WatchGuard Technologies Firebox SOHO User Manual
WatchGuard
®
SOHO User Guide
SOHO and SOHO|tc version 5.0
WatchGuard SOHO and SOHO | tc
2
Using this guide
This guide assumes that you are familiar with your computer’s
operating system. If you have questions about navigating in your
computer’s environment, please refer to your system user manual.
The following conventions are used throughout this guide.
Convention Indication
Bold type Denotes menu commands, dialog box options,
CAUTION Denotes a warning or precautionary information.
NOTE Denotes important information, a helpful tip, or
Web page options, Web page names. For
example: “On the System Information page,
select Disabled.”
additional instructions.
User Guide 5.0 3
Certifications and Notices
FCC Certification
This device has been tested and found to comply with limits for a
Class A digital device, pursuant to Part 15 of the FCC Rules.
Operation is subject to the following two conditions:
• This device may not cause harmful interference.
• This device must accept any interference received, including
interference that may cause undesired operation.
CE Notice
The CE symbol on your WatchGuard Technologies equipment
indicates that it is in compliance with the Electromagnetic
Compatibility (EMC) directive and the Low Voltage Directive
(LVD) of the European Union (EU).
Industry Canada
This Class A digital apparatus meets all requirements of the
Canadian Interference-Causing Equipment Regulations.
Cet appareil numerique de la classe A respecte toutes les exigences
du Reglement sur le materiel broulleur du Canada.
4
Taiwanese Notice
VCCI Notice Class A ITE
User Guide 5.0 5
Declaration of Conformity
6
WatchGuard® End-User License Agreement
IMPORTANT - READ CAREFULLY BEFORE ACCESSING WATCHGUARD SOFTWARE
This WatchGuard End-User License Agreement (“EULA”) is a legal agreement between you
(either an individual or a single entity) and WatchGuard Technologies, Inc. (“WATCHGUARD”)
for the WATCHGUARD software product you have purchased, which includes computer software
and any separately installed components, and any updates or modifications thereto, and which may
include associated media, printed materials, and on-line or electronic documentation (the
“SOFTWARE PRODUCT”). WATCHGUARD is willing to license the SOFTWARE PRODUCT to
you only on the condition that you accept all of the terms contained in this EULA. Please read this
EULA carefully. By installing or using the SOFTWARE PRODUCT, you agree to be bound by the
terms of this EULA. If you do not agree to the terms of this EULA, WATCHGUARD will not
license the SOFTWARE PRODUCT to you, and you will not have any rights in the SOFTWARE
PRODUCT. In that case, promptly return the SOFTWARE PRODUCT, along with proof of
payment, to the authorized dealer from whom you obtained the SOFTWARE PRODUCT for a full
refund of the price you paid.
1. OWNERSHIP AND LICENSE. The SOFTWARE PRODUCT is protected by copyright laws
and international copyright treaties, as well as other intellectual property laws and treaties. This
is a license agreement and NOT an agreement for sale. All title and copyrights in and to the
SOFTWARE PRODUCT (including but not limited to any images, photographs, animations, video,
audio, music, text, and applets incorporated into the SOFTWARE PRODUCT), the accompanying
printed materials, and any copies of the SOFTWARE PRODUCT are owned by WATCHGUARD or
its suppliers. Your rights to use the SOFTWARE PRODUCT are as specified in this EULA, and
WATCHGUARD retains all rights not expressly granted to you in this EULA. Nothing in this
EULA constitutes a waiver of our rights under U.S. copyright law or any other law or treaty.
2. PERMITTED USES. You are granted the following rights to the SOFTWARE PRODUCT:
(A) You may install and use the SOFTWARE PRODUCT on any computer with an associated
connection to the hardware product (the “Hardware”); (B) You may install and use the
SOFTWARE PRODUCT on more than one computer at once without licensing an additional copy
of the SOFTWARE PRODUCT for each additional computer on which you want to use it, provided
each computer on which you install the SOFTWARE PRODUCT has an associated connection to
the Hardware; and (C) You may make a single copy of the SOFTWARE PRODUCT for backup or
archival purposes only.
