteristics
• Protocol: UDP
• Port Number(s): 4500 and 500
IMAP
Internet Mail Access Protocol (IMAP) is a method of getting e-mail or bulletin board messages on a
remote e-mail server as if the messages were local. You can get access to e-mail stored on an IMAP server
from many locations (such as home, work, or laptop) without moving messages.
Characteristics
• Protocol: TCP
• Port Number(s): 143
IPSec
Internet Protocol Security (IPSec) is a framework for a set of protocols for security at the network or
packet layer of network communications. It is a VPN tunneling protocol with encryption.
Characteristics
• Protocol: UDP, ESP, and AH protocols
• Port Number(s): UDP 500 and UDP 4500
IRC
Internet Relay Chat (IRC) is a system for Internet chatting. To use IRC you must have an IRC client and
Internet access. The IRC client is a software application on your computer that sends and receives messages to and from an IRC server. The IRC server makes sure that all messages are sent to all users in the
chat session.
Characteristics
• Protocol: TCP
218
WatchGuard System Manager
Packet Filter Policies
• Port Number(s): 6667
Intel Video Phone
Intel Video Phone is a real-time multimedia application based on H.323. H.323 is an international standard for conferencing over TCP/IP networks. This policy does not filter for dangerous content. It does not
support QoS or rsvp protocol, and it does not support NAT.
Characteristics
• Protocol: TCP
• Port Number(s): 1720, 522
Kerberos v 4 and Kerberos v 5
The Kerberos network authentication protocol is an authentication system developed by the Massachusetts Institute of Technology (MIT). Kerberos enables two computers to exchange private information
across an open network using authentication for security (but no encryption).
Characteristics
• Protocol: TCP and UDP
• Kerberos v 4 Port Numbers(s): UDP 750
• Kerberos v 5 Port Number(s): TCP 88 and UDP 88
L2TP
Layer 2 Tunneling Protocol (L2TP) is an extension to the PPP protocol that enables ISPs to operate virtual
private networks.
Characteristics
• Protocol: UDP
• Port Number(s): 1701
LDAP
Lightweight Directory Access Protocol (LDAP) is an open-standard protocol for using online directory services. The protocol operates with Internet transport protocols, such as TCP. You can use LDAP to get
access to stand-alone directory servers or X.500 directories.
Characteristics
• Protocol: TCP
• Port Number(s): 389
LDAP-SSL
Lightweight Directory Access Protocol over TLS/SSL (LDAP-SSL) is used with Windows 2000 to give more
security when accessing Active Directory.
Characteristics
• Protocol: TCP
• Port Number(s): 636
Fireware Configuration Guide
219
Packet Filter Policies
Lotus Notes
Lotus Notes is a client/server platform for conferencing, databases, e-mail, and creating and using documents. Adding this policy enables the proprietary Lotus Notes protocol. Because the protocol uses encapsulation and tunneling, and gives access to internal data, WatchGuard does not recommend adding the
Lotus Notes policy for addresses out of the trusted network.
Characteristics
• Protocol: TCP and UDP
• Port Number(s): TCP 1352, UDP 1352
MSSQL-Monitor
Microsoft SQL Monitor is used to monitor Microsoft SQL databases.
Characteristics
• Protocol: TCP and UDP
• Port Number(s): TCP 1434, UDP 1434
MSSQL-Server
Microsoft SQL Server is usually used to make a remote connection to a Microsoft SQL database.
Characteristics
• Protocol: TCP and UDP
• Port Number(s): TCP 1433, UDP 1433
MS Win Media
Microsoft Windows Media Server is a proprietary protocol developed by Microsoft to supply unicast
streams. It enables bidirectional connections that enable users to go forward, go back, or pause the playback of unicast streams.
Characteristics
• Protocol: TCP
• Port Number(s): 1755, 80
NetMeeting
NetMeeting is a product developed by Microsoft Corporation that enables groups to teleconference across
the Internet. It is included with Microsoft’s Internet Explorer web browser. This policy is based on the
H.323 protocol and does not filter for dangerous content. It does not support QoS or rsvp protocol, and
it does not support NAT.
Characteristics
• Protocol: TCP
• Port Number(s): 1720, 389
NFS
The Network File System (NFS) protocol is a client server software application created by Sun Microsystems to allow all network users to get access to shared files kept on computers of different types.
Characteristics
• Protocol: TCP and UDP
220
WatchGuard System Manager
Packet Filter Policies
• Port Number(s): TCP 2049, UDP 2049
NNTP
Network News Transfer Protocol (NNTP) is used to transmit Usenet news articles.
The best procedure to use NNTP is to set internal hosts to internal news servers, and external hosts to
news feeds. In most conditions NNTP must be enabled in two directions. If you are operating a public
newsfeed, you must allow NNTP connections from all external hosts. WatchGuard cannot make sure that
these packets were sent from the correct location.
You can configure the Firebox to add the source IP address to the Blocked Sites List when an incoming
NNTP connection is denied. All of the usual log options can be used with NNTP.
Characteristics
• Protocol: TCP
• Port Number(s): 119
NTP
Network Time Protocol (NTP) is a protocol built on TCP/IP that controls local timekeeping. It synchronizes computer clocks with other clocks located on the Internet.
