Instruction/ maintenance manual of the product FireboxTM System 4.6 WatchGuard Technologies
Go to page of 170
W atchGuar d ® Fir ebox ™ System User Guide Firebox System 4.6.
ii Disclaimer Information in this guide is subject to change with out noti ce. Companies , names, and data us ed in examples her ein are fi ctitious unless otherwise noted.
User Guid e iii W atchGuar d T echnologies, Inc. Fir ebox System Softwar e End-User License Agr eem ent Wa tchGuard Firebox System (WFS) End-User License Agreement IMPORTANT — RE AD CAREFULL Y BEFO .
iv (D) T ransfer this license to ano ther party unless (i) the trans fer is permanent, (ii) the third party recipient agr ees to the term s of this AGREEM ENT , and (iii) yo u do not retain any copies of the SOFTWARE PRODUCT ; or (E) R everse engineer , disassemble or decompile the SOFTW ARE PRODUCT .
User Guid e v subdivision (c)(1)(ii) of the R ights in T echnical Data and Com puter Sof tware clause at DFARS 252.227- 7013, or in s ubdivision (c) (1) and (2) o f the Comm ercial Com puter Sof tware -- R estricted Rights Clause a t 48 C.F .R . 52.227 -19, as applicable.
vi FCC Certifi cation This device has been tes ted and found to compl y with limits for a Cl ass A digital device, pursuant to P ar t 15 of the FCC Rules. Oper ation is subjec t to the following two conditions: 1 This device may not ca use harmful interfere nce.
User Guid e vii T able of Contents PART I Introdu ction . ..... ..... ..... .... ........ ............ ............ ............ ..... .... ..... ..1 W elcome to W atchGuard ............. .............. ........................ ......... ... 1 W atchGuar d Fir ebox S ystem components .
viii Resetting Fir ebox pass phrases .......... .......... ......... .............. .......... 24 Setting the time z one .......... .......... ......... ......... .......... ......... .......... 25 Reinitializing a misconf igur ed Fir ebox ...........
User Guid e ix Service pr ecedence .................. ....................... ......... .......... ......... . 56 CHAP TER 9 Controlling W eb T raffic ............ ......... ......... .......... ......... . 59 How We bBlocker works ............ ......
x CHAP TER 15 Reviewing and Working with log files ................ ........ 103 Viewing files with LogViewer .................. ......... .............. ............. 103 Displaying an d hiding fie lds ........................ ......... ......... ...
User Guid e 1 PART I Intr oduction W elcome to W atchGuard The W atchGuard Fireb ox System consists of : • A suite of management and s ecurity software tools • A Plug and P lay network appliance c.
W at chGuard Fir ebox System components 2 •S e c u r i t y s u i t e • LiveSecurity Service W atchGuard Fir ebox The Firebox fam ily of appl iances are specially desi gned and optimized machines.
User Guid e 3 Minimum requirements LiveSecurity Servi ce The innovative LiveSecurity Service subscription make s it easy to maintain the security of an or ganization’s network. W atchGuard’s team of security experts publish alerts and software updates, which are broadcas t to your e-mail cl ient.
Minimum requirements 4 Ha rd wa re re q ui re me n t s Minimum hardwar e requirem ents ar e the same as for the oper ating system on which the W atchGuard Fir ebox System 4.6 runs. The rec ommended hardware ranges ar e listed below . Hardware featur e Minimum requireme nt CPU Pe n t i u m I I Memor y Same a s for o peratin g system .
User Guid e 5 PART II W atchGuar d ® Services The W atchGuard Fire box System is consi derabl y more t han a piece of hardware . This section describ es two W atchGuard service components that addres s your security requireme nts, and the optional features availab le to you.
6.
User Guid e 7 CHAP TER 1 LiveSecurity Service No Internet security solution i s complete wit hout systematic updates. F rom t he latest hacker tec hniques to the most r ecently discover ed operating system bug, t he daily barrage of new threats poses a perpetual cha llenge to any Internet sec urity solution.
LiveSecurity broadcasts 8 accompany each tr ansmission f or easy installati on. These convenient tra nsmissions reli eve you of the burden of tr acking the latest software versi on to keep your sys tem state of the art.
User Guid e 9 LiveSecurity broadcasts • The License K ey number is l ocated on the W atchGuard LiveSec urity Agreement License K ey Certificate. Enter the number in the exa ct form shown on the key , including the hyphens. • V erify that your e-mail a ddress is correct.
LiveSecurity broadcasts 10.
User Guid e 11 CHAP TER 2 T e chnical Support Developing and implementing a network security policy can be a challenge. In addition to fami liarity with the W atchGuard F irebox Syste m, it requir es experience with advanced networking concepts, pr ograms , and protocols .
Getting Intern et tec hnical suppo rt 12 Known issues Another source of information about the W atchGuard Fireb ox System is the Known Issues page on the T echn ical Support W eb. When our engineering or T echnical Support team discovers a li mitation or problem wit h our product, we immedi ately post the information on t he Known Issues page.
User Guid e 13 T raining When you call W atchGuar d T echnical Support, you are prompted for your LiveSecurity Lic ense key. W e use this k ey to track the informati on you report about your network, and to add thi s issue to our datab ase of all t he support issues you have brought to our attention.
