Editing a filter | WatchGuard Technologies FireboxTM System 4.6

Scheduling and running reports

Editing a filter

At any time, you can modify the properties of an existing filter. From the Filters dialog box in Historical Reports:

1Highlight the filter to modify. Click Edit.

The Report Filter dialog box appears.

2Modify filter properties according to your preferences.

For a description of each property, right-click it, and then click What’s This?.

Deleting a filter

To remove a filter from the list of available filters, highlight the filter. Click Remove. This command removes the .ftr file from the report-defsdirectory.

Applying a filter

Each report can use only one filter. To apply a filter, open the report properties. From Historical Reports:

1Select the report for which you would like to apply a filter. Click Edit.

2Use the Filter drop list to select a filter.

Only filters created using the Filters dialog box appear in the Filter drop list. For more information, see “Creating a new filter” on page 113.

3Click OK.

The new report properties are saved to the ReportName.rpt file in the report-defs directory. The filter will be applied the next time the report is run.

Scheduling and running reports

WatchGuard offers two methods to run reports: manually at any time or scheduled automatically using the LiveSecurity Event Processor.

Scheduling a report

You can schedule the LiveSecurity Event Processor to automatically generate reports about network activity. To schedule reports:

1Right-click the LiveSecurity Event Processor desktop tray icon. Select Open Log Center.

2Click the Reports tab.

3Select a report to schedule.

4Select a time interval.

For a custom interval, select Custom and then enter the interval in hours.

5Select the first date and time the report should run.

The report will run automatically at the time selected and then at each selected interval thereafter.

6Click OK.

114

Image 124

WatchGuard Technologies FireboxTM System 4.6 manual Scheduling and running reports, Editing a filter, Deleting a filter