3. PROHIBITED USES. You may not, without express written permission from
WATCHGUARD: (A) Reverse engineer, disassemble or decompile the SOFTWARE PRODUCT; (B)
Use, copy, modify, merge or transfer copies of the SOFTWARE PRODUCT or printed materials
except as provided in this EULA; (C) Use any backup or archival copy of the SOFTWARE
PRODUCT (or allow someone else to use such a copy) for any purpose other than to replace the
original copy in the event it is destroyed or becomes defective; (D) Sublicense, lend, lease or rent
the SOFTWARE PRODUCT; or (E) Transfer this license to another party unless (i) the transfer is
permanent, (ii) the third party recipient agrees to the terms of this EULA, and (iii) you do not
retain any copies of the SOFTWARE PRODUCT.
User Guide 5.0 7
4. LIMITED WARRANTY. WATCHGUARD makes the following limited warranties
for a period of ninety (90) days from the date you obtained the SOFTWARE PRODUCT from
WATCHGUARD or an authorized dealer; (A) Media. The disks and documentation will be free
from defects in materials and workmanship under normal use. If the disks or documentation fail
to conform to this warranty, you may, as your sole and exclusive remedy, obtain a replacement
free of charge if you return the defective disk or documentation to WATCHGUARD or the
authorized dealer from whom you obtained the SOFTWARE PRODUCT with a dated proof of
purchase; and (B) SOFTWARE PRODUCT. The SOFTWARE PRODUCT will materially conform
to the documentation that accompanies it. If the SOFTWARE PRODUCT fails to operate in
accordance with this warranty, you may, as your sole and exclusive remedy, return all of the
SOFTWARE PRODUCT and the documentation to the authorized dealer from whom you obtained
it, along with a dated proof of purchase, specifying the problems, and your authorized dealer will
provide you with a new version of the SOFTWARE PRODUCT or a full refund at its election.
DISCLAIMER AND RELEASE. THE WARRANTIES, OBLIGATIONS AND LIABILITIES OF
WATCHGUARD, AND YOUR REMEDIES, SET FORTH IN PARAGRAPHS 4, 4(A) AND 4(B)
ABOVE ARE EXCLUSIVE AND IN SUBSTITUTION FOR, AND YOU HEREBY WAIVE,
DISCLAIM AND RELEASE ANY AND ALL OTHER WARRANTIES, OBLIGATIONS AND
LIABILITIES OF WATCHGUARD AND ITS LICENSORS AND ALL OTHER RIGHTS, CLAIMS
AND REMEDIES YOU MAY HAVE AGAINST WATCHGUARD OR ITS LICENSORS,
EXPRESS OR IMPLIED, ARISING BY LAW OR OTHERWISE, WITH RESPECT TO ANY
NONCONFORMANCE OR DEFECT IN THE SOFTWARE PRODUCT (INCLUDING, BUT NOT
LIMITED TO, ANY IMPLIED WARRANTY OF MERCHANTABILITY OR FITNESS FOR A
PARTICULAR PURPOSE, ANY IMPLIED WARRANTY ARISING FROM COURSE OF
PERFORMANCE, COURSE OF DEALING, OR USAGE OF TRADE, ANY WARRANTY OF
NONINFRINGEMENT, ANY WARRANTY THAT THIS SOFTWARE PRODUCT WILL MEET
YOUR REQUIREMENTS, ANY WARRANTY OF UNINTERRUPTED OR ERROR-FREE
OPERATION, ANY OBLIGATION, LIABILITY, RIGHT, CLAIM OR REMEDY IN TORT,
WHETHER OR NOT ARISING FROM THE NEGLIGENCE (WHETHER ACTIVE, PASSIVE OR
IMPUTED) OR FAULT OF WATCHGUARD OR ITS LICENSORS AND ANY OBLIGATION,
LIABILITY, RIGHT, CLAIM OR REMEDY FOR LOSS OR DAMAGE TO, OR CAUSED BY OR
CONTRIBUTED TO BY, THE SOFTWARE PRODUCT).