W atchGuard users group 14 Instructor -led courses W atchGuard offers a series of courses supporting our product l ine. Current titles include a two-day c ourse on fir ewalling basics with the W atchGuard Fi rebox System and a one-day course on virt ual private networking.
User Guid e 15 Onli ne He lp Starting WatchGuar d Online H elp W atchGuard Online Help can be started either from the W atchGuard Manageme nt Station or dir ectly fr om a br owser . • In the Management Station softw are, press F1 . • On any platform, browse to the direct ory con taining W atchGuard Online Help.
Online Help 16 Context-sens itive Help In addition to the regular online Help system, context-sensi tive or What’s This? Help is also avai lable. What’s This? Hel p provides a definition and useful informati on on fields and butt ons in the dialog boxes.
User Guid e 17 CHAP TER 3 W atchGuar d Options The W atchGuard Fireb ox System is enhanced by optional featur es designed to accommodate the needs of differ ent customer envir onments and security requ ir emen ts .
Obtaining WatchGuar d options 18 Mobile Use r VPN Mobile User VPN is the W atchGuard IPSec i mplementation of rem ote user virtual private networking. Mobile User VPN connects a n employee on the road or working from home to trusted a nd optional networks behind a F irebox usi ng a standard Internet connection, without compromi sing security.
User Guid e 19 PART III Configuring a Security Policy This secti on de scribe s how to conf igure y our se curity syste m. It s prim ar y focu s is o n using the W atchGuard Contr ol Center and P olicy Manager to devel op and implement a network security policy.
20 you to exert fine contr ol over the type of W eb sites users on your T rusted network are all owed to view . Set up network addr ess tr anslation (NA T) Hide the real IP addr esses of t he hosts and networks behind yo ur firewall through the use of network addr ess translation.
User Guid e 21 CHAP TER 4 Fir ebox Basics This chapter describes the f ollowing tasks, which require direct i nteracti on between the Management Station and the Firebox: •S e t u p a F i r e b o x .
What is a F irebox? 22 Placing a Fir ebox within a network The most common location f or a Fir ebox is dire ctly behind the Internet router , as pictured belo w: Other parts of the network ar e as follows: Management Stati on The computer on which you install and run the W atchGuard LiveSecurity Control Ce nter .
VPN Manage r Guide 23 Opening a configuration file Opening a configuration fi le P olicy Manage r is a compreh ensive software tool for cr eating, modifying, and savi ng configur ation fil es.
Resetti ng Fir ebox pass phrases 24 Saving a config uration to the local hard disk Fr om P olicy Manager in the Advanced view: 1 Select File => Save => As File . The Save dial og box app ears. 2 Enter the name of the file. The default is to save the file to the Wat chGuard directo r y .
VPN Manage r Guide 25 Setting the time zone • Don’t use words in sta ndard dict ionaries, even if you use them back ward or in a for eign la ngua ge . Cre ate your own a crony ms ins te ad. • Don’t use proper names, e speciall y company names or those of fa mous people.
Reinitial izing a misco nfigured Firebox 26 4 When you complete the QuickSetup wizar d, remove the loopb ack cabl e (assuming your Firebox has one) and return the F irebox to its regular position in your network. The Firebox r esumes normal oper ation the next time it restarts.
User Guid e 27 CHAP TER 5 Using the W atchGuar d Contr ol Center The W atchG uard Contr ol Center combines access to W atchGua rd F irebox System application s and tools in on e intuitive interface.
Control Center components 28 • A real-time monitor of tr affic thr ough the Fir ebox. QuickGuide The top part of the display just b elow the title bar is t he QuickGuide.
User Guid e 29 Control Center components •I P S e c •D V C P • W atchGuard VPN The first line of the tunnel entry shows the name that was a ssigned when the tunnel was created, al ong with the tunnel type (IPSec, D V CP , or W atchGuard).
W orking with the C ontr ol Center 30 When you expand an entry that has a r ed exclamation point, another excl amation point appears next to t he specific devi ce or tunnel with the probl em. Use this fe ature to r apidly identify and l ocate problems with your VPN network.
User Guid e 31 Policy Manager much more appr opriate tool for trac king logs; T raffic Monitor just pr ovides a real- time view of what the F irebox a ctivity. 1 Click the W atchGuard Contr ol Center button. Cli ck Sett ings . 2 T ype or use the scroll control to change t he Max Log Entries field.
Firebox Mo nitors 32 The P olicy Manager display includ es: Pull-down menus Menus that pr ovide acce ss to most configur ation and administration ta sks. T oolbar A row of b uttons immediatel y below the pull- down menus. Each button corresponds to a frequently performed P olicy Manager task.
User Guid e 33 HostW atch HostW atch The HostW atch application display s active connections occurri ng on a Fireb ox in real ti me. It can also gr aphically represent the c onnections list ed in a log file , eit her p layi ng ba ck a p revio us f ile for rev iew or displaying connecti ons as they are a dded to the curr ent log file.
LiveSecurity Event Processor 34.
User Guid e 35 CHAP TER 6 Configuring a Network Configuring a network refers to setting up the thr ee Fireb ox interfaces. T o do this, you need to: • Enter the IP address or addre sses for the Fir ebox interfaces. • Enter the IP addresses of secondary networks that are connected to and associated with a Fi rebox interfac e.
Setting up a drop-in network 36 Th e Quic kSe tup w izard a lso w rite s a ba sic c onfig uratio n fi le ca lled wizard.cfg to the har d disk of the Management Station. If you later want to expand or change the basic F irebo x configurat ion using P olicy Manager , use wizard.