Characteristics
• Protocol: UDP, TCP
• Port Number(s): TCP 123 and UDP 123
OSPF
Open Shortest Path First (OSPF) is a routing protocol developed for IP networks based on the link-state
algorithm. OSPF is quickly replacing the use of RIP on the Internet because it gives smaller, more frequent updates to routing tables and makes networks more stable.
Characteristics
• Protocol: OSPF
• Protocol number: 89
pcAnywhere
pcAnywhere is a software application used to get remote access to Windows computers. To enable this
protocol, add the PCAnywhere policy. Then, allow access from the hosts on the Internet that must get
access to internal pcAnywhere servers, and to the internal pcAnywhere servers.
pcAnywhere is not a very secure policy and can put network security at risk, because it allows traffic
through the firewall without authentication. Also, your pcAnywhere server can receive denial of service
attacks. WatchGuard recommends using VPN options to give more security.
Characteristics
• Protocol: UDP and TCP
• Port Number(s): UDP 22, UDP 5632, TCP 5631, TCP 65301
ping
You can use ping to confirm whether a host can be found and is operating and on the network. To find
DOS-based or Windows-based traceroute packets, configure a ping policy.
Enabling outgoing ping is a good tool for troubleshooting. WatchGuard does not recommend you enable
ping connections incoming to your trusted network.
Fireware Configuration Guide
221
Packet Filter Policies
Characteristics
• Protocol: ICMP
• Protocol number: 1
POP2 and POP3
POP2 and POP3 (Post Office Protocol) are e-mail transport protocols, usually used to get a user’s e-mail
from a POP server.
Characteristics
• Protocol: TCP
• Port Number(s): 109 (POP2), and 110 (POP3)
PPTP
PPTP is a VPN tunnel protocol with encryption. It uses one TCP port (for negotiation and authentication
of a VPN connection) and one IP protocol (for data transfer) to connect the two peers in a VPN. Configure the PPTP policy to allow access from Internet hosts to an internal network PPTP server. PPTP cannot
get access to hosts’ static NAT because NAT cannot forward IP protocols. Because this policy enables a
tunnel to the PPTP server and the Firebox cannot examine packets in the tunnel, use of this policy must
be controlled. Be sure to use the most current version of PPTP.
Characteristics
•
•
•
•
Protocol: TCP
PPTP Negotiation Port Number(s): 1723
Protocol: IP
Protocol number: 47 (GRE)
RADIUS and RADIUS-RFC
The Remote Authentication Dial-In User Service (RADIUS) supplies remote users with secure access to corporate networks. RADIUS is a client-server system that keeps authentication information for users, remote
access servers, and VPN gateways in a central user database that is available to all servers. Authentication
for the network occurs from one location. RADIUS uses an authentication key that identifies an authentication request to the RADIUS client
In RFC 2865, the server port used by RADIUS changed from port 1645 to 1812. Make sure you select the
policy that matches your implementation.
Characteristics
• Protocol: UDP
• RADIUS policy Port Number(s): UDP 1645
• RADIUS-RFC policy Port Number(s): UDP 1812
RADIUS-Accounting and RADIUS-ACCT-RFC
The Remote Authentication Dial-In User Service (RADIUS) Accounting policy supplies accounting information to administrators of networks that use RADIUS authentication. RADIUS is a client-server system
that keeps authentication information for users, remote access servers, and VPN gateways in a central user
database that is available to all servers. The RADIUS server is also notified when the authenticated session
starts and stops. This information can be helpful for accounting.
In RFC 2866, the server port used by RADIUS changed from port 1646 to 1813. Make sure you select the
policy that matches your implementation.
222
WatchGuard System Manager
Packet Filter Policies
Characteristics
• Protocol: TCP
• RADIUS-Accounting policy Port Number(s): UDP1646
• RADIUS-ACCT-RFC policy Port Number(s): UDP 1813
RDP
The Microsoft Remote Desktop Protocol (RDP) supplies remote display and input abilities over network
connections for Windows software applications operating on a server.
Characteristics
• Protocol: TCP
• Port Number(s): 3389
RIP
RIP is a routing protocol that came before IP. It is used to automatically create routing tables for local
routers. Because it has no direction, it is almost the same as DNS in configuration. Enable RIP only if your
Internet service provider makes you operate a routing daemon.
Incorrect or deceptive routing information can cause problems with local networks, can cause service
denial problems, and can put the local network at risk. Enable this policy only if necessary.
Characteristics
• Protocol: UDP
• Port Number(s): 520
RSH
Remote Shell (RSH) is used to get access to the command line of a remote host computer. WatchGuard
does not recommend you allow any RSH incoming through the Firebox without the use of a VPN.
Characteristics
• Protocol: TCP
• Port Number(s): 514
RealPlayer G2
Media streaming protocol v7 and v8
Characteristics
• Protocol: TCP
• Port Number(s): 554, 80
Rlogin
Remote login (RLogin) is a UNIX command that allows an approved user to log in to other UNIX computers on a network. After the login, the user can do all the operations the host has approved, such as read,
edit, or delete files. For security reasons, WatchGuard recommends you do not allow incoming Rlogin
through the Firebox.