LIMITATION OF LIABILITY. WATCHGUARD’S liability AND THE LIABILITY OF ITS
LICENSORS (whether in contract, tort, or otherwise; and notwithstanding any fault, negligence,
strict liability or product liability) with regard to THE SOFTWARE Product will in no event
exceed the purchase price paid by you for such Product. THIS SHALL BE TRUE EVEN IN THE
EVENT OF THE FAILURE OF AN AGREED REMEDY. IN NO EVENT WILL WATCHGUARD
OR ITS LICENSORS BE LIABLE TO YOU OR ANY THIRD PARTY, WHETHER ARISING IN
CONTRACT (INCLUDING WARRANTY), TORT (INCLUDING ACTIVE, PASSIVE OR
IMPUTED NEGLIGENCE AND STRICT LIABILITY AND FAULT), FOR ANY INDIRECT,
SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT
LIMITATION LOSS OF BUSINESS PROFITS, BUSINESS INTERRUPTION, OR LOSS OF
BUSINESS INFORMATION) ARISING OUT OF OR IN CONNECTION WITH THIS
WARRANTY OR THE USE OF OR INABILITY TO USE THE SOFTWARE PRODUCT, EVEN IF
WATCHGUARD AND ITS LICENSORS HAVE BEEN ADVISED OF THE POSSIBILITY OF
8
SUCH DAMAGES. THIS SHALL BE TRUE EVEN IN THE EVENT OF THE FAILURE OF AN
AGREED REMEDY.
5. UNITED STATES GOVERNMENT RESTRICTED RIGHTS. The enclosed SOFTWARE
PRODUCT and documentation are provided with Restricted Rights. Use, duplication or disclosure
by the U.S Government or any agency or instrumentality thereof is subject to restrictions as set
forth in DFARS 227.7202-3 (Commercial Computer Software) and DFARS 252.227-7015(b)
(Technical Data-Commercial Items) -- Restricted Rights Clause at FAR 52.227-19, as applicable.
Manufacturer is WatchGuard Technologies, Incorporated, 505 Fifth Avenue, South, Suite 500,
Seattle, WA 98104.
6. EXPORT CONTROLS. You agree not to directly or indirectly transfer the SOFTWARE
PRODUCT or documentation to any country to which such transfer would be prohibited by the U.S.
Export Administration Act and the regulations issued thereunder.
7. TERMINATION. This license and your right to use the SOFTWAR PRODUCT will
automatically terminate if you fail to comply with any provisions of this EULA, destroy all copies
of the SOFTWARE PRODUCT in your possession, or voluntarily return the SOFTWARE
PRODUCT to WATCHGUARD. Upon termination you will destroy all copies of the SOFTWARE
PRODUCT and documentation remaining in your control or possession.
8. MISCELLANEOUS PROVISIONS. This EULA will be governed by and construed in
accordance with the substantive laws of Washington excluding the 1980 United National
Convention on Contracts for the International Sale of Goods, as amended. This is the entire EULA
between us relating to the contents of this package, and supersedes any prior purchase order,
communications, advertising or representations concerning the contents of this package AND BY
USING THE SOFTWARE PRODUCT YOU AGREE TO THESE TERMS. No change or
modification of this EULA will be valid unless it is in writing, and is signed by WATCHGUARD.
9. CANADIAN TRANSACTIONS. If you obtained this SOFTWARE PRODUCT in Canada,
you agree to the following: The parties hereto have expressly required that the present EULA be
drawn up in the English language. / Les parties aux presentes ont expressement exige que la
presente conventions et ses Annexes soient redigees en la langue anglaise.
User Guide 5.0 9
WatchGuard® Limited Hardware Warranty
This WatchGuard Limited Hardware Warranty (the "Warranty") applies to the enclosed
WatchGuard hardware product (the "Hardware Product"). By using the HARDWARE Product,
you agree to the terms hereof. If you do not agree to these terms, please return this package,
along with proof of purchase, to the authorized dealer from whom you purchased the Hardware
Product for a full refund. THIS WARRANTY DOES NOT APPLY TO THE WATCHGUARD
SOFTWARE REQUIRED FOR OPERATION AND USE OF THE HARDWARE PRODUCT.
