WatchGuard SOHO User Guide ® SOHO and SOHO|tc version 5.
Using this guide This guide assumes that you are familiar with your computer’s operating system. If you have questions about navigating in your computer’s environment, please refer to your system user manual. The following conventions are used throughout this guide. Convention Indication Bold type Denotes menu commands, dialog box options, Web page options, Web page names. For example: “On the System Information page, select Disabled.” CAUTION Denotes a warning or precautionary information.
Certifications and Notices FCC Certification This device has been tested and found to comply with limits for a Class A digital device, pursuant to Part 15 of the FCC Rules. Operation is subject to the following two conditions: • This device may not cause harmful interference. • This device must accept any interference received, including interference that may cause undesired operation.
Taiwanese Notice VCCI Notice Class A ITE User Guide 5.
Declaration of Conformity 6
WatchGuard® End-User License Agreement IMPORTANT - READ CAREFULLY BEFORE ACCESSING WATCHGUARD SOFTWARE This WatchGuard End-User License Agreement (“EULA”) is a legal agreement between you (either an individual or a single entity) and WatchGuard Technologies, Inc.
4. LIMITED WARRANTY. WATCHGUARD makes the following limited warranties for a period of ninety (90) days from the date you obtained the SOFTWARE PRODUCT from WATCHGUARD or an authorized dealer; (A) Media. The disks and documentation will be free from defects in materials and workmanship under normal use.
SUCH DAMAGES. THIS SHALL BE TRUE EVEN IN THE EVENT OF THE FAILURE OF AN AGREED REMEDY. 5. UNITED STATES GOVERNMENT RESTRICTED RIGHTS. The enclosed SOFTWARE PRODUCT and documentation are provided with Restricted Rights. Use, duplication or disclosure by the U.S Government or any agency or instrumentality thereof is subject to restrictions as set forth in DFARS 227.7202-3 (Commercial Computer Software) and DFARS 252.227-7015(b) (Technical Data-Commercial Items) -- Restricted Rights Clause at FAR 52.
WatchGuard® Limited Hardware Warranty This WatchGuard Limited Hardware Warranty (the "Warranty") applies to the enclosed WatchGuard hardware product (the "Hardware Product"). By using the HARDWARE Product, you agree to the terms hereof. If you do not agree to these terms, please return this package, along with proof of purchase, to the authorized dealer from whom you purchased the Hardware Product for a full refund.
OR IMPLIED, ARISING BY LAW OR OTHERWISE, WITH RESPECT TO ANY NONCONFORMANCE OR DEFECT IN THE HARDWARE PRODUCT (INCLUDING, BUT NOT LIMITED TO, ANY IMPLIED WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, ANY IMPLIED WARRANTY ARISING FROM COURSE OF PERFORMANCE, COURSE OF DEALING, OR USAGE OF TRADE, ANY WARRANTY OF NONINFRINGEMENT, ANY WARRANTY OF UNINTERRUPTED OR ERROR-FREE OPERATION, ANY OBLIGATION, LIABILITY, RIGHT, CLAIM OR REMEDY IN TORT, WHETHER OR NOT ARISING FROM THE NEGLIGENCE (WHETHER
Copyright and Patent Information Copyright © 1999-2001 WatchGuard Technologies, Inc. All rights reserved. WatchGuard and LiveSecurity are either registered trademarks or trademarks of WatchGuard Technologies, Inc. in the United States and other countries. Firebox is a trademark of WatchGuard Technologies, Inc. CyberPatrol is a registered trademark of SurfControl, Inc. DocVer: B-2.4-User-2 All other trademarks and trade names are the property of their respective owners.
Table of Contents Introduction ................................................ 17 Registration and Identification Information ............ 18 How does a firewall work? ...................................... 18 How does information travel on the internet? ........ 20 How does the SOHO process this information? .....21 The SOHO Home Page—System Status ................. 22 The Default Factory Settings ................................... 22 Rebooting a WatchGuard SOHO ............................
Configuring Your Trusted Network ......................... 47 Configuring Static Routes ....................................... 49 View the Network Statistics .....................................50 Your Administrative Options .................... 53 The System Security Page ....................................... 53 Setting up VPN Manager Access ............................56 Update Your Configuration from a Non-Windows Platform ..............................................................
Configuring the SOHO WebBlocker .......................88 WebBlocker categories ........................................... 93 Searching for blocked sites .....................................96 Configuring Virtual Private Networking .. 97 What you will need ................................................. 98 Step-by-step instructions for configuring a SOHO VPN tunnel ................................................................ 100 Frequently asked questions ..................................
CHAPTER 1 Introduction Welcome Congratulations on purchasing the ideal solution for providing secure access to the Internet–the WatchGuard SOHO or WatchGuard SOHO|tc. Your new security device will give you peace of mind when connecting to the Internet using a high-speed cable or DSL modem, a leased line, or ISDN. This User Guide applies to both the SOHO and the SOHO|tc–the name SOHO is used to refer to both these devices throughout the guide.
