Watchguard-technologies WatchGuard Firebox SOHO 6 Manual do Utilizador

WatchGuard®Firebox® SOHO 6User GuideSOHO 6.1

x WatchGuard Firebox SOHO 6.1 5. Products derived from this software may not be called "OpenSSL" nor may "OpenSSL" appear in their

Chapter 7: Configure Logging82 WatchGuard Firebox SOHO 6.1

User Guide 83CHAPTER 8 VPN—Virtual Private NetworkingThis chapter describes an optional feature of the WatchGuard SOHO 6, Virtual Private Networking (

Chapter 8: VPN—Virtual Private Networking84 WatchGuard Firebox SOHO 6.1What You Need• One WatchGuard SOHO 6 with VPN and an IPSec-compliant appliance.

User Guide 85What You NeedIP Address Table (example):Item DescriptionAssigned ByExternal IP AddressThe IP address that identifies the SOHO 6 to the In

Chapter 8: VPN—Virtual Private Networking86 WatchGuard Firebox SOHO 6.1Enable the VPN UpgradeYou must first redeem the VPN upgrade license key before

User Guide 87Frequently Asked QuestionsSpecial ConsiderationsConsider the following before configuring your WatchGuard SOHO 6 VPN network:• You can co

Chapter 8: VPN—Virtual Private Networking88 WatchGuard Firebox SOHO 6.1this feature to discourage users from creating Web servers. These providers usu

User Guide 89Set Up Multiple SOHO-SOHO VPN TunnelsSet Up Multiple SOHO-SOHO VPN TunnelsWith this release, a SOHO administrator has the ability to manu

Chapter 8: VPN—Virtual Private Networking90 WatchGuard Firebox SOHO 6.1The Add Gateway page appears.4Enter the Name, IPSec Gateway Address, and Shared

User Guide 91Set Up Multiple SOHO-SOHO VPN Tunnelssteps. Make sure that the Phase 1 settings on this device are the same as on the peer device. 6 Sele

User Guide xiThe mod_ssl package falls under the Open-Source Software label because it's distributed under a BSD-style license. The detailed lice

Chapter 8: VPN—Virtual Private Networking92 WatchGuard Firebox SOHO 6.113 In the Diffie-Hellman Group drop list, specify the group. WatchGuard support

User Guide 93Configure Split TunnelingConfigure Split TunnelingAnother new feature in this release is split tunneling that allows the administrator to

Chapter 8: VPN—Virtual Private Networking94 WatchGuard Firebox SOHO 6.1terminating at the local SOHO 6. The SOHO 6 also allows users on the Trusted n

User Guide 95CHAPTER 9 SOHO 6 WebBlockerWebBlocker is an optional feature of the SOHO 6 that provides Web site filtering capabilities. It gives you pr

Chapter 9: SOHO 6 WebBlocker96 WatchGuard Firebox SOHO 6.1SOHO 6 queries the WatchGuard database and determines whether or not to block the site. The

User Guide 97Purchase and Activate SOHO 6 WebBlockerWebBlocker users and groupsGroupsA group is a collection of individuals or users of the system.Use

Chapter 9: SOHO 6 WebBlocker98 WatchGuard Firebox SOHO 6.1Configure the SOHO 6 WebBlockerUse the WatchGuard SOHO 6 Configuration pages to activate Web

User Guide 99Configure the SOHO 6 WebBlocker3 Select Enable WebBlocking.4 Enter the full access password.The full access password allows a user a to b

Chapter 9: SOHO 6 WebBlocker100 WatchGuard Firebox SOHO 6.1The WebBlocker Groups page appears.3 Click New to create a group name and profile.

User Guide 101Configure the SOHO 6 WebBlocker4 Define a Group Name and select the blocked categories for this group.5 Click Submit.A new Groups page a

xii WatchGuard Firebox SOHO 6.15. Products derived from this software may not be called "Apache", nor may "Apache" appear in their

Chapter 9: SOHO 6 WebBlocker102 WatchGuard Firebox SOHO 6.16 To the right of the Users field, click New.The New User page appears.7 Enter a unique use

User Guide 103WebBlocker Categories8 Click Submit.NOTEYou can delete users or groups at any time by selecting them and clicking Delete.WebBlocker Cate

Chapter 9: SOHO 6 WebBlocker104 WatchGuard Firebox SOHO 6.1(using someone’s phone lines without permission), and software piracy. Also includes text a