User Guid e 37 Setting up a routed network • The T rusted interface ARP address replac es the router’s ARP address. • All three Fi rebox interfaces ar e assigned the same IP address. This is true whether or not you use the Optional interface. • The majority of a L AN resides on the T rusted interface .
Adding a secondary network 38 Addi ng a secondary netw ork A secondary network is a network on the same ph ysical wire as a Fi rebox interface that has an addr ess belonging to an entire ly differ ent network. Addin g a secondary network to a F i rebox interface ma ps an IP a ddress from the sec ondary network to the IP address of the int erface.
User Guid e 39 Defining a host route Defining a host route Configure a host r oute if ther e is only one host b ehind the router . Enter the IP addre ss of that single, spe cific host , and do not enter a bitmask. F rom P olicy Manager in the Advanced vi ew: 1 Select Netw ork = > Routes .
Entering WINS and DNS server add res ses 40 Entering WINS and DNS server addresses Several a dvanced feat ures of the F irebox, suc h as DHCP and Remote User VPN, r ely on shared W i ndows Internet Name Ser ver (WINS) and Domain Name System (DNS) server addresses.
User Guid e 41 Defining a Firebox as a DHCP server Modifying an exis ting subnet Fro m Pol ic y Ma na g e r: 1 Select Netw ork = > Configur ation . Cl ick the DHCP Server tab . 2 Click the subnet to r eview or modify. Click Edit . 3 When you have finished reviewin g or modifying the subnet, cl ick OK .
Defining a Firebox as a DHCP server 42.
User Guid e 43 CHAP TER 7 Blocking Sites and Ports Many types of network security attac ks are ea sily identif ied by patterns found in packet headers. P or t space pr obes, addr ess space pr obes, and spoofing atta cks all exhibit cha racteri stic behav ior that a good fir ewall can recogniz e and protect against.
Blocking a site permanently 44 2 Modify the default pac ket-h andling properties ac cording to your se curity policy prefer ences. For a description of each con trol, right-click the co ntrol, and then click What’s This? 3C l i c k OK .
User Guid e 45 Blocking a port p ermanently 2I n t h e Category li st, c lic k Blocke d Sites . 3 Modify the logging and notification par ameters accordi ng to your security policy prefer ences. F or detailed instr uctions, see “Customizing logging an d notification by servi ce or option” on page 76 .
Bloc king sit es tempo rarily with se rvice settings 46 Blocking sites tem porarily with service settings Use service properties to aut omatically and tem porarily block sit es when incoming tra ffic attempts to u se a denied service .
User Guid e 47 CHAP TER 8 Configuring Services The Services Arena of P olicy Manager displays an icon for each configured service. A service represent s a particular type of proxy or pa cket-filtering conne ction such as FTP , SMTP , or proxied HTTP .
Creating a new service 48 7 Y ou can add multiple services to the Services Arena while the Services dialog b ox is open. When you finish a dding services, click Close . The Ser vices Arena displays an icon fo r each ser vice added. 8C l i c k F i l e => S a v e => T o F i r e b o x to save your changes to the F irebox.
User Guid e 49 Defining service pr oper ties 8I n t h e Po r t text box , enter the well-known port number for thi s service. F or a list of well-kno wn services and their asso ciated por ts, see th e R eference Guide or Online Help. 9C l i c k OK . P o licy Man ager adds t h e port configurati on to the N ew Ser vice dial og box.
Defining service pr oper ties 50 6C l i c k OK . Adding outgoing s ervice properties Fro m Pol ic y Ma na g e r: 1 In the Services Arena, double-cl ick the service. Cli ck the Outgoing tab. The Proper ties dialog box displays the Outgoing properties ta b.
User Guid e 51 Configuring services for authentication Configurin g serv ices for authentication One way to create eff ective use r authentication envir on ments is to res trict all outgoing services to allow connecti ons only fr om authenticated users.
Setting up proxy services 52 2 On the toolbar , click the Delete Service icon (it appears as an “X”). Y ou can also select Edit => Delete. A verificatio n alert appears. 3C l i c k Ye s . P o licy Manager removes the s er vice from the Services Arena.
User Guid e 53 Setting up proxy services 3C l i c k Incoming . The Incomi ng SMTP P roxy dialo g box appear s, disp laying th e General tab. 4 Modify gener al properties accor ding to your preference. For a description of each con trol, right-click it, and then click What’s T his?.
Setting up proxy services 54 Configuring th e outgoing SMTP proxy Use the Outgoing SMTP Pr oxy dialog box to set t he parameters f or tra ffic going fr om your T rusted and Optional network to the world. Y ou must alr eady have an SMTP Proxy service icon in the Services Arena.
User Guid e 55 Setting up proxy services 5C l i c k OK . 6C l i c k F i l e => S a v e => T o F i r e b o x to save your changes to the F irebox.
Service pr ecedence 56 3 If you are using the HTTP proxy service because you want to use W ebBlock er , follow the pr ocedure in the next section . Otherwise, enable HTTP prox y properties acc ording to your secu rity policy pr eferences. F or detai led descri ptions of HTTP proxy op tions, see the R eference Guide .
User Guid e 57 Service pr ecedence “IP” refers to exactly one host I P address; “L ist” ref ers to multiple host I P addresses, a network address, or an ali as; and “Any” ref ers to the speci al “Any” tar get (not “Any” services).
