Watchguard Firebox V10 User manual

WatchGuard
WatchGuardWatchGuard
WatchGuard
Firebox Vclass
Firebox VclassFirebox Vclass
Firebox Vclass
QuickStart Guide
QuickStart GuideQuickStart Guide
QuickStart Guide
Thank you for purchasing the WatchGuard Firebox
Vclass. The Firebox Vclass acts as a barrier
between your networks and the public Internet,
protecting them from security threats.
This QuickStart Guide covers the initial installation
of the WatchGuard Firebox Vclass. Please refer to
the accompanying user documentation for compre-
hensive instructions and hardware specifications.
Your package should contain the following:
• WatchGuard Firebox Vclass security appliance
• This QuickStart Guide
• User Documentation
• WatchGuard Firebox Vcontroller CD-ROM
•Powercable
• Ethernet, serial, optical data, and/or appliance-
to-UPS cables based on the Firebox Vclass
appliance you purchased. See the
Firebox Vclass
Hardware Guide
for more information on the
cables available for your Firebox Vclass model.
You should gather the following network informa-
tion needed during the quick setup process.
Firebox Vclass Serial Number
Found on the back of your Firebox Vclass under the
barcode.
Network Addresses
Default Gateway:
Subnet Mask:
Public Interface:
Private Interface:
You can administer the WatchGuard Firebox
Vclass from any computer that you designate as the
Management Station. The following instructions
are for Windows. See the
Firebox Vclass User
Guide
for instructions for other operating systems.
To designate the Management Station, install the
Vcontroller software as follows:
1
11
1 Remove the Vcontroller CD from the package
and insert it in the workstation CD-ROM.
2
22
2 Locate and double-click the CD-ROM drive
icon (usually found in the My Computer win-
dow). If AutoRun is enabled on the CD drive,
the Installer launches automatically.
3
33
3 When the CD window contents appear, double-
click the Windows folder.
4
44
4 When that window’s contents appear, double-
click the setup.exe
setup.exesetup.exe
setup.exe icon to start the installa-
tion of the Vcontroller software.
5
55
5 The installer may detect older versions of the
Java Run-time Environment (JRE) and the
Java Development Kit (JDK) or a version it
cannot verify. WatchGuard recommends
installing the version included on your CD over
any existing versions.
1
11
1Checking Package Contents
Checking Package ContentsChecking Package Contents
Checking Package Contents
2
22
2Gathering Network Information
Gathering Network InformationGathering Network Information
Gathering Network Information
3
33
3Setting Up the Management Station
Setting Up the Management StationSetting Up the Management Station
Setting Up the Management Station
Vcontroller5.0QuickStartGuide.fm Page 15 Friday, June 27, 2003 2:55 PM

6
66
6 When the process is finished, a window
appears, prompting you to start Vcontroller.
NOTE:
NOTE:NOTE:
NOTE: You must activate your LiveSecurity Ser-
vice to enable VPN 3DES encryption or receive
WatchGuard Support. To activate your LiveSecu-
rity Service, go to
http:\\www.watchguard.com\activate
For more information on activating the LiveSecu-
rity Service, see the
Firebox Vclass User Guide .
The next procedure in the installation process is
cabling the appliance to the Management Station.
Refer to the
Firebox Vclass Hardware Guide to
ensure that you have receive all of the necessary
cables.
1
11
1 Remove the Firebox Vclass appliance from its
packaging.
2
22
2 Place the appliance on any stable flat surface
near the Management Station.
3
33
3 Connect the appliance through interface O
(Private) to the Management Station using
the red crossover Ethernet cable (or corre-
sponding optical cable depending upon the
Firebox model).
4
44
4 Connect the appliance to a nearby power
source using the power cord. If connecting the
appliance to a UPS device, be sure to use the
WatchGuard-supplied cable to connect the
two devices through their respective RS-232
ports.
Use WatchGuard Vcontroller to discover a new
factory default Firebox Vclass security appliance
on your network and assign the new unit a perma-
nent, static IP address. The Firebox should be con-
nected to the same LAN segment or subnet as your
Management Workstation through the Private
interface.
