Watchguard Firebox M200 User manual

WatchGuard M200 Firewall/Router
QoS Configuration Guide

QoS Configuration Guide | WatchGuard M200 | Contents
Contents
Intr oduction . . . . . . . . . . . . .
Performance and Capacities
.
.
.
.
. .
. .
.
.
. .
. .
. . . . . . . . . . . . . . . . . . . . 3
. . . . . . . . . . . . . . . . . . . . . 3
Configure Your Fir ewall . . . . . .
.
.
. .
.
. .
. . . . . . . . . . . . . . . . . . . . 4
WatchGuard M200 Firewall Configuration
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. . . .
. . . .
.
4
Quality of Service . . . . . . . . . .
Test Your Connection Capacity
Supported Browsers for Test . .
Test Your Connection Quality .
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
. 10
. 10
. 10
. 11
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
Ports and Firewalls Settings for RingCentral VoIP Service
.
12
2

QoS Configuration Guide | WatchGuard M200 | Introduction
Introduction
Because smaller companies are generally less protected and easier
to break into, small business has become the new big target for
cyber-attacks. The Firebox M200 firewall is specifically engineered
to defend all types of small businesses against attacks that are no
less fierce than those targeting larger organizations..
The Firebox M200 Unified Threat Management (UTM) solution is up to
3 times faster than competing products with all security layers turned
on, and up to 94 percent faster performing HTTPS inspection, ensuring
businesses never have to compromise network security for
performance.
Key Security Features
Performance and Capacities
Ideal for small to midsize business
Recommended user count —60
IPsec VPN throughput —3.2 Gbps
AV —620 Mbps
IPS —1.4 Gbps
UTM —515 Mbps
1 Gig ports —8
Concurrent sessions —1,700,000









Enterprise-grade prevention, detection, correlation and response
from the perimeter to the endpoint with our Total Security Suite.
Latest generation multi-core processors provide the power to run
all security scanning engines in parallel without causing
performance bottlenecks..
Gain critical insights about network security, from anywhere and
at any time, with WatchGuard Dimension..
Built-in compliance reports, including PCI and HIPAA, mean one-
click access to the data you need to ensure compliance
requirements are met.
Up to 8 Gbps firewall throughput. Turn on additional security
services and still see up to 2.6 Gbps throughput.

•
•

3
Note:
The firewalls recommended here are quality hardware that we
have tested internally and work reliably with our services.
However, given the constantly updated firmware and physical
changes made by manufacturers and the nature of cloud-based
services, RingCentral cannot control the final configuration of
the hardware or your computer systems/networks, or promise
that any given firewall will work with your system, or guarantee
that our information is 100% up to date.

QoS Configuration Guide | WatchGuard M200 | Configure Your Firewall
Configure Your Firewall
WatchGuard M200 Firewall Configuration
To review the Quick Start Guide for the WatchGuard M200 click here. See the WatchGuard M200 Hardware Guide here.
1. Log into your WatchGuard. For information about logging into your WatchGuard GUI for first time setup, please refer to the
WatchGuard Quick Start Guide.
2. Navigate to ‘Firewall’and select subcategory ‘Aliases’. (Figure 1)
Figure 1
4
a. Once under ‘Aliases’, select
‘Add’. Name the new alias,
“RingCentral Servers”.
b. Under ‘Alias Members’ select
‘Add’. Create a new entry for
each of the following servers
found here under Section 7:
RingCentral Supernets.
c. Hit ‘Save’once all server
Supernets have been added.
Brand: WatchGuard
Model: M200
Firmware version: 11.12.4

QoS Configuration Guide | WatchGuard M200 | Configure Your Firewall
3. Navigate to ‘Firewall’and select subcategory ‘Firewall Policies’. Hit the ‘Add Policy’button.. (Figure 2)
Figure 2
5

QoS Configuration Guide | WatchGuard M200 | Configure Your Firewall
4. In Figure 2 above, under ‘Select Policy Type’hit ‘Custom’. Then hit ‘Add’.
a)
b)
c)
Name your new policy “RingCentral”.
Keep ‘Type’as Packet Filter.
Under Protocols, enter all applicable RingCentral ports.
Current ports can be found here in Appendix B. (Figure 3)
Enable “Specify custom idle timeout”by hitting the checkbox,
and change the value to ‘300’.
d)
e)
Hit ‘Save’.
Then hit ‘Add Policy’.
Figure 3
6

QoS Configuration Guide | WatchGuard M200 | Configure Your Firewall
5. Now we need to finalize the configuration of the RingCentral Policy. Under the ‘Settings’tab: (Figure 4)
a)
b)
c)
In the ‘From’table, change it from ‘Any-trusted’to ‘Any’, change if you have VLANs setup and want to specific ‘From’endpoints.
In the ‘To’ table, hit ‘Add’and select the previously added ‘RingCentral Servers’. Remove the default entry ‘Any-External’.
Enable “Specify custom idle timeout”by hitting the checkbox, and change the value to ‘300’.
Figure 4
7

