WatchGuard Technologies Firebox X Getting Started, About WatchGuard System Manager, Log Server

Page 7

CHAPTER 1 Getting Started

Historically, organizations used many tools, systems, and personnel to control the security of their net- works. Different computer systems controlled access, authentication, virtual private networking, and net- work control. These expensive systems are not easy to use together or to keep up-to-date. WatchGuard® System Manager (WSM) supplies an integrated solution to manage your network and control security problems. This chapter tells you how to install WatchGuard System Manager into your network.

About WatchGuard System Manager

WatchGuard® System Manager (WSM) gives you an easy and efficient way to manage your network secu- rity. Use one computer as a management station to show, manage, and monitor all the Fireboxes in your network.

WSM gives support for mixed environments. You can manage Firebox® III and Firebox X devices that use different versions of appliance software. You can also manage Firebox X Edge devices.

WSM has three servers that do Firebox management functions:

WatchGuard Management Server

The WatchGuard Management Server operates on a Windows computer. With this server, you can manage all Firewall devices and create VPN tunnels using a simple drag-and-drop function. The basic functions of the Management Server are:

-Centralized management of VPN tunnel configurations

-The certificate authority for distributing certificates for IPSec tunnels

-Protocol translation in support of the WatchGuard SOHO and Firebox X Edge products

Log Server

The Log Server collects logs from each WatchGuard Firebox. The native storage format is XML (plain text) for easy troubleshooting and reporting. Among the information collected from firewall devices are traffic logs, event logs, alarms, and diagnostic messages.

WebBlocker Server

The WebBlocker Server operates with the Firebox HTTP proxy to deny user access to applicable Web sites. The administrator sets the categories of permitted Web sites during

User Guide

1

Image 7

Contents WatchGuardSystem Manager User Guide Address Contents Copy the online help system to more computers Setting Up Logging and NotificationImporting Certificates Microsoft Internet Explorer 5.5 LogViewer SettingsApache Software License, Version 2.0, January Log Server Getting StartedAbout WatchGuard System Manager WatchGuard Management ServerAbout Hardware and Appliance Software Installing WatchGuard System ManagerNetwork addresses License KeysOptional interfaces 1Network IP Addresses Without the FireboxExternal interface Trusted interfaceStrong Software encryption levelsBase Uses 40-bit encryptionPutting the Firebox into operation on your network Setting Up Your Management ServerAdmin password Master passwordInstallation Topics After Your InstallationRouted configuration WFS appliance software configuration modesDrop-in configuration Dynamic IP support on the external interface Adding secondary networks to your configurationTo add a secondary networks, do one of these procedures Use the Quick Setup Wizard during installationAbout slash notation Entering IP addressesInstalling the Firebox cables Installation Topics Easy software updates Service and SupportLiveSecurity Service Solutions Threat responses, alerts, and expert adviceLiveSecurity Service Broadcasts Basic FAQs LiveSecurity Service Self Help ToolsNew from WatchGuard Online Training Advanced FAQsKnown Issues Interactive Support ForumOnline Help Using the WatchGuard Users ForumWatchGuard Users Forum WatchGuard Users GroupSoftware requirements Product DocumentationTechnical Support Copy the online help system to more computersHours Web Site Service TimeWe try to supply a solution in a maximum time of four hours Type of ServiceTraining and Certification From the Windows Desktop Monitoring Your NetworkStarting WatchGuard System Manager About the WatchGuard System Manager WindowLog Connecting to a FireboxDisconnecting from a Firebox DeviceSeeing Information about Devices Connecting to a ServerType the password for the Management Server Disconnecting from a ServerCertificates Firebox StatusBranch Office VPN Tunnels No exclamation point Seeing Information on Log ServersMobile user VPN tunnels Pptp user VPN tunnelsMonitoring VPNs Firebox Manager About the WatchGuard ToolbarStarting Security Applications Policy ManagerHistorical Reports Quick Setup WizardHostWatch Log ViewerSetting Up the Log Server Setting Up Logging and NotificationLog Server collects logs from each WatchGuard Firebox Configuration Guide for your version of appliance software WatchGuard Log Server Configuration dialog box appearsType the new log encryption key two times Click OK Setting Global Logging and Notification PreferencesClick Save Changes or Close Click Save Changes Setting Global Logging and Notification Preferences Traffic log messages Traffic Alarm Event DiagnosticReviewing and Working with Log Files Types of Log MessagesStarting LogViewer Alarm log messagesDiagnostic log messages Log File Names and LocationsBrowse to find the log file and click Open LogViewer Settings Click to set the format of the logs to the default colors Changing LogViewer settings with WFS appliance softwareSelect Edit Find Using LogViewerPaste the data into any text editor Click Browse to find the files to put together Click Merge Click File Merge log filesUsing LogViewer Using LogViewer Creating and Editing Reports Generating Reports of Network ActivityType the report name From Historical Reports, click AddSelect the filter Type the Firebox IP address or host name. Click Add Specifying a Report Time IntervalChange the report definition Specifying Report Sections To consolidate report sections Setting Report PropertiesType the number of items to put in the table Exporting Reports Complete the Filter tabs Using Report FiltersChange the filter properties When finished, click OKRunning Reports Report Sections and Consolidated SectionsReport Sections and Consolidated Sections Session Summary Proxied Traffic Consolidated sections Report Sections and Consolidated Sections Public Key Cryptography and Digital Certificates Managing Certificates Certificate AuthorityPKI in a WatchGuard VPN From the menu, select the correct Managing the Certificate AuthorityCertificate Authority CA Certificate Find and Manage Certificates Management Server CA CertificateGenerate a New Certificate GWvpn gateway nameDestroy RevokeReinstate Puts back a certificate that was revoked beforeImporting Certificates Managing the Firebox X Edge Firebox SohoNetscape Netscape CommunicatorSystem Status Troubleshooting ideasAdministration Managing the Firebox X Edge or Soho DeviceLogging Removing CertificatesSystem security and remote management FirewallSelect File Soho Management Clean up on PC Removing Certificates WatchGuard Firebox Software End-User License Agreement Appendix a Copyright and LicensingWatchGuard System Manager Copyright and Trademarks OpenSSL License LicensesOriginal SSLeay License Apache Software License, Version 2.0, January Licenses Pcre License GNU Lesser General Public License Licenses Licenses Licenses GNU General Public License Licenses Licenses Licenses Sleepycat License Licenses General File Locations Appendix B WatchGuard File LocationsQuick Setup Wizard Default File LocationsHostWatch for Fireware Appliance Software Firebox System Manager for Fireware Appliance SoftwarePolicy Manager for Fireware Appliance Software Policy Manager for WFS Appliance Software WatchGuard System ManagerLogViewer Firebox System Manager for WFS Appliance SoftwareHostWatch for WFS Appliance Software Flash Disk Management for WFS Appliance SoftwareWebBlocker Server Management ServerLog Server User Interface Log Server for WFS Appliance Software Log Server for Fireware Appliance SoftwareHistorical Reports Log Merge Management Server Setup WizardManagement Server User Interface WatchGuard Certificate Authority Default File Locations Index Muvpn Wctp 100