PLEASE REFER TO THE ENCLOSED WATCHGUARD END-USER LICENSE AGREEMENT
(THE “EULA”) FOR THE SOFTWARE WARRANTY AND OTHER TERMS AND CONDITIONS
ASSOCIATED WITH USE OF THE SOFTWARE. IF YOU DO NOT AGREE TO THE TERMS OF
THE EULA, PLEASE RETURN THIS PACKAGE IN ACCORDANCE WITH THIS
PARAGRAPH.
NOW, THEREFORE, WatchGuard Technologies and you agree as follows:
1. Limited Warranty. WatchGuard Technologies warrants that upon delivery and for one (1)
year thereafter (as the same may be extended pursuant to Section 2 below, the "Warranty Period"):
(a) the Hardware Product will be free from material defects in materials and workmanship, and
(b) the Hardware Product, when properly installed and used for its intended purpose and in its
intended operating environment, will perform substantially in accordance with WatchGuard
Technologies applicable specifications. This warranty does not apply to any Hardware Product
that has been: (i) altered, repaired or modified by any party other than WatchGuard Technologies;
or (ii) damaged or destroyed by accidents, power spikes or similar events or by any intentional,
reckless or negligent acts or omissions of any party. You may have additional warranties with
respect to the Hardware Product from the manufacturers of Hardware Product components.
However, you agree not to look to WatchGuard Technologies for, and hereby release WatchGuard
Technologies from any liability for, performance of, enforcement of, or damages or other relief on
account of, any such warranties or any breach thereof.
2. Remedies. If any Hardware Product does not comply with WatchGuard Technologies
warranties set forth in Section 1 above, WatchGuard Technologies will, at its option, either
(a) repair the Hardware Product, or (b) replace the Hardware Product; provided, that you will be
responsible for returning the Hardware Product to the place of purchase and for all costs of
shipping and handling. As to any Hardware Product repaired or replaced by WatchGuard
Technologies, the Warranty Period will end one (1) year after delivery of the repaired or
replacement Hardware Product. Any Hardware Product, component, part or other item replaced
by WatchGuard Technologies becomes the property of WatchGuard Technologies. WatchGuard
Technologies shall not be responsible for return of or damage to any software, firmware,
information or data contained in, stored on, or integrated with any returned Hardware Products.
3. Disclaimer and Release. THE WARRANTIES, OBLIGATIONS AND LIABILITIES OF
WATCHGUARD TECHNOLOGIES, AND YOUR REMEDIES, SET FORTH IN PARAGRAPHS 1
AND 2 ABOVE ARE EXCLUSIVE AND IN SUBSTITUTION FOR, AND YOU HEREBY
WAIVE, DISCLAIM AND RELEASE ANY AND ALL OTHER WARRANTIES, OBLIGATIONS
AND LIABILITIES OF WATCHGUARD TECHNOLOGIES AND ALL OTHER RIGHTS, CLAIMS
AND REMEDIES YOU MAY HAVE AGAINST WATCHGUARD TECHNOLOGIES, EXPRESS
10
OR IMPLIED, ARISING BY LAW OR OTHERWISE, WITH RESPECT TO ANY
NONCONFORMANCE OR DEFECT IN THE HARDWARE PRODUCT (INCLUDING, BUT NOT
LIMITED TO, ANY IMPLIED WARRANTY OF MERCHANTABILITY OR FITNESS FOR A
PARTICULAR PURPOSE, ANY IMPLIED WARRANTY ARISING FROM COURSE OF
PERFORMANCE, COURSE OF DEALING, OR USAGE OF TRADE, ANY WARRANTY OF
NONINFRINGEMENT, ANY WARRANTY OF UNINTERRUPTED OR ERROR-FREE
OPERATION, ANY OBLIGATION, LIABILITY, RIGHT, CLAIM OR REMEDY IN TORT,
WHETHER OR NOT ARISING FROM THE NEGLIGENCE (WHETHER ACTIVE, PASSIVE OR
IMPUTED) OR FAULT OF WATCHGUARD TECHNOLOGIES AND ANY OBLIGATION,
LIABILITY, RIGHT, CLAIM OR REMEDY FOR LOSS OR DAMAGE TO, OR CAUSED BY OR
CONTRIBUTED TO BY, THE HARDWARE PRODUCT).