Registration and Identification Information Registration and Identification Information Once you have installed and configured your SOHO following the instructions you will find in the upcoming chapters, you will need to register the unit at our Web site. When the registration is complete you can take advantage of our LiveSecurity service as well as any upgrade options you may have purchase. Please use this area, provided for your convenience, to enter your SOHO information.
How does a firewall work? these dangers. As is illustrated in the image below, the SOHO physically seperates your trusted network from the Internet. Using rules we will discuss in Chapter 3: “Configuring Incoming and Outgoing Services” on page 63, the WatchGuard SOHO evaluates all traffic between the external network (the Internet) and the trusted network (your computers) and blocks any suspicious activity.
How does information travel on the internet? How does information travel on the internet? Each packet of information transported over the Internet must be packaged in a special way to ensure that it is able to travel from one computer to the next. A system called Internet Protocol (IP) takes chunks of information and wraps them up with a header identifying both where the information is going and how it should be handled enroute.
How does the SOHO process this information? How does the SOHO process this information? Services A service is the combination of protocol(s) and port numbers associated with a specific application or communication type. To facilitate configuration of your SOHO, WatchGuard lets you select pre-configured versions of several commonly used services. Network Address Translation (NAT) All incoming connections through a SOHO automatically use a feature called dynamic network address translation (dynamic NAT).
The SOHO Home Page—System Status The SOHO Home Page—System Status The System Status page is effectively the home page of the SOHO. A variety of information is revealed in an effort to provide you with a comprehensive display of the SOHO configuration.
The Default Factory Settings Firewall Settings All incoming services are blocked. An outgoing service allowing all outbound traffic. None of the Firewall Options are enabled. The DMZ pass-through is disabled. System Security System Security is disabled and no System Administrator name or passphrase is set–the onboard configuration pages are available to all on the trusted network. SOHO Remote Management is disabled. VPN Manager Access is disabled. No remote logging is configured.
Rebooting a WatchGuard SOHO The Base Model SOHO The base model SOHO comes with a ten seat license, that is ten computers have access to the Internet through the SOHO. Remember, while only four devices connect directly to the four (numbered 1-4) Ethernet ports, one or more of these devices can be a hub or router. Please see, “Cabling the SOHO for more than four computers” on page 34.
Rebooting a WatchGuard SOHO • Send an FTP command to the remote SOHO device. Use an FTP application to connect to the SOHO device, then enter the command: quote rebt User Guide 5.
Rebooting a WatchGuard SOHO 26
CHAPTER 2 Getting Started Before you begin Pre-installation checklist Before installing your new WatchGuard SOHO please ensure that you have: • A 10BaseT Ethernet I/O network card installed in your computer. • A cable or DSL modem with a 10BaseT port. • Two Ethernet network cables with RJ45 connectors. These must not be “crossover cables” (which are usually red or orange). One cable is furnished with your unit. A second cable may have been supplied with your modem.
The Installation Process • An operational Internet connection. Setup of your SOHO requires access to the Internet. If your connection does not work, please contact your Internet service provider (ISP). When your connection has been established, you may proceed with installation and setup. • If you have either a cable or DSL modem, consult the manual that came with your service, or call the ISP to find out whether your particular modem supports DHCP or PPPoE.
The Installation Process Determine your current TCP/IP settings For your reference, record the computer’s current TCP/IP settings in the chart provided at the end of this section. Different operating systems will supply different information. To locate your settings: Microsoft Windows NT or 2000 1 Click Start => Programs => Command Prompt. 2 At the C:\ prompt, enter ipconfig/all. Press Enter. 3 Enter your current TCP/IP settings in the chart provided below. 4 Click Cancel.
The Installation Process 3 Exit the TCP/IP configuration screen. TCP/IP Setting Value IP Address Subnet Mask Default Gateway . . . . . . . . . DHCP Enabled Yes Primary WINS Server Secondary WINS Server DNS Server(s) Primary Secondary No . . . . . . . . . . . . NOTE If you are connecting more than one computer to the trusted network behind the SOHO, obtain the configuration TCP/IP information for each computer.
The Installation Process With the HTTP proxy enabled, the browser automatically points itself to Web pages located on the Internet, and you cannot direct the browser to Web pages located in other places. Disabling the HTTP will not prevent you from accessing your favorite Web sites, but it will allow you to access the special configuration pages that reside only on the SOHO. To disable the HTTP proxy in three commonly used browsers, see the instructions below.
The Installation Process 5 Verify that the Direct Connection to the Internet option is enabled. 6 Click OK to save the settings. Internet Explorer 5.0/5.5 and 6.0 1 Open Internet Explorer. 2 3 Click Tools => Internet Options. The Internet Options screen displays. Click the Advanced tab. 4 Scroll down the page to HTTP 1.1 Settings. 5 Disable all checkboxes. 6 Click OK to save the settings.
The Installation Process 1 Complete the “Pre-installation checklist” on page 27. 2 Shut down your computer and unplug the power from your DSL or cable modem. 3 Unplug the Ethernet cable that is connected from your DSL or cable modem to your computer and plug it into the WAN port on the SOHO unit. The SOHO unit is now connected directly to the modem. 4 Plug the Ethernet cable supplied with your SOHO into any one of the four (numbered 1-4) Ethernet ports on the SOHO.