Characteristics
• Protocol: TCP
• Port Number(s): 513
Fireware Configuration Guide
223
Packet Filter Policies
SecurID
RSA SecurID Two-Factor Authentication give more security to the user authentication procedure. Created
by Security Dynamics Technologies, Inc., it uses SecurID tokens to generate codes and ACE/Server software to process the codes.
Characteristics
• Protocol: TCP and UDP
• Port Number(s): TCP 5510, UDP 5500
SMB (Windows Networking)
Windows uses Server Message Block (SMB) is used to share files, computers, printers, and other network
resources.
If you set up replication, you can see many tries to use the port mapper service on port 135. When this
fails, SMB begins to use port 42. Refer to the RFC for DCE, and the DCE-RPC proxy sections for more
instructions.
Note
Allowing SMB through the Firebox is not secure and WatchGuard does not recommend it, unless used
through a VPN connection. These configuration settings are to be used only if there is no other
alternative, and policy settings must specify internal and external hosts.
Characteristics
• Protocol: TCP and UDP
• Port Number(s): UDP 137, UDP 138, TCP 139, TCP 445, UDP 445
SMTP
The SMTP packet filter policy allows SMTP traffic (e-mail) without using the SMTP proxy.
Characteristics
• Protocol: TCP
• Port Number(s): 25
SNMP
Simple Network Management Protocol (SNMP) is used to collect information about and configure remote
computers. This can be dangerous. Many Internet attacks use SNMP.
Characteristics
• Protocols: UDP
• Port Number(s): 161
Because SNMP can cause changes in a network if enabled, carefully review alternatives and record logs
for all connections.
SNMP-Trap
Simple Network Management Protocol (SNMP) traps are notification messages that an SNMP agent (for
example, a router) sends to a network management station. These messages usually report an important
event that must be examined.
224
WatchGuard System Manager
Packet Filter Policies
Characteristics
• Protocols: UDP
• Port Number(s):162
SQL*Net
Oracle uses one port for its sql*net software. By default, this port is 1526/tcp or port 1521/tcp. Or, change
the port by editing the tnsnames.ora file. To allow sql*net through the Firebox, set up a policy for the
port that your sql*net server is using, with a protocol of tcp, and a client port of ignore. Then set up
incoming access from the allowed external hosts to the sql*net server.
Characteristics
• Protocols: TCP
• Port Number(s): 1521, 1526
SQL-Server
The SQL-Server policy is used to give access to Sybase Central and SQL Advantage software.
Characteristics
• Protocols: TCP
• Port Number(s): 10000
ssh
Secure Shell (ssh) is a free software application that allows remote login, command control, and the
movement of files between computers. It gives strong authentication and secure (encrypted) connections.
WatchGuard recommends the use of ssh because it is more secure than more vulnerable protocols such as
telnet, rssh, and rlogin.
If you use ssh, you must also use its strong authentication mechanisms. Strong encryption mechanisms
are available for U.S. customers, Canadian customers, and customers who are allowed by the U.S. government to use strong encryption. To get strong encryption (128 bit, 3DES) or IPSec, send e-mail to WatchGuard Technical Support.
UNIX versions are available from www.ssh.com, and information on versions for Windows can be found at
F-Secure (http://www.f-secure.com).
Characteristics
• Protocol: TCP
• Port Number(s): 22
Sun RPC
Sun Remote Procedure Call (Sun RPC) was developed by Sun Microsystems for connections between clients and servers in the Sun network file system.
Characteristics
• Protocol: TCP and UDP
• Port Number(s): TCP 111, UDP 111
syslog
syslog is a policy used to record operating system events on UNIX hosts. Syslog data is usually enabled on
a firewall to collect data from a host outside the firewall.
Fireware Configuration Guide
225
Packet Filter Policies
The syslog port is blocked in the default Firebox configuration. To allow one log host to collect logs from
more than one Firebox:
• Remove port 514 from the Blocked Ports list
• Add the WatchGuard Logging policy to Policy Manager
Note
It is possible for hackers to fill syslogs with log entries. If the syslog is full, it is more difficult to see an
attack. Also, the disk frequently fills up and the attack is not recorded. Thus, it is usually not secure to
allow syslog traffic through the Firebox.
Characteristics
• Protocol: UDP
• Port Number(s): 514
TACACS
TACACS user authentication is a system that uses user accounts to authenticate users into a dial-up
modem pool. This removes the need to keep copies of accounts on a UNIX system. TACACS does not support TACACS+ or RADIUS.
Characteristics
• Protocol: UDP
• Port Number(s): 49
TACACS+
TACACS+ user authentication is a system that uses user accounts to authenticate users into a dial-up
modem pool. This eliminates the need to keep copies of accounts on a UNIX system. TACAS+ supports
RADIUS.
Characteristics
• Protocol: TCP
• Port Number(s): 49
TCP
This policy serves as the default policy for all TCP connections, and other policies override it. TCP connections that do not match specified policies in Policy Manager do not complete unless TCP-UDP, TCP, or
the TCP Proxy are also configured in Policy Manager. This policy does not enable FTP which operates only
with an FTP policy.
TCP-UDP
This policy serves as the default policy for all TCP and UDP connections, and other policies override it.
