watchguard internet security handbook

Post on 03-Feb-2022

11 Views

Category:

Documents

0 Downloads

Preview:

Click to see full reader

TRANSCRIPT

WatchGuardInternet Security Handbook

LiveSecurity System 4.0

ox™

er

ft

c.

ght and

and ve

DisclaimerInformation in this guide is subject to change without notice. Companies, names, and data used in examples herein are fictitious unless otherwise noted. No part of this guide may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the express written permission of WatchGuard Technologies, Inc.®

Copyright and Patent InformationCopyright© 1998, 1999 WatchGuard Technologies, Inc.® All rights reserved.

WatchGuard Technologies, Inc.®, WatchGuard® are registered trademarks, and Firebis a trademark of WatchGuard Technologies, Inc. in the USA and other countries.

Certain materials herein are Copyright ©1995-1999 Microsystems Software, Inc. CybPatrol® is a registered trademark of Microsystems Software, Inc. CyberNOT™ and CyberNOT List™ are trademarks of Microsystems Software, Inc.

Ethernet™ is a trademark of Xerox Corporation. Microsoft®, NetMeeting™, Windows®, Windows 95®, Windows 98®, Windows NT®,and Windows NT Server® are either registered trademarks or trademarks of MicrosoCorporation in the USA and other countries.Java™ is a trademark of Sun Microsystems®.PostScript® is a registered trademark of Adobe Systems, Inc. X Window™ is a trademark of the Massachusetts Institute of Technology. RealAudio™, RealVideo™, and RealNetwork™s are trademarks of RealNetworks, InStreamWorks™ and StreamWorks Player™ are trademarks of Xing Technology Corporation. VDOLive™ and VDOPhone™ are trademarks of VDOnet Corp.Certain materials herein are Copyright ©1992-99 RSA Data Security, Inc. and Copyri©Hi/fn, Inc. 1993, including one or more U.S. Patents: 4701745, 5015009, 5126739, 5146221, and other patents pending.

Many of the other designations used by manufacturers and sellers to distinguish theirproducts are claimed as trademarks. Where those designations appear in this book, WatchGuard Technologies, Inc. was aware of a trademark claim, the designations habeen printed with initial capital letters or all capital letters.

Printed in the United States of America.

DocVer: S-40-Handbook-3

Declaration of Conformity

OYl[`?mYj\�L][`fgdg_a]k+).�G[[a\]flYd�9n]fm]�Kgml`Kmal]�*((K]Ylld]$�O9�10)(,�

2 WatchGuard Internet Security Handbook

<][dYj]k�l`]�;=%eYjc]\�hjg\m[l2

FCC CertificationL`ak�\]na[]�`Yk�Z]]f�l]kl]\�Yf\�^gmf\�lg�[gehdq�oal`�daealk�^gj�;dYkk�9�\a_alYd�\]na[]$�hmjkmYfl�lg�HYjl�)-�g^�l`]�>;;�Jmd]k&�Gh]jYlagf�ak�kmZb][l�lg�l`]�^gddgoaf_�log�[gf\alagfk2

1. L`ak�\]na[]�eYq�fgl�[Ymk]�`Yje^md�afl]j^]j]f[]

2. L`ak�\]na[]�emkl�Y[[]hl�Yfq�afl]j^]j]f[]�j][]an]\$�af[dm\af_�afl]j^]j]f[]�l`Yl�eYq�[Ymk]�mf\]kaj]\�gh]jYlagf&

CE NoticeL`]�g^^a[aYd�;=�kqeZgd�af\a[Yl]k�[gehdaYf[]�g^�l`ak�OYl[`?mYj\�L][`fgdg_a]k��hjg\m[l�lg�l`]�=E;�\aj][lan]�g^�l`]�=mjgh]Yf�;geemfalq&�L`]�;=�kqeZgd�^gmf\�`]j]�gj�]dk]o`]j]�af\a[Yl]k�l`Yl�l`ak�OYl[`?mYj\�hjg\m[l�e]]lk�gj�]p[]]\k�l`]�^gd%dgoaf_�klYf\Yj\k2

CSA StatementL`ak�;dYkk�9�\a_alYd�YhhYjYlmk�e]]lk�Ydd�j]imaj]e]flk�g^�l`]�;YfY\aYf�Afl]j^]j]f[]%;Ymkaf_�=imahe]fl�J]_mdYlagfk&

;]l�YhhYj]ad�fme]jaim]�\]�dY�[dYkk]�9�j]kh][l]�lgml]k�d]k�]pa_]f[]k�\m�J]_d]e]fl�kmj�d]�eYl]ja]d�Zjgmdd]mj�\m�;YfY\Y&

Product Models: Firebox II, Firebox II Plus

Complies with: 73/23/EEC Low Voltage Directive 89/336/EEC Electromagnetic Compatibility Directive

Compliance Standards:

EN60950:1992 Electrical Safety A1:1993, A2:1993, A3:1995, A4:1997, A11:1997

EN55022,Class A RF Emissions Information Technology

EN50082-1 EMC Immunity Standard

EN60950:1992 Electrical Safety A1:1993, A2:1993, A3:1995, A4:1997, A11:1997

EN55022,Class A RF Emissions Information Technology

EN50082-1 EMC Immunity Standard

WatchGuard Internet Security Handbook 3

4 WatchGuard Internet Security Handbook

Internet Security Handbook Table of Contents

CHAPTER 1 L`]�F]]\�^gj�F]logjc�K][mjalq 1

L`]�;gfn]fa]f[]k�Yf\�<Yf_]jk�g^�F]logjcaf_ 1K][mjalq�nk&�;gfn]fa]f[] )(O`Yl�ak�Y�K][mjalq�Hgda[q7 )(EYcaf_�H]Y[]�oal`�Y�K][mjalq�Hgda[q ))

O`Yl�EYc]k�Y�?gg\�F]logjc�K][mjalq�Kqkl]e ))Kaehda[alq ))K[YdYZadalq )*<akljaZml]\�9j[`al][lmj] )*<qfYea[Yddq�K][mj]\�Y_Yafkl�l`]�DYl]kl�K][mjalq�L`j]Ylk )*=[gfgeq�g^�AH�9\\j]kk]k )+K][mj]�;gff][lagfk )+9ml`]fla[Ylagf )+;gfl]fl�<ak[jaeafYlagf )+K][mj]�J]egl]�EYfY_]e]fl�Yf\�;geemfa[Ylagf ),@a_`dq�;gf^a_mjYZd]�Dg__af_�Yf\�Fgla^a[Ylagf ),KmeeYjar]�Yf\�J]hgjl�F]logjc�9[lanalq ),Ima[c�Yf\�J]khgfkan] ),9�O]dd%;gf[]an]\�K][mjalq�Hgda[q ),H`qka[Yddq�K][mj]\�K][mjalq�9hhdaYf[] ),

L`]�OYl[`?mYj\�Kgdmlagf )-9kkmehlagfk )-K]hYjYlagf�g^�C]q�K][mjalq�Kqkl]e�;gehgf]flk ).=Yk]�g^�Mk]�:]_]lk�K][mj]�Mk] )/Gh]f�;g\]�:Yk] )0Lg�Hjgpq�gj�Lg�HY[c]l�>adl]j7 )1Afl]_jYlaf_�K][mjalq�L][`fgdg_a]k�aflg�Y�KlYf\�9dgf]�9hhdaYf[] )1

CHAPTER 2 K][mjalq�Yf\�>aj]oYdd�EYfY_]e]fl�Hgda[a]k *)

:YdYf[af_�Jakc�nk&�Hjg\m[lanalq **Af[geaf_�K]jna[]k2�K][mjalq�Hjaf[ahd]k *+Gml_gaf_�K]jna[]k *,

Gl`]j�Hjaf[ahd]k�g^�K][mjalq�nk&�Jakc *,=d]e]flk�l`Yl�<][j]Yk]�>aj]oYdd�K][mjalq *-

Gj_Yfaraf_�qgmj�Gj_YfarYlagf */<]l]jeafaf_�qgmj�9ddgoYZd]�LjY^^a[ *0Gj_Yfaraf_�qgmj�f]logjc k! *0<]l]jeafaf_�Gml%g^%:gmf\k�Yj]Yk *1H`qka[Yd�K][mjalq +(L`]�@meYf�>Y[lgj +)

CHAPTER 3 F]logjc�;gf^a_mjYlagf ++

Kaehd]�F]logjc� <jgh%af!�;gf^a_mjYlagf ++@go�l`]�Kaehd]�;gf^a_mjYlagf�Ogjck�oal`�Hjgpq�9JH +,9Zgml�J]dYl]\�F]logjck�Yf\�J]dYl]\�@gklk +-

Emdlahd]�F]logjc�;gf^a_mjYlagf +.

CHAPTER 4 Hjgpqaf_�Yf\�HY[c]l�>adl]jaf_ +1

<qfYea[�HY[c]l�>adl]jaf_ +1Hjgpa]k ,(KlYf[] ,);gf^a_mjaf_�K]jna[]k ,)

;gf^a_mjYZd]�HYjYe]l]jk�^gj�K]jna[]k ,*;`Yf_af_�Y�K]jna[] ,*<]d]laf_�Y�K]jna[] ,+

CHAPTER 5 :]qgf\�Hjgpa]k�Yf\�HY[c]l�>adl]jk ,-

:dg[caf_�Kal]k ,-Dg__af_�:dg[c]\�Kal]k ,.

:dg[caf_�Hgjlk ,.;gf^da[lk�af�:dg[c]\�Hgjlk ,09mlg%Zdg[caf_�kal]k�l`Yl�Yll]ehl�lg�mk]�Zdg[c]\�hgjlk ,1Dg__af_�:dg[c]\�Hgjl�9[lanalq ,1

F]logjc�9\\j]kk�LjYfkdYlagf� F9L! ,1<qfYea[�F9L ,1KlYla[�F9L -);gf^a_mjaf_�KlYla[�F9L -)

9daYkaf_ -)9ml`]fla[Ylagf -*

9ml`]fla[Ylagf�E]l`g\k -+>aj]Zgp�9ml`]fla[Ylagf --Oaf\gok�FL�9ml`]fla[Ylagf --JY\amk�9ml`]fla[Ylagf --;JQHLG;Yj\�9ml`]fla[Ylagf -/@go�;JQHLG;Yj\�9ml`]fla[Ylagf�Ogjck -/J]egnaf_�9ml`]fla[Ylagf -0;gf^a_mjaf_�Yf�9ml`]fla[Ylagf�=fnajgfe]fl -0;geZafaf_�Mk]j�9ml`]fla[Ylagf�Yf\�J]egl]�Mk]j�NHF -0

=f[jqhlagf -1O]Z:dg[c]j .(

K]llYZd]�HYjYe]l]jk .)=p[]hlagfk .)Dg__af_�Yf\�O]Z:dg[c]j .*@go�O]Z:dg[c]j�Ogjck .*

CHAPTER 6 Dan]K][mjalq .-

L`]�Dan]K][mjalq�;da]fl ..9f�Afl]_jYl]\�Kgdmlagf ..Dan]K][mjalq�:jgY\[Yklk ..K][mjalq�:jgY\[Yklk ./L`j]Yl�J]khgfk]k ./Af^gjeYlagf�9d]jlk ./

JYha\�J]khgfk]�L]Ye .0Dan]K][mjalq�9ddaYf[] .0

CHAPTER 7 NajlmYd�HjanYl]�F]logjcaf_ .1

:jYf[`�G^^a[]�NHF /(AHK][�Aehd]e]flYlagf�g^�:jYf[`�G^^a[]�NHF /)OYl[`?mYj\�k�Hjghja]lYjq�=f[jqhlagf�Hjglg[gd /);gf^a_mjYlagf�;`][cdakl /*=f[jqhlagf /+Dg__af_ /+:jYf[`�G^^a[]�NHF�Kh][aYd�;gfka\]jYlagfk /+KYehd]�;gf^a_mjYlagfk /+:jYf[`�G^^a[]�NHF�oal`�AHK][ /,;gf^a_mjaf_�K]jna[]k�lg�ogjc�oal`�NHF /09ml`]fla[Ylaf_�Yf�AHK][�Lmff]d�naY�Y�Oaf\gok�FL�K]jn]j /1

J]egl]�Mk]j�NHF 0(J]egl]�Mk]j�NHF�oal`�HHLH 0(;gf^a_mjYlagf�;`][cdakl 0)Hj]hYjaf_�l`]�;da]fl�;gehml]jk 0)J]egl]�Mk]j�NHF�oal`�AHK][ 0*

CHAPTER 8 Dg__af_�Yf\�Fgla^a[Ylagf 0+

O`Yl�Dg__af_�Ak 0+O`Yl�Fgla^a[Ylagf�Ak 0,<]n]dghaf_�Dg__af_�Yf\�Fgla^a[Ylagf�Hgda[a]k 0,

O`Yl�=n]flk�lg�Dg_ 0-O`a[`�K]jna[]k�=n]flk�lg�Dg_ 0.O`a[`�K]jn]j k!�lg�9ddg[Yl]�Yk�Dg_�@gklk 0.Dg_�>ad]�Kar]�Yf\�Lmjfgn]j�>j]im]f[q 0.O`a[`�=n]flk�oadd�Lja__]j�Fgla^a[Ylagf7 0/O`Yl�^gje�g^�fgla^a[Ylagf�qgm�oadd�mk] 00

@go�Fgla^a[Ylagf�;gmflk�Yf\�@Yf\d]k�=n]flk 00

CHAPTER 9 Egfalgjaf_�qgmj�K][mjalq�Kqkl]e 1)

@gklOYl[` 1*L`]�@gklOYl[`�<akhdYq 1*

:Yf\oa\l`�E]l]j 1+L`]�:Yf\oa\l`�E]l]j�<akhdYq 1+

K]jna[]OYl[` 1+KlYlmkJ]hgjl 1,9ml`]fla[Ylagf�Dakl 1-:dg[c]\�Kal]�Dakl 1-

CHAPTER 10 J]hgjlaf_ 1/

O`q�J]hgjlaf_7 1/L`]�OYl[`?mYj\�@aklgja[Yd�J]hgjlk�Eg\md] 10Lqh]k�g^�J]hgjlk 10:mad\af_�J]hgjlk 11=phgjlaf_�J]hgjlk 11

;<>�J]hgjlk 11O]ZLj]f\k�^gj�>aj]oYddk�Yf\�NHFk��J]hgjlk )((

CHAPTER 1 The Need for Network Security

L`ak�[`Yhl]j�\ak[mkk]k�l`]�[gfn]fa]f[]�g^�hmllaf_�qgmj�f]logjc�gf�l`]�Afl]jf]l�n]jkmk�l`]�k][mjalq�jakck&�Al�l`]f�\ak[mkk]k�nYjagmk�YhhjgY[`]k�lg�k][mjalq&

The Conveniences and Dangers of Networking

Gja_afYddq$�[gehml]jk�o]j]�klYf\%Ydgf]�mfalk&�Kggf$�dYj_]%k[Yd]�mk]jk�Z]_Yf�f]logjcaf_�l`]e�lg_]l`]j�^gj�]Yka]j�]p[`Yf_]�g^�af^gjeYlagf&�L`ak�[j]Yl]\�daf]k�g^�[geemfa[Ylagf�aflg�o`a[`�afl]jdgh]jk� fgo�[geegfdq�[Ydd]\�É`Y[c]jkÊ!�[gmd\�afk]jl�gj�[gmfl]j^]al�e]kkY_]k�lg�_Yaf�Y[[]kk�lg�[dYkka^a]\�\YlY&

:q�l`]�ea\%)11(k$�]n]j�egj]�Y^^gj\YZd]�[gehml]jk�gh]jYl]\�Zq�]Yk%a]j�lg�mk]�kg^loYj]$�[geZaf]\�oal`�l`]�Z]f]^alk�l`Yl�f]logjcaf_�Zjaf_k�af�l`]�\akk]eafYlagf�g^�af^gjeYlagf$�[j]Yl]\�Yf�]phdgkagf�af�l`]�mk]�g^�hjanYl]�afklalmlagfYd�f]logjck�dafc]\�lg�l`]�Afl]jf]l&�L`ak�l][`fa[Yd'kg[aYd�\]n]dghe]fl�dal]jYddq�hml�l`]�ogjd\�Yl�gf]Ìk�^af_]j%lahk&�Gf]�[gmd\�fgo�h]j^gje�egj]�j]k]Yj[`�^jge�Y�h]jkgfYd�[ge%hml]j�oal`�Afl]jf]l�Y[[]kk�Yl�`ge]�l`Yf�\mjaf_�Y�o]]cdgf_�klYq�Yl�Y�dYj_]�e]ljghgdalYf�daZjYjq&�L`]j]�ak�dalld]�Yj_me]fl�l`Yl�l`]�Z]f]^alk�g^�f]logjcaf_�Yj]�]fgjegmk&�Mf^gjlmfYl]dq$�kg�Yj]�l`]�jakck&�

L`]�^Y[l�l`Yl�Yfq�h]jkgf�oal`�Afl]jf]l�Y[[]kk�[gmd\�na]o�qgmj�gj_Y%farYlagfÌk�O]Zkal]$�gj�]p[`Yf_]�]%eYad�oal`�gj_YfarYlagf�e]eZ]jk�Ydkg�e]Yfl�l`Yl�Yfq�h]jkgf�[gmd\�Yll]ehl�lg�^af\�oYqk�lg�_Yaf�j]Y\'ojal]�Y[[]kk�lg�qgmj�k]jn]jk�Yf\�[gehml]jk�l`Yl�klgj]�Yf\�\akhdYq�l`ak�\YlY&�Mh�lg�fgo$�f]logjck�`Y\�ogjcklYlagfk$�k]jn]jk$�Yf\�jgml%]jk&�Lg�hjgl][l�Y_Yafkl�l`]�Afl]jf]lÌk�af`]j]fl�k][mjalq�l`j]Yl$�l`]�[gehml]j�f]logjc�É^aj]oYddÊ�oYk�[j]Yl]\�Yk�Y�f]o�[dYkk�g^�f]logjc�\]na[]&

WatchGuard Internet Security Handbook 9

The Need for Network Security

L`]j]�Yj]�l`j]]�`aklgja[Yd�lj]f\k�l`Yl�d]\�lg�l`]�\]n]dghe]fl�g^�^aj]%oYddk�Yk�Y�[dYkk�g^�f]logjc�\]na[]k2

� The increasing reliance on the Internet for commerce, research and collaboration by corporations.�Fgl�gfdq�o]j]�[gehml]j�mk]jk�Y[[]kkaf_�l`]�Afl]jf]l�^gj�af^gjeYlagf$�l`]q�o]j]�Ydkg�mkaf_�al�lg�ljYfkY[l�Zmkaf]kk$�o`]j]�^mf\k$�Y[[gmfl�fmeZ]jk$�Yf\�[j]\al�[Yj\�fmeZ]jk�o]j]�Z]af_�]p[`Yf_]\&

� The rise of the Internet as an avenue of unauthorized access into corporate networks.�L`]�hjgda^]jYlagf�g^�l`]�Afl]jf]lÌk�hghmdYjalq�Yf\�Y[[]kkaZadalq�Ydkg�e]Yfl�Y�hjgda^]jYlagf�g^�Yll]ehlk�Yl�hjYfck$�nYf\Ydake$�Yf\�l`]^l�g^�afl]dd][lmYd�hjgh]jlq�Yf\�]d][ljgfa[�^gjek�g^�egf]q&

� The costs associated with that unauthorized access.�L`]�Z]f]^alk�g^�af[j]Yk]\�f]logjcaf_�o]j]�Z]af_�l`j]Yl]f]\�Zq�l`]�[gklk�g^�dgkk�^jge�Zj]Yc%afk&

<goflae]�\m]�lg�Y�k][mjalq�Zj]Y[`�[Yf�Z]�n]jq�]ph]fkan]&�Fgl�gfdq�ak�l`]j]�l`]�dgkl�hjg\m[lanalq�mflad�l`]�Zj]Y[`]\�[gehml]jk�Yj]�ZY[c�gfdaf]$�l`]j]�ak�Ydkg�l`]�im]klagf�g^�`go�em[`�dYklaf_�\YeY_]�g[[mjj]\�\mjaf_�l`]�k][mjalq�Zj]Y[`&�Mf^gjlmfYl]dq$�l`]�gfdq�oYq�lg�ljmdq�k][mj]�Y�f]logjc�^jge�l`]�Afl]jf]l�ak�lg�`Yn]�fg�[gff][lagf�lg�l`]�Afl]jf]l$�o`a[`�af�alk]d^�ak�Y�f]_Ylan]�aehY[l�gf�hjg\m[lanalq&��F]logjc�k][mjalq�hjg\m[lk�hjgna\]�l`]�e]Yfk�lg�eYfY_]�l`]�jakck�Ykkg[aYl]\�oal`�Afl]jf]l�Y[[]kk�oal`gml�dgkaf_�l`]�Z]f]^alk�g^�af[j]Yk]\�Y[[]kk�Yf\�[gff][lanalq&��

Security vs. ConvenienceAf�eYfq�[Yk]k�l`]j]�ak�Y�[gfklYfl�ZYlld]�Z]lo]]f�mk]jk�Yf\�kqkl]e�Y\eafakljYlgjk�gn]j�f]logjc�k][mjalq�hgda[q&�Mk]jk�oYfl�lg�`Yn]�l`]�ogjd\�Yl�l`]aj�^af_]jlahk&�Kqkl]e�Y\eafakljYlgjk�`Yn]�Y�n]kl]\�afl]j%]kl�af�j]klja[laf_�Y[[]kk�Yk�em[`�Yk�hgkkaZd]�lg�Ynga\�k][mjalq�[ge%hjgeak]k$�dgkk$�Yf\�\goflae]&�

L`]�[gf^da[l�Z]lo]]f�l`]�^j]]�^dgo�g^�af^gjeYlagf�Yf\�l`]�f]]\�^gj�k][mjalq�[Yf�Z]�j]kgdn]\�oal`�Y�o]dd%\]ka_f]\�^aj]oYdd�YhhdaYf[]�[geZaf]\�oal`�l`]�gj_YfarYlagfÌk�[geeale]fl�lg�Yf�afl]dda_]fl�k][m%jalq�hgda[q&

What is a Security Policy?Af�l`]�[gfl]pl�g^�f]logjc�^aj]oYddk$�Y�k][mjalq�hgda[q�ak�Y�klYl]e]fl�g^�l`]�gn]jYdd�ZYdYf[]�Z]lo]]f�[gfn]fa]f[]�Yf\�k][mjalq�l`Yl�Yf�gj_Yfa%rYlagf�\][a\]k�lg�Y\ghl�Yk�Y�[gehjgeak]�Z]lo]]f�YZkgdml]�k][mjalq�Yf\�YZkgdml]�Y[[]kk&�>mddq�^gje]\$�Y�k][mjalq�hgda[q�kh]ddk�gml�Ydd�o`g�[Yf�_]l�af$�o`g�[Yf�_]l�gml$�Yf\�o`]j]�l`]q�[Yf�_g&�

>gj�]pYehd]$�Y�k][mjalq�hgda[q�ea_`l�kh][a^q�l`Yl�[]jlYaf�AH�Y\\j]kk]k�gf�l`]�Afl]jf]l�eYq�fgl�[gflY[l�Yfqgf]�gj�Yfql`af_�oal`af�qgmj�gj_YfarYlagf$�fg�eYll]j�o`Yl&�Al�ea_`l�^mjl`]j�kh][a^q�l`Yl�[]jlYaf�

10 WatchGuard Internet Security Handbook

What Makes a Good Network Security System

[gehml]jk�oal`af�l`]�gj_YfarYlagf�Yj]�Y[[]kkaZd]�gfdq�Zq�Y[[gmflaf_$�gj�Zq�lgh%d]n]d�eYfY_]e]fl$�gj�eYjc]laf_&�Al�ea_`l�^mjl`]j�kh][a^q�l`Yl�gl`]j�[gehml]jk�gf�l`]�Afl]jf]l�[Yffgl�\aj][ldq�Y[[]kk�Yfq�[ge%hml]j�oal`af�qgmj�gj_YfarYlagf3�l`Yl�afkl]Y\$�Ydd�gmlka\]�ljY^^a[�eYq�gfdq�[gflY[l�qgmj�^aj]oYdd&

L`]�̂ aj]oYdd�l`]f�\][a\]k�o`a[`�ljY^^a[�ak�jgml]\�lg�o`a[`�[gehml]jk$�_jgmhk$�gj�mk]jk&�Al�k`gmd\�dg_�[]jlYaf�lqh]k�g^�Y[lanalq$�Yf\�l`]�hgda[q�k`gmd\�\a[lYl]�o`Yl�lqh]k�g^�Y[lanalq�Yj]�dg__]\�Yf\�o`Yl�lqh]k�[gf%klalml]�Y�hYll]jf�l`Yl�oYjjYflk�fgla^a[Ylagf�g^�Y�f]logjc�Y\eafakljY%lgj&�L`]j]�Yj]�eYfq�egj]�hYjYe]l]jk�Y�k][mjalq�hgda[q�[Yf�lYc]�aflg�Y[[gmfl�Yf\�kh][a^q&�L`]�hgafl�ak$�o`]f�qgm�Y\\�Ydd�l`]�k][mjalq�Y[[]kk�hYjYe]l]jk�mh$�l`]q�[gehjak]�l`]�k][mjalq�hgda[q&

Making Peace with a Security PolicyHmZdak`af_�Y�k][mjalq�hgda[qÈYf\�l`]�j]Ykgfaf_�Z]`af\�alÈlg�l`]�]flaj]�gj_YfarYlagf�al�hjgna\]k�Yl�d]Ykl�l`j]]�Z]f]^alk2

� Gj_YfarYlagf�e]eZ]jk�_Yaf�Y�k]fk]�l`Yl�l`]�gj_YfarYlagf�ak�dggc%af_�gml�lg�hjgl][l�l`]aj�^ad]k�Yf\�l`]aj�dan]da`gg\

� L`]q�g^l]f�^af\�l`Yl�l`]q�`Yn]�Y[[]kk�^j]]\gek�l`]q�o]j]fÌl�hj]%nagmkdq�YoYj]�g^

� L`]q�_Yaf�Yf�mf\]jklYf\af_�l`Yl�Y[[]kk�daealYlagfk�Yj]�aehd]%e]fl]\�lg�hjgl][l�l`]�gj_YfarYlagf�^jge�\akYkl]j��

>aj]oYddk�Y\\j]kk�l`]�k][mjalq�nk&�^j]]\ge�[gf^da[l�Zq�hjgna\af_�Y�ljYfkhYj]fl�kgdmlagf�l`Yl�`]dhk�l`]�kqkl]e�Y\eafakljYlgjk�k][mj]�l`]aj�f]logjc$�o`ad]�kladd�Yddgoaf_�mk]jk�eYfq�g^�l`]�^j]]\gek�l`]q�ogmd\�dac]&�9�hjgh]jdq�[gf^a_mj]\�^aj]oYdd�eYc]k�h]f]ljYlaf_�Y�f]l%ogjc�^jge�l`]�Afl]jf]l�n]jq�\a^^a[mdl$�Yf\�q]l�hj]k]jn]k�Y�_j]Yl�\]Yd�g^�egZadalq�oal`af�l`]�gj_YfarYlagf� a^�\]kaj]\!&�;gf^a_mjaf_�l`]�k][mjalq�kqkl]e�lg�hjg\m[]�\]lYad]\�dg_k�g^�Y[lanalq�l`Yl�Yj]�j]na]o]\�gf�Y�j]_mdYj�ZYkak�eYc]k�al�Ydd�Zml�aehgkkaZd]�^gj�Y�`gklad]�gmlka\]j�lg�Zj]Yc�af�oal`gml�Z]af_�\]l][l]\&�

What Makes a Good Network Security System

EYfq�]d]e]flk�[gehjak]�Y�jgZmkl$�]^^][lan]�k][mjalq�kqkl]e3�l`]�klYjlaf_�hgafl$�`go]n]j$�ak�kaehda[alq�g^�\]ka_f&

SimplicityL`]�^ajkl�hYjY\a_e�g^�f]logjc�k][mjalq�ak�l`Yl�[gehd]p�k][mjalq�akfÌl�k][mj]&�9�f]logjc�k][mjalq�\]na[]�l`Yl�ak�[gehd]p�af�alk�\]ka_f$�[gf%^a_mjYlagf�gj�\Yq�lg�\Yq�gh]jYlagf�ak�egj]�hjgf]�lg�]jjgj$�Yf\�`Yk�egj]�hgaflk�g^�]fljq�l`Yf�gf]�l`Yl�ak�kaehd]&��Kaehd]�\]ka_fk�Yj]�egj]�dac]dq�lg�Z]�mk]\�[gfkakl]fldq�Yf\�[gjj][ldq&�

WatchGuard Internet Security Handbook 11

The Need for Network Security

Egj]gn]j$�k][mjaf_�Y�f]logjc�^jge�gmlka\]�YllY[c�ak�fgl�af`]j]fldq�Y�\a^^a[mdl�gj�[gehd]p�hjghgkalagf&�JYl`]j$�al�ak�e]j]dq�Y�eYll]j�g^�k]_%j]_Ylaf_�ljY^^a[�aflg�log�_jgmhk3�l`Yl�o`a[`�ak�Yddgo]\�lg�hYkk�l`]�^aj]oYdd�mf\]j�[]jlYaf�[gfljgdd]\�[aj[meklYf[]k$�Yf\�l`Yl�o`a[`�ak�fgl&��Af�gl`]j�ogj\k$�l`]�hjg\m[l�k`gmd\�Yddgo�l`Yl�o`a[`�ak�\]]e]\�kY^]�Yf\�\]fq�l`]�j]kl&��

ScalabilityL`]�f]logjc�k][mjalq�kgdmlagf�emkl�Z]�YZd]�lg�c]]h�hY[]�oal`�[ge%hYfq�_jgol`�Yf\�l`]�[gehYfqÌk�af[j]Yk]\�mk]�g^�f]logjc�k][mjalq&�>gj�]pYehd]$�Y�[gehYfq�ea_`l�fgl�af[j]Yk]�af�kar]�ka_fa^a[Yfldq�gn]j�Y�log%q]Yj�h]jag\�Zml�kladd�ea_`l�f]]\�lg�k[Yd]�mh�l`]aj�f]logjc�hjg%l][lagf�ka_fa^a[Yfldq�Yk�l`]q�^af\�f]o�Yhhda[Ylagfk�^gj�f]logjc�l][`%fgdg_q�af�l`]aj�gj_YfarYlagf&�9�k[YdYZd]�kqkl]e�fgl�gfdq�]phYf\k�Yl�j]YkgfYZd]�[gkl$�alk�Y\eafakljYlagf�j]imaj]e]flk�_Yaf�dalld]�[gehd]p%alq�Yk�l`]�kqkl]e�_jgok&�Af�gl`]j�ogj\k$�l`]j]�eYq�Z]�egj]�^aj]oYdd�YhhdaYf[]k$�dg_�`gklk$�Yml`]fla[Ylagf�`gklk$�NHF�lmff]dk$�Yf\�gl`]j�l`af_k�lg�Y\eafakl]j$�Zml�l`]�mk]j�afl]j^Y[]�k`gmd\�j]eYaf�l`]�kYe]&

Distributed Architecture<akljaZml]\�Yj[`al][lmj]�]fYZd]k�qgm�lg�Ykka_f�\a^^]j]fl�̂ aj]oYdd�lYkck�lg�\a^^]j]fl�[gehml]jk&�L`ak�^]Ylmj]�ak�j]dYl]\�lgÈZml�fgl�f][]kkYjadq�\]h]f\]fl�gfÈk[YdYZadalq&�>gj�]pYehd]$�Y�\akljaZml]\�Yj[`al][lmj]�ea_`l�`Yn]�gf]�\]na[]�Yk�l`]�^aj]oYdd�YhhdaYf[]$�Yfgl`]j�[gehml]j�ogmd\�[j]Yl]�Yf\�Ydl]j�[gf^a_mjYlagfk�^gj�al$�gl`]j�[gehml]jk�ogmd\�`Yf\d]�l`]�kqkl]e�dg_k$�Yf\�q]l�gl`]j�gf]k�[gmd\�`Yn]�l`]�Yml`]fla%[Ylagf�Yf\�mk]j�\YlYZYk]k&

<akljaZml]\�Yj[`al][lmj]�gZnagmkdq�eYc]k�k[Ydaf_�mh�]Yka]j$�Zml�al�Ydkg�k]hYjYl]k�lYkck�Yf\�^mf[lagfk�Y[[gj\af_�lg�lqh]�Yf\�Ykka_fk�l`]e�lg�`Yj\oYj]�Z]kl�kmal]\�lg�l`]�j]kh][lan]�lYkck&�9�fglYZd]�]pYehd]�ak�l`Yl�Y�^aj]oYdd�YhhdaYf[]�k`gmd\�`Yn]�fg�klgjY_]�gj�hgjlk�g^�]fljq�]pljYf]gmk�lg�alk�hjaeYjq�^mf[lagf&�9�^aj]oYdd�YhhdaYf[]�oal`�Y�`Yj\�\jan]�Yf\'gj�^j]]dq�YnYadYZd]�l]jeafYd�hgjlk�ak�fgl�Yk�k][mj]�Yk�gf]�o`gk]�[gf^a_mjYlagf�ak�klgj]\�g^^daf]�Yf\�[Yf�Z]�Y[[]kk]\�gfdq�l`jgm_`�Y�\]\a[Yl]\�k]jaYd�daf]�gj�Yf�]f[jqhl]\�[gf%f][lagf&

Dynamically Secured against the Latest Security ThreatsLg�Z]�]^^][lan]$�Y�f]logjc�k][mjalq�\]na[]�[Yffgl�Z]�Y�klYla[$�gf]%lae]�hjg\m[l&�F]logjc�]flj]hj]f]mjk�Yj]�[gfklYfldq�afn]flaf_�f]o�k]j%na[]k�lg�ljYfkeal�emdlae]\aY$�l]d][gf^]j]f[af_$�Yf\�gl`]j�Y\nYf[]\�k]jna[]k�gn]j�l`]�Afl]jf]l&�9f\�l`]�`Y[c]jk�Yj]�[gfklYfldq�afn]flaf_�Yf\�]phdgalaf_�f]o�e]l`g\k�lg�afnY\]�f]logjck$�afljg\m[]�najmk]k�Yf\�ogjek&

12 WatchGuard Internet Security Handbook

What Makes a Good Network Security System

A\]Yddq$�Y�f]logjc�k][mjalq�\]na[]�af[dm\]k�Yf�mh\Ylaf_�e][`Yfake�^jge�l`]�n]f\]j$�o`a[`�\gofdgY\k�af^gjeYlagf�gf�f]o�k][mjalq�l`j]Ylk�Yf\� a^�f][]kkYjq!�kg^loYj]�hYl[`]k�lg�c]]h�l`]�f]logjc�k][m%jalq�[mjj]fl&�

Oal`gml�Y�[gfklYfl�mh\Ylaf_�e][`Yfake$�Yf�gj_YfarYlagfÌk�^aj]oYdd�Z][ge]k�egj]�nmdf]jYZd]�]Y[`�lae]�Y�f]o�]phdgalYlagf�e]l`g\�[ge]k�Ydgf_�mflad�l`]�^aj]oYdd�n]f\gj�akkm]k�Y�kg^loYj]�mh_jY\]&�Gj�l`]�f]logjc�Y\eafakljYlgj�emkl�\ana\]�`ak�lae]�Z]lo]]f�dg[Yd�Y\eafakljYlagf�lYkck�Yf\�c]]haf_�[mjj]fl�gf�f]o�k][mjalq�l`j]Ylk�Yf\�l`]f�ojalaf_�gj�gZlYafaf_�hYl[`]k�gj�[`Yf_af_�l`]�[gf^a_mjYlagf�af�`gh]k�l`Yl�al�c]]hk�l`]�gj_YfarYlagfÌk�f]logjc�k][mj]&

Economy of IP Addresses9�^aj]oYdd�k`gmd\�Z]�YZd]�lg�j]hj]k]fl�qgmj�]flaj]�f]logjc�lg�l`]�ogjd\�Yk�Y�kaf_d]�hmZda[�AH�Y\\j]kk�gj�jYf_]�g^�AH�Y\\j]kk]kÈl`]�^aj]oYdd�YhhdaYf[]Ìk�gof�AH�Y\\j]kk&�L`ak�hjgna\]k�log�Z]f]^alk2�

� L`]�^aj]oYdd�`a\]k�qgmj�gj_YfarYlagfÌk�AH�Y\\j]kk]k�^jge�l`]�j]kl�g^�l`]�ogjd\$�l`]j]Zq�hjgl][laf_�qgmj�[gehml]jkÌ�a\]flala]k�^jge�kljYf_]jk&

� Qgm�[Yf�mk]�hjanYl]�AH�Y\\j]kk]k�oal`af�qgmj�gj_YfarYlagf�oal`%gml�ogjjq�g^�[dYk`af_�oal`�hmZda[�AH�Y\\j]kk]k�gf�l`]�Afl]jf]l&

Secure Connections9dd�k][mjalq�kqkl]ek�k`gmd\�aehd]e]fl�k][mj]�[gff][lagfk�Z]lo]]f�Ydd�[jala[Yd�Yf\�k]fkalan]�hgaflk�g^�[geemfa[Ylagf&�L`ak�_]f]jYddq�e]Yfk�l`Yl�l`]�dafck�Z]lo]]f�l`]�Y\eafakljYlagf�[gehml]j�Yf\�l`]�^aj]oYdd�YhhdaYf[]�]ehdgq�kljgf_�]f[jqhlagf�Yf\�l`Yl�kljgf_�]f[jqh%lagf�ak�YnYadYZd]�^gj�gl`]j�[jala[Yd�dafck&

Authentication9ml`]fla[Ylagf�ak�l`]�e]Yfk�lg�]fkmj]�l`Yl�Yf�af[geaf_�e]kkY_]�ak�Y[lmYddq�k]fl�^jge�l`]�kgmj[]�[dYae]\�lg�gja_afYl]�al&�9�_gg\�^aj]oYdd�`Yk�k]n]jYd�lqh]k�Yf\�d]n]dk�g^�Yml`]fla[Ylagf�YnYadYZd]&�Emdlahd]�d]n%]dk�g^�Yml`]fla[Ylagf�]fYZd]k�qgm�lg�gj_Yfar]�qgmj�k][mjalq�hgda[q�kg�l`Yl�\a^^]j]fl�_jgmhk�g^�mk]jk�`Yn]�\a^^]j]fl�Yj]Yk�Yf\�d]n]dk�g^�Y[[]kk&�Emdlahd]�lqh]k�g^�Yml`]fla[Ylagf�]fkmj]k�l`Yl�l`]�egkl�k][mj]�gj�[gehYlaZd]�lqh]�g^�Yml`]fla[Ylagf�ak�YnYadYZd]�^gj�Y�_an]f�mk]&�

Content Discrimination;gfl]fl�\ak[jaeafYlagf�ak�l`]�YZadalq�lg�hj]n]fl�gj_YfarYlagf�e]e%Z]jk�^jge�mkaf_�Yf�gj_YfarYlagfÌk�lae]�Yf\�j]kgmj[]k�lg�_Yaf�Ogjd\�Oa\]�O]Z%ZYk]\�]fl]jlYafe]fl�afYhhjghjaYl]�lg�l`]�gj_YfarYlagfÌk�_gYdk$�h`adgkgh`a]k$�Yf\�ogjc�]l`a[&�9�_gg\�O]Z�Zdg[caf_�e][`Y%fake�\a^^]j]flaYl]k�lqh]k�g^�hgl]flaYddq�afYhhjghjaYl]�[gfl]fl$�Yf\�

WatchGuard Internet Security Handbook 13

The Need for Network Security

Ykka_fk�\a^^]j]fl�d]n]dk�g^�Y[[]kk�lg�_jgmhk�gj�af\ana\mYdk�Yl�kh][a^a]\�h]jeall]\�Yf\�hjg`aZal]\�Y[[]kk�lae]k&

Secure Remote Management and Communication9�_gg\�k][mjalq�kqkl]e�[Yf�Z]�eYfY_]\�^jge�Y�j]egl]�dg[Ylagf�af�Y�oYq�l`Yl�hj][dm\]k�]Yn]k\jghhaf_�gf�l`]�Y\eafakljYlan]�k]kkagf&�

Highly Configurable Logging and Notification9�_gg\�k][mjalq�kqkl]e�]fYZd]k�qgm�lg�kh][a^q�o`a[`�kgjlk�g^�]n]flk�Yj]�dg__]\&�Qgm�k`gmd\�Z]�YZd]�lg�kh][a^q�o`a[`�]n]flk�Yj]�dg__]\�^gj�]Y[`�af\ana\mYd�k]jna[]&�Kge]�k]jna[]Ìk�]n]flk�eYq�f]]\�dalld]�gj�fg�dg__af_�o`ad]�gl`]j�k]jna[]k�eYq�f]]\�lg�`Yn]�]n]jq�]n]fl�dg__]\&�Qgm�Ydkg�f]]\�lg�Z]�YZd]�lg�Y\bmkl�dg__af_�hYjYe]l]jk�lg�Y[[geeg\Yl]�[`Yf_]k�af�k]jn]j�[YhY[alq$�mkYZd]�^ad]�kar]$�Yf\�l`]�^j]%im]f[q�Yl�o`a[`�l`]�dg_^ad]�Z]_afk�gn]jojalaf_�alk]d^&�9�_gg\�dg__af_�kqkl]e�[Yf�Z]�[gf^a_mj]\�lg�oYl[`�^gj�hYll]jfk�kqehlgeYla[�g^�g^�Yll]ehl]\�k][mjalq�Zj]Y[`]k�Yf\�fgla^q�Yf�Y\eafakljYlgj�g^�l`]�kmk%ha[agmk�Y[lanalq&

Summarize and Report Network Activity9�_gg\�k][mjalq�kqkl]e�_an]k�Yf�Y[[mjYl]$�e]Yfaf_^md$�Yf\�kljYa_`l%^gjoYj\�Y[[gmfl�g^�alk�mk]�lg�eYfY_]e]fl&�Qgm�k`gmd\�Z]�YZd]�lg�kgjl�l`]�dg__af_�\YlY�Zq�nYjagmk�hYjYe]l]jk�km[`�Yk�`gkl%lg%`gkl�[gff][%lagfk$�Afl]jf]l�Y[lanalq$�egkl�Y[lan]�laek]�g^�\Yq$�]l[&

Quick and Responsive9�_gg\�k][mjalq�kqkl]e�]fYZd]k�l`]�f]logjc�Y\eafakljYlgj�lg�eYc]�[gf^a_mjYlagf�[`Yf_]k�ima[cdq$�]Ykadq$�Yf\�oal`�eafaeYd�aehY[l�lg�l`]�gj_YfarYlagfÌk�f]logjc&

A Well-Conceived Security Policy9�f]logjc�k][mjalq�kqkl]e�ak�gfdq�Yk�_gg\�Yk�l`]�k][mjalq�hgda[q�Z]`af\�al&�9�o]dd%hdYff]\�k][mjalq�hgda[q�[dgk]dq�]pYeaf]k�[gfl]fl�k]fl�naY�hjglg[gdk�l`Yl�[Yf�`a\]�gl`]j$�hgl]flaYddq�\]kljm[lan]�[gfl]fl�lqh]k&�Al�kh][a^a]k�o`a[`�gj_YfarYlagf�[gehml]jk�[Yf�[geemfa[Yl]�oal`�l`]�gmlka\]�Yf\�af�o`a[`�oYqk&�Al�]ehdgqk�]f[jqhlagf�o`]j]�[geemfa[Ylagf�daf]k�[gmd\�Z]�afl]j[]hl]\$�Yf\�Yml`]fla[Ylagf�o`]j%]n]j�Y�^Yc]\�mk]j�a\]flalq�[gmd\�`Yn]�\]kljm[lan]�j]kmdlk&�9f\�l`]�o]dd%[gf[]an]\�k][mjalq�hgda[q�`Yk�fg�É`gd]kÊ�af�l`]�^aj]oYdd$�bmkl�Yml`gjar]\�hYkkY_]k&�9�`gd]�ak�Yfq�jgml]�aflg�qgmj�gj_YfarYlagf�f]lgjc�l`Yl�Yddgok�]Ykq�gj�mfYml`gjar]\�]fljq&

Physically Secured Security Appliance>afYddq$�Y�^aj]oYdd�ak�gfdq�Yk�_gg\�Yk�alk�h`qka[Yd�k][mjalq&�9dd�l`]�]f[jqhlagf�Yf\�Yml`]fla[Ylagf�af�l`]�ogjd\�ak�g^�fg�mk]�a^�Yf�mfYm%l`gjar]\�h]jkgf�[Yf�kaehdq�oYdc�mh�lg�qgmj�^aj]Zgp�YhhdaYf[]�gj�

14 WatchGuard Internet Security Handbook

The WatchGuard Solution

eYfY_]e]fl�klYlagf�Yf\�\gofdgY\�[jala[Yd�A<�^ad]k$�AH�Y\\j]kk]k$�hgjl�Ykka_fe]flk$�gj�kaehdq�mfhdm_�gj�h`qka[Yddq�`Yje�l`]�mfal&�9�^aj]oYdd�YhhdaYf[]Ìk�h`qka[Yd�k][mjalq�k`gmd\�Z]�YfYdg_gmk�lg�l`]�f]l%ogjc�k][mjalq�al�hjgna\]k2�l`]j]�k`gmd\�Z]�fg�Yml`gjar]\�Y[[]kk$�Yf\�al�k`gmd\�fgl�Z]�YnYadYZd]�lg�Yfqgf]�gl`]j�l`Yf�alk�Y\eafakljYlgj k!�Yf\�Yml`gjar]\�kmZklalml]k&�L`]�^aj]oYdd�YhhdaYf[]�k`gmd\�Z]�h`qka%[Yddq�dg[c]\�YoYq�^jge�qgmj�gj_YfarYlagf�Yl�dYj_]&

The WatchGuard Solution

OYl[`?mYj\�L][`fgdg_a]kÌ�YhhjgY[`�lg�jgZmkl�f]logjc�k][mjalq�ak�l`]�af]ph]fkan]$�]Ykadq�\]hdgqYZd]$�klYf\Ydgf]�\]na[]�cfgof�Yk�Y�ÉF]logjc�K][mjalq�9hhdaYf[]$Ê�l`]�OYl[`?mYj\�>aj]Zgp&

Assumptions Af�klYf\Yj\�k][mjalq�hjY[la[]k$�l`]�^ajkl�kl]h�lg�k][mjaf_�l`]�o`gd]�]fl]jhjak]�ak�Y�h]jae]l]j�\]^]fk]&�9�\]^]fk]�g^�l`]�h]jae]l]j�Ykkme]k�l`Yl�l`]�h]ghd]�gf�l`]�afka\]�Yj]�lg�Z]�ljmkl]\$�o`ad]�l`gk]�gf�l`]�gmlka\]�Yj]�fgl�lg�Z]�ljmkl]\�af�Yfq�ka_fa^a[Yfl�oYq&�L`]�gml]j�h]jae]l]j�ak�`Yj\]f]\$�d]Ynaf_�gfdq�gf]�_Yl]oYq�[YhYZd]�g^�hYkkaf_�ljY^^a[&�L`ak�_Yl]oYq�ak�l`]f�hdY[]\�af�Y�hgkalagf�g^�_jYflaf_�gj�\]fq%af_�Y[[]kk�lg�l`]�]flaj]�f]logjc&�

>gj�ljY^^a[�l`Yl�gja_afYl]k�^jge��gmlka\]�l`]�h]jae]l]j$�l`]�h]jae]l]j�\]^]fk]�[`Ydd]f_]k�l`]�ljY^^a[�Yf\�Yf\�Yhhda]k�Y�k]l�g^�jmd]k� \]jan]\�^jge�l`]�k][mjalq�hgda[q!�lg�\]l]jeaf]�o`]l`]j�al�oadd�h]jeal�l`]�ljY^%^a[�lg�[ge]�afka\]&�

9�h]jae]l]j�\]^]fk]�eYc]k�l`]k]�Ykkmehlagfk2

� L`]�`gklk�Yf\�afka\]�mk]jk�[Yf�Z]�ljmkl]\&�� L`]�h`qka[Yd�k][mjalq�g^�l`]�afklYddYlagf�ak�Y\]imYl]&��Fg�mfYml`g%

jar]\�h]jkgfk�Yj]�Yddgo]\�lg�Y[[]kk�l`]�Y[lmYd�k][mjalq�kqkl]e&�� L`]�eYfY_]e]fl�klYlagf�ak�k][mj]�^jge�h`qka[Yd�lYeh]jaf_&��Fg�

mfYml`gjar]\�h]jkgfk�Yj]�Yddgo]\�lg�Y[[]kk�l`]�eYfY_]e]fl�ogjcklYlagf&

� F]logjc�ljY^^a[�`Yk�gfdq�gf]�oYq�af�Yf\�gfdq�gf]�oYq�gml&�

?an]f�l`]k]�[gf\alagfk$�Y�h]jae]l]j�\]^]fk]�j]eYafk�k][mj]�Yk�dgf_�Yk�l`]�f]logjc�k][mjalq�kqkl]e�ak�hjgh]jdq�[gf^a_mj]\�Yf\�^mf[lagf%af_&�

Qgm�emkl�YdoYqk�Z]�na_adYfl�gn]j�l`]�^ajkl�Ykkmehlagf$�l`Yl�l`]�h]g%hd]�gf�l`]�afka\]�[Yf�Z]�ljmkl]\&�A^�Y�kqkl]e�oal`�Y�h]jae]l]j�\]^]fk]�ak�km[[]kk^mddq�YllY[c]\$�al�ak�egj]�dac]dq�lg�Z]�Zjgm_`l�\gof�^jge�l`]�afka\]&�L`]j]^gj]$�Yf�]^^][lan]�k][mjalq�kqkl]e�emkl�Ydkg�Z]�YZd]�lg�egfalgj�l`]�afka\]�Y[lanalq�Yf\�]fYZd]�Y\eafakljYlgjk�lg�oYl[`�^gj�

WatchGuard Internet Security Handbook 15

The Need for Network Security

Z]`YnagjÈoal`�gj�oal`gml�eYda[agmk�afl]flÈl`Yl�[gmd\�[gehjg%eak]�l`]�gj_YfarYlagfÌk�k][mjalq&�L`]�Dan]K][mjalq�Kqkl]e�hjgna\]k�Y�kmal]�g^�egfalgjaf_�lggdk�lg�Ya\�af�\]l][lagf�g^�km[`�Y[lanalq&

Separation of Key Security System ComponentsAf�Yfq�^aj]oYdd�afklYddYlagf$�al�ak�f][]kkYjq�lg�eYc]�kge]�ZYka[�Ykkmehlagfk�j]_Yj\af_�l`]�dYqgml�g^�l`]�nYjagmk�[gehgf]flk�

FIGURE 1. Separation of Security Components

L`]�OYl[`?mYj\�K][mjalq�Kqkl]e�`Yk�Y�\akljaZml]\�Yj[`al][lmj]2�al�afl]flagfYddq�k]hYjYl]k�l`]�dg__af_$�eYfY_]e]fl$�Yf\�ljY^^a[�\ak%[jaeafYlagf�^Y[adala]k�aflg�l`j]]�k]hYjYl]�dg_a[Yd�Yf\�h`qka[Yd�[gehg%f]flk$�l`]�dg_�`gkl$�eYfY_]e]fl�ogjcklYlagf$�Yf\�l`]�>aj]Zgp$�j]kh][lan]dq&�

K]hYjYlaf_�l`]k]�^mf[lagfk�]fkmj]k�l`Yl�l`]�>aj]Zgp�`Yk�gfdq�l`]�`Yj\oYj]�Yf\�kg^loYj]�f][]kkYjq�lg�h]j^gje�alk�^mf[lagf�g^�ljY^^a[�\ak[jaeafYlagf&�9dd�gl`]j�^]Ylmj]k�g^�Y�_]f]jYd�hmjhgk]�[gehml]jÈ\akc�\jan]$�mk]j�hjg^ad]k$�dg_af�^ad]k$�hYkkogj\�̂ ad]k$�emdlahd]�l]jeafYd�Y[[]kkÈYj]�fgl�gf�Y�>aj]Zgp&�Daealaf_�l`]�>aj]ZgpÌk�^mf[lagfYdalq�eafaear]k�l`]�]phgkmj]�lg�hgl]flaYd�l`j]Yl&�

Kaf[]�Y[[]kk�lg�Y�[gfkgd]�_]f]jYddq�_jYflk�dgo�d]n]d�Y[[]kk�lg�l`]�k]jn]j�alk]d^$�Ydd�^aj]oYdd�[gfkgd]k�k`gmd\�Z]�_mYj\]\�[dgk]dq&�Lg�Y\\j]kk�l`ak�_]f]jYd�nmdf]jYZadalq$�OYl[`?mYj\�`Yk�j]egn]\�l`]�gh]jYlaf_�kqkl]e�k`]dd�^jge�l`]�>aj]Zgp&�

Af�[Yk]�g^�Y�hgo]j�^Yadmj]$�l`]�>aj]Zgp�YmlgeYla[Yddq�j]Zgglk�Yf\�j]dgY\k�alk�[mjj]fl�[gf^a_mjYlagf�af^gjeYlagf&�Kaf[]�l`]�gh]jYlaf_�kqkl]e�ak�dgY\]\�^jge�]al`]j�Y�\akc]ll]� >ajZgp�)(')((�jmffaf_�OYl[`?mYj\�+&(�gj�]Yjda]j!�gj�^dYk`�e]egjq$�al�ak�fgl�kmZb][l�lg�\akc�[jYk`]k�gj�^ad]�kqkl]e�[gjjmhlagf�Yk�ak�l`]�[Yk]�g^�^aj]oYddk�jmffaf_�gf�_]f]jYd�hmjhgk]�[gehml]jk�oal`�_]f]jYd�hmjhgk]�gh]jYlaf_�kqk%l]ek&�

SD

A l low ed D en ied

E X TE R NA L

T R US T ED

O PT IO NA L

D IS A R M E DAR M E D

PO W E R

F I R E W A L L N E T W O R K

F I R E B O X

ManagementWorkstation

Logging Server

Windows 95Windows NTLinux

Nativeapplications

Windows 95Windows NTUnix Syslog

NotificationEngine

16 WatchGuard Internet Security Handbook

The WatchGuard Solution

Af�l`]�OYl[`?mYj\�k][mjalq�eg\]d$�Y[lanalq�dg_k�Yf\�^aj]oYdd�[gf^a_%mjYlagf�^ad]k�Yj]�klgj]\�gf�gf]�gj�egj]�gl`]j�[gehml]jk$�fgl�gf�l`]�^aj]oYdd�YhhdaYf[]�alk]d^&�9^l]j�Ydd$�l`]�\]na[]�l`Yl�Zdg[ck�mfYml`g%jar]\�ljY^^a[�k`gmd\�fgl�[gflYaf�l`]�c]qk�lg�alk�gof�mf\gaf_���L`]�eYfY_]e]fl�`gkl�Yf\�dg__af_�`gkl k!�[Yf�Z]�[gf^a_mj]\�^gj�Ymlg%eYla[�ZY[cmhk�Yf\'gj�Z]�]imahh]\�oal`�eajjgj]\�\akck�lg�]fkmj]�[Yhlmj]�g^�aehgjlYfl�k][mjalq�af^gjeYlagf&�9dd�[geemfa[Ylagfk�Z]lo]]f�l`]�>aj]Zgp�Yf\�l`]k]�]d]e]flk�Yj]�]f[jqhl]\&��

Kaf[]�l`]�eYfY_]e]fl�ogjcklYlagf�[gflYafk�l`]�[gf^a_mjYlagfÌk�klgj]\�^ad]k�Yf\�\YlY�j]_Yj\af_�l`]�_]f]jYd�ljY^^a[�hYll]jfk�g^�l`]�f]l%ogjc�gf�l`]�dg_�`gkl$�qgm�emkl�h`qka[Yddq�k][mj]�l`ak�kqkl]e�^jge�l`]�j]kl�g^�qgmj�gj_YfarYlagf&��Af�kge]�[Yk]k�al�eYq�fgl�]n]f�Z]�^]Yka%Zd]�lg�c]]h�l`]�eYfY_]e]fl�ogjcklYlagf�gf�l`]�hj]eak]k�Yl�Ydd&�L`]�>aj]Zgp�ak�\]ka_f]\�lg�Y[[geeg\Yl]�k][mj]�j]egl]�eYfY_]e]fl&�Qgm�[Yf�Y\eafakl]j�al�^jge�Y�j]egl]�eYfY_]e]fl�ogjcklYlagf�naY�Yf�]f[jqhl]\�dafc&�Al�Ydkg�mk]k�Yf�]f[jqhl]\�dafc�lg�ojal]�]n]flk�lg�l`]�dg__af_�`gkl&�

H`qka[Yddq�k]hYjYlaf_�l`]�eYfY_]e]fl�ogjcklYlagf�Yf\�dg__af_�`gkl�^jge�l`]�f]logjc�k][mjalq�YhhdaYf[]�]f`Yf[]k�h`qka[Yd�Yf\�\YlY�k][mjalq&�A^�l`]�eYfY_]e]fl�ogjcklYlagf�ak�af�Yf�gh]jYlagf�[]fl]j�l`Yl�ak�k][mj]\�Y_Yafkl�Y�h`qka[Yd�Zj]Y[`�g^�k][mjalq$�l`]�]f[jqhl]\�[`Yff]d�̂ gj��eYfY_]e]fl�Yf\�dg__af_�̂ mf[lagfk�]fkmj]k�l`Yl�l`]�dg_k�Yf\�[gf^a_mjYlagf�^ad]k�Yj]�kY^]�j]_Yj\d]kk�g^�l`]�d]n]d�g^�ljmkl�hdY[]\�af�l`]�afl]jn]faf_�f]logjck&�

Ease of Use Begets Secure Use9f�]Yka]j%lg%mk]�kqkl]e�oadd�Z]�mk]\�egj]�̂ j]im]fldq�Yf\�oal`�̂ ]o]j�gh]jYlagfYd�]jjgjk�l`Yf�Y�[gehda[Yl]\�gf]&�L`]�ZYka[�hjaf[ahd]k�g^�hjgl][laf_�Y�f]logjc�^jge�gmlka\]�afl]j^]j]f[]�Yj]�fgl�\a^^a[mdl�lg�mf\]jklYf\&�:Yka[Yddq$�qgm�k]_j]_Yl]�Ydd�f]logjc�ljY^^a[�aflg�log�_jgmhk3�l`Yl�o`a[`�ak�Yddgo]\�lg�hYkk�mf\]j�[gfljgdd]\�[aj[me%klYf[]k� cfgof�kY^]�[gfl]fl!$�Yf\�l`Yl�o`a[`�ak�fgl� cfgof�Yk�mfkY^]$�gj�mfcfgof�[gfl]fl!&�Hmllaf_�l`ak�kaehd]�hjaf[ahd]�aflg�Y�j]daYZd]�hjg\m[l�ak�af\]]\�Yf�afngdn]\�hjg[]kk$�Zml�alk�mk]�Yf\�Y\eafakljYlagf�[Yf�kladd�Z]�j]dYlan]dq�kaehd]&�

L`]k]�^mf\Ye]flYdk�\jan]�l`]�OYl[`?mYj\�L][`fgdg_a]k�YhhdaYf[]�[gf[]hl2�Y�\]na[]�l`Yl�ak�kaehd]�lg�mk]$�k][mj]�af�l]jek�g^�\]ka_f�Yf\�]p][mlagf$�Yk�^Ykl�Yk�[Yf�Z]�oal`gml�kY[ja^a[af_�kY^]lq$�Yf\�j]daYZd]�gn]j�l`]�dgf_�jmf&�:q�[gf\]fkaf_�l`]�f]logjc�k][mjalq�kqkl]e�lg�Yf�YhhdaYf[]$�l`]�f]logjc�Y\eafakljYlgj�ak�hj]k]fl]\�oal`�Y�\]na[]�l`Yl2�

� =paklk�Yf\�ogjck�^gj�gf]�kaehd]�hmjhgk]3�oal`�^]o]j�lYkck�Z]af_�h]j^gje]\$�l`]j]�ak�d]kk�lg�_g�ojgf_�Yf\�^]o]j�nmdf]jYZadala]k�lg�YllY[c

� @Yk�fg�[gehd]p�mf\]jdqaf_�gh]jYlaf_�kqkl]e�oal`�l`]�Ykkg[aYl]\�nmdf]jYZadala]k�lg�YllY[c�Yf\�^Yadmj]

WatchGuard Internet Security Handbook 17

The Need for Network Security

� Ak�d]kk�]ph]fkan]�l`Yf�Y�k]jn]j%ZYk]\�kgdmlagf� @Yk�Y�`a_`�d]n]d�g^�l`jgm_`hml�o`ad]�h]j^gjeaf_�hjgpq%ZYk]\�

[gfl]fl�afkh][lagf�af�[jalaYd�Yj]Yk&� @Yk�fg�egnaf_�hYjlk�lg�o]Yj�gml�gl`]j�l`Yf�l`]�\akc]ll]�\jan]�af�

l`]�>:%)((�Yf\�l`]�[ggdaf_�^Yfk&��

Open Code Base9fq�eYfm^Y[lmj]j�g^�k][mjalq�\]na[]k�emkl�j]kgdn]�l`]�^mf\Ye]flYd�ljY\]g^^�Z]lo]]f�hjghja]lYjq�Yf\�hmZda[�af^jYkljm[lmj]�^gj�l`]�\]na[]Ìk�mf\]jdqaf_�gh]jYlaf_�kqkl]e&��L`]�_j]Yl]kl�Y\nYflY_]�g^�mkaf_�Y�hjghja]lYjq�gh]jYlaf_�kqkl]e�ak�[gfljgd�g^�l`]�kgmj[]�[g\]&�9dl`gm_`�hjghja]lYjq�gh]jYlaf_�kqkl]ek�eYq�k]]e�egj]�k][mj]$�Y�hjghja]lYjq�kqkl]e�Ydkg�hdY[]k�Y�c]q�[gehgf]fl�g^�l`]�f]logjcÌk�gn]jYdd�k][mjalq�af�l`]�`Yf\k�g^�Y�daeal]\�_jgmh�g^�gh]jYlaf_�kqkl]e�hjg_jYee]jk&��Oal`�l`]�jakaf_�^j]im]f[q�g^�hmZdak`]\�Zm_�j]hgjlk�j]_Yj\af_�o]dd�cfgof�gh]jYlaf_�kqkl]ek�km[`�Yk�Ea[jgkg^l�FL�Yf\�Kmf�KgdYjak$�Y�k][mjalq�\]na[]�eYfm^Y[lmj]�eYq�fgl�Z]�[gf^a\]fl�l`Yl�l`]�n]f\gjk�g^�hjghja]lYjq�gh]jYlaf_�kqkl]ek�hmZdak`�lae]dq�Yf\�Y[[mjYl]�Zm_�^ap]k�^gj�l`]aj�gh]jYlaf_�kqkl]ek&�L`ak�eYq�[j]Yl]�Yf�mff][]kkYjq�]d]e]fl�g^�jakc&

�HmZda[�k[jmlafq�g^�Yf�gh]jYlaf_�kqkl]e$�gf�l`]�gl`]j�`Yf\$�ljY\]k�[gfljgd�g^�l`]�kgmj[]�[g\]�^gj�l`]�hgo]j^md�Ym\al�Yf\�\]n]dghe]fl�[YhYZadalq�g^�gh]jYlaf_�kqkl]e�]ph]jlk�ogjd\�oa\]&�L`]�nYdm]�g^�l`]�hggd�g^�lYd]fl�Yf\�[geeale]fl�j]hj]k]fl]\�Zq�l`ak�_jgmh�g^�h]ghd]�^Yj�]p[]]\k�l`]�nYdm]�g^�Yfq�Y\nYflY_]�af�[gfljgd�l`Yl�af%`gmk]�\]n]dghe]fl�eYq�]fbgq&

L`]�OYl[`?mYj\�L][`fgdg_a]k�K][mjalq�Kqkl]e�ak�ZYk]\�gf�l`]�̂ j]]dq�YnYadYZd]�Dafmp�gh]jYlaf_�kqkl]e&��Fgl�gfdq�`Yk�l`]�gh]jYlaf_�kqk%l]e�alk]d^�oal`klgg\�l`]�`a_`]kl�d]n]dk�g^�hmZda[�k[jmlafq�oal`�j]_Yj\k�lg�alk�^mf\Ye]flYd�\]ka_f$�Zml�l`]�af]nalYZd]�Zm_�^ap]k�l`Yl�Yfq�f]logjc�gh]jYlaf_�kqkl]e�oadd�j]imaj]�gn]j�lae]�`Yn]�`aklgja%[Yddq�Z]]f�YnYadYZd]�^Yj�^Ykl]j�l`Yf�l`gk]�g^�l`]�[gee]j[aYd�gh]jYlaf_�kqkl]e�n]f\gjk&

OYl[`?mYj\Ìk�\]ka_f�hjg[]kk�j]d]Yk]k�Ydd�eg\a^a[Ylagfk�lg�l`]�gh]j%Ylaf_�kqkl]e�c]jf]d�ZY[c�aflg�l`]�hmZda[�\geYaf&�L`ak�hjg[]kk�]fYZd]k�l`]�Dafmp�\]n]dghe]fl�[geemfalq�lg�k[jmlafar]�l`]�[`Yf_]k�o]�`Yn]�eY\]�lg�]fkmj]�l`Yl�l`]�eg\a^a[Ylagfk�Yj]�klYZd]�Yf\�j]da%YZd]&��L`]�Dan]K][mjalq�Kqkl]e�kg^loYj]�[g\]�l`Yl�jmfk�gf�l`]�eg\a%^a]\�c]jf]d�j]eYafk�hjghja]lYjq�lg�OYl[`?mYj\�L][`fgdg_a]k&��L`ak�\]ka_f�YhhjgY[`�Yddgok�OYl[`?mYj\�lg�\]hdgq�Y�k][mj]�YhhdaYf[]�gn]j�Yf�Y__j]kkan]dq�\]Zm__]\�gh]jYlaf_�kqkl]e�Yl�Y�^jY[lagf�g^�l`]�lglYd�[gkl�g^�gl`]j�f]logjc�k][mjalq�YhhjgY[`]k&�

Mkaf_�l`]�Dafmp�c]jf]d�Ydkg�e]Yfk�l`Yl�Ydd�Zm_�^ap]k�j]kmdlaf_�^jge�Y�hj]nagmkdq�mfcfgof�nmdf]jYZadalq�af�l`]�mf\]jdqaf_�gh]jYlaf_�kqk%

18 WatchGuard Internet Security Handbook

The WatchGuard Solution

l]e�Yj]�eY\]�YnYadYZd]�lg�l`]�]f\�mk]j�\aj][ldq�^jge�OYl[`?mYj\&��9k�Y�OYl[`?mYj\�[mklge]j$�qgm�oadd�f]n]j�Z]�lgd\�l`Yl�Yfq�Zm_�ak�klja[ldq�Yf�gh]jYlaf_�kqkl]e�Zm_�Yf\�l`Yl�qgm�k`gmd\�[gflY[l�l`]�gh]jYlaf_�kqkl]e�n]f\gj�^gj�l`]�hYl[`&��O]�k]jna[]�o`Yl�o]�k]dd$�ja_`l�\gof�lg�alk�gh]jYlaf_�kqkl]e&�

To Proxy or To Packet Filter?9dd�^aj]oYddk�[Yf�Z]�dggk]dq�_jgmh]\�aflg�log�[Yl]_gja]k$�l`gk]�l`Yl�j]dq�hjaeYjadq�gf�hjgpqaf_�l`]�ljY^^a[�Yf\�l`gk]�l`Yl�j]dq�hjaeYjadq�gf�^adl]jaf_�l`]�ljY^^a[&��=Y[`�e]l`g\�`Yk�alk�Y\nYflY_]k�Yf\�\akY\%nYflY_]k&�>gj�OYl[`?mYj\�L][`fgdg_a]k�l`]�akkm]k�[ge]�\gof�lg�log�[gfka\]jYlagfk$�kh]]\�Yf\�k][mjalq&�

HY[c]l�^adl]jaf_�^aj]oYddk�`Yn]�gf]�l`af_�af�[geegf2�l`]q�Yj]�^Ykl&��L`ak�ak�Z][Ymk]�l`]q�\g�[gehYjYlan]dq�d]kk�ogjc$�o`a[`�jYak]k�l`]�akkm]2�9j]�l`]q�\gaf_�]fgm_`�ogjc�lg�k][mj]�l`]�f]logjc7�Gf�l`]�gl`]j�`Yf\$�bmkl�Z][Ymk]�hjgpq%ZYk]\�^aj]oYddk�Yj]�\gaf_�egj]�ogjc�l`Yf�l`]�hY[c]l�^adl]jk�\g]k�fgl�f][]kkYjadq�eYc]�l`]e�egj]�k][mj]&�Hjgpa]k�jYak]�l`]�akkm]2�9j]�l`]q�\gaf_�egj]�ogjc�l`Yf�f][]kkYjq$�Yf\�ak�l`]�ogjc�l`]q�Yj]�\gaf_�l`]�ja_`l�ogjc7

