WatchGuard Essentials flashcards
WatchGuard Essentials · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Feature key
- License file tied to the Firebox serial number that unlocks subscription services; the device downloads it from WatchGuard after registration, or you import the file manually.
- Default Trusted IP address
- In the factory default configuration, Eth1 is the Trusted interface with IP address 10.0.1.1/24, while Eth0 is External and obtains an address by DHCP.
- FireboxV
- A virtual Firebox appliance that runs on VMware ESXi, Microsoft Hyper-V, or KVM and provides the same Fireware features as hardware models.
- Total Security Suite
- Subscription bundle that adds APT Blocker, IntelligentAV, DNSWatch, DLP, Threat Detection and Response, and Access Portal to the Basic Security Suite services.
- Basic Security Suite
- Subscription bundle containing Gateway AntiVirus, Intrusion Prevention Service, Application Control, WebBlocker, spamBlocker, Reputation Enabled Defense, and WatchGuard Dimension reporting.
- Web UI management port
- The Fireware Web UI is accessed over HTTPS on TCP 8080, for example https://10.0.1.1:8080, not on the standard HTTPS port 443.
- Cloud-managed configuration
- When a Firebox is activated for WatchGuard Cloud management, its configuration is edited in the cloud portal and the local Web UI configuration settings are locked.
- Traffic Monitor
- Real-time log viewer in the Fireware Web UI that shows connections as they are allowed or denied, with filters for IP address, port, and keyword.
- Configuration file export
- The running Fireware configuration can be saved as an .xml file and imported later to restore settings on the same or a replacement Firebox.
- Packet capture diagnostic
- Web UI diagnostic tool that captures packet headers and payloads on a selected interface, similar to tcpdump, to troubleshoot traffic flow problems.
- Multi-WAN failover
- Traffic uses the highest-priority external interface that is operational; if that link fails, the Firebox switches traffic to the next interface in the list.
- Spillover load balancing
- Multi-WAN method where one external link carries traffic until it reaches a configured bandwidth threshold, then the next external link is added.
- Static route
- A manually configured route consisting of a destination network, a gateway address, and a metric that tells the Firebox where to send matching traffic.
- VLAN interface
- An 802.1Q tagged sub-interface of a physical port that has its own IP address, interface type, DHCP settings, and firewall policies.
- Secondary network
- An additional IP subnet added to an existing Firebox interface, which can be classified as trusted, optional, or custom independently of the primary network.
- First-match evaluation
- The Firebox compares traffic to policies from top to bottom and applies the first policy whose source, destination, and port match the connection.
- Implicit deny
- Any connection that matches no configured policy is dropped, so the Firebox blocks traffic by default unless a policy explicitly allows it.
- Proxy versus packet filter
- A packet filter inspects packet headers up to layer 4, while a proxy terminates the connection and examines the application content.
- Dynamic NAT
- An outbound policy setting that translates private source addresses to the external interface address, hiding internal hosts from the internet.
- 1-to-1 NAT
- A static mapping of one public IP address to one private host covering all ports; a policy must still allow the traffic.
- Proxy action
- A named set of rules for a proxy that defines allowed methods and content types plus which security services scan the passing traffic.
- Gateway AntiVirus
- Scans files carried by HTTP, HTTPS, FTP, SMTP, POP3, IMAP, and TCP-UDP proxy policies and blocks, drops, or logs infected transfers.
- APT Blocker
- Sends suspicious files to a WatchGuard cloud sandbox and blocks the download or attachment when sandbox analysis reports malicious behavior.
- IntelligentAV
- On-box machine-learning engine that analyzes file characteristics to detect malware that signature-based antivirus scanning may miss.
- DNSWatch
- Cloud service that answers DNS queries for protected networks and blocks or redirects requests for domains known to be malicious.
- WebBlocker
- URL filtering service that allows or denies web requests by category or custom lists and can enforce safe search on search engines.
- Application Control
- Signature-based service that identifies application traffic regardless of port and allows or blocks each application per policy.
- Firebox authentication port
- The Firebox web authentication page listens on TCP 4100 by default, where users sign in to be identified for policy and reporting.
- Authentication server types
- Fireware can authenticate users against the Firebox local database, Active Directory, LDAP, RADIUS, or RSA SecurID.
- Mobile VPN with SSL
- Client-to-site VPN that tunnels traffic over TLS on TCP 443 by default and is configured under VPN in the Fireware Web UI.
- BOVPN tunnel phases
- Phase 1 negotiates the IKE security association (encryption, hash, Diffie-Hellman group); Phase 2 negotiates the IPSec SA (ESP encryption, hash, PFS).
- Log destinations
- A Firebox can send log messages to WatchGuard Cloud, a WatchGuard Dimension or log server, or an external syslog server.