The Installation Process 6 Attach the power cord to the SOHO and plug it into an outlet. 7 Restart your computer. 8 For information on the factory default configuration options, see “The Default Factory Settings” on page 22. For specialized configurations, see “Configuring Your External Network” on page 37, as well as, “Configuring Your Trusted Network” on page 47.
The Installation Process exist on the network and communicate with each other, but only the first ten which attempt to access the Internet will be allowed through the SOHO. If you would like to upgrade your SOHO to a twenty-five or fifty-seat user license, please visit: h t t p :/ /w w w .w a t c h g u a rd . c o m / sa l e s /b u y on l in e .a s p 1 Complete the “Pre-installation checklist” on page 27. 2 You will need these additional items: - One or more Ethernet hubs.
The Installation Process 36
CHAPTER 3 Setting Up Your SOHO Network The configuration instructions in this chapter assume that you are using Windows 98/ME. If this is not the case, see your operating system user guide or help resources to locate the equivalent options and commands. Configuring Your External Network When you configure the external network, you establish how the SOHO communicates with your Internet service provider (ISP).
Configuring Your External Network method to distribute IP addresses is to use Dynamic Host Configuration Protocol (DHCP). When you connect your computer to the network, a DHCP server at your ISP automatically assigns it a network IP address. This eliminates the ISP from having to manually assign and manage IP addresses. IP address assignments can be either dynamic or static. With dynamic, your ISP assigns your computer a new address every time you connect.
Configuring Your External Network 3 Scroll through the list of installed network components. Double-click the TCP/IP network component which is bound to your Ethernet card. Look for (Ethernet) in parentheses. The TCP/IP Properties dialog box appears. User Guide 5.
Configuring Your External Network 4 If “Obtain an IP Address Automatically” is selected, your computer is configured for dynamic DHCP. If “Obtain an IP Address Automatically” is not checked, your computer is configured for static addressing. Configuring the SOHO External network for dynamic addressing Out of the box, the SOHO is configured to obtain its external address information automatically, using DHCP.
Configuring Your External Network Configuring the SOHO External network for static addressing If you are assigned a static address, then you must transfer the permanent address assignment from your computer to the SOHO. Instead of communicating directly to your computer, the ISP will now communicate first through the SOHO. To do this you must both modify the static settings on your personal computer as well as enter the information on the SOHO Configuration pages.
Configuring Your External Network 6 Save the changes. 7 On most platforms, click OK until the Control Panel window closes. 8 Shut down and reboot the computer. On the SOHO: 1 2 Open your Web browser. Click Stop. At this point, the Internet connection is not fully configured, and the computer cannot load your home page from the Internet. However, the computer can access special configuration Web pages installed on the SOHO itself.
Configuring Your External Network 4 From the Configuration Mode drop list, select Manual Configuration. 5 Enter the TCP/IP settings you copied from the computer when you started the install process. 6 Click the Submit button. To complete the SOHO External Network configuration, see “Release and renew the IP configuration” on page 46. Configuring the SOHO external network for PPPoE While less common, PPPoE is another method for an ISP to assign addresses.
Configuring Your External Network ISP to see if they use PPPoE. If you cannot find this information, contact your ISP and ask. You will need your PPPoE login name and password. To configure the SOHO for PPPoE: 1 2 Open your Web browser and click Stop. At this point, the Internet connection is not fully configured, and the computer cannot load your home page from the Internet. However, the computer can access special configuration Web pages installed on the SOHO itself.
Configuring Your External Network 5 Enter the PPPoE login name supplied by your ISP. 6 Enter the PPPoE password supplied by your ISP 7 8 Click Automatically restore lost connections. This enables a constant flow of “heartbeat” traffic between the SOHO and the PPPoE server. In the event of routine packet loss, this option allows the SOHO to maintain the PPPoE connection. The SOHO may reboot to recover this connection if the heartbeat fails.
Configuring Your External Network Release and renew the IP configuration Regardless of what type of addressing your computer used originally, it will now obtain this information from the SOHO using DHCP. To enable your computer to receive this information from the SOHO, you must force it to release and renew its IP configuration information. From your computer desktop: 1 Click Start => Programs => Command Prompt. 2 At the C:\ prompt, type winipcfg. Press Enter. The IP Configuration dialog box appears.
Configuring Your Trusted Network Configuring Your Trusted Network Out of the box, the SOHO automatically uses DHCP to assign addresses to computers on your trusted network. In other words, every time you connect a computer to the SOHO, either directly or through a hub, it automatically attempts to obtain its addresses from the SOHO.
Configuring Your Trusted Network 3 Enter the IP address and the Subnet Mask in the appropriate fields. 4 Disable the checkbox labeled Enable DHCP Server on the Trusted Network. 5 Click the Submit button. Configure additional computers to the trusted network Up to four computers can be plugged directly into the four (numbered 1-4) Ethernet ports of the SOHO. A larger number of computers can be networked together by using one or more 10BaseT Ethernet hubs with RJ-45 connectors.