Connections that do not match specified policies in Policy Manager do not complete unless TCP-UDP,
TCP and UDP, or the TCP Proxy are also configured in Policy Manager. This policy does not enable active
mode FTP which operates only with an FTP policy.
UDP
This policy serves as the default policy for all UDP connections, and other policies override it. UDP connections that do not match specified policies in Policy Manager do not complete unless UDP, TCP-UDP,
or the TCP Proxy are also configured in Policy Manager.
226
WatchGuard System Manager
Packet Filter Policies
telnet
The telnet policy is used to log in to a remote computer. It is almost the same as using dial-up access, but
the connection is made across a network.
Characteristics
• Protocol: TCP
• Port Number(s): 23
Timbuktu
Timbuktu Pro is a remote control and file transfer software used to get access to Windows computers. The
protocol uses TCP port 1417 and UDP port 407. Add the Timbuktu policy and allow incoming access from
the hosts on the Internet that must get access to internal Timbuktu servers, and to the internal Timbuktu
servers.
Timbuktu is not a very secure software application and can put network security at risk. It allows traffic
inside the firewall without authentication. In addition, the Timbuktu server can receive denial of service
attacks. WatchGuard recommends using VPN options for more security.
Characteristics
• Protocols: TCP, UDP
• Port Number(s): UDP 407, TCP 1417
Time
The Time policy is almost the same as NTP. It is used to synchronize clocks between hosts on a network.
Time is usually less accurate and less efficient than NTP across a WAN. WatchGuard recommends using
NTP.
Characteristics
• Protocols: TCP, UDP
• Port Number(s): TCP 37, UDP 37
traceroute
traceroute is a software application that creates maps of networks. It is used for network troubleshooting,
network route troubleshooting, and finding the Internet service provider of a site. The WatchGuard traceroute policy controls UNIX-based UDP-style traceroute only. For a DOS-based or Windows-based traceroute packet filter, use the ping policy (see “ping” on page 42).
traceroute uses ICMP and UDP packets to create paths across networks. It uses the UDP TTL field to send
back packets from each router and computer between a source and a destination. Allowing traceroute
incoming to a network can enable a hacker to create a map of your private network. But, outgoing traceroute is good for troubleshooting.
Characteristics
• Protocols: UDP
• Port Number(s): 33401-65535
UUCP
Unix-to-Unix Copy (UUCP) is a Unix tool and protocol that enables one computer to send files to another
computer. This tool is not used frequently, as users more frequently use FTP, SMTP, and NNTP to transfer
files.
Fireware Configuration Guide
227
Packet Filter Policies
Characteristics
• Protocols: TCP
• Port Number(s): 540
WAIS
Wide Area Information Services (WAIS) is a protocol for finding documents on the Internet. Thinking
Machines Incorporated first developed WAIS. Some web sites use WAIS to look for searchable indices, but
it is not used frequently.
WAIS is created on the ANSI Z39.50 search protocol, and the words Z39.50 and WAIS refer to the same
technology.
Characteristics
• Protocol: TCP
• Port Number(s): 210, but servers can be (and frequently are) configured on other ports, much like
HTTP servers
WinFrame
Citrix ICA is a protocol used by Citrix for its software applications, including the Winframe product. Winframe gives access to Windows from different types of clients. Citrix uses TCP port 1494 for its ICA protocol. Citrix MPS 3.0 uses Session Reliability by default. This changes the ICA protocol to use TCP 2598. If
you use Citrix MPS, you must add a policy for TCP port 2598.
Adding a WinFrame policy could put your network security at risk because it allows traffic through the
firewall without authentication. In addition, your Winframe server can receive denial-of-service attacks.
WatchGuard recommends using VPN options to give more security for ICA connections. You can use all of
the usual log options with WinFrame.
Characteristics
• Protocol: TCP
• Port Number(s): 1494
For more information on adding the Citrix WinFrame policy, refer to the Advanced FAQs in the Knowledge Base. Go to www.watchguard.com/support and log in to the LiveSecurity Service.
WG-Auth
The WatchGuard Authenticaton policy allows users to authenticate to the Firebox.
Characteristics
• Protocol: TCP
• Port Number(s): 4100
WG-Firebox-Mgmt
The WatchGuard Firebox Management policy allows configuration and monitoring connections to be
made to the Firebox. WatchGuard recommends allowing this policy only to the Management Station. The
policy is usually set up on the trusted interface.
Characteristics
• Protocol: TCP
• Port Number(s): 4103, 4105, 4117, 4118
228
WatchGuard System Manager
Packet Filter Policies
WG-Logging
The WatchGuard Logging policy is necessary only if a second Firebox must get access to a log host on the
trusted interface of a Firebox. If there is only one Firebox, this policy is not necessary.
Characteristics
• Protocol: TCP
• Port Number(s): 4107, 4115
WG-Mgmt-Server
When you use the WatchGuard Management Server Setup wizard to configure a Management Server, the
wizard automatically adds this policy to the gateway Firebox. It controls incoming connections to the
Management Server.
Characteristics
• Protocol: TCP
• Port Number(s): 4110, 4112, 4113
WG-SmallOffice-Mgmt
The WatchGuard Small Office Management policy allows you to make a secure connection to SOHO and
Edge Fireboxes from the WatchGuard Firebox System.
