WatchGuard Essentials cheat sheet

Firebox families: T series for branch and small sites, M series for midrange and enterprise with expansion slots, FireboxV for VMware/Hyper-V/KVM, and Firebox Cloud for AWS and Azure.

Factory default configuration: Eth0 is the External interface and receives an address by DHCP; Eth1 is the Trusted interface at 10.0.1.1/24.

The local Fireware Web UI is opened at https://10.0.1.1:8080; TCP 8080 is the management HTTPS port, not 443.

A feature key is required to enable any subscription service; it is bound to the device serial number and is downloaded automatically once the Firebox is registered to a WatchGuard account.

Basic Security Suite bundles Gateway AntiVirus, IPS, Application Control, WebBlocker, spamBlocker, Reputation Enabled Defense, and Dimension reporting.

Total Security Suite adds APT Blocker, IntelligentAV, DNSWatch, DLP, Threat Detection and Response/Endpoint Security, and Access Portal on top of the Basic services.

When a subscription expires the associated service stops, but the Firebox continues to forward or drop traffic using the policies already configured.

Holding the front-panel Reset button returns the Firebox to its factory default configuration.

Fireware Web UI uses HTTPS on TCP 8080; WatchGuard System Manager and Firebox System Manager are the legacy Windows management clients.

A Firebox activated for WatchGuard Cloud management takes its configuration from the cloud portal, and the local Web UI configuration is locked.

A cloud-managed Firebox connects outbound on TCP 443 to WatchGuard Cloud; no inbound ports or port forwarding are needed at the edge.

Traffic Monitor shows log messages in real time and can be filtered by source or destination IP address, port, or keyword.

System > Configuration File exports the running configuration as an .xml file and imports it to restore settings.

Firmware upgrades are applied from the Web UI under System > Update OS and require a device reboot.

WatchGuard Cloud provides device management, monitoring dashboards, and log and report data for activated devices.

Web UI diagnostics include ping, traceroute, DNS lookup, and packet capture (tcpdump) on a selected interface.

Interface types are External, Trusted, Optional, and Custom; the chosen type sets default behavior and which policies can use the interface.

Multiple external interfaces enable Multi-WAN; failover uses interface priority order, while load balancing uses round-robin or spillover.

Spillover load balancing keeps using one external link until its configured bandwidth threshold is exceeded, then adds the next link.

A static route consists of a destination network, a gateway address, and a metric; the default route 0.0.0.0/0 normally points at the External gateway.

Fireware supports dynamic routing with BGP, OSPF, and RIP for exchanging routes with adjacent routers.

802.1Q VLANs are defined on a physical interface and each receives its own IP address, interface type, DHCP scope, and policies.

Secondary networks add extra IP subnets to an existing interface, and each can be classified as trusted, optional, or custom.

Link aggregation bonds multiple physical ports using 802.3ad to increase throughput and provide redundancy.

Policies are evaluated from top to bottom and the first policy whose source, destination, and port match is applied; later policies are ignored.

Traffic that matches no configured policy is dropped, because the Firebox default posture is deny (implicit deny).

Packet filter policies inspect headers up to layer 4; proxy policies terminate the connection and inspect the application payload.

Proxy types include HTTP, HTTPS, FTP, SMTP, POP3, IMAP, DNS, SIP, H.323, and TCP-UDP.

A proxy action defines allowed methods and content types plus which security services scan the connection, and each proxy policy references one.

Dynamic NAT (SNAT) configured in an outbound policy translates private source addresses to the external interface address.

1-to-1 NAT maps one public IP address to one private host for all ports, but a policy must still exist to permit the traffic.

Aliases are named IP addresses, networks, or ports that are reused across multiple policies to simplify maintenance.

Gateway AntiVirus scans files carried by HTTP, HTTPS, FTP, SMTP, POP3, IMAP, and TCP-UDP proxy traffic and can block, drop, or log infected transfers.

IPS uses signatures to detect and block exploit traffic per policy, with rules selectable by severity and category.

Application Control identifies applications by signature regardless of TCP/UDP port and allows or blocks each application per policy.

WebBlocker filters web requests by URL category and by custom allow and deny lists, and can enforce safe search on search engines.

spamBlocker tags, quarantines, or drops SMTP spam based on reputation and content scoring.

APT Blocker submits files to a WatchGuard cloud sandbox and returns a verdict, and requires a Total Security Suite subscription.

IntelligentAV performs on-box machine-learning analysis of file attributes to detect malware without relying only on signatures.

DNSWatch sends DNS queries through WatchGuard's cloud service and blocks or redirects requests for known malicious domains.

Reputation Enabled Defense scores URLs and IP addresses against WatchGuard's cloud reputation database.

Authentication server types are the Firebox local database, Active Directory, LDAP, RADIUS, and RSA SecurID.

The Firebox user authentication web page is served on TCP 4100 by default, and users must authenticate there before their traffic is allowed.

Single Sign-On uses the WatchGuard SSO Agent or SSO Client to map Active Directory logon events to firewall users without extra prompts.

Mobile VPN types are SSL, IPSec, L2TP, and IKEv2; Mobile VPN with SSL listens on TCP 443 by default.

A Branch Office VPN is an IPSec site-to-site tunnel negotiated in Phase 1 (IKE SA) and Phase 2 (IPSec SA).

BOVPN virtual interfaces are route-based tunnels that support dynamic routing and multiple remote networks.

Log destinations include WatchGuard Cloud, a WatchGuard Dimension or log server, and an external syslog server; the Firebox also keeps a local log.

Log message categories include Traffic, Event, Alarm, and Diagnostic/Debug entries.