Service pr ecedence 58.
User Guid e 59 CHAP TER 9 Contr olling W eb T raf fic W ebBlocker is a feature of the Fir ebox System that works in conjunction with the HTTP proxy to provid e W eb-site filtering ca pabilities. It enables you to exert fine control over the type of W eb sites that users on your trusted network ar e allowed to view .
Configuring the W ebB locker service 60 Logging and W ebBlocker W ebBlocker logs a ttempts to acc ess sites bloc ked b y W ebBloc ker . The log that is genera ted displays informat ion about source and destination addr ess as well as the block ed URL and the category that caused the denial .
User Guid e 61 Configuring the W ebB locker service Proces sor regularly and automatic ally updates the W ebBlock er database stored on your Firebox. F rom P olicy Manager: 1 If you have not alre ady done so, double-cl ick the service icon you ar e using for HTTP .
Manually do wnloading the W ebBlocker dat abase 62 2I n t h e Allowed Exceptions sec tion, cl ick Add to add ei ther a network or host IP address to be allowed a t all times. T o allow a specific string for a domain, select Host Address. T o allow a specific directory pattern, enter the string to be allow ed.
User Guid e 63 CHAP TER 10 Setting Up Network Addr ess T ranslation Network address translat ion (NA T) hides internal network addresses fr om hosts on an e xt er nal netw or k. W at ch Gua rd s upp or ts tw o type s of NA T: • Outgoing dynamic NA T Hides network addresses from hosts on anot her network; works only on outgoing messages .
Using simpl e dynamic NA T 64 Using simp le dynamic NA T In the majority of networks, the preferr ed security policy is to globally appl y network address transla tion to al l outgoing pack ets. Simp le dynamic NA T provides a q uick method to set NA T policy for your entire network.
User Guid e 65 Using service- based NA T Using service-based NA T Using service-based NA T , you can set outgoing dynamic NA T policy on a service-by - service basis. Service-ba sed NA T is most frequently used to ma ke exce ptions to a globally appl ied simple dynamic NA T entr y.
Configuring a service for incoming static NA T 66 Configurin g a service for incoming stati c NA T Static NA T works on a port-to-host basis. Incoming pack ets destine d for a specific public addres s and port on the External network are r emapped to an addr ess and port behind the firewall.
User Guid e 67 Configuring a service for incoming static NA T 6 Enter the internal IP address. The inter nal IP address is the final destination on the T r usted network. 7 If appropriate, enable the S et Inte rn al P or t T o Diffe rent P ort T ha n Ser vic e che ckbox .
Configuring a service for incoming static NA T 68.
User Guid e 69 CHAP TER 11 Setting Up Logging and Notification Logging and notification ar e crucial to an effective network security policy. T ogether , they make it possi ble to monitor your network sec urity , identify both attacks and attack ers, and take action to addres s security threats and chal lenges.
W atchGuard logging architecture 70 log messages to the se cond Event Proces sor . It continues through the list until it finds an Event Processor c apable of rec ording events.
User Guid e 71 Designating Event Processor s for a Firebox you run the QuickSetup wizar d. Y ou can specify a different primary Event Pr ocessor as well as multi ple backup Eve nt Proc essors. Adding an Event Processor Fro m Pol ic y Ma na g e r: 1 Select Se tup = > Logging .
Designating Event Processor s for a Firebox 72 Removing an Event P rocessor Remove an Event Processor when you no longer want to use it for any logging purpose. Fr om P olicy Manager: 1 Select Se tup = > Logging . The Logging Setup di alog bo x appears.
User Guid e 73 Setting up the Li veSecurity Event Proces sor Another way to set the Event Pr ocessor (and domain contr oller) clocks is to use an independent sour ce such as the atomic clock—b ased servers availa ble on the Internet. One place t o access this service is: http://www .
Setting up the Li veSecurity Event Proces sor 74 W indows NT service. The defaul t method on installation is for it to run as a Windows NT service. As a Windows NT or Windows 2 000 Service By default, the Eve nt Processor is installed t o run as a W indows NT service, starting automatically every time the host computer resta rts.
User Guid e 75 Setting global logging a nd notification prefer ences Starting and st opping the Event Processor The Event Proces sor starts automatica lly when you start the host on which it reside s. However , it is possible to stop or r estar t the Event Pr ocessor fr om its interfa ce at any time.
Custom izing l ogging an d notifica tion by s ervice or option 76 3 F or a record size, enable th e By Number of Entri es chec kb ox. Use the s crol l con tro l or en ter a nu mb er of l og rec ord e nt rie s. The Approximate Size field changes to display the approximate file size of the final log file.
User Guid e 77 Custom izing log ging and no tificat ion by servi ce or opti on Send Notifi cation Enable this checkbox to enabl e notificati on on the event type; clear it to disable logging for the event type .
Custom izing l ogging an d notifica tion by s ervice or option 78 Fro m Pol ic y Ma na g e r: 1 Double-click a s ervice in the Services Arena. The Pro perties dialog box app ears. 2C l i c k Logging . The Logging and No tification dialog bo x appears.
User Guid e 79 CHAP TER 12 Connect with Out-of-Band Management The W atchGuard Fi rebox System out-of-ba nd (OOB) management feature enables the Management Station to commun icate with a Fir ebox by way of a modem and telephone line. O OB is useful for remotely conf iguring a F irebox when access via the Ethernet interfaces is unavailab le.