The WatchGuard Answer: Both in ModerationL`]�OYl[`?mYj\�K][mjalq�Kqkl]e�]ehdgqk�Y�[geZafYlagf�g^�hjgpq�Yf\�hY[c]l�^adl]jaf_�l][`fgdg_a]k&��<gaf_�lgg�em[`�[Yf�Z]�Yk�ZY\�Yk�\gaf_�lgg�dalld]&�Kaf[]�`Ynaf_�Zgl`�lglYd�k][mjalq�Yf\�lglYd�^mf[lagfYd%alq�ak�aehgkkaZd]$�Yfq�kgdmlagf�ak�Y�ljY\]%g^^&�9ddgoaf_�Y�kh][a^a[�k]j%na[]�l`jgm_`�l`]�k][mjalq�kqkl]e�eYq�Z]�lgg�afk][mj]�^gj�Yf�gj_YfarYlagf�k�hmZda[�Afl]jf]l�Y[[]kk$�Zml�Y[[]hlYZd]�^gj�AfljYf]l�mk]&�Gj�Yddgoaf_�Y�_an]f�k]jna[]�eYq�Z]�\]]e]\�lgg�afk][mj]$�lgg�af]^^a%[a]fl$�gj�fgl�oa\]dq�mk]\�]fgm_`�lg�aehd]e]fl�Yl�Ydd&�OYl[`?mYj\�`Yk�]pYeaf]\�]Y[`�k]jna[]�lg�\][a\]�`go�Z]kl�lg�[gfljgd�alk�Y[[]kk�lg�l`]�hjgl][l]\�f]logjc&�

Kg$�^gj�Y�_an]f�k]jna[]$�o`]j]�o]�[Yf�Y\\�nYdm]�Zq�]ehdgqaf_�Y�hjgpq� Yk�oal`�kelh$�^lh$�gj�̀ llh�o`]j]�nmdf]jYZadala]k�Yj]�n]jq�̀ a_`!$�o]�\g�kg&�O`]j]�al�\g]kfÌl�eYc]�k]fk]�oal`af�l`]�[gfl]pl�g^�Y�k]jna[]�lg�mk]�Y�hjgpq$�o]�\gfÌl&��L`mk�o]�Yddgo�Ydd�ljY^^a[�lg�hYkk�gj�Z]�\]fa]\�hYkkY_]�af�l`]�oYq�l`Yl�ak�Z]kl�kmal]\�^gj�l`]�ljY^^a[�lqh]&��>gj�]pYehd]$�kk`�ea_`l�̀ Yn]�Y�oa\]�k]d][lagf�g^�kgmj[]k�Yf\�\]klafYlagfk�Z][Ymk]�l`]�k]jna[]�`Yk�Zmadl%af�Yml`]fla[Ylagf&

Integrating Security Technologies into a Stand Alone ApplianceE]j]dq�eYfY_af_�l`]�\YlY�klj]Ye�oadd�fgl�YllYaf�ljm]�f]logjc�k][m%jalq$�Z][Ymk]�l`]�f]logjc]\�]fnajgfe]fl�af[dm\]k�Zgl`�eY[`af]k�Yf\�l`]�h]ghd]�o`g�mk]�l`]e&��F]logjc�k][mjalq�emkl�afngdn]�l`]�h]ghd]�l`Yl�mk]�l`]�f]logjc$�`go�l`]q�Y[[]kk�al$�Yf\�o`Yl�l`]q�\g�oal`�l`]�j]kgmj[]k�gf�al&�L`]�OYl[`?mYj\�K][mjalq�Kqkl]e�afl]_jYl]k�

WatchGuard Internet Security Handbook 19

The Need for Network Security

l`]�eY[`af]�Yf\�`meYf�^Y[lgjk�g^�f]logjc�k][mjalq�Zq�afl]_jYlaf_�l`j]]�klYf\Ydgf]�[gehgf]flk�aflg�l`]�^aj]oYdd�YhhdaYf[]2

User Authentication Lg�eYfY_]�mk]j�Y[[]kk�lg�Afl]jf]l�j]kgmj[]k�af�l`]�\akljaZml]\�f]logjc�]fnajgfe]fl$�l`]�OYl[`?mYj\�L][`fgdg_a]k�K][mjalq�Kqkl]e�kmhhgjlk�mk]j�Yml`]fla[Ylagf�naY�Yf�FL�<geYaf�;gfljgdd]j$�Y�JY\amk�k]jn]j$�gj�l`]�OYl[`?mYj\�L][`fgdg_a]k�K][mjalq�Kqkl]eÌk�gof�Yml`]fla[Ylagf&�Mk]jk�[Yf�Z]�j]imaj]\�lg�Yml`]fla[Yl]�lg�gf]�g^�l`]k]�kqkl]ek�Z]^gj]�Y[[]kkaf_�Yfq�Afl]jf]l�j]kgmj[]k&�9ml`]fla[Ylagf�]fYZd]k�qgm�lg�eYfY_]$�ljY[c$�Yf\�Ym\a�mk]jkÌ�Y[[]kk�lg�[gjhgjYl]�Afl]jf]l�j]kgmj[]k�oal`�_j]Yl�Y[[m%jY[q&�L`ak�hjgna\]k�nYdmYZd]�hdYffaf_�Yf\�j]kgmj[]�eYfY_]e]fl�\YlY�lg�Ykkakl�af�akgdYlaf_�Yj]Yk�g^�_]f]jYd�afl]j]kl$�lj]f\k$�oYkl]$�^jYm\$�Yf\�YZmk]&

Content ManagementHYll]jfk�af�`meYf�j]kgmj[]�j]_mdYlagfk$�hdmk�l`]�[gkl�lg�Yf�gj_YfarYlagf�j]_Yj\af_�Afl]jf]l�YZmk]�eYc]�al�f][]kkYjq�lg�[gfljgd�l`]�lqh]�g^�[gfl]fl�YnYadYZd]�lg�l`]�[gjhgjYl]�Afl]jf]l�mk]j&�OYl[`?mYj\�L][`fgdg_a]k�`Yk�afl]_jYl]\�l`]�;qZ]j?mYj\�É;qZ]jFGLÊ�dakl�aflg�l`]�OYl[`?mYj\�K][m%jalq�Kqkl]e&��J]ka\af_�gf�l`]�dg_�k]jn]j$�l`ak�af\mkljq%d]Y\af_�\YlYZYk]�g^�Afl]jf]l�kal]k�Yddgok�l`]�Y\eafakljYlgj�lg�_jYfl�gj�\]fq�Y[[]kk�lg��[gf%l]fl�Zq�lqh]$�hjanad]_]�d]n]d$�Yf\�lae]�g^�\Yq&�

Virtual private networkingNajlmYd�hjanYl]�f]logjc�l][`fgdg_q�]fYZd]k�Yf�gj_YfarYlagf�lg�j]hdY[]�d]Yk]\�l]d]h`gf]�daf]k�oal`�em[`�d]kk�[gkldq�mk]�g^�Yf�]f[jqhl]\�[`Yff]d� Y�lmff]d!�gf�l`]�Afl]jf]l&��L`ak�eYc]k�j]egl]k�kal]k�Y[[]kkaZd]�l`Yl�o]j]�hj]nagmkdq�lgg�]ph]fkan]�lg�[gff][l�lg&�L`]�OYl[`?mYj\�Dan]K][mjalq�Kqkl]e�fgl�gfdq�hjgna\]k�l`ak�f]logjc%lg%f]logjc�NHF�[YhYZadalq$�Zml�Ydkg�]fYZd]k�l`]�Y\eafakljYlgj�lg�Yhhdq�Yf�YjZaljYjq�k][mjalq�hgda[q�lg�l`Yl�NHF�k]_e]fl�Yk�l`gm_`�al�o]j]�\aj][ldq�YllY[`]\�lg�Y�h`qka[Yd�afl]j%^Y[]&

20 WatchGuard Internet Security Handbook

CHAPTER 2 Security and Firewall Management Policies

L`]�jmdaf_�hjaf[ahd]�Z]`af\�Y�^aj]oYdd�[gf^a_mjYlagf�ak�Yf�gj_YfarY%lagfÌk�k][mjalq�hgda[q&�Af�alk�ZjgY\]kl�gj�egkl�[gehj]`]fkan]�\]^afa%lagf$�Y�k][mjalq�hgda[q�kh]ddk�gml�]n]jq�Ykh][l�g^�`go�Yf�gj_YfarYlagf�hjgl][lk�alk�Zmad\af_k$�Ykk]lk$�af^gjeYlagf$�Yf\�h]jkgff]d�^jge�l`]^l$�nYf\Ydake$�afljmkagf$�Yf\�afnYkagf�g^�hjanY[q&�L`]k]�Ykh][lk�af[dm\]2

� H`qka[Yd�k][mjalq�g^�l`]�Zmad\af_� H`qka[Yd�k][mjalq�g^�l`]�gj_YfarYlagfÌk�Ykk]lk� K`j]\\af_�gj�\]kljgqaf_�l`]�gj_YfarYlagfÌk�ljYk`�l`Yl�[gflYafk�

k]fkalan]�af^gjeYlagf� KlY^^af_�Yf\�k[`]\mdaf_�lg�aehd]e]fl�l`]�k][mjalq�hgda[q� <YlY�Y[[]kk�_jYfl]\�lg�nYjagmk�mk]jk�Yf\�_jgmhk� J][j]YlagfYd�mk]�g^�Yf�gj_YfarYlagfÌk�^Y[adala]k� K][mjalq�d]n]d�g^�j]egl]�[geemfa[Ylagfk� 9ml`]fla[Ylagf�j]imaj]\�^gj�j]egl]�[geemfa[Ylagfk�

9dd�g^�l`]k]�^Y[lgjk�Yj]�]kk]flaYd�^gj�k]llaf_�mh�Yf�gj_YfarYlagf�oal`�Y�ogjcYZd]�ZYdYf[]�Z]lo]]f�k][mjalq�Yf\�hjg\m[lanalq&�Kge]�g^�l`]e�Yj]�Z]qgf\�l`]�k[gh]�g^�Y�f]logjc�^aj]oYdd&�9dd�g^�l`]e�lg_]l`]j�[gehjak]�Yf�gj_YfarYlagfÌk�YhhjgY[`�lg�k][mjalq$�Yf\�oadd�af^dm]f[]�`go�l`]�gj_YfarYlagf�[gf^a_mj]k�alk�^aj]oYdd&�

GZnagmkdq$�h`qka[Yd�k][mjalq�Yf\�klY^^af_�Yj]�Z]qgf\�l`]�k[gh]�g^�l`ak�\g[me]fl�Yf\�l`]�OYl[`?mYj\�hjg\m[lk&�=n]f�af�eYll]jk�g^�\YlY�Y[[]kk$�kge]�]d]e]flk�g^�l`]�k][mjalq�hgda[q�ogmd\�Z]�aehd]%e]fl]\�Zq�k]llaf_�h]jeakkagfk�d]n]dk�^gj�[gehml]jk$�\aj][lgja]k$�Yf\�^ad]k&�Gl`]j�]d]e]flk�ogmd\�Z]�Y\\j]kk]\�Zq�l`]�^aj]oYdd�YhhdaYf[]&�L`]�>aj]Zgp�[Yf�Ydkg�aehd]e]fl�hgda[a]k�gf�j][j]YlagfYd�mk]�g^�Yf�gj_YfarYlagfÌk�[gehml]jk�Yf\�f]logjck$�Yf\�Yml`]fla[Yl]�Yf\�k][mj]�j]egl]�[geemfa[Ylagfk&�L`]k]�dYll]j�]d]e]flk�Yj]�Y�^aj]oYdd�eYfY_]e]fl�hgda[q&�

WatchGuard Internet Security Handbook 21

Security and Firewall Management Policies

9�^aj]oYdd�eYfY_]e]fl�hgda[q�ak�Y�kmZk]l�g^�l`]�k][mjalq�hgda[q&�Al�kh][a^a[Yddq�Y\\j]kk]k�`go�Yf�gj_YfarYlagfÌk�f]logjc�^aj]oYdd k!�oadd�Z]�[gf^a_mj]\�lg�[gfljaZml]�lg�l`]�gn]jYdd�k][mjalq�hgda[q&

9�^aj]oYdd�eYfY_]e]fl�hgda[q�\]l]jeaf]k2

� O`a[`�`gklk�[Yf�k]f\�Yf\�j][]an]�o`a[`�caf\k�g^�ljY^^a[� O`Yl�[geemfa[Ylagf�hjglg[gdk�Yf\�[gfl]fl�lqh]k�Yj]�Yddgo]\�

l`jgm_`�l`]�^aj]oYdd� O`a[`�[geemfa[Ylagf�dafck�j]imaj]�Yml`]fla[Ylagf�Yf\'gj�

]f[jqhlagf� O`a[`�mk]jk�Yj]�Yml`gjar]\�lg�mk]�nYjagmk�k]jna[]k�l`jgm_`�l`]�

^aj]oYdd� O`Yl�lae]k�g^�\Yq�gj_YfarYlagf�e]eZ]jk�[Yf�Zjgok]�l`]�O]Z� O`Yl�lqh]k�g^�O]Z�kal]k�gj_YfarYlagf�e]eZ]jk�[Yf�nakal

Balancing Risk vs. Productivity

L`]�hmjhgk]�g^�Yfq�k][mjalq�hgda[q�ak�lg�\]l]jeaf]�l`]�ZYdYf[]�Z]lo]]f�kY^]lq�Yf\�hjg\m[lanalq&�L`]�egj]�af^gjeYlagf�Yf\�Ykk]lk�Yj]�YnYadYZd]�lg�Ydd�gj_YfarYlagf�e]eZ]jk$�l`]�ima[c]j�l`]q�[Yf�_]l�l`af_k�\gf]&�L`]�d]kk�af^gjeYlagf�Yf\�Ykk]lk�YnYadYZd]�lg�Ydd�gj_Yfa%rYlagf�e]eZ]jk$�l`]�egj]�k][mj]�l`]�af^gjeYlagf�Yf\�Ykk]lk�Yj]&

Af�f]logjc�k][mjalq$�l`]�egkl�k][mj]�[gf^a_mjYlagf�ak�fg�f]logjc�[gff][lagf�Yl�Ydd&�L`]�f]pl�egkl�k][mj]�ak�Y�\ag\]$�gj�gml_gaf_%gfdq�[gff][lagf&�L`]�l`aj\�egkl�k][mj]�ak�OYl[`?mYj\Ìk�jm\ae]flYjq�f]l%ogjc�[gf^a_mjYlagf�Yk�hjg\m[]\�Zq�l`]�Ima[cK]lmh�OarYj\&�Gf[]�qgm�gh]f�l`]�OYl[`?mYj\�Hgda[q�EYfY_]j�lg�]phYf\�Yf\�^mddq�[gf%^a_mj]�qgmj�>aj]Zgp$�]Y[`�[gf^a_mjYlagf�Y\\alagf�gj�[`Yf_]�qgm�eYc]�lg�af[j]Yk]�l`]�^dgo�g^�ljY^^a[�kaemdlYf]gmkdq�jYak]k�l`]�jakc�d]n]d�g^�qgmj�^aj]oYdd�[gf^a_mjYlagf&

L`]�im]klagfk�qgm�emkl�Ykc�qgmjk]d^�lg�Yjjan]�Yl�qgmj�ZYdYf[]�Yj]2

� O`Yl�\g�qgm�`Yn]�lg�dgk]�af�Y�f]logjc�k][mjalq�Zj]Y[`7�Qgm�[gmd\�dgk]�Y[lmYd�egf]q�af�kge]�[Yk]k$�afl]jfYd�hYkkogj\k$�gj�h]jkgfYd�af^gjeYlagf�gf�gj_YfarYlagf�e]eZ]jk&�Qgm�[gmd\�dgk]�[jala[Yd�\YlYZYk]�^ad]k&�Qgm�[gmd\�dgk]�hjg\m[lanalq�Yk�[gehml]jk�Yj]�[d]Yfk]\$�k`ml�\gof�Yf\�j]Zggl]\&�>gj�kge]�[gehYfa]k$�Y�k][m%jalq�Zj]Y[`�ea_`l�kh]dd�Y�dgkk�g^�[j]\aZadalq�Yf\�hj]kla_]�Y^^][laf_�hj]k]fl�Yf\�^mlmj]�Zmkaf]kk&�

� O`Yl�ak�l`]�hgl]flaYd�[gkl�g^�Y�kaf_d]�k][mjalq�Zj]Y[`7�>gj�]pYe%hd]$�Y�ZYfc�[gmd\�dgk]�eaddagfk�g^�\gddYjk�af�Y�kaf_d]�k][mjalq�Zj]Y[`&�9f�gfdaf]�Zggcklgj]�ea_`l�dgk]�Y�^]o�Zggck�Yf\�af^gje�Y�[mklge]j�l`Yl�l`]�[j]\al�[Yj\�fmeZ]j�mk]\�^gj�l`]�ljYfkY[lagf�oYk�[gehjgeak]\&

22 WatchGuard Internet Security Handbook

Balancing Risk vs. Productivity

� @go�dac]dq�Yj]�nYjagmk�lqh]k�g^�Zj]Y[`]k�lg�g[[mj7�Kge]�lqh]k�g^�k]jn]jk�Yj]�mf\]j�[gfklYfl�YllY[c&�>afYf[aYd�afklalmlagfk�Yj]�mf\]j�YllY[c�^gj�[j]\al�Yf\�Y[[gmfl�af^gjeYlagf&�?gn]jfe]fl�Y_]f[a]k�Yf\�f]logjc�k][mjalq�Y_]f[a]k�Yj]�mf\]j�[gfklYfl�YllY[c�lg�^]]\�l`]�`Y[c]jÌk�]_g�gj�lg�]phj]kk�jY_]�Yl�[gfljgddaf_�gj_YfarYlagfk&�Qgm�`Yn]�lg�\]l]jeaf]�`go�g^l]f�qgm�Yj]�mf\]j�YllY[c$�Yf\�`go�dac]dq�qgm�ogmd\�kmklYaf�Yf�YllY[c�l`Yl�[gmd\�Z]�n]jq�]ph]fkan]&

L`]�Yfko]jk�lg�l`]k]�im]klagfk�k`gmd\�`]dh�qgm�Yjjan]�Yl�qgmj�ZYd%Yf[]�g^�k][mjalq�nk&�hjg\m[lanalq&�>gj�]pYehd]$�kaf[]�^afYf[aYd�afklalm%lagfk�Yj]�Yf�gZnagmk�lYj_]l�Yf\�Y�km[[]kk^md�YllY[c�[gmd\�j]kmdl�af�Za_�dgkk]k$�k][mjalq�emkl�lYc]�hj][]\]fl�gn]j�l`jgm_`hml�Z][Ymk]�^Ykl�l`jgm_`hml�ak�mk]d]kk�a^�qgmj�egf]q�gj�[j]\al�[Yj\�fmeZ]jk�Yj]�klg%d]f�af�l`]�hjg[]kk&�Gf�l`]�gl`]j�`Yf\$�Y�Zmkaf]kk�oal`�Y�`a_`�Yegmfl�g^�ljY^^a[$�o`]j]�]Y[`�ljYfkY[lagf�Yegmflk�lg�Y�keYdd�Yegmfl�g^�egf]q$�ogmd\�nYdm]�l`jgm_`hml�gn]j�YZkgdml]�k][mjalq&

Incoming Services: Security PrinciplesO`]f�qgm�]fYZd]�af[geaf_�k]jna[]k$�qgm�Yj]�[j]Ylaf_�Y�[gf\mal�aflg�qgmj�gj_YfarYlagf&�Al�eYq�Z]�daeal]\�lg�Y�kaf_d]�k]jna[]�Yf\�Y�kaf_d]�hgjl$�Zml�al�ak�Y�[gf\mal�fgf]l`]d]kk&�>gddgoaf_�Yj]�kge]�jmd]k�g^�l`meZ�lg�Ykk]kk�qgmj�k][mjalq�jakck�Yk�qgm�Y\\�af[geaf_�k]jna[]k�lg�qgmj�>aj]Zgp�[gf^a_mjYlagf2

� Qgm�Yj]�YdoYqk�d]kk�k][mj]�l`Yf�l`]�d]Ykl�k][mj]�k]jna[]�qgm�Yddgo�aflg�qgmj�f]logjc&�Qgm�dgk]�k][mjalq�[memdYlan]dq�Yk�qgm�]fYZd]�af[geaf_�k]jna[]k&

� K]jna[]k�qgm�\gfÌl�mf\]jklYf\�n]jq�o]dd�k`gmd\�Z]�[gfka\]j]\�mfljmklogjl`q&�Mfcfgof�jakck�Yj]�YdoYqk�_j]Yl]j�l`Yf�cfgof�gf]k&

� K]jna[]k�oal`�fg�Zmadl%af�Yml`]fla[Ylagf� egkl�JH;�k]jna[]k!�Yf\�l`gk]�l`Yl�o]j]�fgl�\]ka_f]\�lg�Z]�mk]\�af�Yf�Afl]jf]l�Yj]�jakcq&

� K]jna[]k�l`Yl�k]f\�hYkkogj\k�af�l`]�[d]Yj� >LH$�l]df]l$�HGH!�Yj]�n]jq�jakcq&�EYfq�mk]jk�mk]�l`]�kYe]�hYkkogj\�o`]j]n]j�hjgehl]\�^gj�gf]&�9�hY[c]l�kfa^^]j�afl]j[]hlaf_�Yf�>LH$�l]df]l$�gj�HGH�ljYfkY[lagf�[gmd\�afl]j[]hl�Y�[d]Yj�l]pl�hYkkogj\�l`Yl�ogmd\�hjgna\]�Y[[]kk�l`jgm_`gml�qgmj�gj_YfarYlagf&

� K]jna[]k�oal`�Zmadl%af�kljgf_�Yml`]fla[Ylagf� ^gj�]pYehd]$�kk`!�Yj]�j]YkgfYZdq�kY^]&

� K]jna[]k�km[`�Yk�<FK$�KELH$�Yfgfqegmk�>LH$�Yf\�@LLH�Yj]�hj]llq�kY^]�gfdq�a^�l`]q�Yj]�mk]\�af�[gfn]flagfYd�oYqk&�

� 9ddgoaf_�Y�k]jna[]�lg�Y[[]kk�gfdq�Y�kaf_d]�afl]jfYd�`gkl�ak�kY^]j�l`Yf�Yddgoaf_�l`]�k]jna[]�lg�k]n]jYd�gj�Ydd�`gklk&

� 9ddgoaf_�Y�k]jna[]�lg�l`]�GhlagfYd�f]logjc�ak�kY^]j�l`Yf�Yddgoaf_�al�lg�l`]�Ljmkl]\�f]logjc�Z][Ymk]�qgm�Yj]�Yddgoaf_�ljY^^a[�lg�qgmj�Éf]mljYd�rgf]Ê�jYl`]j�l`Yf�qgmj�hjanYl]�f]logjc$�Yf\�l`]�>aj]Zgp�^adl]jk�ljY^^a[�Z]lo]]f�l`]�GhlagfYd�Yf\�Ljmkl]\�f]logjck&�

WatchGuard Internet Security Handbook 23

Security and Firewall Management Policies

� 9ddgoaf_�Y�k]jna[]�^jge�Y�j]klja[l]\�k]l�g^�`gklk�ak�kge]o`Yl�kY^]j�l`Yf�Yddgoaf_�l`]�k]jna[]�^jge�Yfqo`]j]&�Al�ak�kY^]j�q]l�a^�qgm�Yddgo�Y�k]jna[]�gfdq�lg�Y�j]klja[l]\�k]l�g^�`gklk&

� =Y[`�kY^]lq�hj][Ymlagf�qgm�gZk]jn]�af�l`ak�dakl�eYc]k�qgmj�f]l%ogjc�ka_fa^a[Yfldq�kY^]j&�>gj�]pYehd]$�^gddgoaf_�l`j]]�gj�^gmj�hj]%[Ymlagfk�ak�em[`$�em[`�kY^]j�l`Yf�^gddgoaf_�gf]�gj�fgf]&

� A^�l`]�k]jna[]�\g]kfÌl�`Yn]�Zmadl%af�Yml`]fla[Ylagf$�qgm�[Yf�eala%_Yl]�l`]�jakc�Zq�mkaf_�mk]j�Yml`]fla[Ylagf�oal`�l`Yl�k]jna[]&

� 9ddgoaf_�af[geaf_�k]jna[]k�^jge�Y�najlmYd�hjanYl]�f]logjc� NHF!$�o`]j]�l`]�gj_YfarYlagf�Yl�l`]�gl`]j�]f\�ak�cfgof�Yf\�Yml`]fla[Yl]\$�ak�_]f]jYddq�kY^]j�l`Yf�Yddgoaf_�af[geaf_�k]jna[]k�^jge�l`]�Afl]jf]l�Yl�dYj_]&�L`]�egj]�^afal]�l`]�j]egl]�f]logjc$�l`]�kY^]j&�Al�ak�kY^]j�lg�Yddgo�af[geaf_�k]jna[]k�^jge�Y�kaf_d]�`gkl�gj�keYdd�_jgmh�g^�`gklk�l`Yf�^jge�Y�dYj_]j�f]logjc&

Outgoing ServicesAf�_]f]jYd$�l`]�_j]Yl�jakck�[ge]�^jge�af[geaf_�k]jna[]k$�fgl�gml_g%af_�gf]k&�L`]j]�Yj]$�`go]n]j$�kge]�afl]j]klaf_�k][mjalq�jakck�oal`�gml_gaf_�k]jna[]k�Yk�o]dd&�>gj�]pYehd]$�o`]f�Yf�gj_YfarYlagf�e]e%Z]j�Y[[]kk]k�l`]�Afl]jf]l$�l`Yl�ak�Yf�gml_gaf_�k]jna[]$�]n]f�a^�l`]�mk]j�\gofdgY\k�^ad]k�^jge�Yf�]pl]jfYd�O]Z�k]jn]j&�FgjeYddq�l`ak�ak�j]Y%kgfYZdq�kY^]�mfd]kk�l`]�\gofdgY\�[gflYafk�Yf�]p][mlYZd]�hjg_jYe&�Fg�gf]�cfgok�o`Yl�l`Yl�hjg_jYe�oadd�\g�mflad�al�ak�Y[lanYl]\$�o`a[`�ak�lgg�dYl]�a^�l`]�hjg_jYe�ak�eYda[agmk&�9f�]pYehd]�g^�l`ak�oYk�l`]�E]dakkY�najmk�g^�)111$�o`a[`�]eZ]\\]\�Y�Ea[jgkg^l�Ogj\�]p][mlYZd]�af�Yf�]%eYad�e]kkY_]&�O`]f�l`]�mk]j�gh]f]\�l`]�Ogj\�\g[me]fl$�al�Y[lanYl]\�Y�n]jq�kaehd]�Ogj\�eY[jg�l`Yl�k]fl�[gha]k�g^�l`]�]%eYad�lg�l`]�^ajkl�*-�fYe]k�af�l`]�j][aha]flÌk�h]jkgfYd�]%eYad�Y\\j]kk�Zggc&

9k�Yfgl`]j�]pYehd]$�a^�Yf�Yddgo]\�gml_gaf_�k]jna[]�ljYfkealk�[d]Yj%l]pl�hYkkogj\k� ^gj�]pYehd]$�>LH$�l]df]l$�gj�HGH!�l`]q�eYq�Z]�l`]�kYe]�Yk�qgmj�gj_YfarYlagfÌk�afl]jfYd�hYkkogj\k�Yf\�mk]j�A<k&

Other Principles of Security vs. RiskL`]�egj]�[gehd]p�qgmj�f]logjc�[gf^a_mjYlagfk�Yj]$�l`]�jakca]j�l`]q�Yj]&�L`]�dYj_]j�Yf\�egj]�Y[[]kkaZd]�l`]�Ljmkl]\�f]logjc�ak$�l`]�_j]Yl]j�l`]�[`Yf[]�l`]j]�Yj]�hgl]flaYd�hgaflk�g^�YllY[c�Yf\�`gklad]�e]eZ]jk�gf�l`]�f]logjc&

Internal HostsL`]�egj]�afl]jfYd�`gklk�l`Yl�Yj]�Yddgo]\�Yk�\aklaf[l�\]klafYlagfk$�l`]�egj]�jakcq�l`]�[gf^a_mjYlagf&�L`ak�ak�Z][Ymk]�]Y[`�Yddgo]\�af[geaf_�k]jna[]�aehda]k�Y�[]jlYaf�Yegmfl�g^�`gkl%ZYk]\�[gf^a_mjYlagf�Yf\�egfalgjaf_�gf�l`Yl�afl]jfYd�`gkl&�9dd�gl`]j�l`af_k�Z]af_�]imYd$�qgm�Yj]�kY^]j�a^�gfdq�gf]�afl]jfYd�`gkl�ak�l`]�\]klafYlagf�^gj�Ydd�k]jna[]k�l`Yf�a^�qgm�`Yn]�gf]�`gkl�h]j�k]jna[]&

24 WatchGuard Internet Security Handbook

Balancing Risk vs. Productivity

Masquerading Private Network NumbersAl�ak�kY^]j�lg�`Yn]�hjanYl]�f]logjc�fmeZ]jk�af�qgmj�afl]jfYd�f]l%ogjc k!�eYkim]jY\]\�Zq�l`]�>aj]Zgp&�Gmlka\]�Yll]ehlk�lg�\aj][ldq�[gflY[l�hjanYl]�f]logjc�fmeZ]jk�oadd�Z]�j]b][l]\�Zq�l`]�jgml]j�Z]^gj]�l`]q�[Yf�]n]f�eYc]�al�lg�l`]�>aj]Zgp&

Automatic Rejection of Spoofing and IP OptionsKhgg^af_�ak�o`]j]�Yf�Yll]ehl]\�]fljq�mk]k�gf]�g^�qgmj�afl]jfYd�AH�Y\\j]kk]k�Yk�l`]�kgmj[]�Y\\j]kk&�L`]�a\]Y�ak�lg�^ggd�l`]�jgml]j�aflg�Él`afcaf_Ê�l`]�hY[c]l�[Ye]�^jge�oal`af�l`]�gj_YfarYlagf&�AH�ghlagfk�Yj]�Y\\alagfk�lg�l`]�klYf\Yj\�AH�`]Y\]j�o`a[`$�o`]f�mk]\�d]_ala%eYl]dq�Y\\�dalld]�^mf[lagfYdalq$�Yf\�o`]f�mk]\�oal`�eYda[]�Yj]�\Yf%_]jgmk&�Fgl�k]llaf_�qgmj�>aj]Zgp�[gf^a_mjYlagf�lg�YmlgeYla[Yddq�j]b][l�hY[c]lk�oal`�khgg^]\�Y\\j]kk]k�gj�AH�ghlagfk�af�l`]aj�`]Y\]jk�_j]Yldq�[gehjgeak]k�l`]�kY^]lq�g^�qgmj�afklYddYlagf&

Elements that Decrease Firewall Security9^l]j�qgm�[j]Yl]�Y�ZYka[�[gf^a_mjYlagf�oal`�l`]�Ima[cK]lmh�OarYj\$�qgm�oadd�]phYf\�Yf\�^mjl`]j�\]^af]�qgmj�[gf^a_mjYlagf&�=Y[`�^]Ylmj]�qgm�Y\\�gj�k]l�eYq�af[j]Yk]�l`]�af`]j]fl�jakc&�Kge]�^]Ylmj]k�af[j]Yk]�l`]�jakc�Y�dgl$�kge]�d]kk&�L`ak�k][lagf�daklk�nYjagmk�[gf^a_mjYlagf�hYjYe]l]jk�qgm�ea_`l�k]l$�Yf\�Ykkg[aYl]k�Y�dgo$�e]\ame$�gj�`a_`�jakc�^Y[lgj�oal`�l`]�Y\\alagf�g^�l`Yl�^]Ylmj]&

Additional Gateways and Hosts9\\alagfYd�_Yl]oYqk�Yj]�Y�[memdYlan]�jakc&�=Y[`�Y\\alagfYd�_Yl]oYq�qgm�Y\\�g^^�l`]�Ljmkl]\�gj�GhlagfYd�afl]j^Y[]�Y\\k�Y�dgo�jakc&�:q�l`]�lae]�qgm�Y\\]\�]a_`l�gj�egj]�_Yl]oYqk$�qgmÌn]�Y\\]\�Y�^Yajdq�`a_`�jakc&�

=Y[`�\aklaf[ldq�fYe]\�`gkl�gf�l`]�Ljmkl]\�afl]j^Y[]�Y\\k�Y�dgo�jakc�lg�YZgml�l`]�\]_j]]�l`Yl�Yf�Y\\]\�_Yl]oYq�ogmd\&�9k�oal`�Y\\]\�_Yl]oYqk$�]a_`l�gj�egj]�Y\\alagfYd�`gklk�dakl]\�gf�l`]�Ljmkl]\�afl]j%^Y[]�Y\\k�Y�^Yajdq�`a_`�jakc&�

=Y[`�\aklaf[ldq�fYe]\�`gkl�gf�l`]�GhlagfYd�afl]j^Y[]$�`go]n]j$�Y\\k�Y�n]jq�dgo�jakc$�YZgml�`Yd^�o`Yl�Yf�Y\\]\�_Yl]oYq�gj�Ljmkl]\�`gkl�ogmd\&�=n]f�]a_`l�gj�l]f�`gklk�gf�l`]�GhlagfYd�afl]j^Y[]�Y\\k�Y�^Yajdq�dgo�jakc&�

Big RisksL`]k]�jakck�Yj]�]plj]e]dq�`a_`�^gj�Y�>aj]Zgp�k]jnaf_�Yk�qgmj�^aj]oYdd�lg�l`]�Afl]jf]l&�Gn]jja\af_�l`]k]�k]llaf_k�eYq�Z]�GC�a^�qgm�Yj]�mkaf_�l`]�>aj]Zgp�lg�k]hYjYl]�log�afl]jfYd$�hjanYl]�f]logjck&

� Gn]jja\af_�l`]�k]llaf_�lg�YmlgeYla[Yddq�Zdg[c�hY[c]lk�^jge�khgg^]\�Y\\j]kk]k�ak�Y�n]jq�`a_`�jakc$�egj]�l`Yf�loa[]�Yk�`a_`�Yk�`Ynaf_�l]f�_Yl]oYqk�gf�l`]�Ljmkl]\�afl]j^Y[]&�

WatchGuard Internet Security Handbook 25

Security and Firewall Management Policies

� Gn]jja\af_�l`]�k]llaf_�lg�YmlgeYla[Yddq�Zdg[c�hY[c]lk�oal`�AH�ghlagfk�af�l`]�Y\\j]kk�ak�Y�n]jq�`a_`�jakc$�egj]�l`Yf�loa[]�Yk�`a_`�Yk�`Ynaf_�l]f�_Yl]oYqk�gf�l`]�Ljmkl]\�afl]j^Y[]&

� Ajj]khgfkaZd]�[gf^a_mjYlagfk$�km[`�Yk�[gf^a_mjaf_�l`]�É9fqÊ�k]j%na[]�lg�Yddgo�af[geaf_�ljY^^a[�^jge�9fq�]pl]jfYd�`gkl�lg�9fq�ljmkl]\�`gkl&�L`ak�j]f\]jk�qgmj�^aj]oYdd�eggl3�\gfÌl�\g�al�

Medium RisksL`]�^gddgoaf_�hjY[la[]k�Yj]�YZgml�gf]%^gmjl`�lg�gf]%`Yd^�Yk�\Yf_]j%gmk�Yk�l`]�`a_`�jakc�Y[lagfk�YZgn]2

� Mkaf_�hmZda[�AH�Y\\j]kk]k�^gj�[geml]jk�gf�l`]�Ljmkl]\�afl]j^Y[]�afkl]Y\�g^�hjanYl]�Y\\j]kk]k&�

� Fgl�]fYZdaf_�AH�EYkim]jY\af_&�� Fgl�]fYZdaf_�Hgjl�>gjoYj\af_&� =Y[`�afklYf[]�g^�]fYZdaf_�Af[geaf_�>LH3�l`j]]�gj�egj]�]fYZd]\�

Af[geaf_�>LH�k]jna[]k�ogmd\�l`]j]^gj]�Y[[memdYl]�lg�Y�`a_`�jakc&� 9fq�Y\\]\�hY[c]l�^adl]j�k]jna[]� fgl�l`]�hjgpa]\�k]jna[]k!&

Low RisksL`]k]�Y[lagfk�Y\\�jakck$�Zml�fgl�Yk�\jYeYla[Yddq�Yk�l`]�e]\ame�gj�`a_`�jakck&

� 9\\af_�hjgpa]\�k]jna[]k�Y\\k�Y�dgo�jakc�[gehYj]\�lg�`Ynaf_�l`Yl�k]jna[]�\akYZd]\&�Hjgpa]\�KELH�ak�kge]o`Yl�jakca]j�l`Yf�@LLH�gj�<FK&�9�hjgpa]\�k]jna[]�ak�em[`�kY^]j�l`Yf�alk�hY[c]l%^adl]j]\�[gmfl]jhYjl$�Z][Ymk]�gfdq�l`]�hjgpa]\�n]jkagf�Zdg[ck�mfkY^]�[gf%l]fl�lqh]k�ojYhh]\�afka\]�YddgoYZd]�[gfl]fl�lqh]k&

� 9\\af_�k]jna[]k�km[`�Yk�kk`$�kkd$�Yf\�nhf�o`a[`�`Yn]�l`]aj�gof�Yml`]fla[Ylagf�Yj]�dgo]j�jakc�l`Yf�Y\\af_�k]jna[]k�l`Yl�`Yn]�fg�Yml`]fla[Ylagf&�

Lowering RisksGf[]�qgm�`Yn]�Y\\]\�^adl]j�Yf\�hjgpq�k]jna[]k$�qgm�[Yf�j]\m[]�l`]�jakck�l`]q�Zjafc�Zq�^mjl`]j�j]klja[laf_�l`]�YddgoYZd]�ljY^^a[�^gj�l`]�k]j%na[]2

� J]klja[laf_�af[geaf_�ljY^^a[�^gj�Y�_an]f�k]jna[]�lg�Y�kaf_d]�`gkl�gf�l`]�Ljmkl]\�afl]j^Y[]�j]\m[]k�l`]�jakc�Zq�YZgml�gf]%^gmjl`&�

� J]klja[laf_�af[geaf_�ljY^^a[�^gj�Y�_an]f�k]jna[]�lg�Y�kaf_d]�`gkl�gf�l`]�GhlagfYd�afl]j^Y[]�j]\m[]k�l`]�jakc�Zq�YZgml�gf]%`Yd^&�

� A^�log�gj�egj]�`gklk�Yj]�Yddgo]\�af[geaf_�ljY^^a[�^gj�Y�_an]f�k]j%na[]$�l`]j]�ak�dalld]�gj�fg�jakc�j]\m[lagf&�

� A^�gml_gaf_�ljY^^a[�ak�Yddgo]\�^jge�gfdq�gf]�`gkl�^gj�Y�k]jna[]$�l`]�jakc�ak�j]\m[]\�Zq�gf]%^gmjl`&�A^�l`]j]�Yj]�log�gj�egj]�Yddgo]\�`gklk$�l`]j]�ak�fg�ka_fa^a[Yfl�jakc�j]\m[lagf&

26 WatchGuard Internet Security Handbook

Organizing your Organization

� A^�l`]�k]jna[]�j]imaj]k�mk]j�Yml`]fla[Ylagf�lg�Yddgo�Y[[]kk�^jge�]pl]jfYd�`gklk$�l`]�jakc�ak�[ml�af�`Yd^�[gehYj]\�lg�Y�fgf%Yml`]fla%[Yl]\�k]jna[]&�

Organizing your Organization

Gj_Yfaraf_�qgmj�gj_YfarYlagf�^gj�l`]�hmjhgk]k�g^�f]logjc�Y\eafak%ljYlagf�Yf\�k][mjalq�ak�l`]�Y[l�g^�Ykka_faf_�]ehdgq]]k�gj�gj_YfarYlagf�e]eZ]jk�lg�_jgmhk�ZYk]\�gf�l`]�[geegfYdalq�g^�l`]aj�lYkck$�^mf[%lagfk$�Y[[]kk�f]]\k$�Yf\'gj�ljmklogjl`af]kk&

A^�qgm�`Yn]�fgl�Ydj]Y\q�\gf]�l`ak$�fgo�ak�\]^afal]dq�l`]�lae]�lg�gj_Y%far]�qgmj�gj_YfarYlagf�gj�[gehYfqÈZ]^gj]�qgm�Z]_af�[gf^a_mjaf_�qgmj�f]logjc�k][mjalq&

>gj�]pYehd]$�qgm�ea_`l�`Yn]�Y�_jgmh�^gj�Y[[gmflaf_$�Yfgl`]j�^gj�h]jkgff]d$�kYd]k$�eYjc]laf_$�Yf\�j]k]Yj[`�Yf\�\]n]dghe]fl&�Qgm�Ydkg�ea_`l�[j]Yl]�Y�hjgZYlagfYjq�_jgmh�oal`�`a_`�j]klja[lagfk�^gj�f]o�]ehdgq]]k�gj�l`gk]�o`g�Yj]�h]j[]an]\�Yk�Y�_j]Yl]j�jakc�lg�l`]�gj_YfarYlagf&�Oal`�OYl[`?mYj\$�qgm�[Yf�\]daf]Yl]�log�\a^^]j]fl�lqh]k�g^�_jgmhk2�

� ?jgmhk�^gj�YdaYk]k�Yf\�Yml`]fla[Ylagf$�o`]j]�_jgmhaf_k�Yj]�Yhhda%[YZd]�^gj�af[geaf_�Yf\�gml_gaf_�ljY^^a[�^gj�kh][a^a[�k]jna[]k$�Yf\�^gj�najlmYd�hjanYl]�f]logjcaf_� NHF!

� ?jgmhk�^gj�O]Z:dg[c]j$�o`]j]�qgm�\]l]jeaf]�o`a[`�_jgmhk�[Yf�Y[[]kk�o`a[`�[gfl]fl�lqh]k�o`]f�Zjgokaf_�l`]�O]Z&

L`]�^ajkl�lqh]�g^�_jgmhaf_�ak�]plj]e]dq�aehgjlYfl�Yf\�lae]%kYnaf_&�Oal`�_jgmhk$�al�ak�em[`�ima[c]j�Yf\�]Yka]j�lg�k]l�mh�Y�kh][a^a[�k]jna[]�^gj�[]jlYaf�_jgmhk�g^�[gehml]j�mk]jk$�gj�lg�Ykka_f�Y�[]jlYaf�lqh]�g^�Yml`]fla[Ylagf�lg�Y�_jgmh�g^�l]d][geeml]jk&�Qgm�[j]Yl]�_jgmhk�af�OYl[`?mYj\�oal`�l`]�9[[]kk�Yf\�9ml`]fla[Ylagf�K]lmh�lggd&�Gf]�l`af_�]kh][aYddq�`Yf\q�oal`�l`ak�ak�l`Yl�qgm�[Yf�[j]Yl]�_jgmhk�l`Yl�mk]�Y�hYjla[mdYj�caf\�g^�Yml`]fla[Ylagf&�Qgm�[Yf�Ydkg�`Yn]�Y�f]logjc�Yk�Y�_jgmh$�gj�Y�_jgmh�g^�af\ana\mYd�[gehml]jk�Yk�Y�_jgmh&�A^�qgm�^af\�l`Yl�log�gj�egj]�h]ghd]�Yj]�af�egj]�l`Yf�gf]�_jgmh$�lYc]�l`]e�gml�g^�l`gk]�_jgmhk�Yf\�[j]Yl]�Y�f]o�_jgmh�^gj�l`]k]�h]ghd]&�Qgm�[Yf�hj]llq�em[`�[j]Yl]�Yk�eYfq�_jgmhk�Yk�f][]kkYjq�lg�eYc]�kmj]�qgmj�gj_YfarYlagf�ak�hjgh]jdq�\]daf]Yl]\�^gj�egkl�]^^][lan]�Y\eafak%ljYlagf�g^�k][mjalq&

Qgm�[j]Yl]�l`]�k][gf\�lqh]�g^�_jgmhaf_�^gj�O]Z:dg[c]j$�o`]j]�qgm�\]l]jeaf]�o`g�[Yf�na]o�o`Yl�kgjlk�g^�[gfl]fl�lqh]k�Yf\�o`]f�l`]q�eYq�Zjgok]�l`]�O]Z&�Af�O]Z:dg[c]j�qgm�[Yf�[j]Yl]�gf%`gmj�Yf\�g^^%`gmj�Y[[]kk�lg�\a^^]j]fl�[gfl]fl�lqh]k�^gj�\a^^]j]fl�_jgmhk&�>gj�]pYe%hd]$�qgm�ea_`l�`a_`dq�j]klja[l�[mklge]j�k]jna[]�_jgmhk�Z][Ymk]�l`]q�

WatchGuard Internet Security Handbook 27

Security and Firewall Management Policies

`Yn]�lg�Z]�[gfklYfldq�^g[mk]\�gf�[mklge]j�f]]\k$�o`ad]�qgm�]fYZd]�ZjgY\�Zjgokaf_�YZadalq�lg�J�<�lg�eYc]�j]k]Yj[`�^Ykl�Yf\�mf^]ll]j]\&

Determining your Allowable Traffic

<]l]jeafaf_�o`a[`�ljY^^a[�qgm�Yddgo�af�o`a[`�\aj][lagf�ak�Y�eYbgj�eYfa^]klYlagf�g^�qgmj�k][mjalq�hgda[q&�O`]f�[gf^a_mjaf_�k]jna[]k�^gj�qgmj�>aj]Zgp$�qgm�hjgZYZdq�\g�fgl�f]]\�lg�]fYZd]�em[`�Af[geaf_�ljY^^a[&�O`]f�qgmj�gj_YfarYlagf�e]eZ]jk�Y[[]kk�Y�O]Zkal]$�l`Yl�ak�Gml_gaf_�ljY^^a[$�]n]f�o`]f�l`]q�\gofdgY\�kge]l`af_�^jge�Y�O]Z%kal]&�L`]�ljY^^a[�\aj][lagf�ak�\]l]jeaf]\�Zq�o`a[`�\aj][lagf�afalaYl]\�l`]�[gff][lagf&�Af�eYfq�[Yk]k$�l`]�gfdq�af[geaf_�ljY^^a[�oadd�Z]�]fYZd]\�naY�najlmYd�hjanYl]�f]logjcaf_&

L`]�k][mj]�klYf[]�\a[lYl]k�l`Yl�o`Yl]n]j�ak�fgl�]phj]kkdq�Yddgo]\�ak�^gjZa\\]f&�L`]j]^gj]$�qgm�emkl�\][a\]�Yf\�Y[lan]dq�]fYZd]�Yfq�k]j%na[]k�qgm�oYfl�lg�d]l�af�gj�d]l�gml&�J]e]eZ]j�l`Yl�]n]jq�k]jna[]�qgm�]fYZd]�hmf[`]k�Yfgl`]j�`gd]�af�qgmj�^aj]oYdd&�>gj�l`ak�j]Ykgf$�]fYZd]�k]jna[]k�l`Yl�Yj]�gfdq�f][]kkYjq�Yf\�o]dd%bmkla^a]\&�LYc]�[Yj]�fgl�lg�gh]f�j]\mf\Yfl�k]jna[]k�l`Yl�mk]�l`]�kYe]�hjglg[gd�Zml�kaehdq�gh]f�mh�egj]�hgjlk�lg�mk]�al$�l`]j]Zq�eYcaf_�qgmj�f]logjc�egj]�nmdf]jY%Zd]�lg�hgjl�khY[]�hjgZ]k&

Organizing your network(s)

9l�alk�kaehd]kl$�qgm�gj_Yfar]�l`]�f]logjc�aflg�log�Yj]Yk2

� K][mj]\�Yj]Yk� >j]]�Yj]Yk

Oal`�Y�>aj]Zgp$�qgm�hml�l`]�k][mj]\�hYjl�g^�qgmj�afl]jfYd�f]logjc�gf�l`]�Ljmkl]\�afl]j^Y[]�Yf\�l`]�^j]]�Yj]Y�gf�l`]�GhlagfYd�afl]j^Y[]&�;gehml]jk�gf�l`]�GhlagfYd�afl]j^Y[]�[gflYaf�gfdq�l`]�[gfl]fl�l`Yl�qgm�\gfÌl�eaf\�k`Yjaf_�oal`�l`]�j]kl�g^�l`]�ogjd\&�Oal`�OYl[`%?mYj\Ìk�K][mjalq�LjaYf_d]�eg\]d$�fgl�gfdq�\g]k�l`]�>aj]Zgp�hjgl][l�l`]�Ljmkl]\�Yf\�GhlagfYd�afl]j^Y[]k�^jge�l`]�Afl]jf]l$�al�Ydkg�hjgl][lk�l`]�Ljmkl]\�Yf\�GhlagfYd�afl]j^Y[]k�^jge�]Y[`�gl`]j&

L`]�^gddgoaf_�\aY_jYe�ak�[Ydd]\�l`]�ÉOYl[`?mYj\�K][mjalq�LjaYf%_d]&Ê�Al�k`gok�hgkkaZd]�hjaeYjq�ljY^^a[�hYll]jfk�^gj�Y�_an]f�hY[c]l$�Yf\�[Yf�Z]�n]jq�`]dh^md�dYl]j�o`]f�\][a\af_�o`]l`]j�Y�k]jna[]�k`gmd\�Z]�Yddgo]\�gj�\]fa]\&

28 WatchGuard Internet Security Handbook

Determining Out-of-Bounds areas

FIGURE 2. WatchGuard Security Triangle

� L`]�]pl]jfYd�afl]j^Y[]�[gff][lk�lg�l`]�]pl]jfYd�f]logjc� lqha[Yddq�l`]�Afl]jf]l!�l`Yl�hj]k]flk�l`]�k][mjalq�[`Ydd]f_]&�

� L`]�ljmkl]\�afl]j^Y[]�[gff][lk�lg�l`]�afl]jfYd�f]logjc�o`a[`�qgm�oYfl�hjgl][l]\�lg�l`]�eYpaeme�hjY[la[Yd�Yegmfl&

� L`]�ghlagfYd�afl]j^Y[]�[gff][lk�lg�Y�k][gf\�k][mj]�f]logjc&�Lqha%[Yddq�al�ak�[gff][l]\�lg�Yfq�f]logjc�g^�k]jn]jk�hjgna\]\�^gj�hmZda[�Y[[]kk$�l`Yl�ak$�hmZda[�k]jn]jk&

Determining Out-of-Bounds areas

Gf]�dYkl�aehgjlYfl�[gfka\]jYlagf�ak�lg�\][a\]�o`a[`�hYjlk�g^�qgmj�afl]jfYd�f]logjc�Yj]�gml�g^�Zgmf\k�^gj�]n]jqgf]�gj�f]Yjdq�]n]jqgf]&�L`]j]�eYq�Z]�[gehml]jk�l`Yl�k`gmd\�fgl�Z]�[gff][l]\�lg�Yfql`af_�]dk]�Yl�Ydd&�;Yf\a\Yl]k�ea_`l�af[dm\]2

� HYqjgdd�Yf\�h]jkgff]d�j][gj\k� ;gjhgjYl]�J�<�Y[lanalq� :mkaf]kk�hdYfk� F]logjc�Y\eafakljYlagf�lggdk�km[`�Yk�hY[c]l�kfa^^]jk�o`a[`�[gmd\�

Z]�\Yf_]jgmk�lg�qgmj�k][mjalq�a^�l`]q�o]j]�_]f]jYddq�YnYadYZd]&

A^�qgm�\]l]jeaf]�l`Yl�kge]�h]ghd]�f]]\�j]egl]�Y[[]kk�lg�kge]�g^�l`]k]�`gklk$�eYc]�kmj]�qgm�k]l�mh�Y[[]kk�kg�l`Yl�al�ak�]p[dmkan]�Yf\�

:DWFK*XDUG6HFXULW\7ULDQJOH

,QFRPLQJ

,QFRPLQJ

,QFRPLQJ

2XWJRLQJ

2XWJR

LQJ

2XWJRLQJ

6HFXULW\7ULDQJOH

([WHUQDO,QWHUIDFH

2SWLRQDO,QWHUIDFH

7UXVWHG,QWHUIDFH

WatchGuard Internet Security Handbook 29

Security and Firewall Management Policies

j]imaj]k�Yml`gjarYlagf&�Kge]�e]l`g\k�g^�j]egnaf_�_]f]jYd�YnYadYZad%alq�eYq�Z]�Z]qgf\�l`]�>aj]ZgpÌk�k[gh]$�Zml�k`gmd\�Z]�hYjl�g^�qgmj�k][mjalq�hgda[q�fgf]l`]d]kk&�>gj�]pYehd]$�qgm�[gmd\�k]l�h]jeakkagfk�Yf\�gof]jk`ah�g^�[]jlYaf�[gehml]jk�km[`�l`Yl�gfdq�Y�n]jq�^]o�h]g%hd]�[Yf�dg_�aflg�l`]e�Yl�Ydd&�L`]f�daeal�o`Yl�f]logjc�k]jna[]k�[Yf�Z]�mk]\�lg�Y[[]kk�l`]k]�[gehml]jk�lg�gf]k�l`Yl�j]imaj]�Yml`]fla[Ylagf&

L`]j]�eYq�Ydkg�Z]�`gklk�gml�gf�l`]�Afl]jf]l�l`Yl�hgk]�[gfklYfl�\Yf%_]jk&�>gj�]pYehd]$�l`]j]�ea_`l�Z]�Y�mfan]jkalq�[gehml]j�l`Yl�klm\]fl�`Y[c]jk�̀ Yn]�mk]\�egj]�l`Yf�gf[]�lg�ljq�lg�afnY\]�qgmj�f]logjc&�>gj�l`]k]�kal]k$�OYl[`?mYj\�hjgna\]k�Y�:dg[c]\�Kal]k�dakl�o`]j]�qgm�[Yf�h]jeYf]fldq�Zdg[c�Ydd�ljY^^a[�̂ jge�l`]k]�[gehml]jk&�A^�Y�hY[c]l�[ge]k�^jge�Y�`gkl�gf�l`]�:dg[c]\�Kal]k�dakl$�al�kaehdq�\g]kfÌl�_]l�hYkl�l`]�>aj]Zgp&

Physical Security

O`]f�k]llaf_�mh$�[gf^a_mjaf_$�Yf\�afklYddaf_�af�l`]�f]logjc�Yf\�\a_%alYd�j]Yde$�\gfÌl�f]_d][l�l`]�h`qka[Yd�j]Yde&�Qgm�[gmd\�`Yn]�Yf�ajgf%[dY\�k][mjalq�hgda[q�l`Yl�hYkk]k�gfdq�l`]�egkl�affg[mgmk�ljY^^a[$�Zml�alÌk�fgl�n]jq�hjgl][lan]�ak�kge]gf]�[Yf�oYdc�aflg�qgmj�g^^a[]�Yf\�lYc]�l`]�>aj]Zgp�g^^�qgmj�\]kclgh�Yf\�gml�g^�qgmj�[mZa[d]&�L`]�kYe]�_g]k�^gj�qgmj�eYfY_]e]fl�klYlagf� l`]�[gehml]j�qgm�mk]�lg�[j]Yl]$�Ydl]j$�Yf\�mhdgY\�[gf^a_mjYlagfk�lg�l`]�>aj]Zgp!$�jgml]j$�dg_�`gklk$�dYhlgh�[gehml]jk�af�_]f]jYd$�Yf\�]kh][aYddq�dYhlgh�[gehml]jk�mk]\�^gj�J]egl]�Mk]j�NHF�l]d][geemlaf_&

EYc]�kmj]�Ydd�l`]k]�\]na[]k�Yj]�fgl�_]f]jYddq�YnYadYZd]�lg�gj_YfarY%lagf�e]eZ]jk�gj�l`]�hmZda[&�L`]�>aj]Zgp$�eYfY_]e]fl�klYlagf$�Yf\�dg_�`gklk�k`gmd\�Z]�h`qka[Yddq�k][mj]\&�L`]�>aj]Zgp�k`gmd\�Z]�af�Y�jgge�mf\]j�dg[c�Yf\�c]q&�L`]�eYfY_]e]fl�Yf\�dg_�`gklk�k`gmd\�Yl�d]Ykl�`Yn]�Y�c]qkoal[`�Yf\�^Ykl%Y[laf_�hYkkogj\%hjgl][l]\�k[j]]f�kYn]jk$�Yf\�a\]Yddq�k`gmd\�Z]�mf\]j�dg[c�Yf\�c]q�Yk�o]dd&�J]_Yj\af_�l`]�dYhlghk$�j]e]eZ]j$�eYfq�Yml`]fla[Ylagf�k[`]e]k�Y[lmYddq�Yml`]fla[Yl]�l`]�[gehml]j$�fgl�l`]�h]jkgf$�kg�Yf�]jjYfl�dYhlgh�l`YlÌk�gf�l`]�Yml`]fla[Ylagf�dakl�^gj�J]egl]�Mk]j�NHF�[gmd\�hgk]�Y�k]jagmk�k][mjalq�l`j]Yl$�Yl�d]Ykl�mflad�qgm�j]egn]�alk�Yml`gjarYlagf&

>afYddq$�eYc]�kmj]�qgm�`Yn]�Y�k][mjalq�hgda[q�lg�`Yf\d]�hjaflgmlk�Yf\�hgjlYZd]�\YlY�e]\aY� \akc]ll]k$�lYh]k!�k][mj]dq&�Gf]�g^�l`]�egkl�[geegf�`Y[c]j�e]l`g\k�g^�_Yafaf_�cfgod]\_]�g^�Yf�gj_YfarYlagfÌk�Y\\j]kk]k�Yf\�hYkkogj\k�ak�É\mehkl]j�\anaf_$Ê�o`]j]�l`]�`Y[c]j�ka^lk�l`jgm_`�l`]�gj_YfarYlagfÌk�ljYk`�^gj�klgjY_]�e]\aY�Yf\�j]n]Yd%af_�hjaflgmlk&

30 WatchGuard Internet Security Handbook

The Human Factor

The Human Factor

L`]�km[[]kk�g^�l`]�^aj]oYdd�hgda[q�\]h]f\k�gf�`go�[Yj]^mddq�[jY^l]\�l`]�dYj_]j�k][mjalq�hgda[q�ak&�Af�hYjla[mdYj$�qgm�emkl�\jYo�Yf�afl]dda%_]fl�daf]�Z]lo]]f�o`Yl�ak�̀ meYfdq�eYfY_]\�Yf\�o`Yl�ak�YmlgeYl]\&�L`]�>aj]Zgp�ak�Y�hgo]j^md�Yf\�]^^][lan]�lggd$�fgl�Y�^afYd$�YmlgeYl]\�kgdmlagf�lg�f]logjc�k][mjalq&�>gj�]pYehd]$�Ydl`gm_`�l`]�>aj]Zgp�[Yf�hjgl][l�^jge�eYfq�lqh]k�g^�]pl]jfYd�l`j]Ylk$�al�[Yf�gfdq�\ak[gmjY_]�l`j]Ylk�^jge�l`]�afka\]�g^�qgmj�gj_YfarYlagf&�A^�qgmj�j]khgfk]�lg�afl]jfYd�k][mjalq�Zj]Y[`]k�ak�lg�Y\\�Yfgl`]j�k][mjalq�jmd]�lg�l`]�>aj]Zgp�[gf^a_mjYlagf$�qgm�eYq�Z]�[memdYlan]dq�dgo]jaf_�alk�gn]jYdd�k][mjalq�Yk�qgm�Y\\�[gehd]palq&�

Afl]jfYd�k][mjalq�YZmk]k�Yj]�h]jkgff]d�hjgZd]ek$�Yf\�k`gmd\�Z]�`Yf%\d]\�Yk�km[`&�Qgmj�gj_YfarYlagf�emkl�[geeal�alk]d^�lg�j]khgfkaZdq�egfalgjaf_�f]logjc�Y[lanalq� ^gj�o`a[`�l`]�Dan]K][mjalq�Kqkl]e�hjg%na\]k�Y�kmal]�g^�]^^][lan]�egfalgjaf_�lggdk!&�O`]f�h]ghd]�Zj]Y[`�gj�nagdYl]�l`]�k][mjalq�hgda[q$�qgmj�gj_YfarYlagf�emkl�lYc]�j]khgfkaZad%alq�lg�[geemfa[Yl]�oal`�l`gk]�o`gk]�Y[lagfk�hgk]�Y�k][mjalq�jakc&�Al�ak�^Yj�egj]�]^^][lan]�lg�[j]Yl]�Yf�]fnajgfe]fl�o`]j]�k][mj]�Z]`Ynagj�ak�]ph][l]\�l`Yf�lg�ljq�lg�[gf^a_mj]�qgmj�^aj]oYdd�kg�l`Yl�af^jY[lagfk�Yj]�aehgkkaZd]�lg�[geeal&

WatchGuard Internet Security Handbook 31

Security and Firewall Management Policies

32 WatchGuard Internet Security Handbook

CHAPTER 3 Network Configuration

L`ak�[`Yhl]j�]phdYafk�`go�qgm�[Yf�mk]�Y�kaf_d]�Yml`gjar]\�AH�Y\\j]kk�gf�l`]�>aj]Zgp�lg�j]hj]k]fl�Yf\�hjgl][l�Y�oa\]�nYja]lq�g^�hja%nYl]�f]logjck�Yf\'gj�`gklk&�O`]l`]j�qgm�`Yn]�Y�kaf_d]�f]logjc�Z]`af\�l`]�>aj]Zgp$�Y�^]o�f]logjck$�gj�Y�bmeZd]�g^�\akbgafl]\�f]l%ogjck�Yf\�jYf\ge�Y\\j]kk]k�Ykka_f]\�lg�kh][a^a[�`gklk$�l`]�OYl[`%?mYj\�YhhjgY[`�[Yf�YkkaeadYl]�l`]e�Ydd�aflg�Y�>aj]Zgp%[gehYlaZd]�f]logjc�[gf^a_mjYlagf&

OYl[`?mYj\�Y[[gehdak`]k�l`ak�n]jkYladalq�l`jgm_`�k]n]jYd�[gf^a_mjY%lagf�[gf[]hlk�l`Yl�Yj]�]phdYaf]\�af�l`ak�[`Yhl]j2

� Kaehd]�f]logjck� Hjgpq�9JH� Y\\j]kk�j]kgdmlagf�hjglg[gd!� Emdlahd]�f]logjck� KmZ%f]llaf_� J]dYl]\�f]logjck� J]dYl]\�`gklk

Simple Network (Drop-in) Configuration

9�kaehd]$�gj�É\jgh%afÊ�f]logjc�[gf^a_mjYlagf�ak�o`]j]�qgm�`Yn]�Y�kaf_d]��f]logjc�oal`af�qgmj�gj_YfarYlagf$�Yf\�l`]�>aj]Zgp�klYf\k�Z]lo]]f�al�Yf\�l`]�jgml]j�Yf\�Afl]jf]l�ogjd\&�9�kaehd]�f]logjc�[gf%^a_mjYlagf�ak�addmkljYl]\�Z]dgo2

WatchGuard Internet Security Handbook 33

Network Configuration

FIGURE 3. Example of a Simple Network

9dl`gm_`�l`]�addmkljYlagf�eYq�dggc�Y�Zal�[gehd]p$�l`]�aehgjlYfl�l`af_�lg�fgla[]�ak�l`Yl�Ydd�f]logjc�Ykka_fe]flk�̂ gj�l`]�>aj]Zgp$�jgml]j$�Yf\�hjanYl]�f]logjc�mk]�l`]�kYe]�AH�Y\\j]kk�jYf_]&

9�kaehd]�[gf^a_mjYlagf�ak�^gj�kalmYlagfk�o`]j]�qgm�[Yf�\akljaZml]�qgmj�f]logjcÌk�dg_a[Yd�Y\\j]kk�khY[]�Y[jgkk�l`]�>aj]ZgpÌk�afl]j^Y[]k&�Al�]fYZd]k�qgm�lg�hdY[]�l`]�>aj]Zgp�Z]lo]]f�l`]�jgml]j�Yf\�l`]�D9F�oal`gml�j][gf^a_mjaf_�Yfq�g^�l`]�eY[`af]k�gf�l`]�Ljmkl]\�afl]j^Y[]&�

How the Simple Configuration Works with Proxy ARP?]f]jYddq�o`]f�Y�eY[`af]�f]]\k�lg�k]f\�Y�hY[c]l$�al�ZjgY\[Yklk�Yf�9JH� Y\\j]kk�j]kgdmlagf�hjglg[gd!�j]im]kl�Ykcaf_�^gj�l`]�`Yj\oYj]�Y\\j]kk�g^�l`]�afl]j^Y[]�[Yj\�l`Yl�ÉgofkÊ�l`]�\]klafYlagf�AH�g^�l`]�hY[c]l�Z]af_�k]fl2�

����������������DUS�ZKR�KDV�OLQXV�WRUYDOGV�RUJ�WHOO�NHUQHO�WRUYDOGV�RUJ

L`]�`Yj\oYj]�afl]j^Y[]�[Yj\�l`Yl�`Yk�l`]�\]klafYlagf�AH�Y\\j]kk�j]khgf\k�oal`�l`]�[gjj][l�`Yj\oYj]�Y\\j]kk2

����������������DUS�UHSO\�OLQXV�WRUYDOGV�RUJ�LV�DW�����F�����FG�I�

5RXWHU

)LUHER[�,,

Trusted InterfaceIP: 111.222.121.2/24Network: 111.222.121.0

Trusted NetworkNetwork: 111.222.121.0/24

Address Range:111.222.121.3 to

111.222.121.254

RouterIP: 111.222.121.1/24Network: 111.222.121.0

External InterfaceIP: 111.222.121.2/24Network: 111.222.121.0

Optional InterfaceIP: 111.222.121.2/24Network: 111.222.121.0/24

Related Host:111.222.121.3

34 WatchGuard Internet Security Handbook

Simple Network (Drop-in) Configuration

Yf\�l`]�hY[c]l�ak�k]fl�lg�l`]�[gjj][l�Y\\j]kk$�Ykkmeaf_�Zgl`�eY[`af]k�Yj]�gf�l`]�kYe]�h`qka[Yd�oaj]2�gl`]joak]�l`]�ZjgY\[Yklk�[Yffgl�j]Y[`�l`]�ja_`l�afl]j^Y[]�[Yj\$�Yf\�al�l`]j]^gj]�[YfÌl�k]f\�Y�j]hdq&

Af�Y�kaehd]�[gf^a_mjYlagf$�l`]�>aj]Zgp�h]j^gjek�hjgpq�9JH2�al�Yfko]jk�9JH�j]im]klk�^gj�eY[`af]k�l`Yl�Yj]�gf�gl`]j�f]logjck$�o`a[`�gj\afYjadq�[gmd\�fgl�É`]YjÊ�l`]�ZjgY\[Yklk&�O`]f�qgm�afklYdd�l`]�>aj]Zgp�Z]lo]]f�l`]�jgml]j�Yf\�l`]�j]kl�g^�l`]�Ljmkl]\�f]logjc$�al�j]hda]k�^gj�l`]�jgml]j$�Y[[]hlk�l`]�hY[c]l$�Yf\�^gjoYj\k�al�lg�l`]�jgml]j&

L`ak�e][`Yfake�Yddgok�l`]�>aj]Zgp�lg�Z]�hdY[]\�af�Y�f]logjc�oal`%gml�[`Yf_af_�\]^Ymdl�_Yl]oYqk�gf�l`]�Ljmkl]\�`gklk$�kaf[]�l`]�>aj]Zgp�Yfko]jk�^gj�l`]�jgml]j$�]n]f�l`gm_`�l`]�jgml]j�[Yffgl�`]Yj�l`]�Ljmkl]\�`gklÌk�9JH�j]im]klk&

>gj�l`ak�lg�ogjc$�`go]n]j$�Ydd�l`]�Ljmkl]\�eY[`af]k�emkl�`Yn]�l`]aj�9JH�[Y[`]k�^dmk`]\$�kg�l`Yl�l`]�Ljmkl]\�afl]j^Y[]�`Yj\oYj]�Y\\j]kk�ak�Yddgo]\�lg�j]hdY[]�l`]�Y[lmYd�jgml]j�`Yj\oYj]�Y\\j]kk&

>gj�Y�OYl[`?mYj\�Ékaehd]�f]logjc�[gf^a_mjYlagfÊ�lg�ogjc$�Ydd�l`j]]�afl]j^Y[]k�gf�l`]�>aj]Zgp�emkl�Z]�Ykka_f]\�AH�Y\\j]kk]k�gf�l`]�kYe]�f]logjc� j]_Yj\d]kk�g^�o`]l`]j�qgm�eYc]�mk]�g^�l`]�GhlagfYd�afl]j%^Y[]!&�A\]Yddq$�Ydd�l`j]]�afl]j^Y[]k�Yj]�Ykka_f]\�l`]�kYe]�AH�Y\\j]kk$�fgl�bmkl�Y\\j]kk]k�^jge�l`]�kYe]�f]logjc�jYf_]&�L`ak�kYn]k�qgmj�gj_YfarYlagf�log�AH�Y\\j]kk]k&�9_Yaf$�j]^]j�lg�>a_mj] +$�É=pYehd]�g^�Y�Kaehd]�F]logjc$Ê�gf�hY_] +,&

L`]�kaehd]�[gf^a_mjYlagf�Ykkme]k�l`Yl�egkl�g^�qgmj�gj_YfarYlagfÌk�D9F�ak�hdY[]\�gf�l`]�Ljmkl]\�afl]j^Y[]&�Al�[Yf$�`go]n]j$�Y[[geeg%\Yl]�gl`]j�f]logjck�gj�`gklk�g^�gl`]j�Y\\j]kk�jYf_]k�Z]`af\�l`]�>aj]Zgp&�L`]�OYl[`?mYj\�Hgda[q�EYfY_]j�hjgna\]k�Y�lggd�lg�dakl�l`]�AH�Y\\j]kk]k�g^�Yfq�f]logjck�gj�eY[`af]k�oal`�AH�Y\\j]kk]k�gmlka\]�Yf�afl]j^Y[]Ìk�f]logjc�jYf_]&�L`]�gl`]j�f]logjck�Yj]�[Ydd]\�J]dYl]\�F]logjck3�l`]�gl`]j�eY[`af]k�Yj]�[Ydd]\�J]dYl]\�@gklk&

