Whats New in Fireware v11.10WatchGuard Training2015 WatchGuard Technologies, Inc.

Whats New in v11.10New Features Policies by Domain NameBandwidth and time user quotasMonitoring EnhancementsReview and reset user quota dataVPN diagnostic messages and report enhancementsGateway Wireless Controller shows rogue access points and client signal strengthFull Screen mode in FireWatch in Fireware XTM Web UISubscription Services EnhancementSetup wizards for services now available in the Web UIVPN EnhancementsMobile VPN with SSL v11.10 clients for Windows and Mac OS X

WatchGuard Training*

Whats New in v11.10Certificate Management EnhancementsManage certificates from the Web UIAutomatic CA certificate updatesWireless Access Point EnhancementsWireless traffic shapingTime-based SSID ActivationScheduled restarts of AP devicesMultiple AP device selection for AP actionsEnable rogue access point detectionSSO EnhancementsExchange Monitor (EM) Exchange Server 2013 supportClientless SSO for RDP loginsTraffic through BOVPN tunnels can use SSOSupport for switching between multiple users of the SSO ClientWatchGuard Training*

Whats New in v11.10RapidDeploy Enhancements Improvements for CSV files on a USB driveSystem EnhancementsNTP server Networking EnhancementsImproved routing tablesMultiple servers for DHCP relayDHCPv6 prefix delegationARP limit updatesXTM Configuration Report updatesLogging & Reporting EnhancementsSimultaneously send log messages to two Log ServersExpanded information included in Device FeedbackWhat Else is New?A comprehensive Help system with instructions for all Fireware management UIs.

WatchGuard Training*

New Feature Policies by Domain NameWatchGuard Training

Policies by Domain NameWatchGuard Training*You can now use FQDN (Fully Qualified Domain Names) in:From and To lists in a policyAliasesBlocked SitesBlocked Site ExceptionsQuota ExceptionsWe recommend you use this feature to allow traffic to selected domains while blocking all other traffic. Software update sites such as Windows updatesAntivirus signature update sitesUseful for when sites are hosted on content delivery networks (CDNs) that frequently add and change IP addresses.

Domain Name FormatWatchGuard Training*You can use a specific FQDN (host.example.com) or a wildcard domain (*.example.com). For example, the wildcard domain *.example.com would include:a.example.comb.example.coma.b.example.comThese wildcard entries are not supported:*.*.example.comexample*.com*. example.*.comexample.*.com

Policies by Domain NameWatchGuard Training*How It WorksWhen you define an FQDN in your configuration, your Firebox performs forward DNS resolution for the specified domain and stores the IP mappings. For wildcard domains such as *.example.com, the device performs forward DNS resolution on example.com and www.example.com. To resolve the subdomains implied by *.example.com, the device analyzes DNS replies that match your FQDN configuration. As DNS traffic passes through the Firebox, it stores the IP mapping responses to relevant queries.

Policies by Domain NameWatchGuard Training*DNS ConfigurationYou must have a DNS server configured in the network settings of your Firebox, or have the external interface set to DHCP or PPPoE to get a DNS configuration. All clients and your Firebox must use the same DNS server. If the client contains different IP and domain mappings than the Firebox, the traffic will not match to the correct policy and could be allowed by a different policy, or dropped if no policy is matched. If clients try to reach an internal destination with an internal DNS server, the Firebox might not have an opportunity to analyze this traffic for local servers. We recommend that if you use internal DNS server, they should be located on a different internal network than your clients so that the Firebox can see and analyze replies from the DNS server.