Enabling the Management Stat ion 80 Preparing a Windows NT Management Station for OOB Install the Microsoft Remote Acces s Server (RAS) on the Management Station. F rom the W indows NT Desktop: 1 Attach a modem to your computer a ccording t o the manufacturer’s instruct ions.
User Guid e 81 Configuring the Firebox for OOB 5 Enter a nam e for you r c onne ct ion. This can be a nything th at remi nds you of the icon ’s purp ose — VPN Conn ection, for example. 6C l i c k Finish . 7 Click either Dial or Cancel . A new icon is now in the Network and Dial -Up Connections fol der .
Establishing an OOB connection 82.
VPN Manage r Guide 83 PART IV Administerin g a Security Policy Network security is mor e than just designing and impleme nting a security policy and copying the r esulting configuration file to a W atchGuar d Fir ebox. T ruly effective network security requir es constant vi gilance and ongoing adaptatio n to changing business needs.
84.
VPN Manage r Guide 85 CHAP TER 13 Cr eating Aliases and Implementing Authentication Aliases are s hortcuts used to identify gr oups of hosts, networks, or users with one name. The use of aliases simplif ies user authentication and service configur ation.
Using ho st aliases 86 Adding a host alias Fro m Pol ic y Ma na g e r: 1 Select Se tup = > Authentica tion . The Member Access and Aut hentication Setup dialo g box appear s.
VPN Manage r Guide 87 What is user authentication? What is user au thenticati on? User authentication allows the t racki ng of connect ions based on name rat her than IP address .
Configuring Firebox authentication 88 Configurin g Firebox authentication Y ou can use the W atchGuard F irebox Syst em to define users and groups for authentication. Enter Fi rebox User informat ion using P olicy Manager . Fir ebox Users are intended fo r remote user virtual private networking (VPN).
VPN Manage r Guide 89 Configuring RADIUS server authentication 2 Under Authenti cation Enable d V i a , clic k th e NT Servic e option. Wa tchGuard activates the Windows NT Server controls. 3C l i c k t h e Windows NT Server tab. 4 T o identify the host either: - Enter both the host name and the IP addres s of the Windows NT network.
Configuring CRYP TOCard server authentication 90 On the RADIUS Server 1 Add the IP address of t he Fireb ox where appr opriate accor ding to the RADIUS server vendor . Some RADIUS vendors may not requir e this. T o deter mine if this is req uired for your implementation, check th e RADI US ser ver vendor documen tation.
VPN Manage r Guide 91 Configuring SecurID authentication 8 Enter the value of the shar ed secret between the F irebox and the CRYPT OCard server . This is the key or cl ient key in the “P eers” file on the CR YPTOCard ser ver .
Using authentication to define remote user VPN access 92 7 If you ar e using a back up server , enable the Spec ify backup Secur ID server checkbox. Enter the IP address and port number for the backup server .
User Guid e 93 CHAP TER 14 Monitoring Fir ebox Activity An important part of an eff ective network securit y policy is the monitoring of network events. Monitoring enables you to re cognize patterns, id entify potential attacks, and tak e appropriate action.
Firebox Mo nitors 94 Setting F ir ebox Mo nitors vi ew properties Y ou can configure Firebox Monitors to displ ay tra ffic at different spe eds, intervals, and amplitude. From F irebox Monitors: 1 Select V iew = > Properties . 2 Modify display pr oper ties accor ding to your preferences.
User Guid e 95 Firebox Mo nitors P acket counts The number of pack ets all owed, denied, and rej ected between st atus queries. Rejected pack ets are denied pack ets for which W atchGuard se nds an ICMP error messa ge. Allowed: 5832 Denied: 175 Rejects: 30 Log and notif icati on hosts The IP addresses of the log and notifi cation hosts.
Firebox Mo nitors 96 Block Network 123.152.24.64/28 eth2 Logging opti ons Logging options configur ed with either the QuickSetup wizard or by adding and configurin g services fr om P olicy Ma nager .
User Guid e 97 Firebox Mo nitors 42 http-serve S 1052 536 476 372 41 fwcheck S 716 288 296 232 43 http-proxy S 1072 660 580 472 22121 smtp-proxy S 984 360 536 464 19698 http-serve S 1176 704 600 326 I.
HostW atch 98 198.148.32.0 * 255.255 .255.0 U 1500 0 129 eth1:0 127.0.0.0 * 255.0.0.0 U 3584 0 9 lo default 207.54.9.30 * UG 1500 0 95 eth0 ARP table A snapshot of the ARP table on the running Firebox. The ARP table is used to map IP addresses t o hardwar e addresse s: ARP Table Address HWtype HWaddress Flags Mask Iface 207.
User Guid e 99 HostW atch The HostW atch display uses the logging set tings configured for your F irebox usi ng the P olicy Manager . F or instance, to see all denied attempts at incoming T elnet in HostW atch, configure the F irebox to log incomi ng denied T elnet atte mpts.
HostW atch 100 2 Browse to l ocate and sele ct the Logdb file. By default, log files are stored in the WatchGuard installa tion director y at C:Program Files Wa tchGuar dlogs . HostW atch loads the log f ile and beg ins to r eplay the acti vity . 3 T o pause the display , click Pa u s e .