About Related Networks and Related HostsJ]dYl]\�F]logjck�Yj]�f]logjck�gf�l`]�kYe]�h`qka[Yd�oaj]�Yk�l`]�>aj]Zgp�afl]j^Y[]k$�Zml�o`a[`�`Yn]�f]logjc�Y\\j]kk]k�l`Yl�Z]dgf_�lg�Yf�]flaj]dq�\a^^]j]fl�f]logjc&�J]dYl]\�@gklk�Yj]�`gklk� mkmYddq�k]jn%]jk�gj�jgml]jk!�af�Y�Kaehd]�[gf^a_mjYlagf�l`Yl�emkl�Z]�hdY[]\�gf�l`]�GhlagfYd�gj�=pl]jfYd�afl]j^Y[]�g^�l`]�>aj]Zgp&

O`]f�Y\\af_�Y�J]dYl]\�F]logjc�lg�gf]�g^�l`]�>aj]Zgp�afl]j^Y[]k$�qgm�Yj]�eYhhaf_�Yf�AH�Y\\j]kk�^jge�l`]�j]dYl]\�f]logjc�lg�l`]�AH�Y\\j]kk�g^�l`]�afl]j^Y[]� Ljmkl]\$�=pl]jfYd$�gj�GhlagfYd!&�L`ak�ak�cfgof�Yk�[j]Ylaf_�gj�Y\\af_�Yf�AH�YdaYk�lg�l`]�f]logjc�afl]j^Y[]�^gj�

WatchGuard Internet Security Handbook 35

Network Configuration

l`]�J]dYl]\�F]logjc&�L`ak�AH�YdaYk�Z][ge]k�l`]�\]^Ymdl�_Yl]oYq�^gj�Ydd�l`]�eY[`af]k�gf�l`Yl�hYjla[mdYj�j]dYl]\�f]logjc&

L`ak�Ydkg�l]ddk�l`]�>aj]Zgp�l`Yl�l`]j]�ak�Yfgl`]j�f]logjc�j]ka\af_�gf�l`Yl�oaj]&�J]dYl]\�F]logjck�[Yf�Z]�mk]\�Zq�Zgl`�kaehd]�Yf\�emdla%hd]�f]logjc�[gf^a_mjYlagfk&�

Related HostsAf�Y�kaehd]�f]logjc�[gf^a_mjYlagf� k]]�ÉKaehd]�F]logjc� <jgh%af!�;gf^a_mjYlagfÊ�gf�hY_] ++!$�OYl[`?mYj\�Ykkme]k�l`Yl�Ydd�g^�l`]�`gklk�Yj]�gf�l`]�Ljmkl]\�afl]j^Y[]&�Ll`]�J]dYl]\�@gklk�^]Ylmj]�af^gjek�l`]�>aj]Zgp�o`a[`�`gklk�Yj]�]p[]hlagfk�lg�l`]�Y\\j]kk�jYf_]&�Al�ak�[geegf�hjY[la[]�lg�hdY[]�O]Z�k]jn]jk$�>LH�k]jn]jk$�Yf\�gl`]j�ÉhmZda[Ê�eY[`af]k�gf�l`]�GhlagfYd�k]_e]fl&�9�jgml]j�lqha[Yddq�da]k�g^^�l`]�=pl]jfYd�afl]j^Y[]&�

Af�Y�kaehd]�[gf^a_mjYlagf$�l`]k]�Yj]�Ydd�J]dYl]\�@gklk$�Yf\�emkl�`Yn]�l`]aj�AH�Y\\j]kk]k�Ykkg[aYl]\�oal`�l`]�YhhjghjaYl]�afl]j^Y[]&�Af�l`ak�oYq$�OYl[`?mYj\�ak�YZd]�lg�hjgl][l�l`]�nYjagmk�`gklk�l`Yl�j]ka\]�gf�l`]�kYe]�f]logjc�^jge�]Y[`�gl`]j&�L`]�`gklk�gf�l`]�ljmkl]\�afl]j^Y[]�Yj]�Yk�kY^]�^jge�l`]�hmZda[�k]jn]jk�Yk�l`]q�Yj]�^jge�Afl]jf]l�k]jn]jk&

>gj�Y�kaehd]�f]logjc�l`Yl�mk]k�k]hYjYl]�AH�Y\\j]kk]k�^gj�]Y[`�g^�l`]�l`j]]�afl]j^Y[]k� fgl�j][gee]f\]\!$�l`]�=pl]jfYd�afl]j^Y[]Ìk�gof�AH�Y\\j]kk�emkl�Ydkg�Z]�Y\\]\�Yk�Y�J]dYl]\�@gkl�gf�l`]�=pl]jfYd�afl]j%^Y[]&�L`ak�]fkmj]k�l`Yl�`gklk�gf�l`]�Ljmkl]\�Yf\�GhlagfYd�afl]j^Y[]k�[Yf�k]f\�ljY^^a[�lg�l`]�]pl]jfYd�AH�Y\\j]kk&

Af�Y�emdlahd]�f]logjc�[gf^a_mjYlagf$�]Y[`�afl]j^Y[]�ak�gf�Y�\a^^]j]fl�f]logjc$�kg�l`]�J]dYl]\�@gklk�^]Ylmj]�ak�fgl�aehd]e]fl]\�^gj�l`gk]�[gf^a_mjYlagfk&

Multiple Network Configuration

L`]�emdlahd]�f]logjc�[gf^a_mjYlagf�ak�^gj�kalmYlagfk�o`]j]�l`]�>aj]Zgp�ak�hml�af�hdY[]�oal`�k]hYjYl]�dg_a[Yd�f]logjck�gf�alk�afl]j%^Y[]k&�Al�ak�addmkljYl]\�Z]dgo2

36 WatchGuard Internet Security Handbook

Multiple Network Configuration

L`]�emdlahd]�f]logjc�[gf^a_mjYlagf�emkl�Ykka_f�k]hYjYl]�f]logjc�Y\\j]kk�jYf_]k�lg�Yl�d]Ykl�log�g^�l`]�>aj]ZgpÌk�l`j]]�afl]j^Y[]k� =pl]j%fYd$�Ljmkl]\$�Yf\�GhlagfYd!&�A^�qgm�`Yn]�log�k]hYjYl]�f]logjc�Y\\j]kk]k�Yf\�qgm�oYfl�lg�mk]�l`]�emdlahd]�[gf^a_mjYlagf$�mk]�gfdq�l`]�=pl]jfYd�Yf\�Ljmkl]\�afl]j^Y[]k� l`Yl�ak$�\gfÌl�mk]�l`]�GhlagfYd�afl]j^Y[]!�Z][Ymk]�]Y[`�afl]j^Y[]�emkl�Z]�gf�Y�k]hYjYl]�f]logjc�af�emdlahd]�[gf^a_mjYlagf�eg\]&�

A^�qgm�`Yn]�l`j]]�gj�egj]�f]logjc�Y\\j]kk]k$�mk]�l`]�emdlahd]�f]l%ogjc�[gf^a_mjYlagf�Yf\�eYh�l`j]]�f]logjck�lg�l`]�l`j]]�afl]j^Y[]k&�9\\�Y\\alagfYd�f]logjck�Yk�J]dYl]\�F]logjck�lg�gf]�gj�egj]�g^�l`]�afl]j^Y[]k&�Qgm�[Yf�j]dYl]�\a^^]j]fl�f]logjck�lg�\a^^]j]fl�afl]j^Y[]k&�L`gk]�f]logjck�l`]f�[ge]�mf\]j�l`]�hjgl][lagf�Yf\�Y[[]kk�jmd]k�k]l�mh�^gj�l`Yl�afl]j^Y[]&�L`]�>aj]Zgp�^gjoYj\k�hY[c]lk�lg�l`]�nYjagmk�afl]j^Y[]k�\]h]f\af_�gf�`go�l`]�f]logjck�Yf\�`gklk�Yj]�[gf^a_mj]\�Yf\�\]^af]\&

5RXWHU

)LUHER[�,,

Trusted InterfaceIP: 211.111.212.1/24Network: 211.111.212.0/24

Trusted NetworkNetwork: 211.111.212.0/24

Address Range:211.111.212.2 to 211.111.212.255

RouterIP: 111.222.121.1/24Network: 111.222.121.0/24

External InterfaceIP: 111.222.121.2/24Network: 111.222.121.0/24

Optional InterfaceIP: 199.88.66.1.1/24Network: 199.88.66.0/24

Optional HostIP: 199.88.66.194/24Network: 199.88.66.0/24Gateway:199.88.66.1

Default Gateway:IP: 211.111.212.0/24

WatchGuard Internet Security Handbook 37

Network Configuration

38 WatchGuard Internet Security Handbook

CHAPTER 4 Proxying and Packet Filtering

OYl[`?mYj\�hjgna\]k�alk�k][mjalq�l`jgm_`�log�e][`Yfakek2�\qfYea[�hY[c]l�^adl]jaf_�Yf\�ljYfkhYj]fl�Yhhda[Ylagf�hjgpa]k&

L`ak�[`Yhl]j�\]^af]k�Yf\�\]k[jaZ]k�hY[c]l�^adl]jaf_�Yf\�k]jna[]�hjgp%a]k�Yk�j]dYl]\�lg�̂ aj]oYdd�l][`fgdg_q$�o`Yl�]Y[`�\g]k$�Yf\�o`q�[]jlYaf�hjglg[gdk�f]]\�l`]�]pljY�k][mjalq�g^�hjgpqaf_�nk&�^adl]jaf_&�Af[dm\]k�\ak[mkkagf�g^�Y�ÉklYf[]Ê�Yf\�l`]�jYea^a[Ylagfk�g^�OYl[`?mYj\Ìk�klYf[]Èl`Yl�qgm�[gf^a_mj]�]n]jql`af_�qgm�oYfl�lg�hYkk&

Dynamic Packet Filtering

<qfYea[�hY[c]l�^adl]jaf_�]pYeaf]k�l`]�`]Y\]jk�g^�hY[c]lk�Z]af_�k]fl�gj�j][]an]\&�@]Y\]jk�hjgna\]�af^gjeYlagf�gf�l`]�kgmj[]�g^�l`]�hY[c]l$�l`]�\]klafYlagf$�l`]�hjglg[gd�mk]\$�l`]�hgjl�fmeZ]j$�Yf\�gl`]j�af^gjeYlagf�g^�l`Yl�kgjl&�9�hY[c]l�̂ adl]j�]pYeaf]k�l`]�̀ ]Y\]jk�lg�\]l]jeaf]�o`]l`]j�l`]q�^gddgo�d]_alaeYl]�kqflYp�jmd]k�Yf\�[gehdq�oal`�l`]�[gf^a_mj]\�k][mjalq�hgda[q&�

9�^aj]oYdd�hY[c]l�^adl]j�ak�YfYdg_gmk�lg�l`]�eYad�kgjl]j�Yl�Y�hmZdak`af_�[gehYfq$�o`g�]pYeaf]k�l`]�Yml`gjk�]fn]dgh]k�lg�eYc]�kmj]�l`Yl�l`]q�Yj]�Zgl`�[geaf_�^jge�Y�d]_alaeYl]�Y\\j]kk$�Yf\�Zgmf\�^gj�Y�d]_alaeYl]�]\algj�oal`af�l`]�[gehYfq&�@]�[`][ck�l`]�hgklYd�_ma\]%daf]k�lg�eYc]�kmj]�l`Yl�`]�ak�Yddgo]\�lg�k]f\�l`ak�lqh]�g^�eYad�lg�l`ak�hYjla[mdYj�]\algj&�@]�\g]k�fgl�gh]f�l`]�]fn]dgh]k�Yf\�]pYeaf]�l`]�klgjq�Z]af_�k]fl3�`]�kaehdq�kgjlk�Yf\�jgml]k�l`]�eYad&�L`ak�ak�]kk]f%laYddq�o`Yl�hY[c]l�^adl]jk�\g&�

>gj�]pYehd]$�a^�Y�hY[c]l�^adl]j�]f[gmfl]j]\�Y�hY[c]l�Ykka_f]\�lg�hgjl�,(+$�Yf\�l`]�̂ adl]j�ÉcfgokÊ�l`Yl�l`ak�hgjl�̀ Yk�fgl�Z]]f�gh]f]\�̂ gj�Yfq�k]jna[]$�l`]�^adl]j�ogmd\�j]b][l�l`]�hY[c]l�Z][Ymk]�alk�hgjl�fmeZ]j�ak�afnYda\�Y[[gj\af_�lg�hY[c]l�^adl]j�jmd]k&

WatchGuard Internet Security Handbook 39

Proxying and Packet Filtering

HY[c]l�^adl]jk�lqha[Yddq�gh]jYl]�Y[[gj\af_�lg�jmd]k�l`Yl�\]l]jeaf]�hY[c]l�\akhgkalagf&�L`]k]�jmd]k�Yj]�ojall]f�af�Y�^adl]j�dYf_mY_]�Yf\�[gdd][l]\�aflg�_jgmhk�[Ydd]\�ÊJmd]�K]lk&Ê�Jmd]�K]lk�[Yf�Z]�\a^^a[mdl�lg�[gf^a_mj]�Yf\�ogjc�Z]kl�o`]f�afl]jhj]l]\�Zq�hjgh]jdq%ojall]f�^aj]%oYdd�kg^loYj]�jYl`]j�l`Yf�Zq�`Yjja]\�f]logjc�kqkl]e�Y\eafakljYlgjk&�Af�Y\\alagf$�eYfq�hY[c]l�^adl]jk�\g�fgl�hjgna\]�l`]�e]Yfk�lg�^adl]j�gf�kge]�g^�l`]�egj]�mk]^md�hjgh]jla]k�g^�AH�hY[c]lk&�

OYl[`?mYj\�mk]k�\qfYea[�hY[c]l�^adl]jaf_�jmd]k�o`a[`�_g�Z]qgf\�ZYka[�hY[c]l�̂ adl]jaf_�\]k[jaZ]\�YZgn]&�OYl[`?mYj\�ZYk]k�alk�̂ adl]jaf_�fgl�gfdq�gf�k]jna[]�lqh]k$�Zml�Ydkg�gf�[gf\alagfk�kmjjgmf\af_�l`]�afa%laYlagf�g^�Y�[gff][lagf&�OYl[`?mYj\�mk]k�\qfYea[�jmd]%k]lk$�Yddgo%af_�qgm�lg�Y\\�Yf\�j]egn]�jmd]k�\]h]f\af_�gf�f]logjc�Y[lanalq&�>gj�]pYehd]$�a^�Y�hYjla[mdYj�kal]�Yll]ehlk�lg�[gff][l�lg�Y�hgjl�al�`Yk�fg�Zmkaf]kk�[gff][laf_�lg$�OYl[`?mYj\�[Yf�Z]�[gf^a_mj]\�lg�YmlgeYla%[Yddq�Y\\�l`Yl�hYjla[mdYj�`gkl�lg�Y�ÉZdg[c]\�kal]k�dakl$Ê�eYcaf_�l`af_k�km[`�Yk�hgjl�khY[]�hjgZ]k�af[j]Ykaf_dq�\a^^a[mdl�lg�[Yjjq�gml&�

Proxies

Hjgpa]k�_g�o]dd�Z]qgf\�l`]�^mf[lagf�g^�Y�hY[c]l�^adl]j�Zq�]pYeafaf_�fgl�bmkl�l`]�`]Y\]jk�Zml�Ydkg�l`]�hY[c]l�[gfl]fl�Yk�o]dd&�Af�\gaf_�kg$�l`]�hjgpq�\]l]jeaf]k�a^�l`]j]�ak�Y�^gjZa\\]f�[gfl]fl�lqh]�`a\\]f�gj�]eZ]\\]\�af�Yf�Yddgo]\�[gfl]fl�lqh]&�Lg�j]nakal�l`]�[gjhgjYl]�eYad�kgjl]j�YfYdg_q$�d]lÌk�kmhhgk]�l`]�eYad�kgjl]j�`Yk�bmkl�Z]]f�hjgegl]\�lg�k[j]]faf_�]\algj&�Fgo�`]�fgl�gfdq�j]Y\k�l`]�ÉLgÊ�Yf\�É>jgeÊ�Y\\j]kk]k�gf�l`]�]fn]dgh]k$�`]�]pYeaf]k�l`]�]fn]dgh]Ìk�[gfl]flk�lg�\]l]jeaf]�o`]l`]j�l`]�Y\\j]kk]\�]\algj�k`gmd\�j]Y\�l`]�klgjq&�Fgo�`]�ak�Y[laf_�Yk�Y�hjgpq�^gj�l`]�[gfl]fl�]\algj&�>gj�]pYehd]$�l`]�k[j]]f%af_�]\algj�gh]fk�Yf�]fn]dgh]�[gflYafaf_�Y�d]_alaeYl]�Yml`gjÌk�gja_a%fYlaf_�Y\\j]kk$�Yf\�Y\\\j]kk]\�lg�l`]�[ggcZggc�]\algj&��Afka\]�`]�^af\k�Yf�Y[lagf%Y\n]flmj]�^a[lagf�klgjq�k]l�af�Y�jYaf�^gj]kl&�@]�[YfÌl�^gjoYj\�l`]�eYfmk[jahl�Z][Ymk]�alk�[gfl]fl�ak�afYhhjghjaYl]&�Af�l`]�kYe]�oYq$�Y�eYad�hjgpq�]pYeaf]k�Ydd�KELH�hY[c]lk�lg�\]l]jeaf]�o`]l`]j�l`]q�[gflYaf�^gjZa\\]f�[gfl]fl�lqh]k$�km[`�Yk�]p][mlYZd]�hjg_jYek�gj�al]ek�ojall]f�af�k[jahlaf_�dYf_mY_]k&�L`]�KELH�hjgpq�ÉcfgokÊ�l`]k]�[gfl]fl�lqh]k�Yj]�fgl�YddgoYZd]&�9�hY[c]l�̂ adl]j�ogmd\�f]n]j�`Yn]�fgla[]\&

Hjgpa]k�ogjc�Yl�l`]�Yhhda[Ylagf�d]n]d$�o`]j]Yk�AH�hY[c]l�^adl]jk�ogjc�Yl�l`]�hjglg[gd�d]n]d&�L`ak�e]Yfk�l`Yl�]Y[`�hY[c]l�l`Yl�ak�j][]an]\�Zq�Y�hjgpq�emkl�Z]�kljahh]\�g^�Ydd�alk�f]logjc�ojYhhaf_$�YfYdqr]\$�hjg%[]kk]\$�Yf\�j]%ojYhh]\�kg�al�[Yf�Z]�^gjoYj\]\�lg�alk�afl]f\]\�\]kla%fYlagf&�L`ak�Y\\k�k]n]jYd�dYq]jk�g^�[gehd]palq�Yf\�hjg[]kkaf_�o]dd�Z]qgf\�l`]�hY[c]l�^adl]jaf_�hjg[]kk&�O`Yl�l`ak�e]Yfk$�g^�[gmjk]$�ak�l`Yl�hjgpa]k�mk]�mh�egj]�hjg[]kkaf_�ZYf\oa\l`�l`Yf�hY[c]l�^adl]jk&�

40 WatchGuard Internet Security Handbook

Stance

Gf�l`]�gl`]j�`Yf\$�l`]q�[Yf�[Yl[`�\Yf_]jgmk�[gfl]fl�lqh]k�af�oYqk�l`Yl�hY[c]l�^adl]jk�[Yffgl&�

OYl[`?mYj\�]ehdgqk�Y�n]jq�hjY_eYla[�[geZafYlagf�g^�\qfYea[�hY[c]l�^adl]jaf_�Yf\�ljYfkhYj]fl�hjgpa]k�lg�[gfljgd�Yf\�egfalgj�l`]�^dgo�g^�AH�hY[c]lk�l`jgm_`�l`]�^aj]oYdd&�L`]�ljYfkhYj]fl�hjgpa]k�Yj]�mk]\�^gj�l`]�hjglg[gdk�l`Yl�Yj]�l`]�egkl�nmdf]jYZd]$�o`a[`�Yj]�mk]\�Zq�l`]�oa\]kl�nYja]lq�g^�f]logjc�mk]jk$�Yf\�o`a[`�Yj]�egkl�dac]dq�lg�`Yn]�mfYddgo]\�[gfl]fl�lqh]k�]eZ]\\]\�oal`af&�Egkl�fglYZd]�Yegf_�l`]�OYl[`?mYj\�k]jna[]k�Yj]�hjgpa]k�^gj�KELH� ]%eYad!$�>LH� ^ad]�ljYfk^]j!$�Yf\�@LLH� OOO!&�D]kk�\Yf_]jgmk�lqh]k�g^�hY[c]lk�Yj]�^adl]j]\�Zq�af\ana\mYddq�[gf^a_mj]\�k]jna[]k&�=n]f�oal`�hY[c]l�^ad%l]jk$�qgm�[Yf�\]l]jeaf]�o`Yl�`gklk�oal`af�qgmj�D9F�Yf\�gf�l`]�Afl]jf]l�[Yf�[geemfa[Yl]�oal`�]Y[`�gl`]j�l`jgm_`�l`Yl�hjglg[gd$�o`a[`�]n]flk�lg�dg_� km[`�Yk�j]b][l]\�af[geaf_�hY[c]lk!$�Yf\�o`a[`�k]ja]k�g^�]n]flk�k`gm\�afalaYl]�Y�fgla^a[Ylagf�g^�l`]�f]logjc�Y\eafak%ljYlgj&

Stance

L`]�hgda[q�g^�Y�^aj]oYdd�j]_Yj\af_�l`]�\]^Ymdl�\akhgkalagf�g^�AH�hY[c%]lk�ak�cfgof�Yk�alk�klYf[]&�L`]�klYf[]�\a[lYl]k�o`Yl�l`]�^aj]oYdd�oadd�\g�oal`�Yfq�_an]f�hY[c]l�af�l`]�YZk]f[]�g^�]phda[al�afkljm[lagfk&�Al�ak�_]f]jYddq�Y[[]hl]\�Zq�l`]�Afl]jf]l�k][mjalq�[geemfalq�l`Yl�l`]�klYf[]�g^�Y�^aj]oYdd�k`gmd\�Z]�lg�\ak[Yj\�Ydd�hY[c]lk�l`Yl�Yj]�fgl�]phda[aldq�Yddgo]\$�g^l]f�klYl]\�Yk�Él`Yl�o`a[`�ak�fgl�]phda[aldq�Yddgo]\�ak�\]fa]\&Ê

L`]�OYl[`?mYj\�K][mjalq�Kqkl]e$�dac]�egkl�[gee]j[aYd�^aj]oYddk$�Y\ghlk�l`ak�Yk�alk�\]^Ymdl�klYf[]&�L`ak�hjgl][lk�Y_Yafkl�YllY[ck�ZYk]\�gf�f]o$�mf^YeadaYj$�gj�gZk[mj]�AH�k]jna[]k&�Al�Ydkg�hjgna\]k�Y�kY^]lq�f]l�j]_Yj\af_�mfcfgof�k]jna[]k�Yf\�[gf^a_mjYlagf�]jjgjk�o`a[`�[gmd\�gl`]joak]�l`j]Yl]f�f]logjc�k][mjalq&�

O`Yl�l`ak�Ydkg�e]Yfk$�l`]f$�ak�l`Yl�^gj�l`]�>aj]Zgp�lg�hYkk�Yfq�ljY^^a[$�al�emkl�Z]�[gf^a_mj]\�lg�\g�kg&�L`]�f]logjc�Y\eafkljYlgj�emkl�Y[lan]dq�k]d][l�l`]�k]jna[]k�Yf\�hjglg[gdk�YddgoYZd]$�[gf^a_mj]�]Y[`�gf]�Yk�lg�o`a[`�`gklk�[Yf�k]f\�Yf\�j][]an]�l`]e$�Yf\�k]l�gl`]j�hjgh%]jla]k�af\ana\mYd�lg�l`]�k]jna[]&�L`]�egkl�\]lYad]\�Y\\alagfYd�hjgh]j%la]k�Z]dgf_�lg�l`]�hjgpa]k&

Configuring Services

Af�l`]�OYl[`?mYj\�Y\eafakljYlan]�afl]j^Y[]$�a[gfk�j]hj]k]fl�k]jna[]k� hjgpa]k�Yf\�hY[c]l�^adl]jk!�l`Yl�[Yf�Z]�[gf^a_mj]\�^gj�Y�^aj]oYdd&�O]�af[dm\]�f]Yjdq�^gmj�\gr]f�hY[c]l�^adl]jk�Yf\�Yfgl`]j�\gr]f�hjgpa]k&�K]jna[]k�[Yf�Z]�[gf^a_mj]\�^gj�gml_gaf_�ljY^^a[�Yf\'gj�af[geaf_�ljY^%

WatchGuard Internet Security Handbook 41

Proxying and Packet Filtering

^a[&�L`]q�[Yf�Z]�Y[lan]�gj�afY[lan]&�O`]f�qgm�[gf^a_mj]�Y�k]jna[]$�qgm�k]l�l`]�YddgoYZd]�ljY^^a[�]f\�hgaflk�Yf\�\]l]jeaf]�l`]�^adl]j�jmd]k�Yf\�hgda[a]k�^gj�]Y[`�g^�l`]k]�k]jna[]k&�Qgm�[Yf�Ydkg�[j]Yl]�k]jna[]k�lg�[mk%lgear]�jmd]k�k]lk$�\]klafYlagfk$�hjglg[gdk$�hgjlk�mk]\$�]l[&

Qgm�eYq�Ydkg�Y\\�mfaim]�gj�[mklge�k]jna[]k&�L`ak�^]Ylmj]�Yddgok�OYl[`?mYj\�lg�]Ykadq�Y[[geeg\Yl]�f]o�L;H'AH�k]jna[]k�Yk�l`]q�Yj]�\]n]dgh]\&��:]Yj�af�eaf\$�`go]n]j$�l`Yl�a^�OYl[`?mYj\�\a\fÌl�af[dm\]�Y�hY[c]l�^adl]j�k]jna[]�qgmÌ\�dac]$�alÌk�hjgZYZdq�Z][Ymk]�o]�\gfÌl�Y\ng[Yl]�alk�_]f]jYd�mk]�af�Y�^aj]oYdd&�O]�hjgna\]�l`]�e]Yfk�lg�[j]Yl]�qgmj�gof�hY[c]l�^adl]jk$�Zml�o`]f�qgm�\g$�gfdq�h]jeal�l`]�ljY^^a[�^dgo�af�l`Yl�k]jna[]�l`Yl�ak�YZkgdml]dq�]kk]flaYd&

Configurable Parameters for ServicesL`]j]�Yj]�k]n]jYd�hYjYe]l]jk�qgm�[Yf�k]l�gj�[gf^a_mj]�af�l`]�OYl[`%?mYj\�K][mjalq�Kqkl]e$�af[dm\af_�l`]�^gddgoaf_2

ServicesK]jna[]k�Yj]�l`]�hj]%[gf^a_mj]\�hjgpa]k�Yf\�hY[c]l�^adl]jk�l`Yl�kgjl�Yf\�\aj][l�ljY^^a[�^gj�l`]k]�lqh]k�g^�hjglg[gdk&�

Senders and Recipients for a Service>gj�]Y[`�k]jna[]�qgm�oYfl�Y[lan]$�qgm�emkl�k]l�af[geaf_�Yf\'gj�gml_g%af_�Y[[]kk�jmd]k�gj�hjgh]jla]k$�o`a[`�]flYadk�\]^afaf_�l`]�`gklk$�f]l%ogjck$�dg__af_$�Yf\'gj�mk]jk�o`g�Yj]�h]jeall]\�lg�k]f\�gj�j][]an]�hY[c]lk�l`jgm_`�l`]�^aj]oYdd�mkaf_�l`ak�k]jna[]&�

L`]j]�Yj]�k]hYjYl]�[gfljgdk�^gj�[gf^a_mjaf_�af[geaf_�Yf\�gml_gaf_�ljY^%^a[&�L`]�gml_gaf_�[gfljgdk�\]^af]�o`a[`�`gklk�Yf\�mk]jk�Z]`af\�l`]�>aj]Zgp�[Yf�mk]�l`ak�k]jna[]�lg�afalaYl]�k]kkagfk�oal`�Yf�gmlka\]�`gkl&�L`]�af[geaf_�[gfljgdk�\]^af]�o`a[`�`gklk�Yf\�mk]jk�gmlka\]�l`]�>aj]Zgp�[Yf�mk]�l`ak�k]jna[]�lg�afalaYl]�k]kkagfk�oal`�qgmj�hjgl][l]\�mk]jk�Yf\�`gklk&�Qgm�[Yf�Ydkg�kh][a^q�Yf\�Y\\�l`]�`gklk�gj�mk]jk�lg�]al`]j�kgmj[]k�gj�\]kla%fYlagfk�g^�af[geaf_�gj�gml_gaf_�ljY^^a[�Y[[gj\af_�lg�l`]�jmd]k�qgm�oYfl�lg�\]^af]&

Property Settings>gj�hjgpa]k�km[`�Yk�@LLH$�>LH$�Yf\�KELH$�l`]j]�Yj]�Y\\alagfYd�hjgh]j%la]k�k]llaf_k&�Af�l`]�[Yk]�g^�KELH$�l`]j]�Yj]�k]hYjYl]�k]llaf_k�^gj�af[geaf_�Yf\�gml_gaf_�hjgh]jla]k&�L`]k]�[gfljgdk�]fYZd]�qgm�lg�k]l�lae]gmlk�Yf\�gl`]j�j]d]nYfl�hjgh]jla]k�^gj�l`Yl�hjgpq&�

Logging and Notification=Y[`�k]jna[]�`Yk�l`]�[gfljgdk�lg�]fYZd]�qgm�lg�k]d][l�o`a[`�]n]flk�a^�Yfq�Yj]�lg�Z]�dg__]\$�o`]l`]j�qgm�oYfl�lg�Z]�fgla^a]\�g^�l`]k]�]n]flk$�Yf\�o`]l`]j�qgm�oYfl�lg�Z]�fgla^a]\�Zq�]%eYad$�hY_]j$�hgh%mh�oaf\go$�gj�gl`]j�[mklge�e]l`g\&�

Changing a ServiceGf[]�Y�k]jna[]�ak�Y\\]\$�qgm�[Yf�[`Yf_]�[]jlYaf�^]Ylmj]k�Yf\�YlljaZml]k�YZgml�l`Yl�k]jna[]�oal`gml�\]d]laf_�l`]�k]jna[]�Yf\�Y\\af_�al�Y_Yaf2

42 WatchGuard Internet Security Handbook

Configuring Services

� Qgm�[Yf�[`Yf_]�l`]�jmd]�k]lk�^gj�af[geaf_�Yf\�gml_gaf_�ljY^^a[�^gj�Yf�]paklaf_�k]jna[]&

� Qgm�[Yf�[`Yf_]�dg__af_�Yf\�fgla^a[Ylagf�[`YjY[l]jakla[k�^gj�Y�k]j%na[]&

� Qgm�emkl�\]d]l]�Yf\�Y\\�l`]�k]jna[]�a^�qgm�oYfl�lg�[`Yf_]�alk�hgjl�[gf^a_mjYlagf$�[da]fl�hgjl�k]llaf_$�gj�hjglg[gd�mk]\&

Qgm�[Yf�eg\a^q�Yfql`af_�[gflYaf]\�gf�Y�k]jna[]Ìk�hjgh]jla]k�\aYdg_�Zgp$�Zml�[Yffgl�[`Yf_]�Yfql`af_�l`Yl�ak�hYjl�g^�Y�k]jna[]Ìk�afalaYd�k]lmh&

Deleting a ServiceO`]f]n]j�qgm�oYfl�lg�lYc]�Y�k]jna[]�gml�g^�l`]�[gf^a_mjYlagf$�al�ak�n]jq�kaehd]�lg�\]d]l]�al�^jge�l`]�YddgoYZd]�k]jna[]k$�hjgpa]k$�Yf\�hjg%lg[gdk�af�Y�kaf_d]�gh]jYlagf&

Qgm�[Yf�YdoYq�Y\\�l`]�k]jna[]�ZY[c�af�dYl]j�a^�\]kaj]\&

WatchGuard Internet Security Handbook 43

Proxying and Packet Filtering

44 WatchGuard Internet Security Handbook

CHAPTER 5 Beyond Proxies and Packet Filters

9dl`gm_`�hjgpa]k�Yf\�hY[c]l�^adl]jk�Yj]�l`]�ÉZj]Y\�Yf\�Zmll]jÊ�g^�^aj]oYddk$�l`]j]�Yj]�k]n]jYd�gl`]j�^]Ylmj]k�l`Yl�Yj]�]kk]flaYd�lg�Yf�]^^][lan]�^aj]oYdd$�Yf\�eYfq�gl`]j�^]Ylmj]k�l`Yl��Yj]�YhhjghjaYl]�lg�l`]�ZjgY\]j�[gf[]hl�g^�f]logjc�k][mjalq&�Gl`]j�ZYka[�^aj]oYdd�^mf[%lagfk�af[dm\]�Zdg[caf_�kal]k�Yf\�hgjlk$�AH�eYkim]jY\af_$�f]logjc�Y\\j]kk�ljYfdYlagf� F9L!$�Yf\�Ykka_faf_�a\]fla^a]jk�lg�kh][a^a[�[ge%hml]jk�Yf\�_jgmhk�g^�[gehml]jk� YdaYkaf_!&�Gl`]j�f]logjc�k][mjalq�^]Ylmj]k�af[dm\]�Yml`]fla[Ylagf$�najlmYd�hjanYl]�f]logjcaf_$�Yf\�O]Z�Zdg[caf_&

Blocking Sites

9�Zdg[c]\�kal]�ak�Yf�AH�Y\\j]kk�gmlka\]�l`]�>aj]Zgp�l`Yl�OYl[`?mYj\�hj]n]flk�^jge�[gff][laf_�oal`�`gklk�Z]`af\�l`]�>aj]Zgp&�L`]j]�Yj]�log�caf\k�g^�Zdg[c]\�kal]k2

� H]jeYf]fldq�Zdg[c]\�kal]k$�o`a[`�Yj]�dakl]\�af�l`]�[gf^a_mjYlagf�^ad]$�Yf\�[`Yf_]�gfdq�a^�qgm�eYfmYddq�[`Yf_]�l`]e