Configuring Static Routes (LAN). You can also mix computers with different operating systems on your network and they will pass traffic through the SOHO to access the Internet. Follow these steps to add one or more computers to your Trusted network: 1 Ensure that any additional computer has an Ethernet card installed. Shut the computer down, connect it to the network the same way you did in “Cabling the SOHO for more than four computers” on page 34. Restart the computer.
View the Network Statistics 3 Click the Add button. 4 From the Type drop list, select either a Host or Network. 5 Enter the IP address and the Gateway of the route in the appropriate field. 6 Click the Submit button. View the Network Statistics The SOHO has a configuration page which displays a variety of network statistics to assist you in monitoring data traffic as well as troubleshooting potential problems.
View the Network Statistics Follow these instructions to view this page: 1 With your Web browser, go to the SOHO System Status page using the Trusted IP address of the SOHO. For example, if using the default IP address, go to: http://192.168.111.1 2 From the navigation bar on the left side, select Network => Network Statistics. The Network Statistics page appears. User Guide 5.
View the Network Statistics 52
CHAPTER 4 Your Administrative Options The SOHO Administration page allows you to configure access to the unit, update the firmware from a non-Windows operating system, redeem any upgrade options you may have purchased, and see the SOHO configuration file in a text format. The System Security Page The System Security configuration page allows you to create secure settings in order to protect the configuration of your SOHO.
The System Security Page depth in the SOHO Remote Monument Guide located on our Web site: h t t p :/ /h e lp . wa t ch g u a rd . c o m / d oc u m e n t a t i o n /d e f a u l t .a s p Setting a System Administrator Name and System Passphrase Passphrases are a barrier between your computer and anyone trying to break in. They are the first line of defense in computer security. They are, unfortunately, the most frequently overlooked of all security measures.
The System Security Page Follow these steps to setup the SOHO System Passphrase: 1 With your Web browser, go to the SOHO System Status page using the Trusted IP address of the SOHO. For example, if using the default IP address, go to: http://192.168.111.1. 2 From the navigation bar on the left side, select Administration => System Security. The System Security page appears. 3 Verify that the HTTP Server Port is set at 80. 4 Enable the checkbox labeled Enable Password.
Setting up VPN Manager Access 7 Enter the System Passphrase again to confirm it in the appropriate field. 8 Click the Submit button. Setting up VPN Manager Access The SOHO can be configured to allow the WatchGuard VPN Manager software access in order to configure and manage Branch Office VPN tunnels from a remote location. The VPN Manager software is purchased separately. For more information regarding the VPN Manager product, use your Web browser to go to: h t t p s :/ /w w w .w a t c h g u a r d .
Setting up VPN Manager Access 3 Enable the checkbox labeled Enable VPN Manager Access. 4 Enter the Status Passphrase in the appropriate field. 5 Enter the Status Passphrase in the appropriate field again to confirm it. 6 Enter the Configuration Passphrase in the appropriate field. 7 Enter the Configuration Passphrase in the appropriate field again to confirm it. CAUTION These two settings must exactly match the passphrases used in the VPN Manager or the connection will fail.
Update Your Configuration from a Non-Windows Platform Update Your Configuration from a NonWindows Platform If you are managing your SOHO from a computer running a operating system platform other than Windows (such as a Macintosh or Linux OS), you must update your firmware from this configuration page as firmware versions are released. This is because WatchGuard installation applications are built for Windows only.
Redeeming your SOHO upgrade certificates these software options is stored within the SOHO. Once you have purchased an upgrade option and redeemed it, the Feature key stored on your unit is modified to enable the software upgrade. Follow these steps to redeem your upgrade certificate: 1 With your Web browser, go to the SOHO System Status page using the Trusted IP address of the SOHO. For example, if using the default IP address, go to: http://192.168.111.
Redeeming your SOHO upgrade certificates Upgrade certificates Seat Licenses The SOHO can be upgraded to provide for more seats than are available with the base model (for example, the 25 seat license certificate). These certificates must be purchased separately. IPSec Virtual Private Networking (VPN) The SOHO|tc comes with a VPN upgrade certificate, however you must first enable the VPN upgrade in order to configure virtual private networking. The SOHO does not come with the VPN upgrade certificate.
View the Configuration File View the Configuration File From this configuration page, you can view your SOHO configuration file as it appears in text form. Follow these steps to view the file: 1 With your Web browser, go to the SOHO System Status page using the Trusted IP address of the SOHO. For example, if using the default IP address, go to: http://192.168.111.1 2 From the navigation bar on the left side, select Administration => View Configuration File. The View Configuration File page appears.
View the Configuration File 62
CHAPTER 5 Configuring Your Firewall Settings Firewall settings The WatchGuard SOHO enables you to customize what is allowed both incoming and outgoing through your firewall. With this feature, you can narrowly define what kind of communication is permitted between computers on the Internet and computers on your trusted network. To facilitate configuring your SOHO, WatchGuard identifies several commonly used services.