4. Limitation of Liability. WATCHGUARD TECHNOLOGIES’ liability (WHETHER
ARISING IN CONTRACT (INCLUDING WARRANTY), TORT (INCLUDING ACTIVE, PASSIVE
OR IMPUTED NEGLIGENCE AND STRICT LIABILITY AND FAULT) OR OTHER THEORY)
with regard to any HARDWARE Product will in no event exceed the purchase price paid by you for
such HARDWARE Product. THIS SHALL BE TRUE EVEN IN THE EVENT OF THE FAILURE
OF AN AGREED REMEDY. IN NO EVENT WILL WATCHGUARD TECHNOLOGIES BE
LIABLE TO YOU OR ANY THIRD PARTY, WHETHER ARISING IN CONTRACT (INCLUDING
WARRANTY), TORT (INCLUDING ACTIVE, PASSIVE OR IMPUTED NEGLIGENCE AND
STRICT LIABILITY AND FAULT) OR OTHER THEORY, FOR COST OF COVER OR FOR ANY
INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES (INCLUDING
WITHOUT LIMITATION LOSS OF BUSINESS PROFITS, BUSINESS INTERRUPTION, OR
LOSS OF BUSINESS INFORMATION OR DATA) ARISING OUT OF OR IN CONNECTION
WITH THIS WARRANTY OR THE USE OF OR INABILITY TO USE THE HARDWDARE
PRODUCT, EVEN IF WATCHGUARD TECHNOLOGIES HAS BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES. THIS SHALL BE TRUE EVEN IN THE EVENT OF THE
FAILURE OF AN AGREED REMEDY.
5. Miscellaneous Provisions. This Warranty will be governed by the laws of the state of
Washington, without reference to its choice of law rules. The provisions of the 1980 United
Nations Convention on Contracts for the International Sale of Goods, as amended, shall not apply.
If any provision of this Warranty is found to be invalid or unenforceable, then the remainder shall
have full force and effect and the invalid provision shall be modified or partially enforced to the
maximum extent permitted by law to effectuate the purpose of this Warranty. This is the entire
agreement between WatchGuard Technologies and you relating to the contents of this package,
and supersedes any prior purchase order, communications, advertising or representations
concerning the contents of this package AND BY USING THE HARDWARE PRODUCT YOU
AGREE TO THESE TERMS. No change or modification of this Agreement will be valid unless it
is in writing, and is signed by WatchGuard Technologies.
User Guide 5.0 11
Copyright and Patent Information
Copyright © 1999-2001 WatchGuard Technologies, Inc. All rights reserved.
WatchGuard and LiveSecurity are either registered trademarks or trademarks of WatchGuard
Technologies, Inc. in the United States and other countries. Firebox is a trademark of
WatchGuard Technologies, Inc.
CyberPatrol is a registered trademark of SurfControl, Inc.
DocVer: B-2.4-User-2
All other trademarks and trade names are the property of their respective owners.
