WatchGuard Technologies FireboxTM System 4.6 guide

Viewing files with LogViewer

2Configure LogViewer display preferences as you choose.

For a description of each control on the General tab, right-click it and then click What’s This? For information on the Filter Data tab, see “Displaying and hiding fields” on page 105.

Searching for specific entries

LogViewer has a search tool to enable you to find specific transactions quickly by keyphrase or field. From LogViewer:

By keyphrase

1Select Edit => Search => By Keyphrase.

2Enter an alphanumeric string. Click Find.

LogViewer searches the entire log file and displays the results as either marked records in the main window or a separate filter window based on your selection.

By field

1Select Edit => Search => By Fields.

2Click the Field column. Use the Field drop list to select a field name.

3Click the Value column. Use the Value drop list to select a value, or type in a specific value.

4Click Search.

LogViewer searches the entire log file and displays the results as either marked records in the main window or a separate filter window based on your selection.

Copying and exporting LogViewer data

You can either copy and paste or export log file data as text (.txt) from LogViewer into another application.

Copying log data

1Select the log entries to copy.

Use the SHIFT key to select a block of entries. Use the CTRL key to select multiple, non- adjacent entries.

2To copy the entries for pasting into another application, select Edit => Copy => To Clipboard.

3To copy to the Filter window, select Edit => Copy => To Filter Window.

Exporting log data

You can export log records from either the main window (all records) or a separate filter window.

1Select File => Export.

The Save Window dialog box appears.

2Select a location. Enter a file name. Click Save.

LogViewer saves the contents of the selected window to a text file.

104

Image 114

WatchGuard Technologies FireboxTM System 4.6 manual Searching for specific entries, Copying and exporting LogViewer data