Configuring Incoming and Outgoing Services by the SOHO firewall. You can, however, selectively open your network to certain types of Internet connectivity. For example, if you would like to set up a Web server behind the SOHO, you can add an incoming Web service. It is important to remember that each service you add opens a small window into your trusted network and marginally reduces your security. This is the inherent trade-off between access and security.
Configuring Incoming and Outgoing Services 2 Locate the pre-configured service you wish to define, such as FTP, Web, or Telnet, then select either Allow or Deny from the drop list. In our example, the HTTP service is set to Allow enabling Web traffic incoming. 3 Enter the trusted network IP address of the computer to which this rule will apply. In our example, 192.168.111.2. 4 Click the Submit button.
Configuring Incoming and Outgoing Services custom service using either a TCP port, UDP port or specifying an IP protocol. You can also create a custom service allowing any form of protocol over any port incoming from an external address to a trusted host or outgoing from a trusted host to an external address. TCP and UDP Ports Follow these steps to create a custom service for either TCP or UDP ports: 1 With your Web browser, go to the SOHO System Status page using the Trusted IP address of the SOHO.
Blocking External Sites 3 Beneath the Protocol Settings fields, select either TCP Port, UDP Port or Protocol from the drop list. The Custom Service page refreshes. 4 Define a name for the service in the appropriate field. 5 Enter the protocol number to allow in the Protocol field. Now that you have created a custom service, you will need to specify a filter rule as well as define the incoming and outgoing properties. 6 At the Incoming and Outgoing Filter drop lists, select either Allow or Deny.
Blocking External Sites Follow these steps to configure blocked sites: 1 From the navigation bar on the left side, select Firewall => Blocked Sites. The Blocked Sites page appears. 2 Select either Host IP Address, Network IP Address, or Host Range from the drop list. The configuration page refreshes. 3 Enter either a single host IP address, a network IP address, or a the start and end of a range of host IP addresses in the appropriate fields.
Firewall Options 5 Click the Submit button. Firewall Options The SOHO firewall feature includes a few rule settings which are less specific then the service settings discussed previously and can be used to provide further security for your private network. These options are found on the Firewall Options page. 1 With your Web browser, go to the SOHO System Status page using the Trusted IP address of the SOHO. For example, if using the default IP address, go to: http://192.168.111.
Firewall Options Ping requests received on the External Network You can configure the SOHO to deny all ping packets which it may receive on the external interface. 1 Enable the checkbox labeled Do not respond to PING requests received on External Network. 2 Click the Submit button.
Firewall Options Denying FTP access to the Trusted Network interface You can configure the SOHO to deny FTP access to Trusted interface. 1 Enable the checkbox labeled Do not allow FTP access to Trusted Network. 2 Click the Submit button. CAUTION When performing an update of the system firmware, this option must be disabled or the procedure will fail an the unit becomes unrecoverable and must be reset to the factory defaults.
Firewall Options • SOHO supports SOCKS version 5 only. • It is a limited version of SOCKS and does not support authentication, nor does it support Domain Name System (DNS) resolution. CAUTION Configure the particular application so that it will not attempt to make DNS look-ups with SOCKS. However, some applications use only DNS through SOCKS and therefore will not function properly with the SOHO. • Compatible SOCKS-aware applications that can be used through the SOHO include ICQ, IRC, and AOL Messenger.
Firewall Options • For the SOCKS proxy, enter the URL or IP address of the SOHO trusted network. The default IP address is 192.168.111.0. Disabling SOCKS on the SOHO Once you have used a SOCKS-compliant application through the SOHO, the primary SOCKS port is available to anyone on your trusted network. You can, however, close this security gap between uses of SOCKS applications. 1 Enable the checkbox labeled Disable SOCKS proxy. This disables the SOHO from acting as a SOCKS proxy.
Creating a virtual DMZ Follow these steps: 1 Enable the checkbox labeled Log All Allowed Outbound Access. 2 Click the Submit button. Creating a virtual DMZ The SOHO can be configured to allow traffic to be passed through to a dedicated machine that has been separated from the rest of the Trusted Network. Follow these steps to configure DMZ pass through: 1 With your Web browser, go to the SOHO System Status page using the Trusted IP address of the SOHO.
Creating a virtual DMZ 3 Enable the checkbox labeled Enable pass through address. 4 Enter the IP address to the pass through machine in the appropriate field. 5 Click the Submit button. User Guide 5.
Creating a virtual DMZ 76
CHAPTER 6 What is Logging? Logging is the act of recording “events” that occur at the SOHO interfaces. An event is any single activity, such as communication with the WatchGuard Feature Key Server or the WatchGuard WebBlocker database and incoming traffic passing through the SOHO. Logging is intended to record the kinds of activities that can indicate security concerns–most importantly denied packets. Certain patterns of denied packets can indicate the type of attack that is being attempted.