12
Table of Contents
CHAPTER 1 Introduction ................................................17
Registration and Identification Information ............ 18
How does a firewall work? ......................................18
How does information travel on the internet? ........20
How does the SOHO process this information? .....21
The SOHO Home Page—System Status .................22
The Default Factory Settings ...................................22
Rebooting a WatchGuard SOHO ............................24
CHAPTER 2 Getting Started ..........................................27
Before you begin ....................................................27
The Installation Process ..........................................28
CHAPTER 3 Setting Up Your SOHO Network .............37
Configuring Your External Network ........................37
User Guide 2.4 13
Configuring Your Trusted Network .........................47
Configuring Static Routes .......................................49
View the Network Statistics .....................................50
CHAPTER 4 Your Administrative Options ....................53
The System Security Page .......................................53
Setting up VPN Manager Access ............................56
Update Your Configuration from a Non-Windows
Platform ..............................................................58
Redeeming your SOHO upgrade certificates .........58
View the Configuration File ....................................61
CHAPTER 5 Configuring Your Firewall Settings ..........63
Firewall settings ......................................................63
Configuring Incoming and Outgoing Services .......63
Blocking External Sites ............................................67
Firewall Options ......................................................69
Creating a virtual DMZ ............................................74
CHAPTER 6 What is Logging? .......................................77
Viewing SOHO log messages .................................77
Setting a WatchGuard Security Event Processor log
host .....................................................................78
Setting a Syslog Host ..............................................80
Setting the System Time .........................................81
CHAPTER 7 WatchGuard SOHO WebBlocker ............85
How WebBlocker works ..........................................85
Purchasing and enabling SOHO WebBlocker ........87
14
Configuring the SOHO WebBlocker .......................88
WebBlocker categories ...........................................93
Searching for blocked sites .....................................96
CHAPTER 8 Configuring Virtual Private Networking ..97
What you will need .................................................98
Step-by-step instructions for configuring a SOHO VPN
tunnel ................................................................100
Frequently asked questions ..................................101
MUVPN Clients .....................................................103
View the VPN Statistics .........................................103
CHAPTER 9 Resources .................................................105
Troubleshooting ....................................................105
Contacting Technical support ...............................114
Online Documenting and In-Depth FAQs ............114
Special Notices .....................................................114
User Guide 5.0 15
16
CHAPTER 1 Introduction
Welcome
Congratulations on purchasing the ideal solution for providing
secure access to the Internet–the WatchGuard SOHO or
WatchGuard SOHO|tc. Your new security device will give you
peace of mind when connecting to the Internet using a high-speed
cable or DSL modem, a leased line, or ISDN.
This User Guide applies to both the SOHO and the SOHO|tc–the
name SOHO is used to refer to both these devices throughout the
guide. The only difference between them is the ability to create and
use a Virtual Private Network (VPN). This VPN option can be
added to the SOHO, while the SOHO|tc comes with the VPN
option already installed.
The most current installation and user information is available on
the Internet at:
http://www.watchguard.com/support/sohoresources.asp
User Guide 5.0 17
Registration and Identification Information
Registration and Identification Information
Once you have installed and configured your SOHO following the
instructions you will find in the upcoming chapters, you will need
to register the unit at our Web site. When the registration is
complete you can take advantage of our LiveSecurity service as
well as any upgrade options you may have purchase.
Please use this area, provided for your convenience, to enter your
SOHO information.
SOHO Serial Number:
LiveSecurity User ID:
Password:
The SOHO serial number is located on the bottom of the SOHO
unit. You create a LiveSecurity user ID and password when you
register your WatchGuard SOHO or SOHO|tc.
Please keep this information in a secure place.
How does a firewall work?
Fundamentally, a firewall is a way of differentiating between, as
well as protecting, “us” from “them”. On the external side of your
SOHO firewall is the entire Internet. The Internet has many
resources that you want to be able to reach, such as the Web,
Email, and video/audio conferencing. It also presents dangers to
the privacy and security of your computers. On the trusted side of
your SOHO firewall are all the devices you want to protect from
18
How does a firewall work?
these dangers. As is illustrated in the image below, the SOHO
physically seperates your trusted network from the Internet.
Using rules we will discuss in Chapter 3: “Configuring Incoming
and Outgoing Services” on page 63, the WatchGuard SOHO
evaluates all traffic between the external network (the Internet)
and the trusted network (your computers) and blocks any
suspicious activity. In order for this to work as described, you
must configure both the external and trusted networks to work
together and to talk to one another as well as the rest of the world.
User Guide 5.0 19
How does information travel on the internet?
How does information travel on the internet?
Each packet of information transported over the Internet must be
packaged in a special way to ensure that it is able to travel from
one computer to the next. A system called Internet Protocol (IP)
takes chunks of information and wraps them up with a header
identifying both where the information is going and how it should
be handled enroute.
IP Addresses
An IP address defines the specific computer on the Internet that
should send or receive a packet. Every computer on the Internet
has a unique address, including your SOHO device. When
defining a service behind your firewall, you need to include the
trusted network address for the machine hosting the application.
On the Internet, IP addresses can be identified using either a string
of numbers or a user-friendly domain name. For example, the IP
address of the WatchGuard site is 209.191.160.60 while the domain
name is www.watchguard.com.