User Guid e 101 HostW atch 4I n t h e New User field, enter the user ID of the authenticated user to watch. Cli ck Add . R epeat for each authenti cated us er that Ho stW atch sho uld monit or . 5C l i c k OK . Modi fying view pr opertie s Y ou c an change how HostW a tch displays information.
HostW atch 102.
User Guid e 103 CHAP TER 15 Reviewing and W orking with Log Files Log entries ar e stored on the prima ry and backup LiveSecurity Event Pr ocessor . By default, log fil es are placed i n the W atchG uard insta llation directory in a subdirectory called l ogs.
Viewing files with LogView er 104 2 Configure LogV iewer display preferences as you c hoose. For a description of each con trol on the Genera l tab, right-click it and th en click What’s This? For infor mat ion on the F ilter D ata t ab, se e “D ispl aying and hi ding f ields” o n page 105.
VPN Manage r Guide 105 Displaying and hiding fields Displayin g and hiding fi elds Use the Pref erences dialog box to show or hide columns displa yed in LogV iewer . Fro m L o g Vie we r : 1 Select V iew = > Preferenc es . Click the Fi lter D ata tab.
W orkin g with log files 106 IP header l ength Length, in octets, of the I P header for this pack et. A header length that is not equal to 20 indicat es that IP options were pr esent. Default = Hide TTL (time to live) The value of the TTL field i n the logged pack et.
VPN Manage r Guide 107 W ork ing with log files 4 Enter the destination for the f iles in the Copy to T his Di rector y box. 5C l i c k Merg e . The log files are merged and saved to the new file in the designa ted directory .
W orkin g with log files 108.
User Guid e 109 CHAP TER 16 Generating Reports of Network Activity Historical Reports is a r epor ting tool that c reates summa ries and reports of F irebox log activit y. It gener ates these report s using the log files c reated by and stor ed on the LiveSecurity Event Pr ocessor .
Specifying report sections 110 Creating a new report Fr om Historical Reports: 1C l i c k Add . 2 Enter the report name. The report name will appear in Histor ical R eports, the LiveSecurity Event P rocessor , and the title of the out put. 3 Use the box next to Log Directory to define the locati on of log fi les.
User Guid e 111 Specifying a report time span 2 Enable the checkboxes for sec tions to be included in the r eport. F or a description of each section, see “R eport sections and cons olidated sections” on page 115. Specifying a report time span When running Historical Reports, the de fault is to run the re port across the entire log file.
Exporting reports 112 3 Enter the number of elements to r an k in the tab le. Defaul t is 1 00. 4 Select the style of gr aph to use in the r epor t. 5 Select the manner in which you want the proxied summary reports sorted: bandwidth or connections. 6 Enter the number of r ecords to display per page for the deta iled sect ions.
User Guid e 113 Using report filte rs Exporti ng a r eport to a text file When y ou se lect T ext Export from the Setup tab on the Report P roperties dialo g box , the report output i s created as a comma-delimited forma t fil e. The report appears a s a .
Scheduling and running reports 114 Editing a filter At any time, you can modif y the properties of an existing fil ter . Fr om the Filt ers dialog box in Histori cal Reports: 1 Highlight th e filter to modify. Click Edit . The R eport F ilter dialo g box appea rs.
User Guid e 115 Report sections and consolidated sections Manually runnin g a r e port At any time, you can run one or more r eports using Historical Reports. F rom Historical Reports: 1 Enable the checkbox next to each re port you would like to gener ate.
Report sections and consolidated sections 116 Session Summary – P acket F iltere d A table, and optionall y a gra ph, of the t op incoming and outgoing sess ions, sorted either by byt e count or number of connections. The format of the session is: cl ient -> server : service.
User Guid e 117 Report sections and consolidated sections Denied Outgoi ng P acket Detail A list of denied outg oing pack ets, sorted by time. The fields are Date, Tim e, T ype, Client, Client P ort, Server , Ser ver P or t, Protocol , and Durati on. Denied Incomi ng P acket Detai l A list of denied i ncoming pack ets, sorted by ti me.
Report sections and consolidated sections 118 Reports attempts to r esolve the server port to a table to repr esent the ser vice name. If r esolution fai ls, Historical Reports displ ays the port number .
User Guid e 119 PART V W atchGuar d ® Virtual Private Networking A virtual private network (VPN) allows the secure tunneling of data between two networks (or a host to a network) vi a a third unpr otected network.
120.
User Guid e 121 CHAP TER 17 Configuring Branch Of fice V irtual Private Networking Branch offi ce vir tual p rivate networ king (V PN) c reates a secure tunnel , over an unsecure network, between two networks pr otected by the W atchGuard F irebox System or bet ween a W atchGuard Fireb ox and an IPSec-compli ant device.
Using DVCP to connect to devices 122 • IP network addresses for the networks com municating with one another . • A common passphrase, kn own as a shared secr et.
User Guid e 123 Using DVCP to connect to devices Note also tha t if you configure a SOHO for both Basic and Enhanced D V CP , the gateway names must be different. Fro m Pol ic y Ma na g e r: 1 Select N e t w o r k => B r a n c h O f f i c e V P N => B a s i c D V C P .