Characteristics
• Protocol: TCP
• Port Number(s): TCP 4109
WG-WebBlocker
The WatchGuard WebBlocker policy allows connections to the WebBlocker server.
Characteristics
• Protocol: TCP, UDP
• Port Number(s): TCP 5003, UDP 5003
whois
The whois protocol gives information about the administrator of web sites and networks. It is frequently
used to find the administrator of a different web site.
To filter whois traffic, add a whois policy allowing connections to the whois server (such as rs.internic.net).
Characteristics
• Protocol: TCP
• Port Number(s): 43
X11
The X Windows System Protocol has components that are used to create graphic desktops, including windows, colors, displays, and screens. X11 also supplies a flow of events showing the interaction between a
user and a computer input device (such as a mouse, keyboard, and so on).
Fireware Configuration Guide
229
Proxied Policies
Characteristics
• Protocol: TCP
• Port Number(s): 6000-6063
Yahoo Messenger
The Yahoo Messenger Protocol is a tool for instant messaging.
Characteristics
• Protocol: TCP
• Port Number(s): 5050, 80
Proxied Policies
This section reviews the proxied policies supplied by the WatchGuard® Firebox® System. A proxy policy
opens packets, strips out forbidden data types in the packet content, and assembles the packets again
using the source and destination headers of the proxy.
Configuring and activating proxies is done the same way you add packet filtering policies.
DNS
Domain Name Service (DNS) matches host names to IP addresses. The DNS proxy policy examines the
contents of DNS packets to help protect your DNS servers from hackers. It puts limits on the type of operations allowed in a DNS query and can look for specified patterns in query names.
Characteristics
• Protocol: TCP and UDP
• Port Number(s): TCP 53 and UDP 53
FTP
FTP is File Transfer Protocol. FTP is used to move files across the Internet.
Characteristics
• Protocol: TCP
• Port Number(s): 20 (command channel), 21 (data channel)
HTTP
HTTP is the Hypertext Transfer Protocol used by the World Wide Web to move information around the
Internet.
Note
The WatchGuard policy “HTTP Proxy” is not the same as an HTTP caching proxy. An HTTP caching proxy
controls the caching of Web data. If you use an external caching proxy, you must enable (by adding
policies) any outgoing policies that are necessary for your organization. If you do not, outgoing TCP
connections do not operate correctly.
Characteristics
• Protocol: TCP
230
WatchGuard System Manager
Proxied Policies
• Port Number(s): 80 (but servers can operate on any port, a common alternative is 8080, and Secure
Socket Layer (SSL) connections are usually served on port 443)
SMTP
Simple Mail Transfer Protocol (SMTP) is the Internet standard protocol for transmitting and receiving email. Usually SMTP servers are public servers.
You must add an auth policy to Policy Manager when using incoming static NAT with SMTP (see “auth”
on page 32). Configure auth to allow incoming auth to the Firebox. This enables outgoing mail messages
to flow freely from behind the Firebox to the many SMTP servers on the Internet that use auth. It allows
these servers to send messages back through the Firebox to the senders.
Logging incoming SMTP is recommended, but this can cause a large quantity of logs. To not use the
SMTP proxy but have SMTP operate correctly, create a new policy in Policy Manager using TCP protocol
and port 25.
Characteristics
• Protocol: TCP
• Port Number(s): 25
TCP Proxy
The TCP Proxy policy gives configuration options for HTTP on port 80 and adds a rule allowing TCP connections from networks behind the Firebox to networks external to the Firebox by default. The TCP Proxy
rule makes sure that all HTTP traffic from behind the Firebox on all ports is proxied with the HTTP proxy
rules.
WatchGuard recommends that you allow HTTP only to any public HTTP servers kept behind the Firebox.
External hosts can be spoofed. WatchGuard cannot make sure that these packets were sent from the correct location.
Configure WatchGuard to add the source IP address to the Blocked Sites List when an HTTP connection
to a host behind your Firebox is denied. Configure the parameters and MIME types the same as you do for
the HTTP Proxy.
Fireware Configuration Guide
231
Proxied Policies
232
WatchGuard System Manager
Index
Symbols
.cfg file. See configuration file
Numerics
1-1 Mapping dialog box 105
1-to-1 NAT. See NAT, 1-to-1
3DES 143
A
active connections on Firebox, viewing 28
Add Address dialog box 73, 105, 176
Add Route dialog box 63
Add Static NAT dialog box 73, 106
Advanced dialog box 59
AH
described 142
aliases
described 34
ANSI Z39.50 228
Any 213
Any service 213
and RUVPN 174
AOL service 213
Archie service 214
ARP cache, flushing 18
attacks, spoofing. See spoofing attacks.