� �9mlg%Zdg[c]\�kal]k$�o`a[`�OYl[`?mYj\�Y\\k�gj�\]d]l]k�\qfYea%[Yddq$�ZYk]\�gf�`go�l`]�^aj]oYddÌk��\]^Ymdl�hY[c]l�`Yf\daf_�[gf^a_%mjYlagf�ak�k]l&�>gj�]pYehd]$�qgm�[Yf�[gf^a_mj]�al�lg�Zdg[c�kal]k�l`Yl�gja_afYl]�khgg^af_�Yll]ehlk�Yf\�hgjl�hjgZ]k&�Qgm�[Yf�Ydkg�[gf^a_%mj]�Ymlg%Zdg[caf_�gf�Y�k]jna[]%Zq%k]jna[]�ZYkak�^gj�kal]k�l`Yl�gja_a%fYl]�hY[c]lk�l`Yl�Y�kh][a^a[�k]jna[]�\]fa]k&�9mlg%Zdg[caf_�ak�Y�l]ehgjYjq�klYl]�l`Yl�j]n]jlk�o`]f�l`]�Ymlg%Zdg[caf_�e][`Yfake�lae]k�gml� o`a[`�[Yf�jYf_]�^jge�Y�eafml]�lg�Y�^]o�o]]ck!&

:dg[c]\�Kal]k�Yhhda]k�gfdq�lg�ljY^^a[�gf�l`]�=pl]jfYd�afl]j^Y[]�g^�l`]�>aj]Zgp&�;gff][lagfk�Z]lo]]f�l`]�Ljmkl]\�Yf\�GhlagfYd�afl]j^Y[]k�Yj]�fgl�kmZb][l�lg�l`]�:dg[c]\�Kal]k�dakl&

WatchGuard Internet Security Handbook 45

Beyond Proxies and Packet Filters

:q�\]^Ymdl�l`]�OYl[`?mYj\�kqkl]e�h]jeYf]fldq�Zdg[ck�l`j]]�f]l%ogjc�Y\\j]kk]kÈ)(&(&(&('0$�)/*&(&(&).')*$�Yf\�)1*&).0&(&(').&�L`]k]�Yj]�l`]�hjanYl]�f]logjc�Y\\j]kk]k&�:Y[cZgf]�jgml]jk�k`gmd\�f]n]j�hYkk�ljY^^a[�oal`�l`]k]�Y\\j]kk]k�af�l`]�kgmj[]�gj�\]klafYlagf�^a]d\�g^�Yf�AH�hY[c]l&�A^�l`]j]�ak�ljY^^a[�^jge�gf]�g^�l`]k]�Y\\j]kk]k$�al�ak�Ydegkl�[]jlYafdq�Y�khgg^]\�gj�gl`]joak]�kmkh][l�Y\\j]kk&�J>;k�)1)0$�).*/$�Yf\�)-1/�[gn]j�l`]�mk]�g^�l`]k]�Y\\j]kk]k&

OYl[`?mYj\Ìk�Ymlg%Zdg[caf_�Yf\�dg__af_�e][`Yfakek�[Yf�`]dh�qgm�\][a\]�o`Yl�kal]k�lg�h]jeYf]fldq�Zdg[c&�>gj�]pYehd]$�a^�qgm�[gf^a_%mj]�\]^Ymdl�hY[c]l�`Yf\daf_�lg�j]b][l�khgg^af_�Yll]ehlk$�YmlgeYla%[Yddq�Zdg[c�kal]k�l`Yl�Yll]ehl�khgg^af_$�Yf\�lg�dg_�l`]�khgg^af_�Yll]ehl$�qgm�[Yf�dYl]j�na]o�l`]�dg_k�lg�\]l]jeaf]�a^�kh][a^a[�`gklk�Yj]�[gflafmgmkdq�ljqaf_�lg�khgg^�l`]aj�oYq�aflg�qgmj�kqkl]e&�O`]f�qgm�^af\�gf]�l`Yl�]p`aZalk�l`ak�hYll]jf$�qgm�[Yf�Y\\�l`Yl�kal]Ìk�AH�Y\\j]kk�lg�l`]�h]jeYf]fl�:dg[c]\�Kal]k�dakl&

:dg[c]\�Kal]k�Yj]�mk]^md�Z][Ymk]�qgm�[Yf�[gehd]l]dq�hjgl][l�Y_Yafkl�kqkl]ek�oal`�o`a[`�qgm�oYfl�fg�[gflY[l&�Gf[]�qgm�\]l]jeaf]�km[`�kal]k$�kaehdq�Zdg[c�Ydd�Yll]ehl]\�[gff][lagfk�^jge�l`]e&�Qgm�[Yf�[gf^a_mj]�dg__af_�lg�j][gj\�Ydd�Y[[]kk�Yll]ehlk�^jge�Zdg[c]\�kal]k$�Yf\�l`mk�[gdd][l�[dm]k�Yk�lg�o`Yl�k]jna[]k�l`]q�Yj]�Yll]ehlaf_�lg�YllY[c&

Logging Blocked Sites9dd�g^�l`]�mkmYd�dg__af_�ghlagfk�[Yf�Z]�mk]\�oal`�:dg[c]\�Kal]k&�L`]k]�]n]flk�k`gmd\�Z]�k]fl�lg�l`]�>aj]Zgp�dg_$�Yf\�al�ak�Y�_gg\�a\]Y�lg�`Yn]�l`]�kqkl]e�YmlgeYla[Yddq�fgla^q�l`]�f]logjc�Y\eafakljYlgj�o`]f�Y�Zdg[c]\�kal]�Yll]ehlk�lg�[geemfa[Yl]$�kaf[]�l`ak�ak�Y�jYj]�]n]fl�l`Yl�eYq�ka_fa^q�Yf�Yll]ehl]\�Zj]Yc%af&�

Blocking Ports

:dg[caf_�Hgjlk�]fYZd]k�qgm�lg�]phda[aldq�\akYZd]�[]jlYaf�f]logjc�k]j%na[]k�^jge�]pl]jfYd�Y[[]kk�l`Yl�Yj]�nmdf]jYZd]�]fljq�hgaflk�af�qgmj�gh]jYlagf&�L`ak�lYc]k�hj][]\]f[]�gn]j�Yfq�g^�l`]�[gf^a_mjYlagf�k]l%laf_k�^gj�af\ana\mYd�k]jna[]�[gf^a_mjYlagfk&�

Dac]�:dg[c]\�Kal]k$�:dg[c]\�Hgjlk�Yhhdq�gfdq�lg�hY[c]lk�l`Yl�[ge]�af�lg�qgmj�f]logjc�gf�l`]�=pl]jfYd�afl]j^Y[]&�;gff][lagfk�Z]lo]]f�qgmj�GhlagfYd�Yf\�Ljmkl]\�afl]j^Y[]k�Yj]�fgl�kmZb][l�lg�l`]�:dg[c]\�Hgjlk�dakl&

L;H'AH�f]logjck�lqha[Yddq�mk]�hgjlk�lg�\aklaf_mak`�Z]lo]]f�\a^^]j%]fl�Yhhda[Ylagfk�gf�l`]�kYe]�`gkl&�9hhda[Ylagf�k]jn]jk�mk]�o]dd%cfgof�hgjlk�Ykka_f]\�Zq�Afl]jf]l�9kka_f]\�FmeZ]j�9ml`gjalq�

46 WatchGuard Internet Security Handbook

Blocking Ports

A9F9!�^gj�l`]�k]jn]j�ka\]�g^�Y�[gff][lagf$�Yf\�l`]�[da]fl�ka\]�mk]k�jYf\ge�hgjlk�_j]Yl]j�l`Yf�)(*,&

>gj�]pYehd]$�gf�Y�l]df]l�[gff][lagf�^jge�eY[`af]�dafmk&[ge�lg�lgj%nYd\k&gj_$�qgm�ogmd\�YdoYqk�mk]�hgjl�*+�^gj�l]df]l�gf�lgjnYd\k&gj_� l`]�k]jn]j!$�Yf\�kge]�hgjl�fmeZ]j�_j]Yl]j�l`Yf�)(*,�gf�dafmk&[ge� l`]�[da]fl!&

L`]�^ajkl�l]df]l�[gff][lagf�lg�lgjnYd\k&gj_�ea_`l�mk]�hgjl�)(*,�gf�l`]�[da]fl�ka\]�Yf\�hgjl�*+�gf�l`]�k]jn]j�ka\]&

L`]�f]pl�[gff][lagf�ea_`l�mk]�hgjl�)(*-�gf�l`]�[da]fl�ka\]$�Zml�ogmd\�kladd�mk]�hgjl�*+�gf�l`]�k]jn]j�ka\]&

L`]j]�Yj]�k]n]jYd�j]Ykgfk�l`Yl�Zdg[caf_�hgjlk�[Yf�Z]�mk]^md2

� :dg[c]\�Hgjlk�hjgna\]k�Yf�af\]h]f\]fl�[`][c�lg�hjgl][l�l`]�egkl�k]fkalan]�k]jna[]k&�=n]f�a^�Yfgl`]j�hYjl�g^�OYl[`?mYj\�ak�eak[gf%^a_mj]\$�:dg[c]\�Hgjlk�hjgna\]k�Yfgl`]j�daf]�g^�\]^]fk]�^gj�l`]�egkl�nmdf]jYZd]�k]jna[]k&

� HjgZ]k�lg�hYjla[mdYjdq�k]fkalan]�k]jna[]k�[Yf�Z]�dg__]\�af\]h]f%\]fldq&

� Kge]�L;H'AH�k]jna[]k�l`Yl�mk]�hgjlk�_j]Yl]j�l`Yf�)(*,� k]]�Z]dgo!�Yj]�nmdf]jYZd]�lg�YllY[c�a^�l`]�YllY[c]j�gja_afYl]k�l`]�[gf%f][lagf�^jge�Yf�Yddgo]\�o]dd%cfgof�k]jna[]�d]kk�l`Yf�)(*,&�L`mk$�l`]k]�[gff][lagfk�[Yf�Z]�YllY[c]\�Zq�Yhh]Yjaf_�lg�Z]�Yf�Yddgo]\�[gff][lagf�af�l`]�ghhgkal]�\aj][lagf&�L`]�hgjl�fmeZ]jk�g^�km[`�k]jna[]k�k`gmd\�Z]�Y\\]\�lg�l`]�Zdg[c]\�hgjlk�dakl&

:q�\]^Ymdl$�OYl[`?mYj\�Zdg[ck�imal]�Y�^]o�\]klafYlagf�hgjlk&�L`ak�e]Ykmj]�hjgna\]k�[gfn]fa]fl�\]^Ymdlk�o`a[`�oadd�fgl�j]imaj]�[`Yf_]k�^gj�egkl�[mklge]jk&

Lqha[Yddq$�l`]�^gddgoaf_�k]jna[]k�k`gmd\�YdoYqk�Z]�Zdg[c]\2

X Window (ports 6000-6063)P�Oaf\gok�`Yk�k]n]jYd�\aklaf[l�k][mjalq�hjgZd]ek�o`a[`�eYc]�al�Y�daYZad%alq�gf�l`]�Afl]jf]l&�O`ad]�l`]j]�Yj]�k]n]jYd�Yml`]fla[Ylagf�k[`]e]k�YnYad%YZd]�Yl�l`]�P�k]jn]j�d]n]d$�l`]�egkl�[geegf�gf]k�Yj]�]Ykadq�\]^]Yl]\�Zq�Y�cfgod]\_]YZd]�YllY[c]j&�A^�Yf�YllY[c]jk�[Yf�[gff][l�lg�Yf�P�k]jn]j$�l`]q�[Yf�]Ykadq�j][gj\�Ydd�c]qkljgc]k�lqh]\�Yl�l`]�ogjcklYlagf$�[gdd][laf_�Yfq�hYkkogj\k�Yf\�gl`]j�k]fkalan]�af^gjeYlagf&�Ogjk]$�km[`�afljmkagfk�[Yf�Z]�\a^^a[mdl�gj�aehgkkaZd]�lg�\]l][l�Zq�Ydd�Zml�l`]�egkl�cfgod]\_]YZd]�Yf\�hYjYfga\�mk]jk&

L`]�^ajkl�P�Oaf\go�k]jn]j�ak�YdoYqk�gf�hgjl�.(((&�A^�qgm�`Yn]�Yf�P�k]jn]j�oal`�emdlahd]�\akhdYqk$�]Y[`�f]o�\akhdYq�mk]k�Yf�Y\\a%lagfYd�hgjl�fmeZ]j�Y^l]j�.((($�mh�lg�.(.+�^gj�Y�eYpaeme�g^�.,�\akhdYqk�gf�Y�_an]f�`gkl&

WatchGuard Internet Security Handbook 47

Beyond Proxies and Packet Filters

X Font Server (port 7100)J][]fl�n]jkagfk�g^�P�Oaf\gok�kmhhgjl�^gfl�k]jn]jk&�O`ad]�l`]j]�Yj]�fg�cfgof�k][mjalq�jakck�Ykkg[aYl]\�oal`�P�^gfl�k]jn]jk$�l`]k]�Yj]�f]o$�[ge%hd]p�hjg_jYek�o`a[`�jmf�Yk�l`]�kmh]j%mk]j�gf�egkl�`gklk&�9k�km[`$�al�ak�Z]kl�lg�]phda[aldq�\akYZd]�Y[[]kk�lg�P�^gfl�k]jn]jk&

NFS (port 2049)F>K� l`]�F]logjc�>ad]�Kqkl]e!�ak�Y�hghmdYj�L;H'AH�k]jna[]�^gj�hjgna\%af_�k`Yj]\�^ad]�kqkl]ek�gn]j�Y�f]logjc&�@go]n]j$�[mjj]fl�n]jkagfk�`Yn]�k]jagmk�Yml`]fla[Ylagf�Yf\�k][mjalq�hjgZd]ek�o`a[`�eYc]�hjgna\af_�F>K�k]jna[]�gn]j�l`]�Afl]jf]l�n]jq�\Yf_]jgmk&

OpenWindows (port 2000)Gh]fOaf\gok�ak�Y�oaf\goaf_�kqkl]e�^jge�Kmf�Ea[jgkqkl]ek�o`a[`�`Yk�l`]�kYe]�k][mjalq�jakck�Yk�P�Oaf\gok&

rlogin, rsh, rcp (ports 513, 514)L`]k]�log�k]jna[]k�hjgna\]�j]egl]�Y[[]kk�lg�gl`]j�[gehml]jk�Yf\�Yj]�jYl`]j�afk][mj]�gf�l`]�Afl]jf]l&�Kaf[]�eYfq�YllY[c]jk�hjgZ]�^gj�l`]k]�k]j%na[]k$�al�ak�hjm\]fl�lg�Zdg[c�l`]e&

RPC portmapper (port 111)JH;�K]jna[]k�mk]�hgjl�)))�lg�\]l]jeaf]�o`a[`�hgjlk�Yj]�Y[lmYddq�mk]\�Zq�Y�_an]f�JH;�k]jn]j&�Kaf[]�JH;�k]jna[]k�l`]ek]dn]k�Yj]�l]jjaZdq�nmdf]jY%Zd]�lg�YllY[c�gn]j�l`]�Afl]jf]l$�l`]�^ajkl�kl]h�af�YllY[caf_�JH;�k]jna[]k�ak�lg�[gflY[l�l`]�hgjleYhh]j�lg�^af\�gml�o`a[`�k]jna[]k�Yj]�YnYadYZd]&

port 0Hgjl�(�ak�j]k]jn]\�Zq�A9F9$�Zml�eYfq�hjg_jYek�o`a[`�k[Yf�hgjlk�klYjl�l`]aj�k]Yj[`�gf�hgjl�(&

port 1Hgjl�)�ak�^gj�l`]�jYj]dq�mk]\�L;Hemp�k]jna[]&�:dg[caf_�al�ak�Yfgl`]j�oYq�lg�[gf^mk]�hgjl�k[Yffaf_�hjg_jYek&

Other ServicesFgn]dd�AHP�gn]j�AH� hgjl�*)+!&�A^�qgm�mk]�Fgn]dd�AHP�gn]j�AH�afl]jfYddq$�qgm�ea_`l�oYfl�lg�]phda[aldq�Zdg[c�hgjl�*)+�`]j]&

NetBIOS services (ports 137 through 139)Qgm�k`gmd\�Ydkg�Zdg[c�l`]k]�hgjlk�a^�qgm�mk]�F]l:AGK�afl]jfYddq&�O`ad]�km[`�k]jna[]k�Yj]�Zdg[c]\�aehda[aldq�Zq�\]^Ymdl�hY[c]l�̀ Yf\daf_$�Zdg[caf_�l`]e�`]j]�[Yf�Z]�[gfn]fa]fl�Z][Ymk]�l`]q�[Yf�YmlgeYla[Yddq�Y\\�`gklk�lg�l`]�:dg[c]\�Kal]�Dakl&

Conflicts in Blocked PortsKge]lae]k�ÉjYf\geÊ�hgjlk�Yj]fÌl�jYf\ge&�Al�ak�hgkkaZd]�l`Yl�d]_ala%eYl]�mk]jk�ea_`l�`Yn]�hjgZd]ek�Z][Ymk]�g^�Zdg[c]\�hgjlk&�Af�hYjla[%mdYj$�kge]�[da]flk�ea_`l�l]ehgjYjadq�^Yad�Z][Ymk]�g^�Zdg[c]\�hgjlk&�Af�

!NOTE

Port 2049 is not assigned to NFS; however, in practice, this is the most common port used. The port assigned for NFS is assigned by the portmapper. It would be a good idea to verify that NFS is using port 2049 on all your systems.

48 WatchGuard Internet Security Handbook

Network Address Translation (NAT)

hjY[la[]�l`ak�`Yk�fgl�Z]]f�Y�hjgZd]e$�Z][Ymk]�Yhhda[Ylagf�dYq]jk�[Yf�Yf\�\g�j]ljq�^Yad]\�[gff][lagfk&

Qgm�k`gmd\$�`go]n]j$�Z]�n]jq�[Yj]^md�YZgml�Zdg[caf_�hgjl�fmeZ]jk�Z]lo]]f�)(((�l`jgm_`�)111$�Yk�l`]k]�fmeZ]jk�Yj]�hYjla[mdYjdq�dac]dq�lg�Z]�mk]\�Yk�[da]fl�hgjlk&

Auto-blocking sites that attempt to use blocked portsQgm�[Yf�[gf^a_mj]�Y�Zdg[c]\�hgjl�km[`�l`Yl�o`]f�Yf�gmlka\]�`gkl�Yll]ehlk�lg�Y[[]kk�al$�l`Yl�gmlka\]�`gkl�ak�l]ehgjYjadq�Ymlg%Zdg[c]\&�Qgm�[Yf�Ydkg�k]l�l`]�\mjYlagf�g^�l`]�Ymlg%Zdg[c&

Logging Blocked Port ActivityQgm�[Yf�Ydkg�Y\bmkl�qgmj�]n]fl�dg_k�Yf\�fgla^a[Ylagf�lg�Y[[geeg\Yl]�Yll]ehlk�lg�Y[[]kk�Zdg[c]\�hgjlk&�Qgm�[Yf�[gf^a_mj]�l`]�k][mjalq�kqk%l]e�lg�dg_�Ydd�Yll]ehlk�lg�mk]�Zdg[c�hgjlk$�Yf\�[Yf�^mjl`]j�[gf^a_mj]�l`]�kqkl]e�lg�k]fl�Y�f]logjc�Y\eafakljYlgj�fgla^a[Ylagf�o`]f�kge]%gf]�Yll]ehlk�lg�Y[[]kk�Y�Zdg[c]\�hgjl&

Network Address Translation (NAT)

F]logjc�9\\j]kk�LjYfkdYlagf�eYhk�hjanYl]�Y\\j]kk]k�lg�hmZda[�gf]k�Yf\�na[]�n]jkY&�F9L�ak�Ydkg�cfgof�Yk�AH�eYkim]jY\af_�gj�hgjl�^gj%oYj\af_$�\]h]f\af_�gf�l`]�lqh]�g^�Y\\j]kk�ljYfkdYlagf�h]j^gje]\&�:Yka[Yddq$�l`]j]�Yj]�log�lqh]k�g^�F9L2

� <qfYea[�F9L$� Ydkg�cfgof�Yk�AH�eYkim]jY\af_�gj�hgjl�Y\\j]kk�ljYfkdYlagf!�o`a[`�hj]k]flk�l`]�>aj]ZgpÌk�AH�Y\\j]kk�lg�l`]�hmZda[$�o`ad]�al�`a\]k�Yf\�ljYfkdYl]k�l`]�AH�Y\\j]kk]k�g^�l`]�`gklk�al�ak�hjg%l][laf_&�<qfYea[�F9L�hjgl][lk�`gklkÌ�a\]flala]k�af�gml_gaf_�ljY^%^a[&

� KlYla[�F9L$� Ydkg�cfgof�Yk�hgjl�^gjoYj\af_!�o`a[`�Ykka_fk�Y�hgjl�kh][a^a[�lg�Y�_an]f�k]jna[]� km[`�Yk�hgjl�0(�^gj�@LLH!�lg�Yfgl`]j�hgjl�afl]jfYddq$�kg�l`Yl�gja_afYlgjk�g^�af[geaf_�ljY^^a[�f]n]j�cfgo�o`Yl�`gkl�ak�Y[lmYddq�j][]anaf_�l`]�hY[c]lk&

Dynamic NAT<qfYea[�F9L�̀ a\]k�dg[Yd�f]logjc�Y\\j]kk]k�^jge�gl`]j�̀ gklk�gf�l`]�Afl]jf]l&�@gklk�]dk]o`]j]�gf�l`]�Afl]jf]l�k]]�gfdq�hY[c]lk�^jge�l`]�

!NOTE

Solaris uses ports greater than 32768 for clients.

WatchGuard Internet Security Handbook 49

Beyond Proxies and Packet Filters

>aj]Zgp�alk]d^&�<qfYea[�F9L�[Yf�ljYfkdYl]�l`]�Y\\j]kk]k�g^�Ydegkl�Ydd�L;H�Yf\�M<H%ZYk]\�ljYfkeakkagfk&

Af�<qfYea[�F9L$�gml_gaf_�hY[c]lk�Yj]�eYhh]\�lg�Y�jYf\ge�hgjl�gf�l`]�>aj]Zgp&�L`]�kgmj[]�Y\\j]kk�gf�l`]k]�hY[c]lk�ak�l`]f�j]%ojall]f�oal`�l`]�AH�Y\\j]kk�g^�l`]�>aj]Zgp$�Yf\�l`]�jYf\ge�hgjl�fmeZ]j&�L`]�j]egl]�]f\�k]]k�l`]�AH�Y\\j]kk�g^�l`]�>aj]Zgp�Yf\�l`]�jYf\ge�hgjl�fmeZ]j&�<YlY�ak�k]fl�ZY[c�lg�l`ak�dg[Ylagf3�l`]�>aj]Zgp�l`]f�]pYeaf]k�l`]�`]Y\]jk$�Yf\�eYhk�l`]�hgjl�fmeZ]j�ZY[c�lg�l`]�eYkim]jY\]\�`gkl&

L`ak�Y\\j]kk�ljYfkdYlagf�ak�\qfYea[�af�l`Yl�Y�f]o�hgjl%lg%afl]jfYd%`gkl�eYhhaf_�ak�eY\]�^gj�]Y[`�[gff][lagf&�Gf�Yfq�_an]f�[gff][lagf$�Yf�afl]jfYd�`gkl�eYq�Z]�eYhh]\�lg�Yfq�_an]f�hgjl&�L`]�aehda[Ylagfk�g^�l`ak�Yj]�aehgjlYfl2�<qfYea[�F9L�ogjck�gfdq�gf]�oYqÈ^gj�Gml%_gaf_�ljY^^a[&�Lg�h]j^gje�l`]�kYe]�kgjl�g^�gh]jYlagf�^jge�l`]�gmlka\]�lg�l`]�afka\]$�qgm�emkl�]ehdgq�KlYla[�F9L�lg�\]ka_fYl]�kh][a^a[�afl]jfYd�`gklk�lg�j][]an]�l`]�hY[c]lk�g^�gfdq�gf]�hgjl&�KlYla[�F9L�ak�\]k[jaZ]\�af�egj]�\]lYad�af�l`]�f]pl�k][lagf&

Important Dynamic NAT Configuration Parameters<qfYea[�F9L�`Yk�k]n]jYd�[gf^a_mjYZd]�hYjYe]l]jk$�g^�o`a[`�l`]�^gd%dgoaf_�Yj]�hYjla[mdYjdq�ka_fa^a[Yfl2

TimeoutsL`]j]�Yj]�l`j]]�Y\bmklYZd]�lae]gml�nYdm]k�Ykkg[aYl]\�oal`�<qfYea[�F9L2�L;H�A\d]�Lae]gml$�L;H�>afak`�Lae]gml$�Yf\�M<H�A\d]�Lae]gml&�L`]�L;H�lae]gml�nYdm]�Y[lk�Yk�Yf�a\d]�lae]gml�^gj�nYjagmk�L;H�[gff][%lagfk&�9�dYj_]j�nYdm]�ak�`]dh^md�a^�qgm�h]j^gje�dYj_]�^ad]�ljYfk^]jk�gj�dgf_%dan]\�l]df]l�k]kkagfk�Y[jgkk�l`]�^aj]oYdd&�L;H�>afak`�Lae]gml�daealk�l`]�Yegmfl�g^�lae]�Y�k]kkagf�oYalk�^gj�Y�^afak`�hY[c]l�^jge�l`]�j]egl]�kal]$�Yf\�M<H�lae]gml�daealk�l`]�oYal�gf�M<H�k]kkagfk&

Use Dynamic NAT on these networksQgm�[Yf�\]ka_fYl]�o`a[`�f]logjck�`Yn]�l`]aj�Y\\j]kk]k�\qfYea[Yddq�ljYfkdYl]\�lg�l`]�=pl]jfYd�afl]j^Y[]&�Gmlka\]�l`]�afl]j^Y[]$�Ydd�[geemfa%[Ylagf�^jge�l`]k]�`gklk�Yhh]Yjk�lg�[ge]�^jge�qgmj�>aj]Zgp&�Qgm�[Yf�eYkim]jY\]�Yk�eYfq�`gklk�gj�f]logjck�Yk�qgm�dac]&�A^�qgm�mk]�hjanYl]�f]logjck�af�qgmj�gj_YfarYlagf$�qgmj�hjanYl]�f]logjck�k`gmd\�Z]�fme%Z]j]\�af�gf]�g^�l`]�^gddgoaf_�Y\\j]kk�jYf_]k2

Ò )(&(&(&(�lg�)(&*--&*--&*--� )(&(&(&('0�af�kdYk`�fglYlagf!Ò )/*&).&(&(�%�)/*&+)&*--&*--� )/*&).&(&(')*�af�kdYk`�fglYlagf!Ò )1*&).0&(&(�%�)1*&).0&*--&*--� )1*&).0&(&(').�af�kdYk`�fglYlagf!L`]k]�Yj]�l`]�hjanYl]�j]k]jn]\�f]logjc�fmeZ]jk&�;gfkmdl�J>;�)1)0�^gj�egj]�af^gjeYlagf�gf�j]k]jn]\�AH�Y\\j]kk]k&�:q�\]^Ymdl$�l`]k]�Yj]�Ydj]Y\q�]fl]j]\�af�l`]�EYkim]jY\]�Zgp$�kg�qgm�eYq�fgl�f]]\�lg�[gf^a_mj]�Yfql`af_�Y\\alagfYd&

ExceptionsQgm�[Yf�\]ka_fYl]�`gklk�gf�qgmj�ljmkl]\�Yf\�ghlagfYd�f]logjck�l`Yl�oadd�fgl�mk]�<qfYea[�F9L�o`]f�[geemfa[Ylaf_�oal`�l`]�ljmkl]\�f]logjck&�

50 WatchGuard Internet Security Handbook

Aliasing

A^�qgm�<qfYea[�F9L�gfdq�l`]�ghlagfYd�gj�l`]�ljmkl]\�afl]j^Y[]$�qgm�[Yf�eYfmYddq�\akYZd]�al�Z]lo]]f�l`Yl�afl]j^Y[]�Yf\�l`]�gl`]j&�A^�Zgl`�afl]j%^Y[]k�<qfYea[�F9L$�l`]�k][mjalq�kqkl]e�YmlgeYla[Yddq�\akYZd]k�eYk%im]jY\af_�Z]lo]]f�l`]e&

Static NATKlYla[�F9L�hjgna\]k�hjgl][lagf�^jge�af[geaf_�ljY^^a[&�Al�eYaflYafk�l`]�k][mjalq�g^�Yfgfqealq�g^�<qfYea[�F9L�Yf\�Y\\k�l`]�^mf[lagfYd%alq�g^�^gjoYj\af_�]pl]jfYddq�gja_afYl]\�ljY^^a[�lg�kh][a^a[�afl]jfYd�`gklk&

KlYla[�F9L�j]\aj][lk�AH�hY[c]lk�\]klaf]\�lg�Y�>aj]Zgp�lg�l`]�kh][a^a[�eYkim]jY\]\�`gkl�Z]`af\�al&�Al�j]ojal]k�l`]�`]Y\]jk�g^�l`]�hY[c]lk�Yf\�^gjoYj\k�l`]e�ZYk]\�gf�l`]�gja_afYd�\]klafYlagf�hgjl�fmeZ]j&�Qgm�lqha[Yddq�mk]�KlYla[�F9L�̂ gj�hmZda[�k]jna[]k�km[`�Yk�O]Zkal]k�Yf\�]%eYad&

>gj�]pYehd]$�qgm�ea_`l�oYfl�lg�k]l�mh�Y�eYad�k]jn]j�l`Yl�`Yk�Yfg%fqealq$�gj�l`Yl�`Yk�Yf�AH�Y\\j]kk�l`Yl�ogmd\�fgl�Z]�d]_alaeYl]�gf�l`]�]pl]jfYd�f]logjc&�KlYla[�F9L�]fYZd]k�qgm�lg�\]ka_fYl]�Y�kh][a^a[�afl]jfYd�k]jn]j�lg�j][]an]�Ydd�]%eYad&�L`]f$�o`]f]n]j�kge]gf]�k]f\k�]%eYad�Y\\j]kk]\�lg�l`]�>aj]Zgp$�l`]�>aj]Zgp�ÉcfgokÊ�lg�ljYfkdYl]�l`]�Y\\j]kk�lg�l`]�\]ka_fYl]\�]%eYad� KELH!�k]jn]j&

Configuring Static NATLg�[gf^a_mj]�KlYla[�F9L�^gj�Y�_an]f�`gkl$�al�emkl�Ydj]Y\q�Z]�gf�Y�f]l%ogjc�mkaf_�<qfYea[�F9L&�KlYla[�F9L�ak�[gf^a_mj]\�gf�Y�k]jna[]%Zq%k]jna[]�ZYkak&�O`]f�qgm�k]l�mh�Y�_an]f�k]jna[]� ^gj�]pYehd]$�KELH!$�gf[]�qgm�\]l]jeaf]�l`]�]da_aZd]�>jge�Yf\�Lg�`gklk�^gj�af[geaf_�Yf\�gml_gaf_�ljY^^a[$�qgm�eYq�l`]f�Yhhdq�KlYla[�F9L�lg�ljYfkdYl]�l`]�]pl]jfYd�Y\\j]kk�lg�Yf�afl]jfYd�Y\\j]kk3�qgm�[Yf�Ydkg�eYkim]jY\]�l`]�hgjl�^gj�l`Yl�k]jna[]�lg�kge]l`af_�]dk]2

Aliasing

9daYkaf_�]fYZd]k�qgm�lg�[gf^a_mj]�nYjagmk�[gdd][lagfk�g^�[gehml]jk�aflg�_jgmhk$�Yf\�[j]Yl]�_jgmhk�g^�mk]jk�oal`�nYjqaf_�d]n]dk�g^�h]j%eakkagfk&

9daYkaf_�hjgna\]k�Y�kaehd]�oYq�lg�j]e]eZ]j�AH�Y\\j]kk]k$�FL�<geYaf�?jgmhk�Yf\�Mk]jk$�f]logjc�AH�Y\\j]kk]k$�Yf\�kmh]j_jgmhk�[gflYafaf_�kge]�[geZafYlagf�g^�_jgmhk$�mk]jk$�\geYafk$�Yf\�AH�Y\\j]kk]k&�9daYk]k�[Yf�l`]f�Z]�mk]\�^gj�Zmad\af_�Y[[]kk�jmd]k�^gj�k]j%na[]k$�^gj�Yml`]fla[Ylagf�_jgmhk$�Yf\�^gj�_jgmhk�o`]f�[gf^a_mjaf_�O]Z�:dg[c]j&�

WatchGuard Internet Security Handbook 51

Beyond Proxies and Packet Filters

9daYkaf_�ak�l`]�Y[l�g^�\]daf]Ylaf_�qgmj�gj_YfarYlagf�Y[[gj\af_�lg�qgmj�k][mjalq�hgda[q&�Al�af[dm\]k�l`]�^gddgoaf_2

“Friendly” host names9�\]k[jahlan]�gj�]Ykadq�j]e]eZ]j]\�fYe]�Yk�Yf�YdaYk�^gj�Y�_an]f�k]jn]j�gj�ogjcklYlagfÌk�AH�Y\\j]kk&

“Friendly” network names9�\]k[jahlan]�gj�]Ykadq�j]e]eZ]j]\�fYe]�Yk�Yf�YdaYk�^gj�Y�f]logjcÌk�AH�Y\\j]kk&

Work GroupsL`]k]�Yj]�_jgmhk�g^�ogjcklYlagfk�Yf\'gj�k]jn]jk$�mkmYddq�gj_Yfar]\�Zq�^mf[lagf�gj�\]hYjle]fl&

Privilege GroupsAf�O]Z:dg[c]j$�qgm�[Yf�[j]Yl]�_jgmhk�ZYk]\�gf�o`Yl�O]Zkal]k�qgmÌdd�Yddgo�l`]e�lg�Y[[]kk�Yf\�o`]f&

Authentication GroupsL`]k]�Yj]�_jgmhk�gj_Yfar]\�Zq�o`]l`]j�l`]q�j]egl]dq�Y[[]kk�qgmj�f]l%ogjc�naY�J9<AMK$�;JQHLG;Yj\$�gj�OYl[`?mYj\�Yml`]fla[Ylagf&

Authentication

Mk]j�9ml`]fla[Ylagf�Yddgok�af\ana\mYd�mk]jk�lg�Yml`]fla[Yl]�lg�l`]�>aj]Zgp&�Al�ak�_]f]jYddq�mk]\�lg�hjgna\]�Y[[]kk�[gfljgd�^gj�gml_gaf_�[gff][lagfk&�

Mk]j�9ml`]fla[Ylagf�eYhk�Y�mk]j�fYe]�lg�Y�ogjcklYlagf�AH�Y\\j]kk$�Yddgoaf_�l`]�ljY[caf_�g^�[gff][lagfk�ZYk]\�gf�mk]j�fYe]�jYl`]j�l`Yf�AH�Y\\j]kk&�L`]�mk]jÌk�ogjcklYlagf�emkl�̀ Yn]�Y�BYnY%[YhYZd]�Afl]jf]l�Zjgok]j&�>gj�f]logjck�mkaf_�<qfYea[�@gkl�;gfljgd�Hjglg[gd� <@;H!$�l`ak�ak�ka_fa^a[Yfl&�9�mk]jÌk�ogjcklYlagf�eYq�`Yn]�k]n]jYd�\a^^]j]fl�AH�Y\\j]kk]k�gn]j�l`]�[gmjk]�g^�Y�o]]c$�eYcaf_�al�af[j]Yk%af_dq�\a^^a[mdl�lg�ljY[c�l`]�Y[lanala]k�g^�Y�kaf_d]�mk]j&

Oal`�Mk]j�9ml`]fla[Ylagf$�al�fg�dgf_]j�eYll]jk�o`Yl�AH�Y\\j]kk�ak�Z]af_�mk]\$�gj�^jge�o`a[`�eY[`af]�Y�mk]j�[`ggk]k�lg�ogjc&�Lg�_Yaf�Y[[]kk�lg�Afl]jf]l�k]jna[]k� km[`�Yk�Gml_gaf_�@LLH�gj�Gml_gaf_�>LH!�l`]�mk]j�emkl�hjgna\]�Yml`]fla[Ylaf_�\YlY�af�l`]�^gje�g^�Y�dg_af�Yf\�hYkkogj\&�>gj�l`]�\mjYlagf�g^�l`]�Yml`]fla[Ylagf$�l`]�mk]jÌk�fYe]�ak�la]\�lg�[gff][lagfk�gja_afYlaf_�^jge�l`]�AH�Y\\j]kk�^jge�o`a[`�l`]�mk]j�Yml`]fla[Yl]\&

!NOTE

Firebox Domain users and groups and NT Domain users and groups are not the same as Host Aliases. You can use the Aliases tab, however, to create host aliases that contain Firebox Domain users and NT Domain users.