Policies by Domain NameWatchGuard Training*When you configure Domain Names, consider these possibilities:An FQDN can correspond to multiple IP addresses It is possible that different DNS servers can return different IP address replies based on geographical location, time zone, load balancing configurations, and other factors.A specific IP address might map to several FQDN When an FQDN address is resolved to an IP address, it is equivalent to having a firewall policy with that specific IP address in the policy. If another domain or subdomain also resolves to the same IP address, traffic to or from that domain will also match this policy. Multiple FQDN for the same site Many website main pages pull data from other websites and second-level domains for images and other information. If you block all traffic and allow a specific FQDN, you must also allow any additional FQDN that are called by the main page. The Firebox will attempt to map IP addresses from second-level domains for a wildcard domain to provide the full content for a site.

Domain Names in LoggingLog messages show the domain names (including wildcard domains) that are matched in the log messages when a policy is applied to traffic by FQDN.

WatchGuard Training*

Domain Names in ReportingReports show the domain name that was matched when the policy was applied to traffic by FQDN.

WatchGuard Training*

Domain Names in ReportingThe Blocked Sites list identifies the IP addresses blocked by FQDN included in the configuration.

WatchGuard Training*

New Feature QuotasWatchGuard Training*

Bandwidth and Time QuotasWatchGuard Training*You can enable bandwidth and time usage quotas for users on your network for access to external sites. Apply a daily limit to user Internet usage to enforce corporate acceptable use policies. When users exceed the quota limit, a notification message appears in their web browsers and further access attempts are denied.

Bandwidth and Time QuotasYou can set these types of quotas:Bandwidth The bandwidth quota is set in MB per day, and is enforced for all TCP and UDP traffic in both directions. Time The time quota is set in minutes per day.Both bandwidth and time quotas can be enabled at the same time, and the limit that is reached first is enforced.

WatchGuard Training*

Bandwidth and Time QuotasQuota limits are applied to users and groups based on authentication to the Firebox. For a quota to take effect, a user must be authenticated and match a configured policy defined with Firebox users and groups.

WatchGuard Training*

Bandwidth and Time QuotasWatchGuard Training*To enable bandwidth and time quotas, you must:Enable quotas and create quota rulesApply a quota action to a ruleEnable the quota rule in a policy

Enable time and bandwidth quotasAdd a quota rule that defines applicable users and groups, and the quota action to apply.Bandwidth and Time QuotasWatchGuard Training*

A quota action defines the bandwidth and time restrictions to apply to a quota rule.

Bandwidth and Time QuotasWatchGuard Training*

Bandwidth and Time QuotasTo enforce a quota, a quota rule must be enabled for a specific policy. The policy must be defined with users or groups to be able to apply a quota rule.

WatchGuard Training*

You can create exceptions to quotas so that any traffic to a specific destination address is not counted towards the usage quota. Create exemptions for your company's own domains, or software and antivirus signature update sites.

Bandwidth and Time QuotasWatchGuard Training*

Bandwidth and Time QuotasOptions to reset user quota data include:Quota daily limits are automatically reset the next day (starting at 00:00)Configuration changes automatically reset quotas for users and groups that use the updated quota actionReboot the FireboxManually reset quota data for specific users from the Web UI and FSM WatchGuard Training*

Monitoring EnhancementsWatchGuard Training*

Review & Reset Bandwidth and Time QuotasWatchGuard Training*Monitor user quota usage data in Fireware XTM Web UI and Firebox System Manager.Fireware XTM Web UI System Status > Quotas pageFirebox System Manager Quotas tabQuota data includes these details for each connected user:

Quotas Page (Web UI)User Quotas Tab (FSM)DescriptionUserUserThe user name of the connected user.Auth DomainN/AThe authentication domain through which the user is authenticated.Quota ActionQuota ActionThe quota action defined on your Firebox that applies to the user.Used/Configured Bandwidth (per day)Bandwidth Usage (per day)The amount of bandwidth the user has already used and is allowed to use (used/allowed), for each day.Used/Configured Time (per day)Time Usage (per day)The amount of time the user has already used and is allowed to use (used/allowed), for each day.

Review & Reset Bandwidth and Time QuotasWatchGuard Training*Manually reset user quota data for specific users:Select one or more users.Click Reset Quota.