Contents

WatchGuard Firebox System User Guide Disclaimer Copyright and Patent Information WatchGuard Firebox System WFS End-User License Agreement Page Declaration of Conformity Watchguard CE Notice FCC CertificationCSA Statement Table of Contents Using the WatchGuard Control Center Setting Up Network Address Translation 149 Welcome to WatchGuard Part I IntroductionWatchGuard Firebox System components WatchGuard Control Center WatchGuard FireboxWatchGuard security suite LiveSecurity Service Minimum requirementsSoftware requirements Web browser requirements Hardware requirements CPU Part II WatchGuard Services LiveSecurity ServiceWatchGuard Optional Features Technical SupportPage LiveSecurity Service Software UpdateLiveSecurity broadcasts Information Alert Activating the LiveSecurity Service EditorialSupport Flash Virus Alert Minimize or close your Web browser LiveSecurity broadcasts Accessing frequently asked questions FAQ Technical Support Known issues Click the LSS/SOHO Known Issues link on the leftGetting Internet technical support Getting telephone support Training WatchGuard Interactive Training System Wits Online Help WatchGuard users groupInstructor-led courses Starting WatchGuard Online Help Searching for topicsCopying the Help system to additional platforms Online Help system requirements Context-sensitive Help WatchGuard Options Currently available optionsVPN Manager High Availability Mobile User VPN Obtaining WatchGuard optionsSpamScreen Part III Configuring a Security Policy Set up logging and notification Set up network address translation NATConnect with out-of-band management What is a Firebox? Firebox Basics Placing a Firebox within a network Opening a configuration file Saving a configuration fileOpening a configuration from the Firebox Opening a configuration from a local hard disk Resetting Firebox passphrases Saving a configuration to the local hard diskSaving a configuration to the Firebox Tips for creating secure passphrases Setting the time zone Reinitializing a misconfigured FireboxSelect Setup =Time Zone Reinitialize the Firebox using the QuickSetup wizard Booting from the system area Using the WatchGuard Control Center Starting the Control Center and connecting to a FireboxNavigating the WatchGuard Control Center Control Center components Front panel QuickGuideFirebox and VPN tunnel status IPSec Remote VPN tunnelsExpanding and collapsing the display Red exclamation point Connecting to a Firebox Setting the maximum number of log messagesWorking with the Control Center Traffic Monitor Manipulating the Traffic Monitor Policy ManagerOpening WatchGuard Firebox System tools LogViewer Firebox MonitorsChanging the Policy Manager view Historical Reports HostWatchLiveSecurity Event Processor LiveSecurity Event Processor Configuring a Network Running the QuickSetup wizardTrusted External Setting up a drop-in network Setting up a routed network Select Network = Configuration Adding a secondary networkDefining a network route Select Network = Routes Setting the default gateway Select Network = Default GatewayDefining a host route Changing an interface IP address Select Network = Configuration. Click the General tab Select Network = Configuration. Click the Dhcp Server tabEntering Wins and DNS server addresses Defining a Firebox as a Dhcp server Removing a Subnet Modifying an existing subnetClick the subnet to remove it. Click Remove Click OK Defining a Firebox as a Dhcp server Select Setup = Default Packet Handling Configuring default packet handlingBlocking Sites and Ports Blocking a site permanently Removing a blocked siteChanging the auto-block duration Logging and notification for blocked sites Blocking a port permanently Removing a blocked portLogging and notification for blocked ports Category list, click Blocked Sites Configuring a service to temporarily block sites Blocking sites temporarily with service settingsViewing the Blocked Sites list Adding an existing service Configuring ServicesClick OK to close the Properties dialog box Creating a new service IgnoreSecure Port Defining service properties Adding incoming service properties Adding addresses to service properties Adding outgoing service propertiesWorking with wg icons Configuring services for authentication Modifying a serviceDeleting a service Under Internal Hosts, click Add Setting up proxy services Configuring an Smtp proxy serviceConfiguring the incoming Smtp proxy Click Yes Selecting content types Adding address patternsProtecting your mail server against relaying Select headers to allow Configuring an FTP proxy service Configuring the outgoing Smtp proxyClick Outgoing Add masquerading options Configuring an Http proxy service Service precedence From Rank Any List Service precedence How WebBlocker works Controlling Web TrafficReverting to old WebBlocker databases Configuring the WebBlocker service Prerequisites to using WebBlockerLogging and WebBlocker Activating WebBlocker Setting privileges Scheduling operational and non-operational hoursCreating WebBlocker exceptions Click the WebBlocker Controls tab Manually downloading the WebBlocker database Debug- Outputs debugging information Setting Up Network Address Translation What is dynamic NAT? Using simple dynamic NAT Select Setup = NATEnabling simple dynamic NAT Adding dynamic NAT entries Enabling service-based NAT Using service-based NATConfiguring service-based NAT exceptions Configuring a service for incoming static NAT Setting static NAT for a serviceSelect Network = Configuration. Click the External tab Adding external IP addresses Checkbox Enter the internal IP addressClick OK to close the Add Static NAT dialog box Configuring a service for incoming static NAT Setting Up Logging Notification Ensure logging with failover logging Designating Event Processors for a Firebox WatchGuard logging architectureLiveSecurity Event Processor Editing an Event Processor setting Select Setup = LoggingAdding an Event Processor Enabling Syslog logging Removing an Event Processor Reordering Event ProcessorsSynchronizing Event Processors For Windows NT Event Processors Setting up the LiveSecurity Event Processor Installing the Event Processor programRunning an Event Processor on Windows Running an Event Processor on Windows NT or Windows As a Windows NT or Windows 2000 Service Interactive mode from a DOS windowViewing the Event Processor Click WG LiveSecurity Event Processor. Click Startup Setting global logging and notification preferences Setting the log encryption keySetting the interval for log rollover Starting and stopping the Event Processor Customizing logging and notification by service or option Scheduling log reportsControlling notification Category Setting logging and notification for a service Setting Launch Interval and