Setting a WatchGuard Security Event Processor log host The log messages may include time synchronizations between the SOHO and the WatchGuard Key Server, discarded packets for a packet handling violation, duplicate messages, time-outs for attempting to open the WatchGuard Feature Key Server, or return error messages. Follow these steps to view these log messages: 1 With your Web browser, go to the SOHO System Status page using the Trusted IP address of the SOHO.
Setting a WatchGuard Security Event Processor log host 3 Enable the checkbox labeled Enable WatchGuard Security Event Processor Logging. 4 Enter the IP address of the WSEP server that will be your Log Host in the appropriate field. In our example, 206.253.208.100. 5 In the Log Encryption Key field, enter a passphrase that will serve as a password to gain access to the log server. 6 Enter the Log Encryption Key passphrase in the appropriate field again to confirm it. 7 Click the Submit button.
Setting a Syslog Host Setting a Syslog Host The SOHO can also be configured to transmit log entries to a Syslog host. Follow these steps to setup a Syslog Host: 1 With your Web browser, go to the SOHO System Status page using the Trusted IP address of the SOHO. For example, if using the default IP address, go to: http://192.168.111.1. 2 From the navigation bar on the left side, select Logging => Syslog Logging. The Syslog Logging page appears. 3 80 Enable the checkbox labeled Enable syslog output.
Setting the System Time 4 Enter the IP address of the Syslog server in the appropriate field. In our example, 206.253.208.100. 5 Click the Submit button. Setting the System Time The SOHO stamps each log entry with the time that the event occurred. By default, the SOHO is set to record event times in seconds beginning from the last time the unit was rebooted.
Setting the System Time If you have decided to use the WatchGuard Time Server: Enable the option labeled Get Time From WatchGuard Time Server. Or, if you have decided to use a TCP Port 37 Time Server: 3 4 Enable the option labeled Get Time From TCP Port 37 Time Server at. 5 Enter the IP address of the time server in the appropriate field. 6 Click the Submit button.
Setting the System Time • Enable the checkbox labeled Set to GMT. If you want to have your log messages sync with your computer: • Click the Sync Time Now button. User Guide 5.
Setting the System Time 84
CHAPTER 7 WatchGuard SOHO WebBlocker WatchGuard SOHO WebBlocker is an optional feature of the WatchGuard SOHO and SOHO|tc that provides Web site filtering capabilities. It gives you precise control over the types of Web sites users on your trusted network are allowed to view. How WebBlocker works WebBlocker relies on a URL database, the CyberNOT list, a service of CyberPatrol, owned and maintained by SurfControl. The WebBlocker database contains many thousands of IP addresses and directories.
How WebBlocker works site, the SOHO queries the WatchGuard database and determines whether or not to block the site. The SOHO considers the following conditions in determining whether or not to block the site: Web site not in WebBlocker database If the site is not in the WatchGuard WebBlocker database, the Web browser opens the page for viewing.
Purchasing and enabling SOHO WebBlocker Users This feature allows you to create an individual user account, with a unique username and password, and restrict their web browsing by assigning them to a given Group. Bypassing the SOHO WebBlocker Occasionally, you may want to allow select individuals to bypass the filtering functions of SOHO WebBlocker.
Configuring the SOHO WebBlocker Configuring the SOHO WebBlocker Use the WatchGuard SOHO Configuration pages to enable WebBlocker, create a full access password for bypassing WebBlocker, define an Inactivity Timeout which sets the duration that the full access password is valid, define the categories you want to block, and configure WebBlocker Groups and Users.
Configuring the SOHO WebBlocker 3 4 5 Enable the checkbox labeled Enable WebBlocking. Enter the full access password. The full access password allows a user a to bypasses otherwise blocked sites. Enter the Inactivity Timeout in minutes. Setting the inactivity timeout at, for example, 15 minutes, ensures that unattended Web browsers will be disconnected after sitting idle for 15 minutes. 6 If you intend to use WebBlocker Groups and Users, enable the Require Web users to authenticate checkbox.
Configuring the SOHO WebBlocker Create WebBlocker Groups and Users Follow the instructions below to create WebBlocker Groups. If you wish to use a global policy for all users, instead of creating separate group policies, ignore this section and follow the instructions to enable WebBlocker without selecting a Group. 1 With your Web browser, go to the SOHO Configuration Settings page using the Trusted IP address of the SOHO. For example, if using the default IP address, go to: http://192.168.111.
Configuring the SOHO WebBlocker 4 5 Click the Submit button. A new Groups page appears indicating the configuration changes have been accepted and providing access to creating users. To the right of the “Users” field, click the New button. The New User page appears. User Guide 5.
Configuring the SOHO WebBlocker 6 Enter a unique User name and Passphrase (remember to confirm the Passphrase). Use the Group drop down list to assign the new user to a given group. In our example, we have assigned the User “rodolfo” to the Group “chicosmalos” created previously. 7 Click the Submit button. NOTE You can delete Users or Groups at any time by selecting them and clicking the Delete button.