User Guide 105WebBlocker Categoriesor handicap, gender, or sexual orientation. Any picture or text that elevates one group over another. Also includes

Chapter 9: SOHO 6 WebBlocker106 WatchGuard Firebox SOHO 6.1Sexual ActsPictures or text exposing anyone or anything involved in explicit sexual acts an

User Guide 107CHAPTER 10 Support ResourcesTroubleshooting TipsThe following information is offered to help overcome any difficulties that might occur

Chapter 10: Support Resources108 WatchGuard Firebox SOHO 6.1four, numbered, Ethernet ports (labeled 0-3) and reload the configuration.If the Mode ligh

User Guide 109Troubleshooting TipsNOTEYou can also reboot by removing the power source for ten seconds, and then restoring power.How do I reset my Sys

Chapter 10: Support Resources110 WatchGuard Firebox SOHO 6.1a DSL router, set the NAT feature of the DSL router to bridge-only mode.How do I install a

User Guide 111Troubleshooting TipsHow can I see the MAC address of my SOHO 6?A MAC (Media Access Control) address is a unique number used to identify

User Guide xiiiContentsCHAPTER 1 Introduction ...1The Package Contents ...

Chapter 10: Support Resources112 WatchGuard Firebox SOHO 6.1How do I change to a static, trusted IP address?Before you can use a static IP address, yo

User Guide 113Troubleshooting TipsTo disable WebBlocker, deselect Enable WebBlocker.How do I allow incoming services such as POP3, Telnet, and Web (HT

Chapter 10: Support Resources114 WatchGuard Firebox SOHO 6.15 Enter the protocol number to allow in the Protocol field.6 Click Submit.7 From the navig

User Guide 115Troubleshooting TipsHow do I set up my SOHO 6 for VPN Manager Access?This requires the add-on product, WatchGuard VPN Manager software,

Chapter 10: Support Resources116 WatchGuard Firebox SOHO 6.1Contact Technical supportOnline Documentation and In-Depth FAQsWatchGuard maintains an ext

User Guide 117IndexNumerics100 indicator 7AAdd Route page 41Bblocked sitesconfiguring65Blocked Sites page 66browsers, supported 12button, RESET 8Ccabl

Index118 WatchGuard Firebox SOHO 6.1Hhardware description 6HTTP proxy settings, disabling 14Iincoming service, creating custom 63indicators1007link 7M

User Guide 119Blocked Sites 66Custom Service 64, 113Dynamic DNS client 43Filter Traffic 62Firewall Incoming Traffic 114Firewall Options 67Groups 101Lo

Index120 WatchGuard Firebox SOHO 6.1configuring for PPPoE 34configuring for static addressing33configuring VPN tunnel with 86connecting to 23default f

User Guide 121VPNforce™ Port 47VPNsand SOHO 6, SOHO 6 tc2and static IP addresses 87between two SOHO 6s 115configuring with SOHO 6 86–88described 83ena

xiv WatchGuard Firebox SOHO 6.1Disable the HTTP proxy setting of your Web browser...14Enable

Index122 WatchGuard Firebox SOHO 6.1

User Guide xvConfigure the Dynamic DNS Service ...43Configure OPT Port Upgrades ...44Configure Dual IS

xvi WatchGuard Firebox SOHO 6.1CHAPTER 7 Configure Logging ...75View SOHO 6 Log Messages ...

User Guide xviiWebBlocker Categories ...103CHAPTER 10 Support Resources ...107Trou

xviii WatchGuard Firebox SOHO 6.1

User Guide 1CHAPTER 1 IntroductionWelcomeCongratulations on purchasing the ideal solution for providing secure access to the Internet–the WatchGuard®

ii WatchGuard Firebox SOHO 6.1Using this GuideTo use this guide you need to be familiar with your computer’s operating system. If you have questions a

Chapter 1: Introduction2 WatchGuard Firebox SOHO 6.1This User Guide is for both the SOHO 6 and the SOHO 6tc–the name SOHO 6 refers to both these appli

User Guide 3How Does a Firewall Work?How Does a Firewall Work?Fundamentally, a firewall is a way of distinguishing between, as well as protecting, “us

Chapter 1: Introduction4 WatchGuard Firebox SOHO 6.1and the trusted network (your computer) and blocks any suspicious activity.How Does Information Tr