AUTH 214
auth (ident) service 214
Authentication 228
authentication
and ssh 225
defining groups for 108
described 34, 107, 143
for VPNs, viewing 15
from external interface 108
from outside Firebox 107
selecting method for 143
Fireware Configuration Guide
authentication servers
described 143
RADIUS 110
SecurID on RADIUS server 112
types 108
types supported 175
B
Bandwidth Meter tab 21
bandwidth usage, viewing 21
blocked ports
avoiding problems with legitimate users 125
default 124
permanent 125
reasons for 124
Blocked Ports list 125
blocked services
rcp 125
rlogin 125
RPC portmapper 125
rsh 125
X Font server 124
X Window 124
blocked sites
auto-blocked 121
blocking with service settings 124
described 121
dynamic 124
exceptions to 122
permanent 121, 122
storing in external file 122
temporary 124
Blocked Sites list
exceptions to 122
viewing 26
BOVPN
and certificate-based authentication 148
creating tunnel policies 160
described 148
BOVPN with a Management Server
creating tunnels 168
BOVPN with Manual IPSec
233
adding gateways 153
configuring a gateway 153
configuring a tunnel with manual security 156
described 148, 153
encryption levels 149, 153
Phase 1 settings 155
specifying authentication method 155
specifying encryption 155
using certificates 155
BOVPN with VPN Manager
adding devices to 164
adding policy templates 166
adding security templates 167
creating tunnels 168
defining Firebox as DVCP client 165
described 149
editing tunnels 168
removing devices and tunnels 169
scenario 150
branch office VPN. See BOVPN
C
certificate authority
described 143
certificates
described 143
viewing CA fingerprint 15
viewing expiration date and time of 14
viewing status of 14
Citrix ICA 214, 228
Clarent-command service 215
Clarent-gateway service 214
configuration file
and Policy Manager 47
opening 47
saving 49
saving to Firebox 49
saving to local drive 50
configuring High Availability 210
Connect to Firebox dialog box 9
CU-SeeMe service 215
D
default gateways
viewing IP address of 14
default packet handling
blocking address space probes 120
blocking port space probes 120
blocking spoofing attacks 120
Details button 67
Device Policy dialog box 166, 167
devices
adding to VPN Manager 164
dynamic 164
removing from VPN Manager 169
DHCP 57
DHCP server
default lease time for 58
described 57
not using Firebox as 57
setting up Firebox as 57
DHCP support on external interface 58
DHCP-Server service 215
234
dialog boxes
1-1 Mapping 105
Add Address 73, 105, 176
Advanced 59
Connect to Firebox 9
Device Policy 166
Firebox Name 51
Network Configuration 56, 60
New Service 68
Resource 167
Security Policy 168
Security Template 167, 168
service Properties 67, 124
Services 67, 68
Setup Firebox User 110, 173
Setup Routes 62
Tunnel Properties 169
WebBlocker Utility 201
Diffie-Hellman
described 144
groups 144, 155
DNS Proxy service 230
DNS server addresses 61
DNS servers, configuring 172
DNS service 216
DVCP
and VPN Manager 149
DVCP clients
defining Fireboxes as 165
dynamic NAT. See NAT, dynamic
dynamically blocked sites 124
E
EDGE
creating tunnels for dynamic 168
encryption
activating strong 171
and RUVPN with PPTP 171
levels of 142
encryption for VPNs, viewing 15
Entrust 216
Entrust service 216
ESP
described 142
extended authentication
defining groups for 175
described 143
external interface
dynamic addressing on 58
F
finger service 216
Firebox interfaces
viewing IP addresses of 14
Firebox Name dialog box 51
Firebox passphrases. See passphrases
Firebox System Manager
front panel 14
starting 9
Fireboxes
as CAs 143
configuring for RUVPN with PPTP 171
connecting to 9
WatchGuard System Manager
defining as a DHCP server 57
defining as DVCP clients 165
designating log hosts 36
friendly names in log files, reports 51
opening configuration file 47
resetting pass phrase 50
saving configuration file to 49
setting time zone for 51
viewing active connections on 28
viewing bandwidth usage 21
viewing everyone authenticated to 25
FTP packet filter service 216
FTP Proxy service 230
FTP servers, and archie service 214
fully meshed topology 145
G
gateways
adding 153
configuring 153
described 153
gopher service 216
GRE service 217
groups
assigning users to 110
for authentication 108
H
HBCI service 217
High Availability 14
configuring 210
Historical Reports
time zone 51
host routes, configuring 63
hosts
viewing in HostWatch 29
HostWatch
choosing colors for display 30
described 28
display 28
modifying view properties 30
setting display properties 29
starting 28
viewing authenticated users 29
viewing hosts 29
viewing ports 29
HTTP caching proxy 230
HTTP packet filter service 217
HTTP Proxy service 230
HTTP service 230
HTTPS service 217
hub-and-spoke configuration 146
described 144
phase 1,2 144
IKE service 218
IMAP service 218
Intel video phone service 219
Internet
accessing through PPTP tunnel 178
Internet Key Exchange. See IKE
Internet Security Association and Key Management
Protocol. See ISAKMP
IP addresses
default gateways 14