Branch of fice VPN with IPSec 124 Y ou c an also change the network range of a W atchGuard client. However , when you save the configur ation to the server , it automatically triggers the client to reboot a nd load the new polic y. Fro m Pol ic y Ma na g e r: 1 Select N e t w o r k => B r a n c h O f f i c e V P N => B a s i c D V C P .
User Guid e 125 Branch of fice VPN with IPSec and how W atchGuard implements branc h office VPN with IPSec, see the Ne two rk Secu rity Han dbook. Fro m Pol ic y Ma na g e r: • Select N e t w o r k => B r a n c h O f f i c e V P N => I P S e c .
Branch of fice VPN with IPSec 126 Removing a ga teway Fro m t h e Configure Gateways dia log box: 1 Click the gateway. 2C l i c k Remove . Configuring a tunnel with manual security A tunnel encapsulates pack ets between two gateways. It speci fies encryption type and/or authentication method.
User Guid e 127 Branch of fice VPN with IPSec 5U s e t h e A uthe nticat ion drop list to selec t an authentication method. Options inclu de: None (no authe ntication), MD5-HMA C (128-bit algo rithm), or SHA1-HMAC (160-bi t algorit hm). 6C l i c k Key .
Branch of fice VPN with IPSec 128 11 After you add all tunnels f or this gateway , click OK . The Config ure Gate ways dialo g box appea r s. 12 T o configure more tunnels for another gateway , click T unnels . Select a new gateway and repeat the tunnel c reation pro cedure for that gateway.
User Guid e 129 Branch of fice VPN with IPSec 9U s e t h e Protocol drop lis t to limit the prot ocol used by the policy. Option s inclu de: * (specify port s but not protoco l), TCP , and UD P . 10 In the Sr c P ort fi eld, enter the local host port.
Configuring Wat chGuard VPN 130 Allow VPN a ccess to any services T o allow all tr affi c from VPN connection s, add the Any service to the Services Arena and configur e it as descr ibed above.
User Guid e 131 Configuring Wat chGuard VPN 4I n t h e Local Fir ebox IP fiel d, enter an IP address from a r eser ved network not in use on the local or rem ote networks. 5 In the text box to the left of the Add button, enter the IP address i n slash notation of any rem ote network to which acces s should be granted from th e lo cal Fir ebox .
Configuring Wat chGuard VPN 132 Conf igur ing incom ing serv ice s to allo w V PN Because users on the r e mote Fi rebox are tec hnically outside the truste d network, you must confi gure servi ces to all ow tr affic thr ou gh t he VPN connect ion.
User Guid e 133 CHAP TER 18 Configuring the Fir ebox for Remote User VPN Remote user virtual private networking (RUVPN) establishes a secur e connection between an unsecured r emote host and a pr otected network over an unsecur ed network.
Configuring shared servers fo r RUVPN 134 • The IP addresses of the DNS and WINS servers in the trusted network that perform IP addres s lookup on host alias names. • The usernames and passwords of those a uthorized to connect to the F irebox using RUVPN.
User Guid e 135 Configuring services to allow incoming RUVPN 3 Enter the username and password. Firebox usernames are case sensitive. 4 T o add the user to a gr oup, select the gr oup name in the Not Member Of list. Click the left-pointin g arrow . Use pptp_u sers for R emote User PPTP and ipsec_users for Mobile User VPN.
Configuring the Firebox for Remote User PPTP 136 -F r o m : S e l e c t e d - T o: pptp_users or ipsec_users Configurin g the Firebox for Remote User PP TP Configuring the Firebox for Remote User PPTP.
User Guid e 137 Configuring the Firebox for Mobile User VPN Fro m t h e R emote Us er Setu p dialog box: 1C l i c k t h e PPTP tab. 2C l i c k Add . 3U s e t h e Choo se T ype drop list to sele ct either a host or network. Y ou can configure u p to 50 addresses.
Configuring the Firebox for Mobile User VPN 138 automatically incl uded in the P olicy Manager software, to activate the fe ature a license for eac h installati on of the client software must be purc hased. T o purcha se IPSec lic ense key s, contact your loc al resel ler or visit: http://www .
User Guid e 139 Configuring the Firebox for Mobile User VPN 10 Use the Encryption dr op list to select an encryption method. Options available with the s trong encryption version of WatchGuard Firebox System include: None (no encryption), DES-CBC (56-bit), an d 3DES-CBC (16 8-bit).
Configuring d ebugging options 140 The packages are l ocated on the W atchGuard Li veSecurity Service W eb site at http://www .watchguard.com/support. Enter the Service W eb site using your LiveSecurity username and password. Click the Mobile User VPN link.
User Guid e 141 CHAP TER 19 Pr eparing a Host for Remote User VPN Remote user virtual private networking (RUVPN) establishes a secur e connection between an unsecured r emote host and a pr otected network over an unsecur ed network.
Preparing the client computers 142 • Public I P address Remote hos t operating sys tem The remote client must be running Windows and have the most r ecent MSDUN (Microsoft Dial -Up Networking) upgra des installed and may need other extensions and updates for pr oper configurati on.
User Guid e 143 Preparing the client computers 5 Enter the domain name you are connec ting to. This shou ld be the same as the “Log on to Windo ws NT domain” va lue. 6 Enter a description for your com puter (optional). 7 V erify that Dial-Up Adapter #2 ( VPN Support) is installed.