User Guide 5How Does the SOHO 6 Process Information?Port numbersThe port numbers are used by computers at both the sending and receiving end to determ

Chapter 1: Introduction6 WatchGuard Firebox SOHO 6.1the external address of the SOHO 6. When a hacker tries to violate the computer, they are stopped

User Guide 7The SOHO 6 Hardware DescriptionStatusWhen illuminated, this light indicates that a management connection has been made.LinkThe link indica

Chapter 1: Introduction8 WatchGuard Firebox SOHO 6.1The SOHO 6 has six Ethernet ports, a reset button, and a power input located on the rear of the ap

User Guide 9The SOHO 6 Hardware DescriptionNOTEThe OPT port is only available if you purchase the Dual ISP Port or VPNforce Port upgrades. You can not

Chapter 1: Introduction10 WatchGuard Firebox SOHO 6.1

User Guide 11CHAPTER 2 InstallationThis chapter explains how to install the SOHO 6 into your network. You must complete the following steps:• Review a

User Guide iiiCertifications and NoticesFCC CertificationThis appliance has been tested and found to comply with limits for a Class A digital applianc

Chapter 2: Installation12 WatchGuard Firebox SOHO 6.1Before You BeginBefore installing your new SOHO 6, be certain that you have the following items:.

User Guide 13Before You Begin2 At the default prompt, type ipconfig/all, then press Enter.3 Enter the TCP/IP settings in the chart provided below.4 Cl

Chapter 2: Installation14 WatchGuard Firebox SOHO 6.13 Exit the TCP/IP configuration screen.NOTEIf you are connecting more than one computer to the tr

User Guide 15Before You BeginTo disable the HTTP proxy in three commonly used browsers, see the instructions below. If your browser is not listed, see

Chapter 2: Installation16 WatchGuard Firebox SOHO 6.1Internet Explorer 5.0, 5.5, and 6.01 Open Internet Explorer.2 Click Tools => Internet Options

User Guide 17Before You Begin4 Click Properties.The network connection Properties dialog box appears.5 Double click the Internet Protocol (TCP/IP) com

Chapter 2: Installation18 WatchGuard Firebox SOHO 6.16 Select Obtain an IP address automatically. Select Obtain DNS server address automatically.7 Cli

User Guide 19Physically connect the SOHO 6Cabling the SOHO 6 for one to four appliancesEach of the Trusted Network ports (numbered 0-3) is able to con

Chapter 2: Installation20 WatchGuard Firebox SOHO 6.1numbered, Ethernet ports (labeled 0-3) on the SOHO 6. Connect the other end into the Ethernet por

User Guide 21Physically connect the SOHO 6The SOHO 6 ships with a “10-seat” license. In other words, the SOHO 6 allows up to ten computers on a networ

iv WatchGuard Firebox SOHO 6.1VCCI Notice Class A ITE

Chapter 2: Installation22 WatchGuard Firebox SOHO 6.12 Disconnect the Ethernet cable that runs from your DSL/cable modem or other Internet connection

User Guide 23CHAPTER 3 SOHO 6 BasicsOnce you have physically installed the SOHO 6, you can connect to it using your Web browser. The SOHO 6 includes a

Chapter 3: SOHO 6 Basics24 WatchGuard Firebox SOHO 6.1The System Status page appears.The System Status page is effectively the home page of the SOHO 6

User Guide 25Default Factory Settings -Pass Through• Upgrade options and their status• Configuration information for both the Trusted and External net

Chapter 3: SOHO 6 Basics26 WatchGuard Firebox SOHO 6.1Firewall SettingsAll incoming services are blocked.An outgoing service allowing all outbound tra

User Guide 27Register your SOHO 6 and Activate the LiveSecurity ServiceFinally, the PWR indicator light should remain illuminated. Your SOHO 6 is now

Chapter 3: SOHO 6 Basics28 WatchGuard Firebox SOHO 6.1NOTEYo u must have JavaScript enabled on your browser to be able to activate LiveSecurity Servi

User Guide 29Reboot the SOHO 6the default IP address, go to: http://192.168.111.1. Click Reboot.• Unplug the SOHO 6 and reconnect it to a power source

Chapter 3: SOHO 6 Basics30 WatchGuard Firebox SOHO 6.1

User Guide 31CHAPTER 4 Configure the Network InterfacesConfigure Your External NetworkWhen you configure the external network, you establish how the S