entering for RUVPN with PPTP 175
netmask 14
WINS/DNS servers 62
IP alias 60
IPSec
benefits of 142
described 142
IPSec service 218
IRC service 218
ISAKMP
and Diffie-Hellman groups 155
described 144, 156
K
Kerberos v 4 service 219
Kerberos v 5 service 219
L
L2TP service 219
Large Icons button 66
launch interval, setting 72, 83, 123
LDAP service 219
LDAP-SSL service 219
log files
setting Firebox names used in 51
log hosts
adding 37
designating for Firebox 36
log messages
copying deny messages 17
issuing ping or traceroute on deny messages 17
Logging 229
logging
enabling Syslog 38
for blocked ports 123, 124, 126
logging and notification
defining for services 82
designating log hosts 36
LogViewer
time zone 51
Lotus Notes service 220
I
IDENT 214
ident (auth) service 217
IGMP service 218
IKE
and Diffie-Hellman group 155
and Phase 1 settings 155
Fireware Configuration Guide
M
MAC address of interfaces, viewing 14
mail servers
and NAT 73, 106
main menu button 18
235
Management Server 229
Managing SOHOs and Edges 229
manual security, configuring tunnels with 156
MD5-HMAC 143
Media Server 220
meshed topology 145
Microsoft SysKey Utility 163
Mobile User VPN. See MUVPN
monitoring
active connections on Firebox 28
probes 19
MS Win Media 220
MSDUN, and RUVPN 176
MSSQL-Monitor service 220
MSSQL-Server service 220
MUVPN
and WINS/DNS server addresses 61
authentication for 148
described 148
encryption levels for 148
making outbound connections behind Firebox 40
scenario 150
with extended authentication 151
N
NAT
1-to-1
described 101, 103
using 103
and mail servers 73, 106
and tunnel switching 147
and VPNs 144
dynamic
described 101, 102
static
configuring a service for 73, 101
types of 101
NAT Setup dialog box 102
netmask, viewing address of 14
NetMeeting service 220
network address translation. See NAT
Network Configuration dialog box 56, 60
Network Connection wizard 177, 178
Network File System 124
Network File System (NFS) service 220
network routes. See routes
network topology
described 145
fully meshed 145
hub-and-spoke 146
partially meshed 145
New Service dialog box 68
NNTP service 221
notification
bringing up popup window as 72, 83, 123
for blocked ports 123, 126
setting launch interval 72, 83, 123
setting repeat count 72, 83, 123
NTP service 221
P
packet filter 65
packet handling, default. See default packet handling
packets
viewing number sent and received 14
partially meshed networks 145
passphrases
management server passphrase
described 162
resetting for Firebox 50
tips for creating 50
password authentication 143
passwords
and security of VPN endpoints 143
described 143
location 162
master password
decribed 162
uses of 162
pcAnywhere service 221
permanently blocked sites 122
Phase 1
described 144
settings 155
Phase 2
described 144
ping command for source of deny messages 18
ping service 221
Policy Manager
as view of configuration file 47
described 47
displaying detailed view 67
displaying Large Icons view 66
opening a configuration file 47
services displayed in 66
using to create configuration file 55
policy templates
adding 166
adding resources to 167
POP2 service 222
POP3 service 222
popup window, as notification 72, 83, 123
ports
0 125
1 125
1000-1999 125
111 125
513 125
514 125
additional. See three-port upgrade
speed and duplex settings 63
viewing in HostWatch 29
PPPoE support on external interface 58, 59
PPTP 142
PPTP service 222
PPTP. See also RUVPN with PPTP
probes
defining 19
processor load indicator 14
proxy
definition 65
proxy services 230
O
OSPF service 221
236
WatchGuard System Manager
R
RADIUS Accounting 222
RADIUS server authentication 110
rcp service 125
RealPlayer G2 service 223
Remote User VPN. See RUVPN with PPTP
repeat count, setting 72, 83, 123
reports
setting Firebox names used in 51
Resource dialog box 167
RIP service 223
Rlogin service 223
rlogin service 125
routes
configuring 62
described 62
host 63
network 62
RPC portmapper 125
rsh service 125, 223
RUVPN with PPTP
accessing the Internet with 178
activating 175
and MSDUN 176
and the Any service 174
and WINS/DNS server addresses 61
configuration checklist 171
configuring services to allow 174
configuring shared servers for 172
described 148, 171
encryption levels 171
entering IP addresses for 175
IP addressing 171
preparing client computers for 176
preparing Windows 2000 remote host 177
preparing Windows XP remote host 177
running 178
S
Save dialog box 50
secondary networks
adding 60
secure shell (ssh) service 225
SecurID authentication 112
SecurID service 224
security policy
opening configuration file 47
Security Policy dialog box 168
Security Template dialog box 167, 168
security templates, adding 167
security traffic display
selecting center interface 13
switch between 3 port and 6 port 13
viewing Firebox status using 13
Select Probe window 19
service Properties dialog box 67, 124
service properties, using to block sites 124
services
adding 67
adding several of same type 69
Any 213
AOL 213
Archie 214
Fireware Configuration Guide