Gateway Wireless Controller Rogue Access PointsUse the Gateway Wireless Controller Wireless Deployment Maps to scan for foreign wireless access pointsSee a list of rogue access points on the Foreign BSSIDs pageA rogue access point is any wireless access point within range of your network that is not recognized as an authorized access point. Rogue access point can be installed by a malicious user, but could also be a device installed by someone inside your organization without consent.

WatchGuard Training*

Gateway Wireless Controller Client Signal StrengthThe Gateway Wireless Controller in Fireware XTM Web UI and Firebox System Manager now includes an indicator to show the wireless client signal strength.WatchGuard Training*

Enhanced VPN Diagnostic ToolsVPN diagnostic messages New VPN messages now indicate why a branch office VPN gateway or tunnel failed, and can include information about what action to take to resolve the error.VPN diagnostic messages appear in three places in the UI:Firebox System Manager Front Panel tabWatchGuard System Manager Device Status tabFireware XTM Web UI System Status > VPN Statistics pageEnhanced VPN Diagnostic ReportPerforms more checks to identify many of the most common VPN issuesProvides more actionable information

WatchGuard Training*

VPN Diagnostic MessagesVPN diagnostic messages appear below the gateway in the Web UI and FSM.Messages can be for a specific tunnel or gateway endpoint.ErrorsError status Web UIRed text FSM and WSM.Warnings Warning status Web UI.Orange text FSM and WSM.WatchGuard Training*

VPN Diagnostic Report EnhancementsImproved VPN Diagnostic ReportThe VPN Diagnostic Report now does more extensive diagnostics checks, and provides more information.The report includes three new sections:[Conclusion] This section at the top summarizes what was observed, lists any detected errors, and includes suggestions of next steps to troubleshoot the VPN.[Address Pairs in Firewalld] This section shows the address pairs and the traffic direction (IN, OUT, or BOTH).[Policy checker result] This section shows policy checker results for policies that manage traffic for each tunnel route.The VPN Diagnostic Report is now available in the Fireware XTM Web UI on the System Status > VPN Statistics page, as well as on the System Status > Diagnostics page. WatchGuard Training*

Branch Office VPN Troubleshooting TipsFor any branch office VPN, you can run reports and monitor error messages on both endpoint devicesthe initiator and the responder.The initiator is the endpoint that starts the tunnel negotiationThe responder receives the proposal and accepts or rejects the proposed tunnel settings from the initiatorFor troubleshooting VPN negotiation, run the VPN Diagnostic Report or look at the VPN diagnostic messages on the responder.The responder has more information about settings that do not match.On the responder, VPN diagnostic errors include more detailed information about what setting the initiator proposed, and what setting was expected. The initiator does not know what settings were expected. WatchGuard Training*

VPN Troubleshooting in Firebox System ManagerExample VPN diagnostic message for a mismatched Phase 2 proposal VPN diagnostic message on the initiator:Received No Proposal Chosen message. Check VPN IKE diagnostic log messages on the remote gateway endpoint for more information.The VPN diagnostic message on the responder is more informative:Received ESP encryption 3DES, expecting AESThe same messages appear in the VPN Diagnostic Report.To run the report, right-click the gateway and select VPN Diagnostic Report.

WatchGuard Training*InitiatorResponder

VPN Diagnostic Messages in the Web UIVPN diagnostic messages appear in the System Status > VPN Statistics page.

WatchGuard Training*

VPN Diagnostic Report in the Web UITo run the VPN Diagnostic Report from the System Status > VPN Statistics page:On the Branch Office VPN tab, click Debug for a Gateway.Or, select the Debug tab, select the gateway, and click Start Report.