User Guide vDeclaration of Conformity

Chapter 4: Configure the Network Interfaces32 WatchGuard Firebox SOHO 6.1The most common method to distribute IP addresses is dynamically using DHCP (

User Guide 33Configure Your External NetworkConfigure the SOHO 6 External Network for static addressingIf you are assigned a static address, then you

Chapter 4: Configure the Network Interfaces34 WatchGuard Firebox SOHO 6.14 Enter the TCP/IP settings you recorded from your computer during the instal

User Guide 35Configure Your External Network4 From the Configuration Mode drop list, select PPPoE Client.The page refreshes.5 Enter the PPPoE login na

Chapter 4: Configure the Network Interfaces36 WatchGuard Firebox SOHO 6.1Configure the Trusted NetworkBy default, the SOHO 6 uses DHCP to assign addre

User Guide 37Configure the Trusted NetworkThe Trusted Network Configuration page appears.3 Enter the IP address and the Subnet Mask in the appropriate

Chapter 4: Configure the Network Interfaces38 WatchGuard Firebox SOHO 6.12 Enter the IP address of the DHCP relay server. 3 Click Submit and reboot th

User Guide 39Configure the Trusted NetworkConfigure the Trusted Network with static addressesTo disable the SOHO 6 DHCP server and assign addresses st

Chapter 4: Configure the Network Interfaces40 WatchGuard Firebox SOHO 6.14 Disable the checkbox labeled Enable DHCP Server on the Trusted Network.5 Cl

User Guide 41Configure Static RoutesThe Routes page appears.3 Click Add.The Add Route page appears.4 From the Type drop list, select either Host or Ne

vi WatchGuard Firebox SOHO 6.1WATCHGUARD SOHO SOFTWARE END-USER LICENSE AGREEMENTWATCHGUARD SOHO SOFTWAREEND-USER LICENSE AGREEMENTIMPORTANT - READ CA

Chapter 4: Configure the Network Interfaces42 WatchGuard Firebox SOHO 6.15 Enter the IP address and the Gateway of the route in the appropriate field.

User Guide 43Configure the Dynamic DNS ServiceConfigure the Dynamic DNS ServiceThis feature allows you to register the external, IP address of the SOH

Chapter 4: Configure the Network Interfaces44 WatchGuard Firebox SOHO 6.1NOTEThe SOHO 6 receives the IP of members.dyndns.org when it connects to the

User Guide 45Configure OPT Port UpgradesThe SOHO 6 uses two methods to determine if the external port connection is down:• The link to the nearest rou

Chapter 4: Configure the Network Interfaces46 WatchGuard Firebox SOHO 6.1Once you have upgraded to the SOHO 6 to activate this features, follow these

User Guide 47Configure OPT Port Upgrades9 Enter the number of times the system will ping the Interface before timeout.10 Click Submit.Configure VPNfor

Chapter 4: Configure the Network Interfaces48 WatchGuard Firebox SOHO 6.12 From the navigation bar on the left side, selectNetwork => Optional.The

User Guide 49Configure OPT Port Upgrades6 To require encrypted MUVPN connections on this interface, enable the Require Encrypted MUVPN connections on

Chapter 4: Configure the Network Interfaces50 WatchGuard Firebox SOHO 6.1

User Guide 51CHAPTER 5 Administrative OptionsThe SOHO 6 Administration page is where you configure access to the SOHO 6–using System Security, enablin

User Guide vii archival purposes only.3. Prohibited Uses. You may not, without express written permission from WATCHGUARD: (A) Reverse engineer,

Chapter 5: Administrative Options52 WatchGuard Firebox SOHO 6.1The System Security PageThe System Security configuration page allows you to create sec

User Guide 53The System Security Pagerecommends that the passphrase contain at least one special character, number, and a mixture of upper and lower c

Chapter 5: Administrative Options54 WatchGuard Firebox SOHO 6.15 Enter the System Administrator Name.6 Enter the System Passphrase and confirm it.7 Cl

User Guide 55Set up VPN Manager Access2 From the navigation bar on the left side, selectAdministration => VPN Manager Access.The VPN Manager Access

Chapter 5: Administrative Options56 WatchGuard Firebox SOHO 6.1Update Your Firmware As new firmware is released, you should update the version running