Preparing the client computers 144 9C l i c k Dial Out On ly . Clic k Continue . 10 Click OK . 11 Restart the mach ine. Adding a domain name to a Windows NT workstation Often remote clients need to connect to a domai n behind the fir ewall. T o do this, the remote clie n t must be able to r ecognize the domains to whi ch they belong.
User Guid e 145 Configuring the remote host for RUVPN with PP TP 9I n t h e Initial Connec tion windo w th at ap pear s, cl ick Ye s . 10 Click Pr operties . The Virtual Pri vate Connecti on window a ppears. 11 Click the Ge ner al tab, and e nter a host name or an IP address of the destinati on comp uter .
Using Remote Us er PPTP 146 10 Click OK . Click OK again . 11 Restart the comput er . Installing a VPN ad apter on Windows NT Fr om the Windows NT Desktop of t he remote host: 1D o u b l e - c l i c k My Com puter . 2D o u b l e - c l i c k Dial-Up Networking .
User Guid e 147 Configuring d ebugging optio ns 3 Double-click the RUVPN connection. If you conf igured th e client co mputer as descr ibed in “Wi ndows 95 /98 plat form preparati on” o n page 14 2, double- click Con nect with RU VPN. 4 Enter the remote client username and passwor d.
Configuring d ebugging options 148.
User Guid e 149 Index A Access cont roll ing 83 Access r ules def ining 49 Accessing kno wn issues 12 Activating LiveSecurity Service 8 Active connections 95 FTP 95 Active TCP connections 95 Addin g e.
150 C Changi ng an interface IP address 39 IPSec policy order 129 remote network entries on VPN 131 Checklist, branch office VPN 121 Client DVCP 122 Client f or Micr osof t Networ ks installing 143 Cl.
User Gui de 151 characte ristic s 36 configur ation 36 DVCP Client Wizard 122 introductio n 122 Dynamic NA T adding ent ries 64 described 63 disabl ing 65 enabling 63, 65 enabling si mple 64 reord eri.
152 monitor s 2, 32 , 93 Band widthMe ter 94 opening co nfigur ation fi le 23 opening co nfigur atio n file fr om 23 PPP timeout disconnects 81 reinitiali zing 25 resettin g pass phr ase 24 saving con.
User Gui de 153 exporti ng repo rts as 112 HTTP 48 , 60, 94, 99 protoc ol 55 proxied 60 proxy 59 types of ser vices 55 HTTP p roxy 112 HTTP proxy repo rts HT TP detail 116 most popu lar d omains 116 I.
154 for blo cked sites 44 global preferences 75 LogV ie wer 103 options 96 PPTP 137 repl ayin g a fil e 99 searching log files 103 setting f or a service 77 setting u p 20 viewing files 103 WebB locke.
User Gui de 155 Navigating Control Center 27 Netscape Communica tor 3 Network broadc ast 2 changing range of clie nt 124 configur ation 95 configur ing 35 conf igu ring OO B 81 inter faces 97 LiveSecu.
156 pull-down menus 32 ser vices arena 32 Status B ar 32 toolbar 32 P olicy order changing IPSec 129 P olling rate changing 30 P o rt a ddress trans lation.
User Gui de 157 adding a domain n ame to an NT workst ation 144 adding new doma in fo r NT works tat ion 144 installing a V PN adaptor f or Windows 95/ 98 145 installing a VPN ad aptor on Windows NT 1.
158 introductio n 37 Ro u t e s 97 network co nfigur ation 37 RUVPN 147 activating r emote user PPTP 136 adding a d omain nam e for NT 144 adding mem bers to bui lt-in user grou ps 13 4 adding new dom.
User Gui de 159 Sof tware U pdate 7 SOHO editing tunn el properties 123 reboo ting 12 4 removing t unnel 124 SpamScreen 18 Security P a rameter In dex see also SPI (Security P ara meter Index) 126 Spo.
160 manager 17 mo bile us er 18 multiple-box config uration 130 preventing IP spoof ing 131 remote us er 11 9 removing IPSec gatew ay 12 6 r u nning w ith PPTP 147 two-box co nfigur ation 130 verifyin.
An important point after buying a device WatchGuard Technologies FireboxTM System 4.6 (or even before the purchase) is to read its user manual. We should do this for several simple reasons:
If you have not bought WatchGuard Technologies FireboxTM System 4.6 yet, this is a good time to familiarize yourself with the basic data on the product. First of all view first pages of the manual, you can find above. You should find there the most important technical data WatchGuard Technologies FireboxTM System 4.6 - thus you can check whether the hardware meets your expectations. When delving into next pages of the user manual, WatchGuard Technologies FireboxTM System 4.6 you will learn all the available features of the product, as well as information on its operation. The information that you get WatchGuard Technologies FireboxTM System 4.6 will certainly help you make a decision on the purchase.
If you already are a holder of WatchGuard Technologies FireboxTM System 4.6, but have not read the manual yet, you should do it for the reasons described above. You will learn then if you properly used the available features, and whether you have not made any mistakes, which can shorten the lifetime WatchGuard Technologies FireboxTM System 4.6.
However, one of the most important roles played by the user manual is to help in solving problems with WatchGuard Technologies FireboxTM System 4.6. Almost always you will find there Troubleshooting, which are the most frequently occurring failures and malfunctions of the device WatchGuard Technologies FireboxTM System 4.6 along with tips on how to solve them. Even if you fail to solve the problem, the manual will show you a further procedure – contact to the customer service center or the nearest service center