WatchGuard Training*

Routes Table UpdatesIn Fireware XTM Web UI, the Routes table in System Status > Routes includes these updates:Filter routes by:IP address type (IPv4, IPv6, or both IPv6 is new)Route Type (Connected, Static, Dynamic, VPN)Interface (Select the interface)Destination (Type a valid IPv4 network address)The Routes table shows the first 100 routes that match the filter criteria.WatchGuard Training*

Routes Table UpdatesThe Firebox System Manager Status Report tab now includes two route tables.IPv4 Routes Shows the first 100 IPv4 routes (all routes, including static, dynamic, and VPN routes).IPv6 Routes Shows the first 100 IPv6 routes (all routes, including static, dynamic, and VPN routes).Route table includes the same information as the output of the CLI show ip route and show v6 ip route commands.These two route tables replace the four route tables that previously appeared in the Status Report (main, ethx.out, any.out, and zebra).

WatchGuard Training*

FireWatch EnhancementsFireWatch can now be viewed in Full Screen mode in Fireware XTM Web UIFull Screen mode options include:Select to include one or more groups in the displaySpecify the information refresh rateThe settings controls are hidden after a period of timeSelect all standard filtersSee information in bytes for all groups except WebBlocker, which appears in number of connectionsWatchGuard Training*

FireWatch EnhancementsSelect group, data, and refresh options in Full Screen ModeWatchGuard Training*

FireWatch EnhancementsSelect which group information appears:SourceDestinationApplicationsPoliciesInterface (In) Interface (Out)Select the type of data that appears:RateBytesConnectionDuration

WatchGuard Training*

Subscription Services EnhancementsWatchGuard Training*

Subscription Services Setup WizardsNew Web UI activation wizards that guide you through the steps to enable these Subscription Services and create a basic configuration:spamBlockerWebBlockerGateway AntiVirusIntrusion Prevention

WatchGuard Training*

Signature Update WarningsNew warnings displayed for services when automatic signature updates are disabled.IPSGateway AntiVirusApplication ControlDLP

WatchGuard Training*

VPN EnhancementsWatchGuard Training*

Updates to Mobile VPN with SSL ClientsUpdated WatchGuard Mobile VPN with SSL clients for Windows and Mac OS XBoth clients now use OpenVPN 2.3.6Both clients now support more than 24 routesThe Windows client now includes the TAP driver for Windows 8.1WatchGuard Training*

Certificate Management EnhancementsWatchGuard Training*

Manage Certificates from the Web UIYou can now perform all the same certificate management tasks from the Web UI that are available in Firebox System Manager. Delete, Install, and export certificatesView certificate detailsImport CRLsCreate CSRs (certificate signing requests)

WatchGuard Training*

Automatic CA Certificate UpdatesAutomatically get new versions of the trusted CAcertificates stored on the device and automatically install the new certificates.Ensures all trusted CA certificates on your device are the latest version. Expired certificates are updated, andnew trusted CA certificates are added to your device. Updated certificates are downloaded from a secure WatchGuard server.

WatchGuard Training*

Wireless Access Point EnhancementsWatchGuard Training*

Wireless AP EnhancementsWatchGuard Training*Wireless traffic shapingTime-based SSID ActivationScheduled restarts of AP devicesMultiple AP device selection for AP actionsEnable rogue access point detection

Wireless Traffic ShapingConfigure traffic rate shaping for each wireless SSID.Traffic shaping is for wireless download traffic only.Base rate The base throughput rate for the SSID. Not allowed to exceed this limit except for burst activity.Ceiling rate The hard limit throughput rate for the SSID. This limit includes burst activity.Burst The maximum number of kilobytes allowed beyond the base rate.

WatchGuard Training*

Time-based SSID ActivationEnable SSIDs for specific time periods.Limits access to the SSID based on the start and end times you configure.WatchGuard Training*

Scheduled Restarts of AP DevicesRestart wireless services or reboot all of your APdevices at scheduled times on a daily or weekly basis. Refreshes the AP device and makes sure the device configuration and all access control lists are up to date.Automatically updates wireless channel selection.AP devices are restarted in 90 second intervals to make sure they are not all restarted at the same time.WatchGuard Training*

Multiple AP Device Selection for AP ActionsYou can select multiple AP devices to complete reboot, upgrade, and restart wireless actions.WatchGuard Training*

Enable Rogue Access Point DetectionEnable rogue access point detection for each SSID.Add known device MAC addresses to the exceptions list so they are not considered a rogue access point.