Protocol
A protocol defines how a packet is bundled up and packaged for
shipment across a network. The most commonly used protocols
are Transmission Control Protocol (TCP) and User Datagram
Protocol (UDP). In addition, there are a variety of IP protocols
which are used less frequently.
Port number
The port number alerts the computers at both the sending and
receiving end how to handle the packet.
20
How does the SOHO process this information?
How does the SOHO process this information?
Services
A service is the combination of protocol(s) and port numbers
associated with a specific application or communication type. To
facilitate configuration of your SOHO, WatchGuard lets you select
pre-configured versions of several commonly used services.
Network Address Translation (NAT)
All incoming connections through a SOHO automatically use a
feature called dynamic network address translation (dynamic
NAT). Without dynamic NAT, your trusted, private addresses
would not be passed along the Internet to their destination.
Furthermore, the SOHO protects your trusted network by
disguising private IP addresses. During an Internet connection, all
traffic passed between computers includes their IP address
information. However, due to the dynamic NAT feature,
applications and servers on the Internet only see the public,
external IP address of the SOHO itself and are never privy to the
addresses in your trusted network address range when they
exchange information with a computer behind your firewall.
Imagine that you install a computer behind the SOHO with the
private IP address 192.168.111.12. If this address were broadcast to
the Internet, hackers could easily direct an attack on the computer
itself. Instead, the SOHO converts the address automatically to the
public, external address of the SOHO. When a hacker tries to
violate the computer, they are stopped cold at the SOHO, never
learning the true address of your computer.
User Guide 5.0 21
The SOHO Home Page—System Status
The SOHO Home Page—System Status
The System Status page is effectively the home page of the SOHO.
A variety of information is revealed in an effort to provide you
with a comprehensive display of the SOHO configuration.
• The firmware version
• A few of the SOHO features and their status:
- WSEP Logging
- VPN Manager
-Syslog
-DMZ
• Upgrade options and their status
• Configuration information for both the Trusted and External
networks
• Configuration information on your firewall settings (that is,
Incoming and Outgoing services)
• A reboot button to restart the unit
The Default Factory Settings
Your SOHO has the following default network and configuration
settings:
External Network
External network settings use DHCP.
Trusted Network
The trusted network IP address is 192.168.111.1.
All computers on the trusted network automatically
receive their addresses using DHCP.
22
The Default Factory Settings
Firewall Settings
All incoming services are blocked.
An outgoing service allowing all outbound traffic.
None of the Firewall Options are enabled.
The DMZ pass-through is disabled.
System Security
System Security is disabled and no System Administrator
name or passphrase is set–the onboard configuration
pages are available to all on the trusted network.
SOHO Remote Management is disabled.
VPN Manager Access is disabled.
No remote logging is configured.
WebBlocker
WebBlocker is disabled and no settings are configured.
Upgrade Options
No upgrade options are enabled until the certificates have
been redeemed.
Resetting a SOHO to the Factory Defaults
It is possible that due to a firmware corruption or other unforeseen
misfortune (such as a lost System Security passphrase) you may
need to reset the SOHO to the factory defaults.
To do this, you will need to remove the SOHO from your network
disconnect the power, disconnect all cables, plug one end of an
Ethernet cable into the WAN port in the back of the device and the
other end into any of the other four (numbered 1-4) Ethernet ports.
Then, reconnect the power, wait at least 90 seconds, and
disconnect power. Your SOHO is now reset to factory defaults.
Connect the cables in the original configuration and power up
again.
User Guide 5.0 23
Rebooting a WatchGuard SOHO
The Base Model SOHO
The base model SOHO comes with a ten seat license, that is ten
computers have access to the Internet through the SOHO.
Remember, while only four devices connect directly to the four
(numbered 1-4) Ethernet ports, one or more of these devices can be
a hub or router. Please see, “Cabling the SOHO for more than four
computers” on page 34.
Rebooting a WatchGuard SOHO
To reboot a SOHO located on a local system, use one of the
following methods:
• Using your Web browser.
With your Web browser, go to the SOHO System Status
page using the Trusted IP address of the SOHO. (For
example, if using the default IP address, go to: http://
192.168.111.1.)
Click the Reboot button.
