Manuals / WatchGuard Technologies / Computer Equipment / Network Router

WatchGuard Technologies FireboxTM System 4.6 manual WatchGuard Firebox, WatchGuard Control Center

Models: FireboxTM System 4.6

1 170

Download 170 pages 21.61 Kb

Page 12

WatchGuard Firebox System components

•Security suite

•LiveSecurity Service

WatchGuard Firebox

The Firebox family of appliances are specially designed and optimized machines. They are small, efficient, and reliable. The Firebox is a low-profile component with an indicator display panel in front and physical interfaces in back.

For detailed Firebox specifications, see the Reference Guide.

WatchGuard Control Center

WatchGuard Control Center is a toolkit of applications run from a single location, enabling you to configure, manage, and monitor your network security policy. Control Center includes:

Policy Manager

Used to design, configure, and manage the electronic portion of a network security policy.

Firebox Monitors

Combines the WatchGuard set of monitoring tools into a single user interface.

LogViewer

Displays a static view of the log data, which you can filter by type, search for keywords and fields, and print and save to a separate file.

HostWatch

Displays active connections occurring on a Firebox in real time or represents the connections listed in a log file. HostWatch either plays back a previous file for review or displays connections in real time, as they are added to the current log file.

Historical Reports

Creates HTML reports that display session types, most active hosts, most used services, URLs, and other data useful in monitoring and troubleshooting your network.

WatchGuard security suite

In addition to basic security policy configuration, the Firebox System includes a suite of advanced software features. These include:

•User authentication

•Network address translation

•Remote user virtual private networking

•Branch office virtual private networking

•Selective Web-site blocking

2

Image 12

WatchGuard Technologies FireboxTM System 4.6 WatchGuard Firebox, WatchGuard Control Center, WatchGuard security suite