WatchGuard Training*

SSO EnhancementsWatchGuard Training*

Single Sign-On EnhancementsSingle Sign-On Enhancements include:Support for Microsoft Exchange Server 2013 for the SSO Exchange Monitor.NET Framework v3.5 required on Exchange Server 2013 serverClientless SSO for RDP loginsEvent Log Monitor now recognizes both logon and logoff events for RDP connections and reports this information to the SSO Agent, which sends the events to the Firebox.The Firebox opens and closes user sessions based on the logon and logoff event reports from the Event Log Monitor.Traffic through BOVPN tunnels can now use Single Sign-On (SSO Client only)Support for switching between multiple users of the SSO Client on Windows Vista, 2008, 2012, 7, 8, and 8.1

WatchGuard Training*

Single Sign-On EnhancementsNew Enable SSO through BOVPN tunnels option allows users of BOVPN tunnels to use SSO for network connectionsWatchGuard Training*

RapidDeploy EnhancementsWatchGuard Training*

RapidDeploy CSV File Change External InterfaceYou can now use a CSV file to change the external interface number.A device that starts with factory-default settings can automatically configure the external interface from settings in a CSV file on a connected USB drive. Previously, the only valid interface you could specify in the CSV file was 0.A device that uses Fireware v11.10 now supports interface numbers other than 0.The format of the CSV file did not change. This is most often used for RapidDeploy.Example line in a CSV file to configure interface 2 as the external interface:70XX00777X777,2,ext,Static,203.0.113.20/24,203.0.113.1,198.51.100.20WatchGuard Training*

System EnhancementsWatchGuard Training*

NTP ServerAfter you enable a Firebox to use NTP, you can enable the device as an NTP server.When you enable the device as an NTP server, the NTP Server policy is automatically created. The NTP Server policy allows connections to the NTP server from clients on the trusted and optional networks. Configure NTP clients to get the date and time from the interface IP address or domain name of the Firebox.

WatchGuard Training*

Networking EnhancementsWatchGuard Training*

Multiple Servers for DHCP RelayIn the DHCP Relay settings, you can now add the IP addresses of up to three DHCP servers.Previously you could configure only one IP address for DHCP Relay.The Firebox relays DHCP requests to the IP addresses of all DHCP servers. WatchGuard Training*

DHCPv6 Prefix DelegationYou can enable DHCPv6 Client Prefix Delegation on an external interface. The device requests an IPv6 prefix from a DHCPv6 server.You can use the delegated prefix when you configure IPv6 addresses on trusted, optional, and custom interfaces. DHCP prefix delegation is described in RFC 3633.WatchGuard Training*

DHCPv6 Prefix DelegationThe delegated prefix appears on the Front Panel tab of Firebox System Manager.

WatchGuard Training*

DHCPv6 Prefix DelegationYou can use the delegated prefix for a trusted, optional or custom interface.Static IPv6 interface IP addressIPv6 prefix advertisementDHCPv6 address poolDHCPv6 reserved addressesSelect Use delegated prefix.The delegated prefix name appears as the first part of the IPv6 address.The prefix name includes the external interface device name, followed by _prefix. For example eth0_prefix.Type the subnet in the adjacent text box.WatchGuard Training*Delegated prefix in the DHCPv6 address poolDelegated prefix in a static IPv6 address

DHCPv6 Prefix DelegationWatchGuard Training*You can also enable the DHCPv6 server on an interface to delegate prefixes to DHCPv6 clients.Add prefixes to the Prefix Pool.To reserve a specific prefix for a client, add the prefix to the Reserved Addresses and Prefixes list.

