Enabling data transfer to a Cisco device. Watchguard XCS

Threat Prevention

Cisco Devices

Administrators can push Threat Prevention information to an existing Cisco device. The system can update the Cisco device with information from one data group. The Cisco device can then be configured to block a given IP address by adding it to an appropriate ACL (Access Control List). When an item is removed from the

Threat Prevention list, it is automatically removed from the Cisco IP access list.

The system utilizes the IP named access control list feature to forward information to the Cisco device. Cisco IOS version 11.2 or later is required for WatchGuard XCS and Cisco integration.

To configure a Cisco device:

1. Select Security > Anti-Spam > Threat Prevention > Cisco Devices .

2. Click Add .

ƒ Name — Enter a descriptive name to refer to this specific Cisco device.

ƒ URL — Enter the full telnet URL for the Cisco device. For example: telnet://192.168.1.175

.

ƒ User Name — Enter a valid user name to log into the Cisco device.

ƒ User Password — A corresponding password for the user name entered above.

ƒ Administrative Password — Enter the administrative (enable) password for this device.

Enabling data transfer to a Cisco device

The Threat Prevention feature can be configured to push items from a defined data group to an IP access list on a Cisco device. To enable data to be pushed to the Cisco device, select a data group defined on the

WatchGuard XCS in Security > Anti-Spam > Threat Prevention > Data Groups , and ensure the Push to

Cisco Devices check box enabled.

When using Cisco integration with a cluster, only the Primary system’s data groups will get pushed to the Cisco device.

The Cisco device can only accept one data group. It is recommended that the blacklisted list be used to block clients at the Cisco device.

User Guide 327