Contents

WatchGuard Firebox System User Guide Disclaimer Copyright and Patent Information WatchGuard Firebox System WFS End-User License Agreement Page Declaration of Conformity Watchguard FCC Certification CE NoticeCSA Statement Table of Contents Using the WatchGuard Control Center Setting Up Network Address Translation 149 Part I Introduction Welcome to WatchGuardWatchGuard Firebox System components WatchGuard Firebox WatchGuard Control CenterWatchGuard security suite Software requirements LiveSecurity ServiceMinimum requirements Web browser requirements Hardware requirements CPU WatchGuard Optional Features Part II WatchGuard ServicesLiveSecurity Service Technical SupportPage LiveSecurity broadcasts LiveSecurity ServiceSoftware Update Information Alert Support Flash Activating the LiveSecurity ServiceEditorial Virus Alert Minimize or close your Web browser LiveSecurity broadcasts Accessing frequently asked questions FAQ Technical Support Getting Internet technical support Known issuesClick the LSS/SOHO Known Issues link on the left Getting telephone support Training WatchGuard Interactive Training System Wits WatchGuard users group Online HelpInstructor-led courses Copying the Help system to additional platforms Starting WatchGuard Online HelpSearching for topics Online Help system requirements Context-sensitive Help VPN Manager WatchGuard OptionsCurrently available options High Availability Obtaining WatchGuard options Mobile User VPNSpamScreen Part III Configuring a Security Policy Set up network address translation NAT Set up logging and notificationConnect with out-of-band management What is a Firebox? Firebox Basics Placing a Firebox within a network Opening a configuration from the Firebox Opening a configuration fileSaving a configuration file Opening a configuration from a local hard disk Saving a configuration to the Firebox Resetting Firebox passphrasesSaving a configuration to the local hard disk Tips for creating secure passphrases Select Setup =Time Zone Setting the time zoneReinitializing a misconfigured Firebox Reinitialize the Firebox using the QuickSetup wizard Booting from the system area Navigating the WatchGuard Control Center Using the WatchGuard Control CenterStarting the Control Center and connecting to a Firebox Control Center components QuickGuide Front panelFirebox and VPN tunnel status Expanding and collapsing the display IPSecRemote VPN tunnels Red exclamation point Working with the Control Center Connecting to a FireboxSetting the maximum number of log messages Traffic Monitor Policy Manager Manipulating the Traffic MonitorOpening WatchGuard Firebox System tools Firebox Monitors LogViewerChanging the Policy Manager view HostWatch Historical ReportsLiveSecurity Event Processor LiveSecurity Event Processor Trusted Configuring a NetworkRunning the QuickSetup wizard External Setting up a drop-in network Setting up a routed network Defining a network route Select Network = ConfigurationAdding a secondary network Select Network = Routes Defining a host route Setting the default gatewaySelect Network = Default Gateway Changing an interface IP address Entering Wins and DNS server addresses Select Network = Configuration. Click the General tabSelect Network = Configuration. Click the Dhcp Server tab Defining a Firebox as a Dhcp server Modifying an existing subnet Removing a SubnetClick the subnet to remove it. Click Remove Click OK Defining a Firebox as a Dhcp server Configuring default packet handling Select Setup = Default Packet HandlingBlocking Sites and Ports Changing the auto-block duration Blocking a site permanentlyRemoving a blocked site Logging and notification for blocked sites Logging and notification for blocked ports Blocking a port permanentlyRemoving a blocked port Category list, click Blocked Sites Blocking sites temporarily with service settings Configuring a service to temporarily block sitesViewing the Blocked Sites list Configuring Services Adding an existing serviceClick OK to close the Properties dialog box Secure Creating a new serviceIgnore Port Defining service properties Adding incoming service properties Adding outgoing service properties Adding addresses to service propertiesWorking with wg icons Deleting a service Configuring services for authenticationModifying a service Under Internal Hosts, click Add Configuring the incoming Smtp proxy Setting up proxy servicesConfiguring an Smtp proxy service Click Yes Protecting your mail server against relaying Selecting content typesAdding address patterns Select headers to allow Click Outgoing Configuring an FTP proxy serviceConfiguring the outgoing Smtp proxy Add masquerading options Configuring an Http proxy service Service precedence From Rank Any List Service precedence Controlling Web Traffic How WebBlocker worksReverting to old WebBlocker databases Logging and WebBlocker Configuring the WebBlocker servicePrerequisites to using WebBlocker Activating WebBlocker Creating WebBlocker exceptions Setting privilegesScheduling operational and non-operational hours Click the WebBlocker Controls tab Manually downloading the WebBlocker database Debug- Outputs debugging information Setting Up Network Address Translation What is dynamic NAT? Enabling simple dynamic NAT Using simple dynamic NATSelect Setup = NAT Adding dynamic NAT entries Using service-based NAT Enabling service-based NATConfiguring service-based NAT exceptions Select Network = Configuration. Click the External tab Configuring a service for incoming static NATSetting static NAT for a service Adding external IP addresses Enter the internal IP address CheckboxClick OK to close the Add Static NAT dialog box Configuring a service for incoming static NAT Setting Up Logging Notification Ensure logging with failover logging WatchGuard logging architecture Designating Event Processors for a FireboxLiveSecurity Event Processor Adding an Event Processor Editing an Event Processor settingSelect Setup = Logging Enabling Syslog logging Synchronizing Event Processors Removing an Event ProcessorReordering Event Processors For Windows NT Event Processors Running an Event Processor on Windows Setting up the LiveSecurity Event ProcessorInstalling the Event Processor program Running an Event Processor on Windows NT or Windows Viewing the Event Processor As a Windows NT or Windows 2000 ServiceInteractive mode from a DOS window Click WG LiveSecurity Event Processor. Click Startup Setting the interval for log rollover Setting global logging and notification preferencesSetting the log encryption key Starting and stopping the Event Processor Controlling notification Customizing logging and notification by service or optionScheduling log reports Category Setting logging and notification for a service Setting Launch Interval and