1
11
1 Launch Vcontroller.
The Vcontroller and Login dialog boxes
appear.
2
22
2 Click the binoculars icon to the right of the
Server/IP Name
Server/IP NameServer/IP Name
Server/IP Name drop list. The WatchGuard
Security Appliance Discovery dialog box
appears.
3
33
3 Click Find
FindFind
Find to start the process.
If the Management Station has more than one
NIC, you
must select the IP address of the
appropriate card from the drop list before pro-
ceeding.
A status dialog box appears and remains open
until the discovery process is complete. See
the
Firebox Vclass User Guide to trobleshoot
a failed discovery.
The Device Found dialog box appears.
4
44
4 From the Devices Found field, select the appli-
ance you want to configure.
You need to define a temporary IP address for
the Private interface (Router Mode), or a Sys-
tem IP (Transparent Mode). This temporary
IP address is used in the initial configuration.
5
55
5 Click the Set Interface IP
Set Interface IPSet Interface IP
Set Interface IP button.
6
66
6 Select the System Mode for the Appliance byt
clicking Router Mode or Transparent Mode.
7
77
7(Router Mode) In the Interface 0 IP and
Interface 0 Mask fields, type an unused IP
address and the subnet mask on for this IP
address.
8
88
8(Transparent Mode) In the System IP and
System Mask fields, type an unused IP
address and the subnet mask for the appli-
ance.
9
99
9 Click Update
UpdateUpdate
Update.
If more than one appliance is listed in this
window, you can set an IP address for each
appliance at this time, prior to clicking Apply
All.
10
1010
10 If there are no more appliances to be set, click
Apply All
Apply AllApply All
Apply All.
A confirmation window appears.
4
44
4Cabling the Firebox Vclass
Cabling the Firebox VclassCabling the Firebox Vclass
Cabling the Firebox Vclass
5
55
5Using Appliance Discovery
Using Appliance DiscoveryUsing Appliance Discovery
Using Appliance Discovery
Vcontroller5.0QuickStartGuide.fm Page 16 Friday, June 27, 2003 2:55 PM

11
1111
11 Click Yes
Ye sYe s
Yes to proceed.
The Result window appears.
12
1212
12 Wait for the Result window to display “ALL
DONE” and then click Close
CloseClose
Close to restart the
appliance and return to the Set Interface win-
dow. The Appliance restarts.
13
1313
13 After the appliance has restarted, click Cancel
CancelCancel
Cancel
to close the Devices Found window.
The Vcontroller Installation Wizard configures a
newly discovered Firebox Vclass with a basic con-
figuration while simultaneously updating the Vcon-
troller management software for use with this and
other Firebox Vclass appliances.
1
11
1 Power up the Firebox Vclass appliance.
2
22
2 Launch Vcontroller and click Login
LoginLogin
Login.
The Login dialog box appears.
3
33
3 Type the IP address or host name of the Fire-
box Vclass in the Server IP/Name field or
select it from the drop list.
4
44
4 Type your administrator login name and pass-
word in the appropriate fields. The default
name and password for the Firebox Vclass
appliance is admin.
All data traffic between the Management Sta-
tion and the Firebox Vclass appliance, includ-
ing all configuration exchanges, is protected
by SSL, using 128-bit RC4 and SHA1.
5
55
5ClickOK
OKOK
OK.
The Installation Wizard Welcome window
appears.
6
66
6ClickNext
NextNext
Next to proceed.
The General Information dialog box appears.
7
77
7 Enter the following General information:
System Name Type either the assigned
DNS name for the appli-
ance or another arbitrary
name.
System Location Type a description of
where your appliance will
be used. For example, this
can be a building, floor
number, office name, or
other simple description.
System Contact: Type the name and phone
number or email address
of the principal adminis-
trator or department
responsible for manage-
ment of the appliance.
System Time Click Change
ChangeChange
Change to open the
Date, Time, and Time
Zone window. Make any
necessary adjustments,
and click OK
OKOK
OK.
8
88
8 Click Next
NextNext
Next to proceed. The Interface Informa-
tion dialog box appears.
• Choose whether the system will be in Trans-
parent Mode or Router Mode. Refer to your
documentation for more information.