archie 214
auth (ident) 214
Citrix ICA 214
Clarent-command 215
Clarent-gateway 214
configuring for incoming static NAT 73, 101
configuring to allow RUVPN traffic 174
creating new 68
CU-SeeMe 215
customizing logging and notification 82
deleting 69
DHCP-Server 215
displayed in Policy Manager 66
DNS 216
DNS Proxy 230
Entrust 216
finger 216
FTP packet filter 216
FTP Proxy 230
gopher 216
GRE 217
HBCI 217
HTTP 230
HTTP packet filter 217
HTTP Proxy 230
HTTPS 217
icons for 66
ident (auth) 217
IGMP 218
IKE 218
IMAP 218
Intel video phone 219
IPSec 218
IRC 218
Kerberos v 4 219
Kerberos v 5 219
L2TP 219
LDAP 219
LDAP-SSL 219
Lotus Notes 220
MSSQL-Monitor 220
MSSQL-Server 220
NetMeeting 220
Network File System (NFS) 220
NNTP 221
NTP 221
OSPF 221
PCAnywhere 214, 215
pcAnywhere 221
ping 221
POP2 222
POP3 222
PPTP 222
proxied 230
rcp 125
RealPlayer G2 223
RIP 223
Rlogin 223
rlogin 125
RPC portmapper 125
rsh 125, 223
SecurID 224
SMB 224
SMTP 231
SMTP packet filter 224
SMTP Proxy 231
SNMP 224
SNMP-Trap 224
SQL*Net 225
SQL-Server 225
237
ssh 225
Sun RPC 225
syslog 225
TACACS 226
TACACS+ 226
TCP Proxy 231
TCP-UDP 226
telnet 227
Timbuktu 227
Time 227
traceroute 227
types 213
UDP 226
UUCP 227
viewing number of connections by 22
WAIS 228
well-known 213
WG-Auth 228
WG-Logging 229
WG-Mgmt-Server 229
WG-SmallOffice-Mgmt 229
WG-WebBlocker 229
whois 229
WinFrame 228
X Font service 124
X Window 124
X11 229
Yahoo Messenger 230
Services Arena
described 66
Services dialog box 67, 68
Setup Firebox User dialog box 110, 173
Setup Routes dialog box 62, 63
SHA-HMAC 143
shared secrets 143
Simple Mail Transfer Protocol 231
Simple Network Management Protocol (SNMP) 224
sites, blocked. See blocked sites.
SMB service 224
SMTP packet filter service 224
SMTP Proxy service 231
SMTP service
described 231
with static incoming NAT 217
SNMP service 224
SNMP-Trap service 224
SOHO
creating tunnels for dynamic 168
split tunneling
with PPTP, enabling 178
spoofing attacks
described 120
SQL*Net service 225
SQL-Server service 225
ssh service 225
Star Mode 13
static NAT 218
Steel Belted RADIUS 112
Sun Remote Procedure Call service 225
Sun RPC service 225
Syslog color 17
Syslog logging
enabling 38
syslog service 225
System Manager
authentication list 25
Blocked Sites list 26
238
monitoring tunnels in 15
ServiceWatch tab 22
viewing bandwidth usage 21
T
TACACS service 226
TACACS+ service 226
TCP connections 226
TCP Proxy service 231
TCPmux service 125
TCP-UDP service 226
telnet 227
telnet service 227
the Any policy 213
Thinking Machines Incorporated 228
third-party authentication server. See authentication
or name of third-party server
Timbuktu service 227
Time service 227
time zone for Firebox, setting 51
traceroute command for source of deny messages 18
traceroute service 227
traffic
viewing using security traffic display 13
traffic log messages
copying 17
issuing ping or traceroute command for 17
Traffic Monitor
copying messages in 17
issuing ping and traceroute command in 17
limiting messages 16
traffic volume indicator 14
Triangle Mode 13
TripleDES 143
tunnel policies
creating 160
described 160
Tunnel Properties dialog box 169
tunnel switching 147
tunneling protocols 142
tunnels
and gateways 153
configuring with manual security 156
creating with Add VPN Wizard 168
creating with VPN Manager 161, 168
drag-and-drop creation 168
editing 168
monitoring 15
removing from VPN Manager 169
viewing status of 14
types of services 213
U
UDP service 226
Unix-to-Unix Copy service 227
users, viewing in HostWatch 29
UUCP service 227
WatchGuard System Manager
V
VPN Manager
adding devices 164
and authentication via certificates 149
and DVCP 149
described 149, 161
VPNs
access control for 144
and 1-to-1 NAT 103
and NAT 144
authentication methods for 143
design considerations 143, 145, 146
network topology 145
scenarios 149
VPNs, and Any service 213
W
WAIS service 228
WatchGuard Management Server
functions 161
replacing DVCP server 161
setup wizard 163
WatchGuard PPTP policy icon 175
Web sites, filtering 4, 201
WebBlocker 229
creating exceptions for 206
described 4, 201
prerequisites 201
scheduling hours 207
time zone 51
WebBlocker utility 201
WebBlocker Utility dialog box 201
well-known services 213
WG-Auth service 228
WG-Logging service 229
WG-Mgmt-Server service 229
WG-SmallOffice-Mgmt service 229
WG-WebBlocker service 229
whois service 229
Wide Area Information Services (WAIS) 228
Windows 2000
preparing for RUVPN with PPTP 177
Windows networking 224
Windows XP
preparing for RUVPN with PPTP 177
Winframe 214
Winframe service 228
WINS server addresses 61
WINS servers, configuring 172
X
X Font server 124
X Window 124
X11 service 229
Y
Yahoo Messenger service 230
Fireware Configuration Guide
239
240
WatchGuard System Manager
Was this manual useful for you? yes no
Thank you for your participation!

* Your assessment is very important for improving the work of artificial intelligence, which forms the content of this project

Download PDF

advertisement