Fireware How To Network Configuration

Transcription

1 Fireware How To Network Configuration How do I configure the external interface of my Firebox? Introduction Most users configure the Firebox interfaces when they use the Quick Setup Wizard to create a basic configuration file. You can also use Policy Manager to set or change the configuration you created with the Quick Setup Wizard. You can configure a maximum of four external Firebox interfaces, with IP addresses assigned by one of these procedures: Static IP address You can give the external interface of the Firebox a static IP address. DHCP The Firebox can use a DHCP (Dynamic Host Configuration Protocol) server, usually controlled by your ISP, to get an IP address, gateway, and netmask. PPPoE The Firebox can make a PPPoE Point-to-Point Protocol over Ethernet) connection to the PPPoE server of your ISP. The Firebox supports unnumbered and static PPPoe. This connection automatically configures your IP address, gateway, and netmask. Is there anything I need to know before I start? If you configure more than one interface as an external interface, only the lowest-order external interface can serve as an IKE gateway or an IPSec tunnel endpoint. If this interface is down, all IPSec tunnels to and from the Firebox will not operate. For example, if you have configured eth0 and eth1 as external interfaces, only eth0 can be the IPSec tunnel endpoint. If you configure more than one external interface on a Firebox, map the Fully Qualified Domain Name(FQDN) to the external interface IP address of the lowest order. For example, if you have configured eth0 and eth1 as external interfaces, map the FQDN to the IP address assigned to eth0. The Quick Setup Wizard uses a device discovery procedure to find the Firebox X model you are configuring. This procedure uses a UDP broadcast. Software firewalls, including the firewall in Microsoft Windows XP SP2, can cause problems with device discovery. Using the Quick Setup Wizard If you have already have a Firebox configured, it is a good idea to make a backup of your previous configuration before you use the Quick Setup Wizard. The Quick Setup Wizard makes a new, basic configuration file. The Firebox uses the basic configuration file when it starts. This enables the Firebox to operate as a basic firewall. You can start the Quick Setup Wizard from the Windows desktop or from System Manager. From the desktop, select Start > All Programs > WatchGuard System Manager 8.2 > Quick Setup Wizard. From System Manager, select Tools > Quick Setup Wizard. After the Firebox is configured with this basic configuration, you can use Policy Manager to expand or change the Firebox configuration. Caution In the Quick Setup Wizard, you must set a status and configuration passphrase for the Firebox. When you are ready to configure a Log Server to collect log messages from the Firebox, use the status passphrase you set in the Quick Setup Wizard as your default log encryption key. After your Log Server is configured, you can change your log encryption key if you want. 1

2 Opening a Configuration File in Policy Manager The first step to start a new configuration file is to connect to a Firebox and open Policy Manager. There are two methods to do this. Caution We recommend that you create a new configuration file only after a fresh install or a safe mode restart. Connecting to the Firebox from WSM 1 From WatchGuard System Manager, select File > Connect To > Device. Or, click the Connect to Device icon on the WatchGuard System Manager toolbar. The Connect to Firebox dialog box appears. 2 Use the drop-down list to select your Firebox, or type the IP address of the Firebox. Type the status passphrase. Click OK. The device appears in the WatchGuard System Manager Device tab. 3 Select the Firebox on the Device tab. Then, select Tools > Policy Manager. Or, Click the Policy Manager icon on the WatchGuard System Manager toolbar. Policy Manager opens, and it opens the configuration file in use on the selected Firebox. Connecting to the Firebox from Policy Manager 1 From WatchGuard System Manager, select Tools > Policy Manager. Or, click the Policy Manager icon on the WatchGuard System Manager toolbar. The Policy Manager dialog box appears. 2 Use the Firebox drop-down list to select the model of Firebox you want to configure. Click OK. The new configuration file contains the default parameters for the specified Firebox model. 2

3 Using Policy Manager to Set or Change an External Interface IP Address Using Policy Manager to Set or Change an External Interface IP Address 1 From Policy Manager, select Network > Configuration. The Network Configuration dialog box appears. 2 Select the interface you want to configure as an external interface and set the type to External, if necessary, using the drop-down list. Click Configure. Using a static IP address 1 From the Interface Settings dialog box, select Static. 2 Type the IP address and default gateway for the external interface.

4 3 Click OK. Using PPPoE 1 From the Interface Settings dialog box, select PPPoE. 2 Select one of the two options: - Get an IP address automatically - Use IP address (supplied by your network administrator). 3 If you selected Use IP Address, enter the IP address in the text box to the right. 4 Type the User Name and Password. You must type the password two times. 5 Click Properties to configure PPPoE parameters. The PPPoE parameters dialog box appears. Your ISP can tell you if it is necessary to change the time-out or LCP values. 6 Use the radio buttons to select when the Firebox connects with the PPPoE server. - Always On The Firebox keeps a constant PPPoE connection. It is not necessary that network traffic go through the external interface. - Dial-on-Demand The Firebox connects to the PPPoE server only when it gets a request to send traffic to an IP address on the external interface. If your ISP regularly resets the connection, select Dial-on-Demand. If you do not select Dial-on-Demand, you must manually restart the Firebox each time the connection resets. 7 In the PPPoE initialization time field, use the arrows to set the time allowed to start a PPPoE connection. 8 In the LCP echo failure field, use the arrows to set the number of failed LCP echo requests allowed before the PPPoE connection is closed. 9 In the LCP echo timeout field, use the arrows to set the length of time, in seconds, that the response to each echo time-out must be received. 4

5 Using DHCP 1 From the Interface Settings dialog box, select DHCP. 2 If your DHCP server makes you use an optional identifier in your DHCP exchange, type this identifier in the Host Name text box. 3 If the IP address is assigned automatically through DHCP, select Obtain an IP address automatically. If the IP address is assigned manually, select the Use IP Address option and type the IP address. 4 To manually set the lease expiration time for an IP address assignment, select the Specify Lease Time check box. Type the number of hours or days in the first field and select the unit of time from the drop-down list. For information about adding a secondary network or using the Advanced Settings, see the Fireware Configuration Guide, Network Setup and Configuration chapter. Frequently Asked Questions About This Procedure Can I define more than one external interface You can configure a Firebox with a maximum of four external interfaces, but VPN tunnels only go through the lowest-order external interface. When you add the Firebox to the Management Server, all of the IP address properties must match the properties of the lowest-order interface. For example, if the interface uses a static IP address, you must configure the Management Server with the same IP address as the lowest-order external interface. The default configuration sets eth0 as the lowest-order external interface. If you change the interface type, a different interface can be the lowest-order external interface. For example, if you change eth0 from an external interface to a trusted or optional interface, the interface you set as external becomes the lowest-order interface. SUPPORT: U.S. and Canada All Other Countries COPYRIGHT 2006 WatchGuard Technologies, Inc. All rights reserved. WatchGuard, the WatchGuard logo, Firebox, and Core are registered trademarks or trademarks of WatchGuard Technologies, Inc. in the United States and/or other countries.

6 6