Authentication, VPN, and Logging/Reporting
Authentication
Auth servers include Firebox-DB (local), Active Directory, LDAP, RADIUS, Kerberos and SAML 2.0 (AuthPoint, Azure AD, Okta). Authentication types matter: Firebox authentication prompts users (typically an HTTP/S redirect on proxy policies) before a policy matches; single sign-on (SSO) maps IP addresses to usernames transparently via an SSO agent or terminal services agent; management authentication covers admins logging into the device. Users and groups are then referenced in the policy's From field.
VPN
Mobile VPN options: SSL (TLS client, default port 443, client downloadable from the Firebox authentication page), IPSec, L2TP and IKEv2. Branch Office VPN (BOVPN) comes as a classic policy-based tunnel - phase 1 (IKE version, encryption, hash, DH group, PSK or certificate) and phase 2 (local/remote subnets, proposal) - or as a BOVPN virtual interface, which is route-based and supports dynamic routing and multiple tunnels per peer.
Logging and reporting
Traffic Monitor shows live events. For retention: WatchGuard Cloud or Dimension for dashboards, reports and alerts; a Log Server for locally managed devices; syslog (default UDP 514) and SNMP to external collectors; and the diagnostic log for troubleshooting. A policy only generates log records if logging is enabled on it.
Traps
Mismatched PSK, DH group or proposals at one end of a tunnel. Confusing mirrored phase 2 subnets with identical ones. Expecting reports with no logging enabled. A web server already using port 443 conflicting with the SSL VPN listener.
Rule of thumb: when a tunnel fails, compare phase 1 settings on both ends first, then phase 2, side by side.