Contents

WatchGuard Firebox System User Guide Disclaimer Copyright and Patent InformationWatchGuard Firebox System WFS End-User License Agreement Page Declaration of Conformity WatchguardFCC Certification CE NoticeCSA Statement Table of Contents Using the WatchGuard Control Center Setting Up Network Address Translation 149 Part I Introduction Welcome to WatchGuardWatchGuard Firebox System components WatchGuard Firebox WatchGuard Control CenterWatchGuard security suite LiveSecurity Service Minimum requirementsSoftware requirements Web browser requirementsHardware requirements CPUPart II WatchGuard Services LiveSecurity ServiceWatchGuard Optional Features Technical SupportPage LiveSecurity Service Software UpdateLiveSecurity broadcasts Information AlertActivating the LiveSecurity Service EditorialSupport Flash Virus AlertMinimize or close your Web browser LiveSecurity broadcasts Accessing frequently asked questions FAQ Technical SupportKnown issues Click the LSS/SOHO Known Issues link on the leftGetting Internet technical support Getting telephone supportTraining WatchGuard Interactive Training System WitsWatchGuard users group Online HelpInstructor-led courses Starting WatchGuard Online Help Searching for topicsCopying the Help system to additional platforms Online Help system requirementsContext-sensitive Help WatchGuard Options Currently available optionsVPN Manager High AvailabilityObtaining WatchGuard options Mobile User VPNSpamScreen Part III Configuring a Security Policy Set up network address translation NAT Set up logging and notificationConnect with out-of-band management What is a Firebox? Firebox BasicsPlacing a Firebox within a network Opening a configuration file Saving a configuration fileOpening a configuration from the Firebox Opening a configuration from a local hard diskResetting Firebox passphrases Saving a configuration to the local hard diskSaving a configuration to the Firebox Tips for creating secure passphrasesSetting the time zone Reinitializing a misconfigured FireboxSelect Setup =Time Zone Reinitialize the Firebox using the QuickSetup wizardBooting from the system area Using the WatchGuard Control Center Starting the Control Center and connecting to a FireboxNavigating the WatchGuard Control Center Control Center componentsQuickGuide Front panelFirebox and VPN tunnel status IPSec Remote VPN tunnelsExpanding and collapsing the display Red exclamation pointConnecting to a Firebox Setting the maximum number of log messagesWorking with the Control Center Traffic MonitorPolicy Manager Manipulating the Traffic MonitorOpening WatchGuard Firebox System tools Firebox Monitors LogViewerChanging the Policy Manager view HostWatch Historical ReportsLiveSecurity Event Processor LiveSecurity Event Processor Configuring a Network Running the QuickSetup wizardTrusted ExternalSetting up a drop-in network Setting up a routed network Select Network = Configuration Adding a secondary networkDefining a network route Select Network = RoutesSetting the default gateway Select Network = Default GatewayDefining a host route Changing an interface IP addressSelect Network = Configuration. Click the General tab Select Network = Configuration. Click the Dhcp Server tabEntering Wins and DNS server addresses Defining a Firebox as a Dhcp serverModifying an existing subnet Removing a SubnetClick the subnet to remove it. Click Remove Click OK Defining a Firebox as a Dhcp server Configuring default packet handling Select Setup = Default Packet HandlingBlocking Sites and Ports Blocking a site permanently Removing a blocked siteChanging the auto-block duration Logging and notification for blocked sitesBlocking a port permanently Removing a blocked portLogging and notification for blocked ports Category list, click Blocked SitesBlocking sites temporarily with service settings Configuring a service to temporarily block sitesViewing the Blocked Sites list Configuring Services Adding an existing serviceClick OK to close the Properties dialog box Creating a new service IgnoreSecure PortDefining service properties Adding incoming service propertiesAdding outgoing service properties Adding addresses to service propertiesWorking with wg icons Configuring services for authentication Modifying a serviceDeleting a service Under Internal Hosts, click AddSetting up proxy services Configuring an Smtp proxy serviceConfiguring the incoming Smtp proxy Click YesSelecting content types Adding address patternsProtecting your mail server against relaying Select headers to allowConfiguring an FTP proxy service Configuring the outgoing Smtp proxyClick Outgoing Add masquerading optionsConfiguring an Http proxy service Service precedence From Rank Any List Service precedence Controlling Web Traffic How WebBlocker worksReverting to old WebBlocker databases Configuring the WebBlocker service Prerequisites to using WebBlockerLogging and WebBlocker Activating WebBlockerSetting privileges Scheduling operational and non-operational hoursCreating WebBlocker exceptions Click the WebBlocker Controls tabManually downloading the WebBlocker database Debug- Outputs debugging informationSetting Up Network Address Translation What is dynamic NAT?Using simple dynamic NAT Select Setup = NATEnabling simple dynamic NAT Adding dynamic NAT entriesUsing service-based NAT Enabling service-based NATConfiguring service-based NAT exceptions Configuring a service for incoming static NAT Setting static NAT for a serviceSelect Network = Configuration. Click the External tab Adding external IP addressesEnter the internal IP address CheckboxClick OK to close the Add Static NAT dialog box Configuring a service for incoming static NAT Setting Up Logging Notification Ensure logging with failover loggingWatchGuard logging architecture Designating Event Processors for a FireboxLiveSecurity Event Processor Editing an Event Processor setting Select Setup = LoggingAdding an Event Processor Enabling Syslog loggingRemoving an Event Processor Reordering Event ProcessorsSynchronizing Event Processors For Windows NT Event ProcessorsSetting up the LiveSecurity Event Processor Installing the Event Processor programRunning an Event Processor on Windows Running an Event Processor on Windows NT or WindowsAs a Windows NT or Windows 2000 Service Interactive mode from a DOS windowViewing the Event Processor Click WG LiveSecurity Event Processor. Click StartupSetting global logging and notification preferences Setting the log encryption keySetting the interval for log rollover Starting and stopping the Event ProcessorCustomizing logging and notification by service or option Scheduling log reportsControlling notification CategorySetting logging and notification for a service Setting Launch Interval and