Improved Route Tables Command Line InterfaceTo see the first 100 IPv4 routes, use the show ip route commandReplaces the show route commandOutput is easier to read than the output of the old show route commandWG>show ip routeKernel IP routing tableDestination Gateway Genmask Interface Flags Metric0.0.0.0 203.0.113.1 0.0.0.0 eth0 UG 510.0.70.0 0.0.0.0 255.255.255.0 eth1 U 010.0.71.0 0.0.0.0 255.255.255.0 eth1 U 010.0.78.0 0.0.0.0 255.255.255.0 vlan10 U 010.0.79.0 0.0.0.0 255.255.255.0 br0 U 010.10.10.0 0.0.0.0 255.255.255.0 ath1 U 0127.0.0.0 0.0.0.0 255.0.0.0 lo U 0192.168.113.0 0.0.0.0 255.255.255.0 tun0 U 0203.0.113.0 0.0.0.0 255.255.255.0 eth0 U 0Use command options to filter the route table (same filters as in the Web UI)WG>show ip route ? Carriage return IP subnet for the destination connected Connected routes dynamic Dynamic routes ifname Interface device name static Static routes vpn VPN routes

WatchGuard Training*

Improved Route Tables Command Line InterfaceTo see the first 100 IPv6 routes use show v6 ip routeOutput no change from 11.9.xWG>show v6 ip routeKernel IPv6 routing tableDestination Next Hop Interface Flags Metric2001::/64 :: vlan10 U 256fe80::/64 :: vlan10 U 256New command options to filter the route table (same filters as in the Web UI)WG>show v6 ip route ? Carriage return IPv6 subnet for the destination connected Connected routes dynamic Dynamic routes ifname Interface device name static Static routes vpn VPN routesWatchGuard Training*

Updated XTM Configuration ReportThe XTM Configuration Report available from the Fireware Web UI now includes information about Default Packet Handling and FireCluster configuration settings.

WatchGuard Training*

Logging & Reporting EnhancementsWatchGuard Training*

Logging EnhancementsSimultaneously send Log Messages to two WatchGuard Log ServersTwo different WatchGuard Log Servers Dimension or WSM Log ServersConfigure two sets of Log ServersAdd primary and backup servers for each Log Server setWatchGuard Training*

Logging Enhancements Fireware XTM Web UI Logging > Log Servers 1 & Log Servers 2 tabsWatchGuard Training*

Logging EnhancementsPolicy Manager Logging Setup > Configure > Log Servers 1 & Log Servers 2 tabsWatchGuard Training*

Device Feedback Report EnhancementsNew information in the Device Feedback sent to WatchGuard includes:Start and end time stamps for the feedback data sent to WatchGuardPeak proxy connection limit usageNumber of proxy actions with Subscription Services enabled in the configurationSubscription Services details include:Whether the service is enabledCounts of the number of events for each service enabled on the FireboxA list of the events triggered on the Firebox for each service (includes the source IPaddress, protocol, and threat level of the event).WatchGuard Training*

What Else is New?WatchGuard Training*

Integrated Fireware HelpThe v11.10 release includes the first iteration of a comprehensive online-only Help system for Fireware with integrated instructions for all Fireware management UIs.Includes context-sensitive help topics for these management and monitoring tools:Fireware XTM Web UIWatchGuard System Manager & all WSM toolsWatchGuard DimensionWatchGuard WebCenterWatchGuard Server Center & WatchGuard serversWatchGuard Deployment Center (RapidDeploy)WatchGuard Training*

Additional ResourcesWatchGuard Training*

Additional ResourcesInformation about the new and enhanced features included in this release is available from these resources on the Product Documentation pages of the WatchGuard website:From the Help systems:Fireware Help Whats New in This ReleaseFrom the Whats New presentation:Whats New in Fireware v11.10

WatchGuard Training*

Thank You!WatchGuard Training*