Repeat Count Setting logging and notification for blocked sites and ports Select Setup = Blocked Sites Connecting a Firebox with OOB management Connect with Out-of-Band ManagementEnabling the Management Station Preparing a Windows NT Management Station for OOB Install the modemConfigure the dial-up connection Preparing a Windows 95/98 Management Station for OOB Configuring PPP for connecting to a Firebox Configuring the Firebox for OOBSelect Network = Configuration. Click the OOB tab Establishing an OOB connection Establishing an OOB connection Firebox Activity Monitors Part IV Administering a Security PolicyAliases and Authentication Network Activity ReportsPage Creating Aliases Implementing Authentication Using host aliases Adding a host alias Modifying a host aliasRemoving a host alias What is user authentication? User authentication typesHow user authentication works Under Authentication Enabled Via, click the Firebox option Configuring Firebox authenticationConfiguring Windows NT Server authentication To close the Setup Remote User dialog box, click Close Configuring Radius server authentication Click the Windows NT Server tab On the Radius Server Configuring CRYPTOCard server authenticationEnter the administrator password Enter or accept the time-out in seconds Configuring SecurID authentication Using authentication to define remote user VPN access Example Configuring a service for Remote User VPN Starting Firebox Monitors and connecting to a Firebox Monitoring Firebox Activity Bandwidth Meter Setting Firebox Monitors view propertiesServiceWatch StatusReport Log and notification hosts Network configurationPacket counts Blocked Sites list Memory Authentication host informationLogging options Load average Interfaces RoutesInterface the Firebox uses for each destination address Authentication list Blocked Sites listARP table Select File = Connect Replaying a log fileHostWatch display Select File = Open Viewing specific hosts Viewing authenticated usersControlling the HostWatch display Viewing specific ports Modifying view properties Add HostWatch 102 Viewing files with LogViewer Setting LogViewer preferencesReviewing and Working with Log Files Starting LogViewer and opening a log file Searching for specific entries Copying and exporting LogViewer data Displaying and hiding fields Working with log files Consolidating logs from multiple locations Forcing the rollover of log files Setting log encryption keysCopying log files From LiveSecurity Event Processor Working with log files 108 Creating and editing reports Generating Reports of Network ActivityStarting Historical Reports Viewing the reports list Editing an existing report Specifying report sectionsCreating a new report Deleting a report Setting report properties Specifying a report time spanConsolidating report sections Exporting a report to WebTrends for Firewalls and VPNs Exporting reportsExporting reports to Html format Enter the number of elements to rank in the table Using report filters Exporting a report to a text fileCreating a new filter Deleting a filter Scheduling and running reportsEditing a filter Applying a filter Report sections and consolidated sections Manually running a report Host Summary Proxied Traffic Session Summary Packet FilteredTime Summary Proxied Traffic Proxy Summary Consolidated Sections 118 Part V WatchGuard Virtual Private Networking Branch office virtual private networkRemote user virtual private network 120 Configuring Branch Office Virtual Private Networking Configuration checklist Basic and Enhanced Dvcp Using Dvcp to connect to devicesHow does Dvcp work? Creating a tunnel to a Soho or SOHOtc Telecommuter IP Address Editing a tunnel to a deviceSelect Network = Branch Office VPN = Basic Dvcp Soho Private Network Defining a Firebox as an Enhanced Dvcp Client Branch office VPN with IPSecRemoving a tunnel to a device Select the tunnel policy. Click Edit Adding a gateway Configuring a gatewaySelect Network = Branch Office VPN = IPSec Click Gateways Using Encapsulated Security Protocol ESP Configuring a tunnel with manual securityIncoming Settings for Outgoing checkbox Removing a gateway Click Key. Enter a passphrase. Click OK Configuring a tunnel with dynamic securityUsing Authenticated Headers AH Click the Dynamic Security tab Bypass Creating an IPSec policyBlock Dst Port field, enter the remote host port Src Port field, enter the local host port Configuring services for branch office VPN with IPSecChanging IPSec policy order Incoming Setting up WatchGuard VPN Configuring WatchGuard VPNWatchGuard VPN configuration models Allow VPN access to any services Preventing IP spoofing with WatchGuard VPN Enable the Activate WatchGuard VPN checkboxChanging remote network entries Enter the encryption key. Click Make Key Configuring incoming services to allow VPN Verifying successful WatchGuard VPN configuration Configuring the Firebox for Remote User VPN Remote User PptpMobile User VPN Configuring shared servers for Ruvpn Adding remote access usersAdding a member to built-in Ruvpn user groups Configuring services to allow incoming Ruvpn By individual serviceUsing the Any service Entering IP addresses for Remote User sessions Configuring the Firebox for Remote User PptpActivating Remote User Pptp Select Network = Remote User. Click the Pptp tab Configuring the Firebox for Mobile User VPN Purchasing a Mobile User VPN licenseRules for valid Remote User Pptp addresses Defining a new mobile user Preparing Mobile User VPN configuration filesEntering license keys Select Network = Remote User. Click the Mobile User VPN tab Modifying an existing Mobile User VPN entry Saving the configuration to a FireboxDistributing the software and configuration files Select Network = Remote User Configuring debugging options Debugging Mobile User VPNDebugging Remote User VPN Pptp Preparing a Host for Remote User VPN Preparing the client computers Remote host operating system Windows 95/98 platform preparationClick the Identification tab Installing Client for Microsoft Networks Installing Dial-Up Adapter #2 VPN SupportWindows NT platform preparation Adding a domain name to a Windows NT workstation Setting up Ruvpn for WindowsClick Dial Out Only. Click Continue Select Computer Browser Initial Connection window that appears, click Yes Configuring the remote host for Ruvpn with PptpInstalling a VPN adapter on Windows 95/98 Click Obtain an IP Address Automatically. Click OK Using Remote User Pptp Installing a VPN adapter on Windows NTStarting Remote User Pptp Double-click the Ruvpn connection Enter the remote client username and passwordRunning Remote User Pptp Click Connect Configuring debugging options 148 Index 150 User Guide 151 152 User Guide 153 154 User Guide 155 156 User Guide 157 158 User Guide 159 160