WebBlocker categories WebBlocker categories WebBlocker relies on a URL database, the CyberNOT list, a service of CyberPatrol. The WebBlocker database contains many thousands of IP addresses and directories. These addresses are divided into categories based on content such as Drug Culture, Intolerance, or Sexual Acts. CyberPatrol constantly searches the Internet to update the list of blocked sites. The WebBlocker database contains the following 14 categories.
WebBlocker categories measures. Topic includes groups that advocate violence as a means to achieve their goals. It also includes pages devoted to “how to” information on the making of weapons (for both lawful and unlawful reasons), ammunition, and pyrotechnics. Drug Culture Pictures or text advocating the illegal use of drugs for entertainment. Includes substances used for other than their primary purpose to alter the individual’s state of mind, such as glue sniffing.
WebBlocker categories of maiming, bloody figures, and indecent depiction of bodily functions. Violence/Profanity Pictures or text exposing extreme cruelty or profanity. Cruelty is defined as: Physical or emotional acts against any animal or person that are primarily intended to hurt or inflict pain. Topic includes obscene words, phrases, and profanity in either audio, text, or pictures. Search Engines Search engine sites such as AltaVista, InfoSeek, Yahoo!, and WebCrawler.
Searching for blocked sites adult personals, and sites devoted to selling pornographic CD-ROMs and videos. Full Nudity Pictures exposing any or all portions of human genitalia. Topic does not include sites categorized as Partial/Artistic Nudity containing partial nudity of a wholesome nature. For example, it does not include Web sites for publications such as National Geographic or Smithsonian magazine nor sites hosted by museums such as the Guggenheim, the Louvre, or the Museum of Modern Art.
CHAPTER 8 Configuring Virtual Private Networking This chapter describes an optional feature of the WatchGuard SOHO: Virtual Private Networking (VPN) with IPSec. The following WatchGuard SOHO products support IPSec tunnels: • WatchGuard SOHO with VPN option enabled • WatchGuard SOHO|tc Why create a virtual private network? Virtual Private Networking (VPN) tunnels enable you to and securely connect computers in two locations without requiring expensive, dedicated point-to-point data connections.
What you will need What you will need • One WatchGuard SOHO with VPN and an IPSec-compliant device. NOTE While you can create a SOHO to SOHO VPN, you can also create a VPN with a WatchGuard Firebox or other IPSec-compliant devices. • The following information from your Internet service provider for both devices: - Static IP address - Default gateway address - Primary domain name service (DNS) IP address - If available, a secondary DNS address - Domain name • Network addresses and subnet mask for networks.
What you will need IP Address Table (example): Item External IP Address Description The IP address that identifies the SOHO to the Internet. Assigned By ISP Site A: 207.168.55.2 Site B: 68.130.44.15 External Subnet Mask The overlay of bits that determines which part of the IP address identifies your network. For example, a Class C address licenses 256 addresses and has a netmask of 255.255.255.0. Site A: 255.255.255.0 Site B: 255.255.255.
Step-by-step instructions for configuring a SOHO VPN tunnel Obtaining the VPN upgrade If you purchased a WatchGuard SOHO and would like to purchase the VPN upgrade from a reseller or e-tailer, open your Web browser to: h t t p :/ /w w w .w a t c h g u a rd . c o m / sa l e s /b u y on l in e .
Frequently asked questions device. To set up multiple VPN tunnels, you will need to have at least one WatchGuard Firebox configured with the WatchGuard VPN Manager. • Each device must be able to send messages to the other. If either device has a dynamically assigned Internet (IP) address (see “Network addressing” on page 37 for an explanation of dynamic IP addresses), it will not be able to find its remote counterpart. • Both devices must be set to use the same encryption method.
Frequently asked questions How do I connect three or four offices together? To connect more than two offices together, WatchGuard recommends designating one office the center of a “star” network configuration and upgrading it to a WatchGuard Firebox. You can then manage multiple tunnels to SOHOs or other IPSec compliant devices from the central Firebox. How do I troubleshoot the connection? If you can ping the remote SOHO and computers behind it, your VPN tunnel is up and running.
MUVPN Clients How do I enable a VPN Tunnel? Full instructions for enabling a VPN tunnel can be found online at: h t t p :/ /w w w .w a t c h g u a rd . c o m / Ad v a n c e d F a q s / s oi n t e r o p _ m a in . a sp MUVPN Clients The SOHO can be upgraded to use the MUVPN clients option. This feature allows single remote users to securely connect to the SOHO through an IPSec VPN tunnel and access network resources on the Trusted network.
View the VPN Statistics 104
CHAPTER 9 Resources Troubleshooting The following information is offered to help overcome any minor difficulties that might occur when installing and setting up your SOHO. General How do I reboot my SOHO? 1 With your Web browser, go to the SOHO System Status page using the Trusted IP address of the SOHO. For example, if using the default IP address, go to: http://192.168.111.1 2 Click the Reboot button. 3 Wait for the SOHO to finish rebooting.
Troubleshooting NOTE You can also reboot by removing the power source for ten seconds, and then restoring power. What do the ON and MODE lights signify on the SOHO? When the ON light is illuminated, the SOHO has power. When the MODE light is illuminated, the SOHO is operational. If the ON light is blinking it is indicative of a couple of concerns: • If the MODE light is off than the unit is running through it’s boot process and the ON light will cease blinking when the process is complete.