QoS Configuration Guide | WatchGuard M200 | Configure Your Firewall
6. Now navigate to the ‘Traffic Management’tab. (Figure 5)
a)
Under ‘Forward Action (From > To)’, hit ‘Add’. To help calculate these values, check here on Section 10.
i.
ii.
iii.
iv.
Name is ‘RC BWM’
Change ‘Maximum Bandwidth’ to values specific to your environment.
Change ‘Guarantee Bandwidth’ to values specific to your environment.
Hit ‘Save Changes’.
Figure 5
b)
Under ‘Reverse Action (To > From)’, select ‘RC BWM’from the dropdown.
8

QoS Configuration Guide | WatchGuard M200 | Configure Your Firewall
7. Now navigate to the ‘Advanced’tab. (Figure 6)
a) Browse down to the ‘QoS’section and modify the following values:
i.
ii.
iii.
iv.
v.
Change ‘Marking Type’to ‘DSCP’
Change ‘Marking Method’to ‘Assign’
Change ‘Value’to ’46 (EF)’
Change ‘Prioritize Traffic Based On’to ‘Custom Value’
Change ‘Value’to ‘7 (Highest)’
Figure 6
8. Hit ‘Save’at the bottom.
9. Select the new Policy ‘RingCentral’and change it to Order 1. Once set, hit ‘Save Policy Order’.
9

QoS Configuration Guide | WatchGuard M200 | Quality of Service
Quality of Service
RingCentral provides reliable, high-quality voice service. Your local
network, internet connection, and your router all contribute to overall call
quality, with sufficient dedicated bandwidth to voice calls being the biggest
factor. To help you manage your call quality, RingCentral offers tools to
check your internet connection speed, and instructions to configure the
Quality of Service (QoS) settings of your routers.
The QoS settings on your router enable it to give priority to real-time voice
traffic over lower-priority data traffic, such as large downloads. This
document provides recommended configuration settings to ensure the
highest-possible QoS experience on the WatchGuard M200
Firewall/Router. Please reference the relevant TCP/UDP settings on the
Ports and Firewalls table to complete the recommended setup.
Supported Browsers for Test
Internet Explorer® 11 or higher (Windows® XP, 7, 8 or higher)
Firefox® version 36 or higher (Windows and Mac®)
Safari version 6.2 or higher (Mac)



Test Your Connection Capacity
The RingCentral Connection Capacity test will help determine the maximum
number of simultaneous RingCentral calls that can be supported on your
broadband connection. Run this test during normal business hours when the
connection is in use by other applications, including large file downloads.
The capacity test should be run using the maximum number of simultaneous
call connections needed, and should use the G.711 codec selection.
Specific requirements for QoS:




Bandwidth—100Kbps up and down per call
Latency (one-way)—less than 150 ms
Jitter—not to exceed 100 ms
Packet loss—less than 3%
These requirements are the foundation for ensuring your local network can
support satisfactory VoIP. Failure to meet these requirements will result in
poor voice quality.
When the test completes, you will see the recommended number of
simultaneous calls your connection can support while maintaining good quality
voice calls.
10
Note:
The routers recommended here are quality hardware that we
have tested internally and work reliably with our services.
However, given the constantly updated firmware and physical
changes made by manufacturers and the nature of cloud-based
services, RingCentral cannot control the final configuration of
the hardware or your computer systems/networks, or promise
that any given router will work with your system, or guarantee
that our information is 100% up to date.

QoS Configuration Guide | WatchGuard M200 | Quality of Service
Test Your Connection Quality
RingCentral provides a VoIP Quality test that will simulate VoIP calls
between your computer and RingCentral, and provide an estimate of
the voice quality you should expect when using our service. For the
most accurate results, run this test at least three different times
throughout a business day, and during peak usage times, while
connected to the network that you plan to use for RingCentral.
A two-minute test is typically sufficient, while longer tests are useful
to find intermittent problems or to simultaneously test VoIP
performance along with other traffic, such as file transfers or remote
access.
Select the maximum number of simultaneous users you expect to
support, and set the test duration between 1 and 5 minutes; 2
minutes is considered sufficient in most instances.
Click jitter and packet loss on the RESULTS SUMMARY panel to view
the overall quality of your expected VoIP connection.
MOS score (Mean Opinion Score) refers to a test that has been used
for decades in telephony networks to obtain the human user's view of
the quality of the network. The MOS is the arithmetic mean of all the
individual scores, and can range from 1 (worst) to 5 (best). A MOS
score of 4 is good.
11

QoS Configuration Guide | WatchGuard M200 | Ports and Firewalls Settings for RingCentral VoIP Service
Ports and Firewalls Settings for RingCentral VoIP Service
Please see RingCentral Ports and Firewalls reference link for the required TCP/UDP ports that need to be opened for RingCentral devices to
work. Categories are:




Device Type
Protocol
Source Port—Customer Side
Destination Port—RingCentral Side
Also see information on Port Triggering on the referenced page.
©2018 RingCentral, Inc. All rights reserved. RingCentral and the RingCentral logo are registered trademarks of RingCentral, Inc. Other third-party marks and logos displayed
in this document are the trademarks of their respective owners.
KID- 11580
12