Repeat Count Setting logging and notification for blocked sites and ports Select Setup = Blocked Sites Connect with Out-of-Band Management Connecting a Firebox with OOB managementEnabling the Management Station Install the modem Configure the dial-up connectionPreparing a Windows NT Management Station for OOB Preparing a Windows 95/98 Management Station for OOB Configuring the Firebox for OOB Select Network = Configuration. Click the OOB tabConfiguring PPP for connecting to a Firebox Establishing an OOB connection Establishing an OOB connection Part IV Administering a Security Policy Aliases and AuthenticationFirebox Activity Monitors Network Activity ReportsPage Creating Aliases Implementing Authentication Using host aliases Modifying a host alias Adding a host aliasRemoving a host alias User authentication types What is user authentication?How user authentication works Configuring Firebox authentication Configuring Windows NT Server authenticationUnder Authentication Enabled Via, click the Firebox option To close the Setup Remote User dialog box, click Close Configuring Radius server authentication Click the Windows NT Server tab Configuring CRYPTOCard server authentication Enter the administrator passwordOn the Radius Server Enter or accept the time-out in seconds Configuring SecurID authentication Using authentication to define remote user VPN access Example Configuring a service for Remote User VPN Starting Firebox Monitors and connecting to a Firebox Monitoring Firebox Activity Setting Firebox Monitors view properties ServiceWatchBandwidth Meter StatusReport Network configuration Packet countsLog and notification hosts Blocked Sites list Authentication host information Logging optionsMemory Load average Routes InterfacesInterface the Firebox uses for each destination address Blocked Sites list Authentication listARP table Replaying a log file HostWatch displaySelect File = Connect Select File = Open Viewing authenticated users Controlling the HostWatch displayViewing specific hosts Viewing specific ports Modifying view properties Add HostWatch 102 Setting LogViewer preferences Reviewing and Working with Log FilesViewing files with LogViewer Starting LogViewer and opening a log file Searching for specific entries Copying and exporting LogViewer data Displaying and hiding fields Working with log files Consolidating logs from multiple locations Setting log encryption keys Copying log filesForcing the rollover of log files From LiveSecurity Event Processor Working with log files 108 Generating Reports of Network Activity Starting Historical ReportsCreating and editing reports Viewing the reports list Specifying report sections Creating a new reportEditing an existing report Deleting a report Specifying a report time span Setting report propertiesConsolidating report sections Exporting reports Exporting reports to Html formatExporting a report to WebTrends for Firewalls and VPNs Enter the number of elements to rank in the table Exporting a report to a text file Using report filtersCreating a new filter Scheduling and running reports Editing a filterDeleting a filter Applying a filter Report sections and consolidated sections Manually running a report Session Summary Packet Filtered Time Summary Proxied TrafficHost Summary Proxied Traffic Proxy Summary Consolidated Sections 118 Branch office virtual private network Part V WatchGuard Virtual Private NetworkingRemote user virtual private network 120 Configuring Branch Office Virtual Private Networking Configuration checklist Using Dvcp to connect to devices How does Dvcp work?Basic and Enhanced Dvcp Creating a tunnel to a Soho or SOHOtc Editing a tunnel to a device Select Network = Branch Office VPN = Basic DvcpTelecommuter IP Address Soho Private Network Branch office VPN with IPSec Removing a tunnel to a deviceDefining a Firebox as an Enhanced Dvcp Client Select the tunnel policy. Click Edit Configuring a gateway Select Network = Branch Office VPN = IPSecAdding a gateway Click Gateways Configuring a tunnel with manual security Incoming Settings for Outgoing checkboxUsing Encapsulated Security Protocol ESP Removing a gateway Configuring a tunnel with dynamic security Using Authenticated Headers AHClick Key. Enter a passphrase. Click OK Click the Dynamic Security tab Creating an IPSec policy BlockBypass Dst Port field, enter the remote host port Configuring services for branch office VPN with IPSec Changing IPSec policy orderSrc Port field, enter the local host port Incoming Configuring WatchGuard VPN WatchGuard VPN configuration modelsSetting up WatchGuard VPN Allow VPN access to any services Enable the Activate WatchGuard VPN checkbox Changing remote network entriesPreventing IP spoofing with WatchGuard VPN Enter the encryption key. Click Make Key Configuring incoming services to allow VPN Verifying successful WatchGuard VPN configuration Remote User Pptp Configuring the Firebox for Remote User VPNMobile User VPN Adding remote access users Configuring shared servers for RuvpnAdding a member to built-in Ruvpn user groups By individual service Configuring services to allow incoming RuvpnUsing the Any service Configuring the Firebox for Remote User Pptp Activating Remote User PptpEntering IP addresses for Remote User sessions Select Network = Remote User. Click the Pptp tab Purchasing a Mobile User VPN license Configuring the Firebox for Mobile User VPNRules for valid Remote User Pptp addresses Preparing Mobile User VPN configuration files Entering license keysDefining a new mobile user Select Network = Remote User. Click the Mobile User VPN tab Saving the configuration to a Firebox Distributing the software and configuration filesModifying an existing Mobile User VPN entry Select Network = Remote User Debugging Mobile User VPN Configuring debugging optionsDebugging Remote User VPN Pptp Preparing a Host for Remote User VPN Preparing the client computers Windows 95/98 platform preparation Remote host operating systemClick the Identification tab Installing Dial-Up Adapter #2 VPN Support Installing Client for Microsoft NetworksWindows NT platform preparation Setting up Ruvpn for Windows Click Dial Out Only. Click ContinueAdding a domain name to a Windows NT workstation Select Computer Browser Configuring the remote host for Ruvpn with Pptp Installing a VPN adapter on Windows 95/98Initial Connection window that appears, click Yes Click Obtain an IP Address Automatically. Click OK Installing a VPN adapter on Windows NT Using Remote User PptpStarting Remote User Pptp Enter the remote client username and password Running Remote User PptpDouble-click the Ruvpn connection Click Connect Configuring debugging options 148 Index 150 User Guide 151 152 User Guide 153 154 User Guide 155 156 User Guide 157 158 User Guide 159 160