• Unplug the SOHO and plug it back in.
To reboot a SOHO located on a remote system, the SOHO must be
configured to allow either incoming Web or FTP traffic to the
trusted address of the SOHO. For information on configuring a
SOHO to allow incoming traffic, see “Configuring Incoming and
Outgoing Services” on page 63.
You can than use one of the following methods:
• Open a special HTML page with the external IP address of
the SOHO in the URL followed by
example, http://209.191.160.60/rebootreq.
24
/rebootreq. For
Rebooting a WatchGuard SOHO
• Send an FTP command to the remote SOHO device. Use an
FTP application to connect to the SOHO device, then enter
the command:
quote rebt
User Guide 5.0 25
Rebooting a WatchGuard SOHO
26
CHAPTER 2 Getting Started
Before you begin
Pre-installation checklist
Before installing your new WatchGuard SOHO please ensure that
you have:
• A 10BaseT Ethernet I/O network card installed in your
computer.
• A cable or DSL modem with a 10BaseT port.
• Two Ethernet network cables with RJ45 connectors. These
must not be “crossover cables” (which are usually red or
orange). One cable is furnished with your unit. A second
cable may have been supplied with your modem. If not, you
will need to purchase a second Ethernet, RJ45 cable. Make
sure that both cables are long enough to comfortably connect
the modem to the SOHO and the SOHO to the computer in
your individual office environment.
User Guide 5.0 27
The Installation Process
• An operational Internet connection. Setup of your SOHO
requires access to the Internet. If your connection does not
work, please contact your Internet service provider (ISP).
When your connection has been established, you may
proceed with installation and setup.
• If you have either a cable or DSL modem, consult the manual
that came with your service, or call the ISP to find out
whether your particular modem supports DHCP or PPPoE.
You will need this information later in the installation
process.
• If you are using PPPoE to connect to your local Internet
service provider, the WatchGuard SOHO must be running
firmware version 2.0 or later.
• An installed Web browser–either Netscape Navigator 4.77
(or higher) or Internet Explorer 5.0 (or higher).
• SOHO serial number.
The Installation Process
Before you begin the installation process, connect to the Internet.
You need to determine your current TCP/IP settings and disable
your HTTP proxy.
NOTE
You must also know whether your ISP provides you with Dynamic or
Static TCP/IP settings. For assistance, please see, “Determining whether
your ISP uses dynamic or static addressing” on page 38.
28
The Installation Process
Determine your current TCP/IP settings
For your reference, record the computer’s current TCP/IP settings
in the chart provided at the end of this section. Different operating
systems will supply different information. To locate your settings:
Microsoft Windows NT or 2000
1Click Start => Programs => Command Prompt.
2 At the C:\ prompt, enter ipconfig/all. Press Enter.
3 Enter your current TCP/IP settings in the chart provided
below.
4Click
Cancel.
Microsoft Windows 95 or 98 or ME
1Click Start => Run.
2Type:
winipcfg. Click OK.
3 Select the “Ethernet Adapter.”
Enter your current TCP/IP settings in the chart provided below.
4Click Cancel.
Macintosh
1Click Apple menu => Control Panels => TCP/IP.
2 Enter your current TCP/IP settings in the chart provided
below.
3Close the window.
Other operating systems (Unix, Linux)
1 Consult your operating system guide to locate the TCP/IP
screen.
2 Enter settings in the chart provided below.
User Guide 5.0 29
The Installation Process
3 Exit the TCP/IP configuration screen.
TCP/IP Setting Value
IP Address
Subnet Mask
Default Gateway
DHCP Enabled Yes No
Primary WINS Server
Secondary WINS
Server
DNS Server(s) Primary
Secondary
. . .
. . .
. . .
. . .
. . .
. . .
. . .
NOTE
If you are connecting more than one computer to the trusted network
behind the SOHO, obtain the configuration TCP/IP information for each
computer.
Disable your browser’s HTTP proxy
To configure a WatchGuard SOHO after it is installed, you must be
able to access the special configuration pages that reside on the
SOHO. If the HTTP proxy in your browser is enabled, you can not
access these pages, and you can not complete the configuration
process.
30
Loading...