Troubleshooting available. The first year of service is free with purchase of the SOHO. To register your SOHO: 1 With your Web browser, go to the SOHO System Status page using the Trusted IP address of the SOHO. For example, if using the default IP address, go to: http://192.168.111.1 2 Click on LiveSecurity in the top header and follow the instructions provided. 3 Click on the Register your SOHO link, beneath the “New Subscribers Activate here header”.
Troubleshooting DSL router, the NAT feature of the DSL router should be set for bridge-only mode. How do I install a SOHO using a Macintosh? The process is essentially identical to installing on any other platform. Use the Installation chapter within this Guide. The one unique element for Macintosh users, determining your TCP/IP settings, can be found on page 29. How do I know whether the cables are connected correctly to my SOHO? There are twelve lights on the front of the SOHO grouped in pairs.
Troubleshooting How can I see the MAC address of my SOHO? A MAC (Medium Access Control) address is a unique number used to identify the actual physical hardware of an Ethernet device. 1 With your Web browser, go to the SOHO Configuration Settings page using the Trusted IP address of the SOHO. For example, if using the default IP address, go to: http://192.168.111.1 2 Towards the bottom of the System Status page, you will see the External Network header on the right side.
Troubleshooting How do I change to a static trusted IP address? Before you can use a static IP address, you must have a base Trusted IP address and subnet mask. The following IP address ranges and subnet masks are set aside for private networks in compliance with RFC 1918. Replace the Xs in the network IP address with a number between 1 and 254. The subnet addresses do not need to be changed. Network IP range Subnet mask 10.x.x.x 255.0.0.0 172.16.x.x 255.240.0.0 192.168.x.x 255.255.0.
Troubleshooting Enable the checkbox labeled Enable WebBlocker. Enter a Full Access password, and an Inactivity Timeout (in minutes). To disable Web blocking, disable the checkbox labeled Enable WebBlocker. 3 How do I allow incoming services such as POP3, Telnet, and Web (HTTP)? 1 With your Web browser, go to the SOHO System Status page using the Trusted IP address of the SOHO. For example, if using the default IP address, go to: http://192.168.111.
Troubleshooting 3 Beneath the Protocol Settings fields, select either TCP Port, UDP Port or Protocol from the drop list. The Custom Service page refreshes. 4 Define a name for the service in the appropriate field. 5 Enter the protocol number to allow in the Protocol field. 6 Click the Submit button. 7 From the navigation bar on the left side, select Firewall => Incoming. The Firewall Incoming Traffic page appears.
Troubleshooting • The same authentication method for each end (MD-5 or SHA-1). How do I set up my SOHO for VPN Manager Access? This requires the add-on product, WatchGuard VPN Manager software, which is purchased separately. To purchase VPN Manager, use your Web browser to go to: h t t p s : // ww w . w a t c h g u a r d .c o m / p r od u c t s/ vp n m a n a g e r. a sp For more information on how to allow VPN Manager access to a SOHO, see the VPN Manager Guide.
Contacting Technical support Contacting Technical support (877) 232-3531 U.S.; End-user support (206) 521-8375 U.S.; Authorized Reseller support (360) 482-1083 International support Online Documenting and In-Depth FAQs WatchGuard maintains an extensive knowledge base consisting of product documentation in the form of printer friendly .pdf files, tutorials, In-Depth FAQs, and more. This information is available at: h t t p s :/ /s u p p o rt . w a t c h g u a r d .
B blocked sites in WebBlocker 96 Browser Netscape 4.
H HTTP proxy disabling 30 I ICQ, enable with SOCKS 71 ICQ, IRC, AOL Messenger 72 Incoming service creating custom 65 Information copyright 12 patent 12 Installation cabling the SOHO 32 manual 28 pre-installation checklist 27 Introduction 3 information & Internet 63 IP address 20 port number 20 protocol 20 services 21 IP address 20 reason for static 101 static, obtaining 98 IP configuration, releasing and renewing 46 L LED, troubleshooting 105 Link LED troubleshooting 105 Linux, setting TCP/IP 29 LiveSecur
M Macintosh, setting TCP/IP 29 Manual installation 28 Masquerading 21 N Network private network default factory settings 22 Network Address Translation 21 P Part number, SOHO 12 Password saving 18 Patent Information 12 Ping 102 Port number, introduction 20 PPPoE, configuring client 43 Pre-configured service, adding 64 Pre-installation, checklist 27 Private network setting default factory settings 22 Protocol, introduction 20 Proxy, disabling HTTP 30 R Releasing IP configuration 46 Remote Log Host, settin
adding pre-configured 64 creating custom incoming 65 Services, introduction 21 SOCKS 71 and ICQ 72 and IRC 72 SOCKS and AOL Messenger 72 Static IP address 98, 99 Static IP address, reason for 101 T TCP/IP releasing IP configuration 46 setting in Macintosh 29 setting in Unix, Linux, etc.