Repeat CountSetting logging and notification for blocked sites and ports Select Setup = Blocked SitesConnecting a Firebox with OOB management Connect with Out-of-Band ManagementEnabling the Management Station Install the modem Configure the dial-up connectionPreparing a Windows NT Management Station for OOB Preparing a Windows 95/98 Management Station for OOBConfiguring the Firebox for OOB Select Network = Configuration. Click the OOB tabConfiguring PPP for connecting to a Firebox Establishing an OOB connectionEstablishing an OOB connection Part IV Administering a Security Policy Aliases and AuthenticationFirebox Activity Monitors Network Activity ReportsPage Creating Aliases Implementing Authentication Using host aliasesAdding a host alias Modifying a host aliasRemoving a host alias What is user authentication? User authentication typesHow user authentication works Configuring Firebox authentication Configuring Windows NT Server authenticationUnder Authentication Enabled Via, click the Firebox option To close the Setup Remote User dialog box, click CloseConfiguring Radius server authentication Click the Windows NT Server tabConfiguring CRYPTOCard server authentication Enter the administrator passwordOn the Radius Server Enter or accept the time-out in secondsConfiguring SecurID authentication Using authentication to define remote user VPN access Example Configuring a service for Remote User VPNStarting Firebox Monitors and connecting to a Firebox Monitoring Firebox ActivitySetting Firebox Monitors view properties ServiceWatchBandwidth Meter StatusReportNetwork configuration Packet countsLog and notification hosts Blocked Sites listAuthentication host information Logging optionsMemory Load averageInterfaces RoutesInterface the Firebox uses for each destination address Authentication list Blocked Sites listARP table Replaying a log file HostWatch displaySelect File = Connect Select File = OpenViewing authenticated users Controlling the HostWatch displayViewing specific hosts Viewing specific portsModifying view properties AddHostWatch 102 Setting LogViewer preferences Reviewing and Working with Log FilesViewing files with LogViewer Starting LogViewer and opening a log fileSearching for specific entries Copying and exporting LogViewer dataDisplaying and hiding fields Working with log files Consolidating logs from multiple locationsSetting log encryption keys Copying log filesForcing the rollover of log files From LiveSecurity Event ProcessorWorking with log files 108 Generating Reports of Network Activity Starting Historical ReportsCreating and editing reports Viewing the reports listSpecifying report sections Creating a new reportEditing an existing report Deleting a reportSetting report properties Specifying a report time spanConsolidating report sections Exporting reports Exporting reports to Html formatExporting a report to WebTrends for Firewalls and VPNs Enter the number of elements to rank in the tableUsing report filters Exporting a report to a text fileCreating a new filter Scheduling and running reports Editing a filterDeleting a filter Applying a filterReport sections and consolidated sections Manually running a reportSession Summary Packet Filtered Time Summary Proxied TrafficHost Summary Proxied Traffic Proxy SummaryConsolidated Sections 118 Part V WatchGuard Virtual Private Networking Branch office virtual private networkRemote user virtual private network 120 Configuring Branch Office Virtual Private Networking Configuration checklistUsing Dvcp to connect to devices How does Dvcp work?Basic and Enhanced Dvcp Creating a tunnel to a Soho or SOHOtcEditing a tunnel to a device Select Network = Branch Office VPN = Basic DvcpTelecommuter IP Address Soho Private NetworkBranch office VPN with IPSec Removing a tunnel to a deviceDefining a Firebox as an Enhanced Dvcp Client Select the tunnel policy. Click EditConfiguring a gateway Select Network = Branch Office VPN = IPSecAdding a gateway Click GatewaysConfiguring a tunnel with manual security Incoming Settings for Outgoing checkboxUsing Encapsulated Security Protocol ESP Removing a gatewayConfiguring a tunnel with dynamic security Using Authenticated Headers AHClick Key. Enter a passphrase. Click OK Click the Dynamic Security tabCreating an IPSec policy BlockBypass Dst Port field, enter the remote host portConfiguring services for branch office VPN with IPSec Changing IPSec policy orderSrc Port field, enter the local host port IncomingConfiguring WatchGuard VPN WatchGuard VPN configuration modelsSetting up WatchGuard VPN Allow VPN access to any servicesEnable the Activate WatchGuard VPN checkbox Changing remote network entriesPreventing IP spoofing with WatchGuard VPN Enter the encryption key. Click Make KeyConfiguring incoming services to allow VPN Verifying successful WatchGuard VPN configurationConfiguring the Firebox for Remote User VPN Remote User PptpMobile User VPN Configuring shared servers for Ruvpn Adding remote access usersAdding a member to built-in Ruvpn user groups Configuring services to allow incoming Ruvpn By individual serviceUsing the Any service Configuring the Firebox for Remote User Pptp Activating Remote User PptpEntering IP addresses for Remote User sessions Select Network = Remote User. Click the Pptp tabConfiguring the Firebox for Mobile User VPN Purchasing a Mobile User VPN licenseRules for valid Remote User Pptp addresses Preparing Mobile User VPN configuration files Entering license keysDefining a new mobile user Select Network = Remote User. Click the Mobile User VPN tabSaving the configuration to a Firebox Distributing the software and configuration filesModifying an existing Mobile User VPN entry Select Network = Remote UserConfiguring debugging options Debugging Mobile User VPNDebugging Remote User VPN Pptp Preparing a Host for Remote User VPN Preparing the client computersRemote host operating system Windows 95/98 platform preparationClick the Identification tab Installing Client for Microsoft Networks Installing Dial-Up Adapter #2 VPN SupportWindows NT platform preparation Setting up Ruvpn for Windows Click Dial Out Only. Click ContinueAdding a domain name to a Windows NT workstation Select Computer BrowserConfiguring the remote host for Ruvpn with Pptp Installing a VPN adapter on Windows 95/98Initial Connection window that appears, click Yes Click Obtain an IP Address Automatically. Click OKUsing Remote User Pptp Installing a VPN adapter on Windows NTStarting Remote User Pptp Enter the remote client username and password Running Remote User PptpDouble-click the Ruvpn connection Click ConnectConfiguring debugging options 148 Index 150 User Guide 151 152 User Guide 153 154 User Guide 155 156 User Guide 157 158 User Guide 159 160