User Guide 57Redeem your SOHO 6 Upgrade Options4 Enter the location of the firmware files located on your computer.5 If you do not know the location o

Chapter 5: Administrative Options58 WatchGuard Firebox SOHO 6.13 Follow the instructions provided on the site to redeem your upgrade license key.4 Cop

User Guide 59Redeem your SOHO 6 Upgrade OptionsDual ISP Port This upgrade to the SOHO 6 activates the Optional port as a fail-over support for the ext

Chapter 5: Administrative Options60 WatchGuard Firebox SOHO 6.1http://www.watchguard.com/renew/Follow the instructions at the site to activate or purc

User Guide 61CHAPTER 6 Configure the Firewall SettingsFirewall SettingsThe flow of incoming and outgoing traffic is controlled by the configuration se

viii WatchGuard Firebox SOHO 6.1Limitation of Liability. WATCHGUARD'S LIABILITY (WHETHER IN CONTRACT, TORT, OR OTHERWISE; AND NOTWITHSTANDING ANY

Chapter 6: Configure the Firewall Settings62 WatchGuard Firebox SOHO 6.1Configure Incoming and Outgoing ServicesBy default, the security stance of the

User Guide 63Configure Incoming and Outgoing Services2 Locate a pre-configured service, such as FTP, Web, or Telnet, then select either Allow or Deny

Chapter 6: Configure the Firewall Settings64 WatchGuard Firebox SOHO 6.12 From the navigation bar on the left side, select Firewall => Custom Servi

User Guide 65Block External Sites5 Enter the port number (or numbers if creating a range of ports) or enter the IP protocol number to allow in the app

Chapter 6: Configure the Firewall Settings66 WatchGuard Firebox SOHO 6.1The Blocked Sites page appears.2 Select either Host IP Address, Network IP Add

User Guide 67Firewall OptionsFirewall OptionsThe SOHO 6 firewall feature includes a few rule settings that are less specific then the service settings

Chapter 6: Configure the Firewall Settings68 WatchGuard Firebox SOHO 6.1Ping requests received on the External NetworkYou can configure the SOHO 6 to

User Guide 69Firewall Options• SOHO 6 supports SOCKS version 5 only.• It is a limited version of SOCKS and does not support authentication.NOTEConfigu

Chapter 6: Configure the Firewall Settings70 WatchGuard Firebox SOHO 6.1• For the SOCKS proxy, enter the URL or IP address of the SOHO 6 trusted netwo

User Guide 71Firewall OptionsFollow these steps:1 Select Log All Allowed Outbound Access.2 Click Submit.Enable override MAC address for the External N

User Guide ixNo change or modification of this EULA will be valid unless it is in writing, and is signed by WATCHGUARD.Notice to UsersInformation in t

Chapter 6: Configure the Firewall Settings72 WatchGuard Firebox SOHO 6.1Create an Unrestricted Pass ThroughThe SOHO 6 is able to allow traffic to be p

User Guide 73Create an Unrestricted Pass Throughand Trusted network computers are not protected from potential threats, do not use the Pass Through fe

Chapter 6: Configure the Firewall Settings74 WatchGuard Firebox SOHO 6.1

User Guide 75CHAPTER 7 Configure LoggingWhat is logging? Logging is the act of recording “events” that occur at the SOHO 6 interfaces. An event is any

Chapter 7: Configure Logging76 WatchGuard Firebox SOHO 6.1View SOHO 6 Log MessagesThe WatchGuard SOHO 6 generates an ongoing activity log stored on th

User Guide 77Set up Logging to a WatchGuard Security Event Processor Log HostTo have your log messages synchronize with your computer:• Click Sync Tim

Chapter 7: Configure Logging78 WatchGuard Firebox SOHO 6.1The WatchGuard Security Event Processor page appears.3 Select Enable WatchGuard Security Eve

User Guide 79Set up Logging to a Syslog HostSet up Logging to a Syslog HostThe SOHO 6 also sends log entries to a Syslog host.Follow these steps to se

Chapter 7: Configure Logging80 WatchGuard Firebox SOHO 6.1To adjust your syslog messages to your browsers local time:• Select Include local time in sy

User Guide 81Set the System TimeThe System Time page appears.If you have decided to use the WatchGuard Time Server:3 Select Get Time From WatchGuard T