• For Transparent Mode, type the System IP
and the System Network Mask.
• For Router Mode, bouble-click the Interface
0 row, and type the IP Address and network
mask in the appropriate fields.
• If you want to enable the appliance as a
DHCP server, click Enable DHCP Server
Enable DHCP ServerEnable DHCP Server
Enable DHCP Server.
Type the maximum number of potential cli-
ents that will be assigned IP addresses and
the number of hours or days that an IP
address will be leased to a DHCP client. You
can also use a separate DHCP Server by
clicking DHCP Relay
DHCP RelayDHCP Relay
DHCP Relay, and typing the remote
DHCP server IP address.
• To configure the Publice Interface, see the
Firebox Vclass User Guide .
9
99
9 Click OK
OKOK
OK, then click Next
NextNext
Next to proceed.
10
1010
10 If you want, you can configure routing at this
time. To configure a default gateway, type the
public interface IP address in the Specify
6
66
6Configuring the Firebox
Configuring the FireboxConfiguring the Firebox
Configuring the Firebox
Vcontroller5.0QuickStartGuide.fm Page 17 Friday, June 27, 2003 2:55 PM

Default Route field. To configure additional
routes, click Add
AddAdd
Add and complete the Add Route
dialog box. For more information on configur-
ing routes, see the
Firebox Vclass User Guide .
When you complete adding routes, click Next
NextNext
Next
and then OK
OKOK
OK.
11
1111
11 If you want, you can configure a DNS server
at this time. You must provide the Firebox
domain name and insert the IP addresses of
any DNS servers. Click Next
NextNext
Next to continue.
12
1212
12 If you want, you can automatically implement
default firewall policies. We recommend that
you review the defaults against the security
policy preferences of your organization. For
more information, see the
Firebox Vclass User
Guide
. Click Next
NextNext
Next to continue.
13
1313
13 The Change Password dialog box appears.
This step requires you to replace the default
root admin account password with a new,
secure password of your choosing.
14
1414
14 Click Finish
FinishFinish
Finish.
The Firebox can now be used as a basic firewall. If
you have not already done so, you should now
deploy the Firebox in its permanent network loca-
tion.
• Complete a software shutdown of the Firebox.
Launch Vcontroller and connect to the Firebox
using the Firebox name or IP and the system
administrator password. From the main Vcon-
troller window, select Shut Down
Shut DownShut Down
Shut Down. Click OK
OKOK
OK.
• Place the Firebox in its permanent location.
• Connect the Firebox to your network and a
power source.
• Change the default gateway setting on all desk-
tops to the Firebox Trusted interface IP address.
Congratulations! You have successfully installed,
configured, and deployed your new Firebox Vclass
security appliance on your network. What’s next?
Here are some things to remember as a new cus-
tomer:
Customizing your security policy
You customize your security policy by adding traf-
fic actions that expand what you allow in and out of
your firewall. Every action brings trade-offs
between network security and accessibility. When
selecting actions, balance the needs of your organi-
zation with the requirement that the computer
assets be protected from attack.
Please refer to the
Firebox Vclass Guide for more
information and assistance on configuring traffic
actions.
What to expect from your LiveSecurity Ser-
vice
Your Firebox includes a 3-month subscription to
our award-winning LiveSecurity Service. Your sub-
scription:
• Enables 3DES encryption and/or High Availabil-
ity.
• Provides up-to-date network protection with the
latest software upgrades.
• Solves problems with comprehensive technical
support resources including known issues and
Frequently Asked Questions.
• Reduces down time with alerts and configuration
tips to combat the newest threats and vulnerabil-
ities.
• Keeps you prepared for upcoming security
threats with editorials and analysis from indus-
try experts.
• Extends your network security with bundled soft-
ware, utilities, and special offers.
Part No: 0700-000
7
77
7Deploying the Firebox into your
Deploying the Firebox into yourDeploying the Firebox into your
Deploying the Firebox into your
Network
NetworkNetwork
Network
8
88
8What’s Next
What’s NextWhat’s Next
What’s Next
Vcontroller5.0QuickStartGuide.fm Page 18 Friday, June 27, 2003 2:55 PM