52 WatchGuard Internet Security Handbook

Authentication

L`ak�eYc]k�al�hgkkaZd]�lg�ljY[c�fgl�gfdq�l`]�eY[`af]k�^jge�o`a[`�[gff][lagfk�Yj]�gja_afYlaf_$�Zml�Ydkg�^jge�o`ge�l`]q�Yj]�gja_afYl%af_&

Gl`]j�kalmYlagfk�o`]j]�Yml`]fla[Ylagf�ea_`l�Z]�mk]^md�af[dm\]�]\m%[Ylagf�]fnajgfe]flk$�km[`�Yk�[dYkkjggek$�Yf\�[gdd]_]�[gehml]j�[]f%l]jk�o`]j]�eYfq�\a^^]j]fl�h]ghd]�ea_`l�mk]�l`]�kYe]�AH�Y\\j]kk�gn]j�l`]�[gmjk]�g^�l`]�\Yq&

Authentication Methods9ml`]fla[Ylagf�ak�mk]\�lg�hgkalan]dq�a\]fla^q�mk]jk�Yf\�\]^af]�Émk]jÊ�Yf\�Émk]j�_jgmhÊ�hgda[a]k&�L`]�OYl[`?mYj\�Dan]K][mjalq�Kqkl]e�[Yf�Yml`]fla[Yl]�mk]jk�Y_Yafkl�^gmj�Yml`]fla[Ylagf�k]jn]jk2�

� FL�hjaeYjq�\geYaf�[gfljgdd]jk&� 9�f]logjc�\geYaf�ak�Y�_jgmh�g^�[gehml]jk�Yf\�\]na[]k�gf�Y�f]logjc�l`Yl�Yj]�Y\eafakl]j]\�Yk�Y�mfal�oal`�[geegf�jmd]k�Yf\�hjg[]\mj]k& )

� J9<AMK%[gehdaYfl�Yml`]fla[Ylagf�k]jn]jk� Yk�\]^af]\�af�J>;�*)+0!�

� ;JQHLG;Yj\�Yml`]fla[Ylagf�� OYl[`?mYj\�k�Zmadl%af�Yml`]fla[Ylagf�k]jn]j� >aj]Zgp�\geYaf!

L`]�\a^^]j]f[]k�Yegf_�l`]�nYjagmk�Yml`]fla[Ylagf�k[`]e]k�Yj]�dYj_]dq�ljYfkhYj]fl�lg�l`]�mk]j3�l`]�mk]j�h]j^gjek�l`]�kYe]�k]im]f[]�g^�lYkck�lg�Z]�Yml`]fla[Yl]\�Y_Yafkl�Yfq�g^�l`]�^gmj�lqh]k�g^�Yml`]fla%[Ylagf&�

L`]�\a^^]j]f[]�^gj�l`]�>aj]Zgp�Y\eafakljYlgj�ak�l`Yl�af�gf]�[Yk]�l`]�\YlYZYk]�g^�mk]jfYe]k$�hYkkogj\k$�Yf\�_jgmhk�Yj]�klgj]\�gf�l`]�>aj]Zgp�alk]d^$�Yf\�af�l`]�gl`]j�[Yk]k$�l`]�mk]jfYe]k$�hYkkogj\k$�Yf\�_jgmhk�Yj]�klgj]\�gf�l`]�k]jn]j�h]j^gjeaf_�l`]�Yml`]fla[YlagfÈOaf\gok�FL�k]jn]j$�JY\amk�k]jn]j$�gj�;JQHLG;Yj\�k]jn]j&�

Af�l`]�[Yk]�g^�Yf�]pl]jfYd�Yml`]fla[Ylagf�k]jn]j$�qgm�emkl�k]l�mh�l`Yl�k]jn]j�Y[[gj\af_�lg�l`]�eYfm^Y[lmj]jÌk�afkljm[lagfk�Yf\�hdY[]�al�gf�l`]�f]logjc�kg�al�ak�Y[[]kkaZd]�Zq�l`]�>aj]Zgp&

!NOTE

Because usernames are bound to IP addresses, User Authentication should never be used in an environment where multi-user machines (such as Unix servers) are being used. Only one user per machine can be authenticated at any one time.

WatchGuard Internet Security Handbook 53

Beyond Proxies and Packet Filters

A^�qgm�Ydj]Y\q�Yj]�mkaf_�Y�Oaf\gok�FL�<geYaf�;gfljgdd]j$�qgm�eYq�oYfl�lg�[gflafm]�mkaf_�l`Yl�^gj�mk]j�Yml`]fla[Ylagf�^gj�k]jna[]k�gl`]j�l`Yf�J]egl]�Mk]j�NHF&�

Af�Y\\alagf$�l`]j]�Yj]�log�?dgZYd�9ml`]fla[Ylagf�K]llaf_k2�

� Dg_gf�lae]gml�o`]j]�qgm�k]d][l�`go�eYfq�k][gf\k�Yj]�Yddgo]\�^gj�Yf�Yll]ehl]\�dg_gf�Z]^gj]�l`]�lae]gml�k`mlk�\gof�l`]�[gff][%lagf

� K]kkagf�lae]gml�o`]j]�qgm�k]l�`go�eYfq�`gmjk�Y�k]kkagf�[Yf�j]eYaf�gh]f�oal`gml�c]qkljgc]k�Z]^gj]�l`]�lae]gml�k`mlk�\gof�l`]�[gff][lagf&

The WatchGuard Authentication ImplementationLg�Yml`]fla[Yl]$�mkaf_�Yfq�BYnY�]fYZd]\�[da]fl�Zjgok]j$�km[`�Yk�F]lk[Yh]�FYna_Ylgj�gj�Ea[jgkg^l�Afl]jf]l�=phdgj]j$�mk]jk�^ajkl�im]jq�Yf�Yml`]fla[Ylagf�\Y]egf�gf�l`]�>aj]Zgp&�9�ea[jg%OOO�k]jn]j�gf�l`]�>aj]Zgp�l`]f�k]f\k�Y�BYnY�Yhhd]l�ZY[c�lg�l`]�mk]j$�o`]j]af�fYe]�Yf\�hYkkogj\�af^gjeYlagf�ak�]fl]j]\&�L`ak�af^gjeYlagf�ak�]f[jqhl]\�oal`af�l`]�Yhhd]l�Yf\�hYkk]\�ZY[c�lg�l`]�>aj]Zgp�^gj�n]ja^a[Ylagf�Y_Yafkl�l`]�Yml`]fla[Ylagf�k]jn]j�\]^af]\�af�alk�[gf^a_mjYlagf&�9k�Y�j]kmdl$�l`]�kqkl]e�Yml`]fla[Yl]k�mk]jk�bmkl�gf[]$�afkl]Y\�g^�]Y[`�lae]�l`]q�Yll]ehl�lg�[gff][l�lg�Y�kal]&�Mk]j�fYe]�Yf\�hYkkogj\�af^gjeY%lagf�f]]\]\�^gj�Yml`]fla[Ylagf�ak�f]n]j�hYkk]\�af�[d]Yj�l]pl&

9ml`]fla[Ylagf�ak�hYjla[mdYjdq�[jm[aYd�o`]f�qgm�mk]�\qfYea[�AH�Y\\j]kkaf_� <@;H!�Z]`af\�l`]�>aj]Zgp$�gj�oYfl�mk]jk�lg�a\]fla^q�l`]ek]dn]k�Z]^gj]�h]j^gjeaf_�nYjagmk�k]jna[]k�l`jgm_`�l`]�>aj]Zgp&�Oal`�l`]�OYl[`?mYj\�Dan]K][mjalq�Kqkl]e$�Yml`]fla[Ylagf�[Yf�Z]�[gf^a_mj]\�gf�Y�k]jna[]%Zq%k]jna[]�ZYkak�Yddgoaf_�mk]jk�lg�gfdq�f]]\�lg�Yml`]fla[Yl]�^gj�[]jlYaf�k]jna[]k&

OYl[`?mYj\�g^^]jk�^mdd�afl]jgh]jYZadalq�oal`�klYf\Yj\k%ZYk]\�Yml`]fla[Ylagf�l][`fgdg_q�^jge�;JQHLG;Yj\�^gj�Zgl`�;JQHLG9\%eaf�Yf\�J:%)�Lgc]fk&�L`ak�]fYZd]k�qgm�lg�k][mj]�f]logjc�Y[[]kk�mkaf_�hgo]j^md�lgc]f%ZYk]\�Yml`]fla[Ylagf�kgdmlagfk�^jge�;JQHLG%;Yj\$�af�[gfbmf[lagf�oal`�l`]�OYl[`?mYj\�Dan]K][mjalq�Kqkl]e&

L`]�Zmadl%af�Yml`]fla[Ylagf�k]jn]j�af[dm\]\�oal`�l`]�OYl[`?mYj\�Dan]K][mjalq�Kqkl]e�ak�\]ka_f]\�^gj�keYdd]j�]fnajgfe]flk&�Mk]j�fYe]k$�_jgmh�fYe]k�Yf\�hYkkogj\k�[Yf�Z]�]fl]j]\�\aj][ldq�aflg�l`]�>aj]Zgp�[gf^a_mjYlagf�lg�k]l�af\ana\mYd�^adl]j�jmd]k�Yk�\]kaj]\&

!NOTE

Only one type of User Authentication may be used at a time.

54 WatchGuard Internet Security Handbook

Authentication

Firebox AuthenticationMk]jfYe]k$�hYkkogj\k$�Yf\�_jgmhk�eYq�Ydkg�Z]�klgj]\�af�l`]�>aj]Zgp&�L`]k]�Y[[gmflk�Yj]�Ydkg�mk]\�^gj�J]egl]�Mk]j�NHF&�

>gj�FL�<geYaf�;gfljgdd]j�gj�JY\amk�Yml`]fla[Ylagf$�qgm�emkl�]fl]j�l`]�mk]jk�Yf\'gj�_jgmhk�gf�l`]�j]kh][lan]�Oaf\gok�FL�gj�JY\amk�Yml`]fla[Ylagf�k]jn]jk&�>gj�>aj]Zgp�<geYaf�Y[[gmflk$�`go]n]j$�qgm�h]j^gje�Ydd�Yml`]fla[Ylagf�k]lmh�gf�l`]�>aj]Zgp�Mk]jk�lYZ�g^�l`]�E]eZ]j�9[[]kk�Yf\�Mk]j�9ml`]fla[Ylagf�K]lmh�\aYdg_�Zgp&

Af�[gf^a_mjaf_�>aj]Zgp�Yml`]fla[Ylagf$�qgm�[Yf�\]^af]�mk]jk�Yf\�_jgmhk$�Yf\�Ykka_f�e]eZ]jk�lg�kh][a^a[�_jgmhk&�

Windows NT AuthenticationOaf\gok�FL�<geYaf�Mk]j�9ml`]fla[Ylagf�ak�ZYk]\�gf�FL�<geYaf�Mk]jk�Yf\�?jgmhk$�Yf\�mk]k�l`]�Mk]j�Yf\�?jgmh�\YlYZYk]�Ydj]Y\q�af�hdY[]�gf�qgmj�Oaf\gok�FL�<geYaf�;gfljgdd]j&

OYl[`?mYj\Ìk�aehd]e]flYlagf�g^�Yml`]fla[Ylagf�naY�Y�Oaf\gok�FL�k]jn]j�Ykkme]k�qgm�`Yn]�[gf^a_mj]\�qgmj�Oaf\gok�FL�k]jn]j�oal`�mk]jk�Yf\�_jgmhk&�Qgm�[Yf�[gf^a_mj]�l`]k]�hYjYe]l]jk�o`]f�k]llaf_�mh�Oaf\gok�FL�Yml`]fla[Ylagf�^gj�OYl[`?mYj\2

Host NameL`]�`gkl�fYe]�g^�l`]�FL�k]jn]j�qgm�oYfl�lg�mk]�^gj�Yml`]fla[Ylagf&

Automatic IP Address LookupQgm�[Yf�[gf^a_mj]�OYl[`?mYj\�lg�dggc�mh�l`]�AH�Y\\j]kk�^gj�l`]�Oaf%\gok�FL�\geYaf�`gkl�fYe]&

Use Local GroupsQgm�[Yf�mk]�l`]�Oaf\gok�FL�k]jn]jÌk�gj_YfarYlagf�g^�mk]jk�Yf\�_jgmhk&

Radius AuthenticationL`]�J]egl]�9ml`]fla[Ylagf�<aYd%Af�Mk]j�K]jna[]� J9<AMK!�hjgna\]k�j]egl]�mk]jk�oal`�k][mj]�Y[[]kk�lg�[gjhgjYl]�f]logjck&�J9<AMK�ak�Y�[da]fl%k]jn]j�kqkl]e�l`Yl�klgj]k�Yml`]fla[Ylagf�af^gjeYlagf�^gj�mk]jk$�

!NOTE

The group “RemoteVPN” is a special built-in group that contains only currently authenticated Remote User VPN users. You must add user names to this group to enable them to use Remote User VPN.

!NOTE

You cannot use local groups for Windows NT authentication if your administration workstation is a Windows 95 host. Windows 95 does not support the ability to gather the list of local groups from a computer running Windows NT. You must run SMS from a Windows NT host to configure local groups in your rule sets.

WatchGuard Internet Security Handbook 55

Beyond Proxies and Packet Filters

j]egl]�Y[[]kk�k]jn]jk$�Yf\�NHF�_Yl]oYqk�af�Y�[]fljYd�mk]j�\YlYZYk]�YnYadYZd]�lg�Ydd�k]jn]jk&�9ml`]fla[Ylagf�^gj�l`]�]flaj]�f]logjc�`Yh%h]fk�^jge�gf]�dg[Ylagf&�J9<AMK�hj]n]flk�`Y[c]jk�^jge�afl]j[]hlaf_�Yf\�j]khgf\af_�lg�Yml`]fla[Ylagf�j]im]klk�Zq�ljYfkeallaf_�Yf�Yml`]fla[Ylagf�c]q�l`Yl�a\]fla^a]k�al�lg�l`]�J9<AMK�[da]fl&�Fgl]�l`Yl�al�ak�l`]�c]q�l`Yl�ak�ljYfkeall]\$�Yf\�fgl�Y�hYkkogj\&�L`]�hYkkogj\�j]ka\]k�gf�l`]�[da]fl�Yf\�k]jn]j�kaemdlYf]gmkdq&�L`Yl�ak�o`q�al�ak�g^l]f�[Ydd]\�Y�Ék`Yj]\�k][j]l&Ê�

:]^gj]�J9<AMK$�mk]j�Yml`]fla[Ylagf�oYk�klgj]\�gf�]Y[`�j]egl]�Y[[]kk�k]jn]j�gf�Y�f]logjc&�=Y[`�k]jn]j�`Y\�lg�Z]�af\ana\mYddq�[gf%^a_mj]\$�eYcaf_�k][mjalq�hgda[a]k�Yf\�l`]�mk]j�\YlYZYk]�`Yj\�lg�eYaflYaf&�J9<AMK�`Yk�Y[[]kk�lg�emdlahd]�k]jn]jk$�Yf\�[]fljYdar]\�[gf^a_mjYlagf�Yf\�[gfljgd&�L`ak�kaehda^a]k�alk�dafck�oal`�]paklaf_�f]l%ogjc�gh]jYlaf_�kqkl]e�Yml`]fla[Ylagf�af^gjeYlagf� ^gj�]pYehd]$�Oaf\gok�FL�Mk]j�<geYaf�gj�Fgn]dd�F]lOYj]�<aj][l�K]jna[]�lj]]k!&�Al�Ydkg�eYc]k�al�]Yka]j�^gj�j]egl]�Y[[]kk�kg^loYj]�^jge�emdlahd]�n]f%\gjk�lg�ogjc�o]dd�lg_]l`]j&

L`]�J9<AMK�k]jn]j�klgj]k�Yf\�^gjoYj\k�k]kkagf�[gf^a_mjYlagf�af^gj%eYlagf�gf�Yf�af\ana\mYd$�mk]j%Zq%mk]j�ZYkak$�kg�mk]jk�_]lk�l`]�kYe]�k]jna[]�hYjYe]l]jk�j]_Yj\d]kk�g^�l`]�k]jn]j�l`]q�[gff][l�lg&�

>gj�JY\amk�Yml`]fla[Ylagf$�qgm�emkl�]fl]j�l`]�mk]jk�Yf\'gj�_jgmhk�[j]Yl]\�^gj�l`]�af\ana\mYd�k]jna[]�hjgh]jla]k�Yf\�l`]�AH�Y\\j]kk�g^�l`]�>aj]Zgp�gf�l`]�JY\amk�Yml`]fla[Ylagf�k]jn]j&�

OYl[`?mYj\Ìk�aehd]e]flYlagf�g^�JY\amk�Yml`]fla[Ylagf�]fYZd]k�qgm�lg�[gf^a_mj]�l`]k]�hYjYe]l]jk2

IP AddressL`]�AH�Y\\j]kk�g^�l`]�eY[`af]�qgm�Yj]�mkaf_�Yk�Y�JY\amk�k]jn]j&

PortL`]�hgjl�fmeZ]j�l`]�>aj]Zgp�oadd�mk]�^gj�JY\amk�Yml`]fla[Ylagf&

SecretL`]�hYkkogj\�l`Yl�oadd�^mf[lagf�Yk�Y�k`Yj]\�k][j]l�Z]lo]]f�qgmj�>aj]Zgp�Yf\�l`]�JY\amk�k]jn]j&�L`]�k][j]l�ak�[Yk]%k]fkalan]�Yf\�emkl�Z]�]pY[ldq�l`]�kYe]�Yk�l`]�gf]�]fl]j]\�gf�l`]�JY\amk�k]jn]j&

Backup radius serverQgm�[Yf�kh][a^q�Y�k][gf\�JY\amk�k]jn]j�Yk�Y�ZY[cmh�^gj�JY\amk�Yml`]fla%[Ylagf�o`]f�qgmj�hjaeYjq�k]jn]j�ak�mfYnYadYZd]&�L`]�ZY[cmh�emkl�`Yn]�l`]�kYe]�k`Yj]\�k][j]l�Yk�l`]�l`]�Y\eafakljYlagf�`gkl�Yf\�l`]�hjaeYjq�JY\amk�k]jn]j&

!NOTE

WatchGuard Radius works only with CHAP (Challenge Hand-shake Authentication Protocol) authentication. Make sure your Radius server supports CHAP.

56 WatchGuard Internet Security Handbook

Authentication

CRYPTOCard Authentication;JQHLG;Yj\�ak�Y�̀ Yj\oYj]%ZYk]\�Yml`]fla[Ylagf�kqkl]e�l`Yl�Yddgok�mk]jk�lg�Yml`]fla[Yl]�naY�;JQHLG;Yj\Ìk�[`Ydd]f_]�j]khgfk]�kqkl]e�o`a[`�af[dm\]k�g^^daf]�`Yk`af_�g^�hYkkogj\k&�Al�]fYZd]k�qgm�lg�Yml`]fla[Yl]�af\ana\mYdk�af\]h]f\]fl�g^�l`]�`gklk�l`]q�Yj]�gf&�

;gf^a_mjaf_�OYl[`?mYj\�;JQHLG;Yj\�k]jn]j�Yml`]fla[Ylagf�Ykkme]k�l`Yl�qgm�`Yn]�Y[imaj]\�Yf\�afklYdd]\�Y�;JQHLG;Yj\�k]jn]j�Y[[gj\af_�lg�l`]�eYfm^Y[lmj]jÌk�afkljm[lagfk$�Yf\�l`Yl�l`]�k]jn]j�ak�Y[[]kkaZd]�^gj�Yml`]fla[Ylaf_�lg�l`]�>aj]Zgp&

OYl[`?mYj\Ìk�aehd]e]flYlagf�g^�;JQHLG;Yj\�K]jn]j�]fYZd]k�qgm�lg�[gf^a_mj]�l`]k]�hYjYe]l]jk2

IP AddressL`]�AH�Y\\j]kk�g^�l`]�eY[`af]�qgm�Yj]�mkaf_�Yk�Y�;JQHLG;Yj\�K]jn]j&

PortL`]�hgjl�fmeZ]j�l`]�>aj]Zgp�oadd�mk]�^gj�l`]�;JQHLG;Yj\�K]jn]j&�L`]�hgjl�fmeZ]j�\g]k�fgl�mkmYddq�f]]\�lg�Z]�[`Yf_]\�^jge�l`]�\]^Ymdl$�.*,&

Administrator PasswordL`]�;JQHLG;Yj\�k]jn]jËk�Y\eafakljYlgj�hYkkogj\�Yk�^gmf\�af�l`]�;JQHLG;Yj\�k]jn]jÌk�ÉHYkko\Ê�^ad]&

TimeoutL`]�d]f_l`�af�k][gf\k�^gj�l`]�lae]gml�h]jag\&�L`]�lae]gml�h]jag\�ak�l`]�eYpaeme�Yegmfl�g^�lae]�qgm�[Yf�oYal�^gj�l`]�;JQHLG;Yj\�k]jn]j�lg�j]khgf\�lg�qgm&�;JQHLG;Yj\Ìk�j][gee]f\]\�lae]gml�ak�.(�k][gf\k&�

SecretL`]�hYkkogj\�l`Yl�oadd�^mf[lagf�Yk�Y�k`Yj]\�k][j]l�Z]lo]]f�l`ak�>aj]Zgp�Yf\�l`]�;JQHLG;Yj\�k]jn]j&�L`ak�ak�l`]�c]q�gj�[da]fl�c]q�af�l`]�ÉH]]jkÊ�^ad]�gf�l`]�;JQHLG;Yj\�k]jn]j&�L`]�k][j]l�ak�[Yk]%k]fkalan]�Yf\�emkl�Z]�]pY[ldq�l`]�kYe]�Yk�l`]�gf]�]fl]j]\�gf�l`]�;JQHLG;Yj\�k]jn]j&�L`ak�oadd�Z]�mk]\�lg�]f[jqhl�l`]�k]kkagf�Z]lo]]f�l`]�>aj]Zgp�Yf\�l`]�;JQH%LG;Yj\�k]jn]j&

How CRYPTOCard Authentication WorksL`]j]�ak�Y�eafa%@LLH�k]jn]j�jmffaf_�gf�l`]�>aj]Zgp�gf�hgjl�,)((�Yl�`llh2''S>aj]Zgp�ljmkl]\�afl]j^Y[]�AHU2,)((&�Af�gj\]j�lg�Yml`]fla[Yl]$�mk]jk�emkl�[gff][l�lg�l`ak�Yml`]fla[Ylagf�k]jn]j�mkaf_�Y�o]Z�Zjgok]j� l`Yl�kmhhgjlk�BYnY!�lg�l`ak�MJD2�`llh2''S>aj]Zgp�ljmkl]\�afl]j^Y[]�AH�`]j]U2,)(('&

!NOTE

When implementing a CRYPTOCard authentication scheme, you must also add the Firebox’s IP address and the users or groups to authenticate to the CRYPTOCard server’s configuration file. The Firebox is entered as a client to the CRYPTOCard server. For more information, see your CRYPTOCard server documenta-tion. Only one alias/group is supported by the CRYPTOCard server.

WatchGuard Internet Security Handbook 57

Beyond Proxies and Packet Filters

L`ak�dgY\k�Y�BYnY�Yhhd]l�l`Yl�hjgehlk�^gj�Y�mk]jfYe]�Yf\�hYkkogj\&�Gf[]�l`]�mk]j�km[[]kk^mddq�lqh]k�af�Y�eYl[`af_�mk]jfYe]�Yf\�hYkk%ogj\$�l`]�BYnY�Yhhd]l�\akhdYqk�Yf�Yml`]fla[Ylagf�kljaf_�af�l`]�^gje�g^�Y�fmeZ]j&�L`]�mk]j�l`]f�]fl]jk�l`ak�fmeZ]j�aflg�`ak�;JQHLG;Yj\&�L`]�;JQHLG;Yj\�hjg[]kk]k�l`]�fmeZ]j�Yf\�akkm]k�Y�k][gf\�fme%Z]j&�L`]�mk]j�l`]f�]fl]jk�l`ak�fmeZ]j�af�Y�k][gf\�khY[]�gf�l`]�BYnY�Yhhd]lÌk�mk]j�afl]j^Y[]&�L`ak�fmeZ]j�ak�ljYfkeall]\�lg�l`]�;JQHLG%;Yj\�k]jn]j$�o`a[`�l`]f�Yml`]fla[Yl]k�l`]�j]khgf\af_�fmeZ]j&�Af�\gaf_�kg$�;JQHLG;Yj\�lYc]k�l`]�ZYka[�Yml`]fla[Ylagf�g^�JY\amk�Yf\�Y\\k�kljaf_]fl�d]n]dk�g^�Yml`]fla[Ylagf&�Oal`�;JQHLG;Yj\�Yml`]fla%[Ylagf$�gf]�[Yffgl�mk]�Y�O]Z�Zjgok]j�lg�Y[[]kk�kal]k�gf�l`]�=pl]jfYd�afl]j^Y[]�oal`gml�hgkk]kkagf�g^�Y�;JQHLG;Yj\&�L`]�;JQHLG;Yj\�emkl�Z]�k]l�mh�Yf\�j]_akl]j]\�oal`�l`]�;JQHLG;Yj\�k]jn]j&�>mj%l`]jegj]$�gf]�[Yffgl�mk]�Y�;JQHLG;Yj\�lg�h]j^gje�l`]�fmeZ]j�]fljq�Yf\�j]khgfk]�oal`gml�c]qaf_�af�l`]�[gjj][l�mk]j�a\]fla^a[Ylagf�Yf\�hYkkogj\�gf�l`]�;JQHLG;Yj\�alk]d^&�

Gf[]�l`]q�Yj]�km[[]kk^mddq�Yml`]fla[Yl]\$�mk]jk�[Yf�l`]f�eafaear]�l`]�BYnY�oaf\go�Yf\�Z]_af�Zjgokaf_�l`]�O]Z&�9k�dgf_�Yk�l`]�BYnY�oaf\go�j]eYafk�Ydan]� l`Yl�ak$�al�[Yf�Z]�eafaear]\�Zml�fgl�[dgk]\!$�mk]jk�j]eYaf�Yml`]fla[Yl]\&�A^�l`]q�[da[c�l`]�;dgk]�Zmllgf�af�l`]�BYnY�oaf\go�gj�[dgk]�l`]aj�Zjgok]j�[gehd]l]dq$�l`]q�Yj]�fg�dgf_]j�Yml`]fla[Yl]\&

Removing AuthenticationL`]�gfdq�oYq�lg�hj]n]fl�k]d][l]\�Y[[gmflk�^jge�Z]af_�YZd]�lg�Yml`]fla[Yl]�ak�lg�\akYZd]�l`]aj�Y[[gmflk�gf�l`]aj�j]kh][lan]�Yml`]fla%[Ylagf�k]jn]jkÈl`]�FL�;gfljgdd]j$�JY\amk�K]jn]j$�gj�gf�l`]�>aj]Zgp&�9�mk]j�[Yf�j]eYaf�[gff][l]\�^gj�mh�lg�*,�`gmjk�Z]^gj]�Z]af_�Ymlg%eYla[Yddq�\ak[gff][l]\&�L`]�kYe]�Yhhda]k�lg�;JQHLG;Yj\$�]p[]hl�qgm�[Yf�Ydkg�[gf^ak[Yl]�l`]�mk]jÌk�;JQHLG;Yj\�alk]d^$�o`a[`�j]f\]jk�Yml`]la[Ylagf�aehgkkaZd]�^gj�l`Yl�mk]j&

Configuring an Authentication EnvironmentGf]�oYq�lg�[j]Yl]�]^^][lan]�Mk]j�9ml`]fla[Ylagf�]fnajgfe]flk�ak�lg�j]klja[l�Ydd�Gml_gaf_�k]jna[]k�lg�gfdq�Yddgo�[gff][lagfk�>jge�9ml`]fla[Yl]\�Mk]jk&�>gj�]pYehd]$�mkaf_�Oaf\gok�FL�K]jn]j$�qgm�ogmd\�[j]Yl]�Y�?jgmh�gf�l`]�Oaf\gok�FL�k]jn]j�l`Yl�[gflYafk�Ydd�l`]�Mk]j�Y[[gmflk&�L`]f�qgm�ogmd\�Y\\�l`Yl�_jgmh�fYe]�lg�l`]�Afl]jfYd�`gklk�^gj�l`]�Gml_gaf_�gj�Hjgpq�k]jna[]�af�l`]�OYl[`?mYj\�Hgda[q�EYfY_]j&

Combining User Authentication and Remote User VPNO`]f�Y�J]egl]�Mk]j�NHF�[gff][lagf�ak�eY\]�lg�l`]�>aj]Zgp$�l`]�[da%]flÌk�mk]jfYe]�Yf\�hYkkogj\�Yj]�[`][c]\�Y_Yafkl�l`]�>aj]Zgp�<geYaf�gfdq&�>gj�l`ak�j]Ykgf$�J]egl]�Mk]j�NHF�mk]jk�emkl�`Yn]�Yf�Y[[gmfl�af�l`]�>aj]Zgp�<geYaf$�Yf\�emkl�Z]�Y�e]eZ]j�g^�l`]�

58 WatchGuard Internet Security Handbook

Encryption

J]egl]NHF�_jgmh�^gj�Y[[]kk$�j]_Yj\d]kk�g^�Yfq�gl`]j�Yml`]fla[Ylagf�k[`]e]�af�mk]&�S[j]^�lg�JMNHF�`]j]U

O`]f�mk]jk�Yml`]fla[Yl]�mkaf_�l`]aj�Y[[gmfl�af�l`]�>aj]Zgp�<geYaf$�OYl[`?mYj\�YmlgeYla[Yddq�Y\\k�l`]aj�AH�Y\\j]kk�lg�Ydd�>aj]Zgp�<geYaf�_jgmhk�g^�o`a[`�l`]q�Yj]�Y�e]eZ]j� Yf\�[gfn]jk]dq�j]egn]\�o`]f�l`]q�]f\�l`]aj�Yml`]fla[Ylagf!&

J]egl]NHF�ak�Y�Zmadl%af�>aj]Zgp�<geYaf�?jgmh�o`]j]�qgm�emkl�]fl]j�Ydd�[mjj]fldq�Y[lan]�J]egl]�Mk]j�NHF�mk]jk&�O`]f�Y�mk]j�km[%[]kk^mddq�[gff][lk�lg�l`]�>aj]Zgp�mkaf_�J]egl]�Mk]j�NHF$�OYl[`%?mYj\�YmlgeYla[Yddq�Y\\k�l`]�Ykka_f]\�J]egl]NHF�Y\\j]kk�lg�l`]�mk]jfYe]�lg�l`ak�Zmadl%af�YdaYk&�O`]f�l`]�mk]j�k`mlk�\gof�l`]�J]egl]�Mk]j�NHF�k]kkagf$�OYl[`?mYj\�YmlgeYla[Yddq�j]egn]k�l`]�mk]jÌk�Y\\j]kk�Ykkg[aYl]\�oal`�l`Yl�mk]j�^jge�l`]�J]egl]NHF�YdaYk&

:q�\]^Ymdl$�J]egl]�Mk]j�NHF�mk]jk� gj�Yfq�mk]jk!�`Yn]�fg�Y[[]kk�hjanad]_]k�l`jgm_`�Y�>aj]Zgp&�Lg�Yddgo�J]egl]�Mk]j�NHF�mk]jk�lg�Y[[]kk�eY[`af]k�gf�l`]�Ljmkl]\�f]logjc$�qgm�emkl�Y\\�l`]aj�mk]j%fYe]k� gj�l`]�J]egl]NHF�_jgmh�YdaYk!�lg�k]jna[]�a[gfk�af�l`]�k]j%na[]k�Yj]fY&

9�lqha[Yd�mk]�g^�l`ak�Zmadl%af�_jgmh�ak�lg�Yddgo�af[geaf_�[gff][lagfk�lg�[]jlYaf�Ljmkl]\�k]jn]jk�^jge�l`]�J]egl]NHF�_jgmh�e]eZ]jk&�L`ak�ak�Yf�]Ykq�oYq�lg�hjgna\]�gmlka\]�Y[[]kk�lg�[jala[Yd�eY[`af]k�afka\]�qgmj�f]logjc$�oal`gml�jakcaf_�qgmj�_]f]jYd�k][mjalq&

>gj�]pYehd]$�lg�Yddgo�gml_gaf_�l]df]l$�Zml�gfdq�Yddgo�af[geaf_�l]d%f]l�a^�l`]�j]im]kl�[ge]k�^jge�Y�J]egl]�Mk]j�NHF�mk]j$�qgm�ogmd\

� 9\\�l`]�l]df]l�k]jna[]�lg�l`]�OYl[`?mYj\�Hgda[q�EYfY_]j� ;gf^a_mj]�l`]�gml_gaf_�\aj][lagf�gfdq�lg�Yddgo�l]df]l�ljY^^a[�^jge�

Yfq�afl]jfYd�`gkl�lg�Yfq�gmlka\]�`gkl&�� ;gf^a_mj]�af[geaf_�\aj][lagf�lg�Yddgo�ljY^^a[�^jge�l`]�

J]egl]NHF�_jgmh$�lg�Yfq�afl]jfYd�`gkl&

Encryption

=f[jqhlagf�k[jYeZd]k�l`]�[`YjY[l]jk�af�ljYfkeakkagf�hY[c]lk�lg�eYc]�al�\a^^a[mdl�lg�\][g\]�Yf\�j]Y\&�Afl]j[]hlaf_�hY[c]lk�ak�fgl�\a^^a[mdl&�K]f\af_�[jala[Yd�af^gjeYlagf�km[`�Yk�[j]\al�[Yj\�fmeZ]jk�oal`�]ph]j%Ylagf�\Yl]k�gj�hYkkogj\k�Yk�[d]Yj�l]pl�ak�fgl�Y�kY^]�l`af_�lg�\g&�L`]�OYl[`?mYj\�Dan]K][mjalq�kqkl]e�]ehdgqk�\a^^]j]fl�lqh]k�g^�]f[jqh%lagf�^gj�[jala[Yd�[gff][lagfk�l`Yl�[gmd\�[gehjgeak]�qgmj�kqkl]e�a^�\YlY�o]j]�ljYfkeall]\�Yk�[d]Yj�l]pl&�

WatchGuard Internet Security Handbook 59

Beyond Proxies and Packet Filters

L`]�Dan]K][mjalq�Kqkl]e�hjgna\]k�YmlgeYla[�]f[jqhlagf�^gj�[gff][%lagfk�Z]lo]]f�l`]�EYfY_]e]fl�KlYlagf�Yf\�l`]�>aj]Zgp$�Dg_�@gkl$�Yf\�=n]fl�Hjg[]kkgj&�Al�g^^]jk�[gf^a_mjYZd]�]f[jqhlagf�o`]f�k]llaf_�mh�J]egl]�Mk]j�gj�:jYf[`�G^^a[]�NHF&

OYl[`?mYj\�g^^]jk�l`j]]�\a^^]j]fl�d]n]dk�g^�]f[jqhlagf2�KlYf\Yj\$�=f`Yf[]\$�Yf\�Kljgf_&�=f`Yf[]\�Yf\�Kljgf_�]f[jqhlagf�Yj]�g^^]j]\�Yk�ghlagfk$�Yf\�emkl�Z]�da[]fk]\�Yf\�afklYdd]\�k]hYjYl]dq�^jge�qgmj�klYf\Yj\�Dan]K][mjalq�Kqkl]e&

KlYf\Yj\�]f[jqhlagf�mk]k�Y�-.%Zal�]f[jqhlagf�c]q$�Ydkg�cfgof�Yk�<=K� <YlY�=f[jqhlagf�K]jna[]!&�=f`Yf[]\�]f[jqhlagf�mk]k�Y�))*%Zal�c]q&�Kljgf_�]f[jqhlagf�mk]k�Y�).0%Zal� ljahd]%<=K!�c]q&�L`]k]�Yj]�l`]�d]n%]dk�g^�]f[jqhlagf�^gj�l`]�EYfY_]e]fl�KlYlagf�[gff][lagfk�l`Yl�mk]�YmlgeYla[�]f[jqhlagf&�L`]k]�da[]fk]�daealk�Ydkg�]klYZdak`�`go�kljgf_�Yf�]f[jqhlagf�qgm�[Yf�mk]�^gj�NHF&�>gj�]pYehd]$�a^�qgm�Yj]�k]llaf_�mh�:jYf[`�G^^a[]�NHF�oal`�YmlgeYla[�AHK][$�qgm�emkl�`Yn]�kljgf_�]f[jqhlagf�lg�mk]�K@9%)%@E9;�Yml`]fla[Ylagf�oal`�+<=K%;:;�]f[jqhlagf&

A^�qgm�`Yn]�=f`Yf[]\�gj�Kljgf_�]f[jqhlagf$�qgm�[Yf�[`ggk]�l`]�d]n]d�g^�]f[jqhlagf�YhhjghjaYl]�lg�l`]�lmff]d�qgm�k]l�mh&�>gj�]pYehd]$�^gj�_]f]jYd�mk]$�qgm�ea_`l�mk]�kaf_d]%<=K�]f[jqhlagf�eYpaear]�l`jgm_`hml&�>gj�Y\eafakljYlan]�gj�ljYfkY[lagfYd�[gff][lagfk�o`]j]�qgm�`Yn]�egj]�lg�dgk]�a^�hY[c]lk�Yj]�afl]j[]hl]\�Yf\�\][g\]\$�qgm�[Yf�k]l�mh�`a_`dq�]f[jqhl]\�lmff]dk�Z]lo]]f�kh][a^a[�`gklk�gj�f]l%ogjck&

WebBlocker

O]Z:dg[c]j�ogjck�oal`�l`]�@LLH�hjgpq�l`Yl�hjgna\]k�MJD%^adl]jaf_�[YhYZadala]k&�Al�ak�Y�[gehj]`]fkan]�lggd�Yf\�mk]j�afl]j^Y[]�^gj�]p]jlaf_�^af]�[gfljgd�gn]j�o`Yl�lqh]�g^�O]Z�kal]k�mk]jk�Yj]�Yddgo]\�lg�na]o&�

O]Z:dg[c]j�hjgna\]k�l`]�e]Yfk�lg�\]l]jeaf]�l`]�o`g$�o`]f$�Yf\�o`Yl�g^�O]Z�kmj^af_�oal`af�qgmj�gj_YfarYlagf&�Al�]fYZd]k�qgm�lg�k]h%YjYl]�qgmj�gj_YfarYlagf�aflg�Yk�eYfq�mk]jk�gj�_jgmhk�Yk�qgmÌ\�dac]� o`g!$�\][a\]�o`Yl�`gmjk�l`]q�Yj]�^j]]�lg�Y[[]kk�l`]�Ogjd\�Oa\]�O]Z� o`]f!$�Yf\�o`Yl�[Yl]_gja]k�g^�O]Z�kal]k�l`]q�eYq�nakal� o`Yl!&��Af�^Y[l$�qgm�[Yf�\a^^]j]flaYl]�Z]lo]]f�l`]�kal]k�l`]q�[Yf�nakal�\mjaf_�j]_mdYj�`gmjk�Yf\�l`]�kal]k�YnYadYZd]�af�qgmj�gj_YfarYlagfÌk�g^^%`gmjk&

O]Z:dg[c]j�mk]k�Y�\YlYZYk]�g^�o]Zkal]k�o`gk]�[gfl]fl�ak�egkl�dac]dq�lg�Z]�[gmfl]j�lg�Y�lqha[Yd�gj_YfarYlagfÌk�k][mjalq�hgda[q&�L`]�\YlYZYk]�ak�mh\Yl]\�gf�Y�^j]im]fl�ZYkak&�Qgm�[Yf�[gf^a_mj]�O]Z:dg[c]j�lg�YmlgeYla[Yddq�mh\Yl]�l`]�o]Zkal]�\YlYZYk]$�gj�qgm�[Yf�[`ggk]�lg�

60 WatchGuard Internet Security Handbook

WebBlocker

eYfmYddq�mh\Yl]�al�o`]f�qgm�dac]&�>gj�YmlgeYla[�mh\Ylaf_$�OYl[`%?mYj\�[`][ck�l`]�\YlYZYk]�gf[]�Y�\Yq&�A^�l`]�\YlYZYk]�gf�l`]�\YlY%ZYk]�O]Zkal]�ak�\a^^]j]fl�^jge�l`]�gf]�Z]af_�mk]\�Yl�qgmj�kal]$�OYl[`?mYj\�gZlYafk�l`]�f]o�\YlYZYk]�Yf\�dgY\k�al�aflg�l`]�>aj]Zgp&

Settable ParametersO`]f�k]llaf_�mh�O]Z:dg[c]j$�qgm�[Yf�[gf^a_mj]�l`]k]�ZYka[�Yj]Yk2

� ;gfljgdk� O]Z:dg[c]j�?jgmhk� =p[]hlagfk� Na]o�?jgmh�E]eZ]jk

ControlsAf�l`]�[gfljgdk�Yj]fY$�qgm�[Yf�Y[lanYl]�gj�\]Y[lanYl]�O]Z:dg[c]j$�[Ymk]k�eYfY_]e]fl�ogjcklYlagf�lg�[`][c�l`]�gZb][lagfYZd]�o]Zkal]�\YlYZYk]�gf[]�Y�\Yq�Yf\�YmlgeYla[Yddq�\gofdgY\�al�o`]f�al�[`Yf_]k$�Yf\�]fl]j�Y�[mklge�e]kkY_]�lg�Z]�k]fl�lg�mk]jk�Zjgok]jk�o`]f�l`]q�Yj]�\]fa]\�Y�hY_]�Z][Ymk]�g^�O]Z:dg[c]j�jmd]k&�

>gj�Y�[gehd]l]�daklaf_�g^�O]Z:dg[c]j�[Yl]_gja]k�Yf\�o`Yl�lqh]k�g^�O]Zkal]k�l`]q�j]hj]k]fl$�k]]�É;Yl]_gjq�<]k[jahlagfk�^gj�O]Z%:dg[c]jÊ�af�l`]�OYl[`?mYj\�J]^]j]f[]�EYfmYd&

WebBlocker GroupsL`]�O]Z:dg[c]j�?jgmhk�Yj]Y�ak�o`]j]�qgm�k]l�mh�Yf\�eYaflYaf�Y[[]kk�hjanad]_]k�^gj�_jgmhk�g^�mk]jk&�>gj�O]Z:dg[c]j�lg�Yddgo�gj�\]fq�Y[[]kk�hjanad]_]k$�qgm�emkl�[j]Yl]�Yf\�\]^af]�_jgmhk�g^�`gklk&

SchedulingO]Z:dg[c]j�hjgna\]k�log�k]hYjYl]dq�[gf^a_mjYZd]�lae]�Zdg[ckÈGh]jYlagfYd�@gmjk�Yf\�Fgf%gh]jYlagfYd�`gmjk&�Gh]jYlagfYd�`gmjk�Yj]�Yf�gj_YfarYlagfÌk�fgjeYd�`gmjk�g^�gh]jYlagf3�fgf%gh]jYlagfYd�`gmjk�Yj]�o`]f�Yf�gj_YfarYlagf�ak�fgl�[gf\m[laf_�alk�fgjeYd�Zmka%f]kk&�Mk]�l`]k]�lae]�Zdg[ck�lg�Zmad\�jmd]k�YZgml�o`]f�\a^^]j]fl�lqh]k�g^�kal]k�Yj]�lg�Z]�Zdg[c]\&�>gj�]pYehd]$�qgm�ea_`l�Zdg[c�khgjlk�kal]k�\mjaf_�Zmkaf]kk�`gmjk$�Zml�Yddgo�Y[[]kk�Yl�dmf[`�lae]$�]n]faf_k$�Yf\�o]]c]f\k&

A^�l`]�kYe]�`gkl�gj�YdaYk�ak�Y�e]eZ]j�g^�egj]�l`Yf�gf]�_jgmh$�Yf\�l`]�Y[[]kk�jmd]k�Yj]�\a^^]j]fl�^gj�l`]�log�_jgmhk$�l`Yl�`gkl�gj�YdaYk�ak�kmZ%b][l�lg�l`]�kljgf_]j�jmd]&�L`Yl�ak$�l`]�_jgmh�l`Yl�`Yk�l`]�hjg`aZal]\�kal]k�lYc]k�hj][]\]f[]�gn]j�l`]�h]jeall]\�kal]k�g^�l`]�gl`]j�_jgmh&�

ExceptionsO]Z:dg[c]j�hjgna\]k�Yf�=p[]hlagfk�[gfljgd�lg�gn]jja\]�Yfq�g^�l`]�O]Z:dg[c]j�k]llaf_k&�L`ak�lYc]k�hj][]\]f[]�gn]j�Ydd�gl`]j�jmd]k&�9\\�MJDk�l`Yl�oadd�Z]�Yddgo]\�gj�\]fa]\�YZgn]�Yf\�Z]qgf\�Ydd�gl`]j�k]l%

WatchGuard Internet Security Handbook 61

Beyond Proxies and Packet Filters

laf_k&�L`]�Zdg[c]\�MJDk�`]j]�Yhhdq�gfdq�lg�@LLH�ljY^^a[�Yf\�Yj]�fgl�j]dYl]\�lg�l`]�:dg[c]\�Kal]k�dakl&

=p[]hlagfk�Yj]�ZYk]\�gf�hYll]jf%eYl[`af_&�HYll]jfk�Yj]�eYl[`]\�ZYk]\�gf�l`]�^ajkl�hYjl�g^�l`]�MJD�Y^l]j�l`]�AH�Y\\j]kk�gj�@gkl�9daYk&�Lqha[Yd�MJDk� ^gj�]pYehd]$�\]Ydaf_�oal`�_YeZdaf_!�ea_`l�dggc�dac]�l`ak2

KWWS���ZZZ�KHGJHP\�FRP�EHWVKWWS���ZZZ�KHGJHP\�FRP�EHWV�IUHHKWWS���ZZZ�KHGJHP\�FRP�EHWVDFWVKWWS���ZZZ�KHGJHP\�FRP�EHWVHGXFDWLRQ�KWWS���ZZZ�KHGJHP\�FRP�IUHHEHWV

L`]�hYll]jf�eYl[`af_�ogjck�gf�l`]�l]pl�l`Yl�[ge]k�Y^l]j�ooo&`]\_]eq&[ge2�Z]lk$�Z]lkY[lk$�Z]lk]\m[Ylagf$�Z]lk'^j]]$�Yf\�^j]]Z]lk&

HdY[]�Yf�Ykl]jakc� "!�af�^jgfl�g^�l`]�kljaf_�qgm�oak`�lg�eYl[`&�A^�l`Yl�kljaf_�Yhh]Yjk�Yfqo`]j]�af�l`]�dg[Ylagf�hYjl�g^�l`]�MJD$�al�oadd�Z]�eYl[`]\&�L`]j]^gj]$�"Z]lk�oadd�eYl[`�Ydd�g^�l`]�MJDk�dakl]\�af�gmj�]pYehd]$�kaf[]�ÉZ]lkÊ�Yhh]Yjk�Yl�kge]�hgafl�af�Ydd�g^�l`]�MJDk&

Logging and WebBlockerO]Z:dg[c]j�_]f]jYl]k�dg_k�\]Ydaf_�oal`�\]faYdk$�\YlYZYk]�\gofdgY\�j]kmdlk$�Yf\�Jmd]�[gf^da[lk&�

9[[]kk�Yll]ehlk�Yj]�dg__]\�\akhdYqaf_�af^gjeYlagf�YZgml�kgmj[]�Yf\�\]klafYlagf�Y\\j]kk�Yk�o]dd�Yk�l`]�Zdg[c]\�MJD$�Yf\�o`Yl�[Yl]_gja]k�[Ymk]\�l`]�\]faYd&

9�dg_�]fljq�ak�_]f]jYl]\�k`goaf_�l`]�j]kmdlk�g^�Yfq�Yll]ehl]\�\YlY%ZYk]�j]lja]nYdÈa^�al�oYk�km[[]kk^md$�a^�al�^Yad]\$�Yf\�o`q&

How WebBlocker WorksO`]f�O]Z:dg[c]j�ak�afalaYddq�klYjl]\$�l`]�OYl[`?mYj\�=n]fl�Hjg[]k%kgj�emkl�Z]�jmffaf_�af�gj\]j�lg�k]f\�Y�\YlYZYk]�lg�l`]�>aj]Zgp&�

L`]�>aj]Zgp�Yf\�=n]fl�Hjg[]kkgj�ogjc�lg_]l`]j�lg�c]]h�l`]�:dg[c]\�MJD�<YlYZYk]�[mjj]fl&�Gf�klYjlmh$�l`]�>aj]Zgp�im]ja]k�l`]�=n]fl�Hjg[]kkgj�^j]im]fldq�^gj�Y�:dg[c]\�MJD�\YlYZYk]&�L`]�=n]fl�Hjg[]k%kgj�[gflY[lk�Y�k]jn]j�gh]jYl]\�Zq�OYl[`?mYj\�L][`fgdg_a]k$�Af[&�

!NOTE

Exceptions are intended to block specific sites and subsections of these sites. For that reason, you cannot enter *bets in the pattern sec-tion, and expect to block all URLs (including sites other than www.hedgemy.com) that contain the word “bets.” This is an optional field which, when omitted, matches the pattern to any IP address.

62 WatchGuard Internet Security Handbook

WebBlocker

O`]f�al�^af\k�l`]�\YlYZYk]$�al�j]lja]n]k�al�Yf\�\gofdgY\k�al�lg�l`]�>aj]Zgp&

L`]�>aj]Zgp�l`]f�im]ja]k�l`]�=n]fl�Hjg[]kkgj�`gmjdq�^gj�Yf�mh\Yl]\�\YlYZYk]&�A^�l`]j]�ak�Y�f]o�n]jkagf�g^�l`]�:dg[c]\�MJD�<YlYZYk]$�l`]�=n]fl�Hjg[]kkgj�Yml`]fla[Yl]k�alk]d^�Yf\�ljYfk^]jk�l`]�f]o�<YlYZYk]�gn]j�Yf�]f[jqhl]\�[`Yff]d&�Al�l`]f�[gflY[lk�l`]�>aj]Zgp�Yf\�dgY\k�l`]�f]o�<YlYZYk]�aflg�l`]�>aj]Zgp�Yf\�_]f]jYl]k�Y�dg_�]fljq�k`goaf_�af^gjeYlagf�YZgml�l`]�f]o�<YlYZYk]2�alk�kar]$�[`][ckme$�Yf\�Y�lae]k%lYeh&�L`]j]Y^l]j$�l`]�>aj]Zgp�im]ja]k�l`]�=n]fl�Hjg[]kkgj�`gmjdq�^gj�l`]�hj]k]f[]�g^�Y�f]o�\YlYZYk]&

A^�^gj�Yfq�j]Ykgf$�l`]�f]o]kl�<YlYZYk]�ak�[gjjmhl$�oYk�af[gehd]l]dq�j]lja]n]\$�gj�ak�Yfq�gl`]j�oYq�af[gehd]l]$�l`]�>aj]Zgp�oadd�fgl�dgY\�al&�A^�Y�ljYfk^]j�ak�mfkm[[]kk^md$�l`]�=n]fl�Hjg[]kkgj�oadd�ljq�Y_Yaf�af�Yf�`gmj&

A^�qgm�oak`�lg�j]n]jl�lg�Y�hj]nagmk�[ghq�g^�l`]�<YlYZYk]$�al�[Yf�Z]�^gmf\�af�l`]�afklYddYlagf�\aj][lgjq$�fYe]\�Éo]ZZdg[c]j&gd\&Ê�Kaehdq�j]fYe]�l`ak�^ad]�lg�Éo]ZZdg[c]j&\ZÊ�Yf\�l`]�>aj]Zgp�oadd�mh\Yl]�alk]d^&

O`]f�l`]�>aj]Zgp�ak�j]klYjl]\$�Ydd�O]Z�Y[[]kk�oadd�Z]�Zdg[c]\�^gj�Y�eafml]�gj�log&�Mk]jk�eYq�_]l�Yf�]jjgj�e]kkY_]�l`Yl�j]Y\k�É\YlYZYk]�fgl�dgY\]\$Ê�o`ad]�l`]�>aj]Zgp�hj]hYj]k�^gj�^adl]jaf_&

Al�ak�hgkkaZd]�lg�eYfmYddq�^gj[]�Y�\gofdgY\�g^�l`]�dYl]kl�:dg[c]\�MJD�<YlYZYk]&�;gfkmdl�l`]�OYl[`?mYj\�Mk]jÌk�?ma\]�^gj�\]lYadk&

WatchGuard Internet Security Handbook 63

Beyond Proxies and Packet Filters

64 WatchGuard Internet Security Handbook

CHAPTER 6 LiveSecurity

L`]�k][mjalq�gj_YfarYlagf$�;=JL$�j]hgjlk�Y�f]o�k][mjalq�l`j]Yl�ak�\ak%[gn]j]\�]n]jq�/&-�\Yqk&�9k�Y�j]kmdl$�ljY\alagfYd�klYla[�^aj]oYdd�kgdm%lagfk�Yj]�ima[cdq�gml\Yl]\�Yk�l`]q�_jgo�af[j]Ykaf_dq�nmdf]jYZd]�gn]j�lae]�Zq�mfj]eallaf_�l`j]Ylk&�>gj�l`]�lqha[Yd�f]logjc�Y\eafakljYlgj$�c]]haf_�l`]�f]logjc�k][mjalq�kqkl]e�[mjj]fl�ak�Y�\Ymflaf_�lYkc&�Al�j]imaj]k�[`][caf_�af\mkljq�afka\]j�f]ok�Yf\�lahk�^gj�l`]�dYl]kl�k][m%jalq�l`j]Ylk$�Ykk]kkaf_�o`]l`]j�l`]�f]o�l`j]Yl�ak�\Yf_]jgmk�lg�l`]�dg[Yd�k][mjalq�kqkl]e$�Yf\�a^�f][]kkYjq$�[j]Ylaf_�hYl[`]k�gj�\akYZdaf_�hgjlk�gj�k]jna[]k�nmdf]jYZd]�lg�l`]�f]o]kl�l`j]Ylk&�Oal`�Ydd�l`]�gl`]j�\mla]k�[gf^]jj]\�gf�Y�f]logjc�Y\eafkljYlgj$�l`ak�ak�fgl�Y�j]Ydakla[�]ph][lYlagf&

L`]�OYl[`?mYj\�Dan]K][mjalq�Kqkl]e�ak�kljm[lmj]\�lg�c]]h�qgmj�f]l%ogjc�\]^]fk]k�Yl�l`]aj�`a_`]kl�d]n]d�Yl�Ydd�lae]k&�Af`]j]fl�af�l`]�Yj[`a%l][lmj]�ak�Y�\qfYea[�ZjgY\[Ykl�f]logjc�lg�k][mj]dq�\]dan]j�kg^loYj]�mh\Yl]k$�l`j]Yl�j]khgfk]k$�Yf\�af^gjeYlagf�Yd]jlk�\aj][ldq�lg�qgmj�eYfY_]e]fl�klYlagf&�

9�gf]%q]Yj�kmZk[jahlagf�lg�Dan]K][mjalq$�]Ykadq�j]f]o]\�YffmYddq$�ak�Y�klYf\Yj\�[gehgf]fl�g^�l`]�Dan]K][mjalq�Kqkl]e&�Gf[]�qgmj�Dan]K][mjalq�Kqkl]e�ak�afklYdd]\$�al�c]]hk�qgmj�f]logjc�\]^]fk]k�Yl�l`]aj�`a_`]kl�d]n]d�Zq�afl]dda_]fldq�Yf\�k]Yed]kkdq�hjgna\af_�l`]k]�Z]f]^alk2

Dynamically UpdatedDan]K][mjalq�ak�l`]�egkl�eYlmj]�k][mjalq�kqkl]e�\]ka_f]\�^gj�kqkl]eYla[�mh\Ylaf_&�Al�ljYfkealk�l`]�dYl]kl�kg^loYj]�mh\Yl]k�Yf\�Y\nYf[]k�af�^aj]%oYdd�l][`fgdg_a]k�gj�Yml`]fla[Ylagf�Y[[]kk�[gfljgd�\aj][ldq�lg�qgmj�gj_Y%farYlagfÌk�Dan]K][mjalq�;da]fl�[gehml]j&

Fast and ResponsiveL`]�OYl[`?mYj\�o]�`Yn]�l`]�JYha\�L`j]Yl�J]khgfk]�L]Ye&�L`ak�ak�Y�_jgmh�g^�k][mjalq�]ph]jlk�o`gk]�bgZ�ak�lg�mf[gn]j�Yf\�f]mljYdar]�Afl]jf]l�k][mjalq�l`j]Ylk�Yf\�`Y[c]j�YllY[ck�l`Yl�[gmd\�l`j]Yl]f�qgmj�Zmkaf]kk&�Af�

WatchGuard Internet Security Handbook 65

LiveSecurity

Y�eYll]j�g^�`gmjk$�Y�kgdmlagf�ak�a\]fla^a]\�Yf\�mh\Yl]\�k][mjalq�hjgl][%lagf�ak�ZjgY\[Ykl�lg�qgm&�

Team-OrientedGmj�l]Ye�g^�d]Y\af_�k][mjalq�]ph]jlk�hjaeYjq�lYkck�Yj]�lg�^af\�f]o�k][mjalq�l`j]Ylk$�Ykk]kk�l`]aj�nmdf]jYZadalq�lg�l`]�OYl[`?mYj\�Dan]K][m%jalq�Kqkl]e$�Yf\�o`]f�f][]kkYjq$�[j]Yl]�kg^loYj]�hYl[`]k�lg�klj]f_l`]f�qgmj�afklYddYlagf�Y_Yafkl�l`]�f]o]kl�l`j]Yl&�L`ak�ak�Y�^Yj�kY^]j�YhhjgY[`�l`Yf�Y�f]logjc�Y\eafakljYlgj�ogjcaf_�Ydgf]�lg�c]]h�l`]�kqkl]e�[mjj]fl&�Dan]K][mjalq�ak�l]Ye%gja]fl]\�af�log�oYqk2�l`]�l]Ye�ogjck�lg_]l`]j�lg�^af\�hjgZd]ek�Yf\�^ap�l`]e$�Yf\�l`]�l]Ye�ogjck�oal`�qgmj�gj_YfarYlagf�lg�c]]h�qgmj�f]logjc�k][mjalq�[mjj]fl&�Dan]K][mjalq�kmZk[jaZ]jk�Yj]�l`]�^ajkl�lg�Z]f]^al�^jge�l`]aj�af^gjeYlagfYd�Yd]jlk�Yf\�k][mjalq�]ph]jlak]&�G^l]f�qgm�oadd�j][]an]�ZjgY\[Yklk�Z]^gj]�l`]�k][mjalq�l`j]Yl�`Yk�Z]]f�eY\]�hmZda[&

The LiveSecurity Client

=n]jq�f]o�OYl[`?mYj\�Dan]K][mjalq�Kqkl]e�af[dm\]k�Y�gf]%q]Yj�kmZk[jahlagf� ]Ykadq�j]f]o]\!�lg�l`]�Dan]K][mjalq�ZjgY\[Ykl�k]jna[]&�L`ak�hYjl�g^�l`]�Dan]K][mjalq�Kqkl]e�af[dm\]k�l`]�Dan]K][mjalq�;da%]fl$�Y�:Y[cO]Z�[da]fl$�l`Yl�Édakl]fkÊ�lg�OYl[`?mYj\Ìk�Dan]K][mjalq�:jgY\[Ykl�k]jna[]&�L`]�Dan]K][mjalq�;<%JGE�[gflYafk�l`]�Dan]K][m%jalq�[da]fl&�Gf[]�afklYdd]\$�l`ak�[da]fl�Yhhda[Ylagf�YmlgeYla[Yddq�]klYZ%dak`]k�Y�k][mj]�[gff][lagf�oal`�Y�OYl[`?mYj\�Dan]K][mjalq�k]jn]j�Yf\�\gofdgY\k�l`]�dYl]kl�k][mjalq�kg^loYj]&�L`ak�mh\Yl]k�qgmj�k][m%jalq�kqkl]e�Y_Yafkl�Yfq�[gf[]jfk�gj�l`j]Ylk�l`Yl�eYq�`Yn]�\]n]dgh]\�Z]lo]]f�o`]f�qgmj�>aj]Zgp�oYk�k`ahh]\�Yf\�o`]f�qgm�afklYdd]\�al&

An Integrated SolutionL`]�OYl[`?mYj\�Dan]K][mjalq�Kqkl]e�afl]_jYl]k�kg^loYj]�Yf\�`Yj\%oYj]�[gehgf]flk�aflg�Y�kqkl]e�ghlaear]\�^gj�kY^]dq�Y[[]hlaf_�ljYfk%eakkagfk&�OYl[`?mYj\�mk]k�Y�[geZafYlagf�g^�l][`fgdg_a]k�lg�k][mj]dq�ljYfkeal�Ydd�Dan]K][mjalq�ZjgY\[Yklk�\aj][ldq�lg�qgmj�\]kc%lgh&�<a_alYd�[]jla^a[Yl]k�Yj]�mk]\�af�[gfbmf[lagf�oal`�Y�hmZda[�c]q�]f[jqhlagf�kqkl]e�\]n]dgh]\�Zq�JK9�<YlY�K][mjalq�Af[&�Ljmkl]\�[]j%la^a[Ylagf�Yml`gjala]k� km[`�Yk�N]jaka_f�Af[!�akkm]�l`]�\a_alYd�[]jla^a%[Yl]k�mk]\�Zq�l`]�Kqkl]e&

LiveSecurity BroadcastsDan]K][mjalq�ZjgY\[Yklk�Yj]�\]dan]j]\�lg�l`]�Dan]K][mjalq�kg^loYj]�[da]fl�qgm�\]ka_fYl]\�\mjaf_�afklYddYlagf&�Qgm�eYq�Ydkg�j][]an]�Dan]K][mjalq�af^gjeYlagf�Yd]jlk�Yf\�l`j]Yl�j]khgfk]k�naY�]%eYad&�<m]�lg�af`]j]fl�daealYlagfk�af�[mjj]fl�]%eYad�l][`fgdg_q$�Kg^loYj]�Mh\Yl]k�Yj]�\]dan]j]\�gfdq�^jge�Y�k][mj]�Dan]K][mjalq�O]Z�kal]�lg�qgmj�[da]fl&�Af�Y\\alagf$�Dan]K][mjalq�]%eYad�ak�YdoYqk�ka_f]\�oal`�gmj�H?H�c]q�lg�_mYjYfl]]�Yml`]fla[alq&�Af�Ydd�[Yk]k$�kg^loYj]�\aklja%

66 WatchGuard Internet Security Handbook

The LiveSecurity Client

Zmlagfk�Yj]�\a_alYddq�ka_f]\�Yf\�[`][c]\�\mjaf_�l`]�kg^loYj]�afklYd%dYlagf�hjg[]kk&

LjYfkeall]\�lg�qgm�Yj]2�

Software UpdatesGf_gaf_�^mf[lagfYd�]f`Yf[]e]flk�[gn]jaf_�qgmj�]flaj]�Dan]K][mjalq�Kqkl]e&

Threat ResponsesKg^loYj]�mh\Yl]k�kh][a^a[Yddq�Y\\j]kkaf_�Y�f]odq�\ak[gn]j]\�l`j]Yl&

Information AlertsLae]dq�fgla^a[Ylagfk�g^�Zj]Ycaf_�f]ok�Yf\�[mjj]fl�akkm]k�af�Afl]jf]l�k][mjalq&

Security BroadcastsAf�Y\\alagf�lg�kg^loYj]�mh\Yl]k�Y\\j]kkaf_�kh][a^a[�l`j]Ylk$�qgm�j][]an]�^mf[lagfYd�kg^loYj]�]f`Yf[]e]flk�[gn]jaf_�qgmj�]flaj]�OYl[`?mYj\�Dan]K][mjalq�Kqkl]e�gf�Yf�gf_gaf_�ZYkak&�9f�afklYddY%lagf�oarYj\�Yf\�j]d]Yk]�fgl]k�Y[[gehYfq�]Y[`�ljYfkeakkagf�^gj�]Ykq�afklYddYlagf&�L`]k]�[gfn]fa]fl�ljYfkeakkagfk�j]da]n]�qgm�g^�l`]�Zmj%\]f�g^�ljY[caf_�l`]�dYl]kl�kg^loYj]�n]jkagf�lg�c]]h�qgmj�Kqkl]e�[mj%j]fl&

Threat Responses9k�l`]�^j]im]f[q�g^�f]o�YllY[ck�Yf\�k][mjalq�Y\nakgja]k�af[j]Yk]k$�l`]�lYkc�g^�]fkmjaf_�l`Yl�qgmj�f]logjc�ak�k][mj]�Z][ge]k�]n]f�egj]�g^�Y�Zmj\]f&�OYl[`?mYj\�k�JYha\�J]khgfk]�L]Ye$�Y�\]\a[Yl]\�_jgmh�g^�afl]jfYd�k][mjalq�]ph]jlk$�`]dhk�YZkgjZ�l`ak�Zmj\]f�Zq�egfalgjaf_�l`]�Afl]jf]l�k][mjalq�dYf\k[Yh]�lg�a\]fla^q�f]o�l`j]Ylk�Yk�l`]q�]e]j_]&

Gf[]�Y�f]odq�\ak[gn]j]\�l`j]Yl�ak�a\]fla^a]\$�l`]�JYha\�J]khgfk]�L]Ye�\]n]dghk�Yf\�ljYfkealk�qgm�Y�kg^loYj]�mh\Yl]�kh][a^a[Yddq�Y\\j]kkaf_�l`ak�l`j]Yl�lg�]fkmj]�qgmj�f]logjc�ak�[gflafmgmkdq�hjg%l][l]\&�=Y[`�L`j]Yl�J]khgfk]�af[dm\]k�Y�\]k[jahlagf�\]lYadaf_�l`]�fYlmj]�Yf\�k]n]jalq�g^�l`]�l`j]Yl$�l`]�jakck�al�hgk]k�Yf\�o`Yl�kl]hk�qgm�k`gmd\�lYc]�lg�]fkmj]�qgmj�f]logjc�ak�hjgl][l]\&

Information AlertsDan]K][mjalq�af^gjeYlagf�Yd]jlk�hjgna\]�lae]dq�fgla^a[Ylagfk�g^�Zj]Ycaf_�f]ok�Yf\�[mjj]fl�akkm]k�af�Afl]jf]l�k][mjalq&�;gfl]fl�ak�lYa%dgj]\�^gj�qgmj�f]]\k$�kg�qgm�f]]\�gfdq�dggc�af�gf]�hdY[]�lg�klYq�YZj]Ykl�g^�l`]�^Ykl�[`Yf_af_�Afl]jf]l�k][mjalq�dYf\k[Yh]���qgmj�\]kc%lgh&�L`ak�e]Yfk�l`Yl�o`]f�qgm�j]Y\�YZgml�Y�f]o�`Y[c]j�l`j]Yl$�qgm�n]�Ydj]Y\q�Z]]f�Zja]^]\�gf�alk�aehY[l�Yf\�l`]�hjgh]j�Kqkl]e�[gf^a_mjYlagf�f][]kkYjq�lg�hjgl][l�Y_Yafkl�al&

WatchGuard Internet Security Handbook 67

LiveSecurity

9\\alagfYddq$�Af^gjeYlagf�9d]jlk�c]]h�qgm�af^gje]\�g^�mh[geaf_�]f`Yf[]e]flk�lg�qgmj�OYl[`?mYj\�Dan]K][mjalq�Kqkl]e�Yf\�gl`]j�kh][aYd�Yffgmf[]e]flk&

Rapid Response Team

:]`af\�l`]�Dan]K][mjalq�k]jna[]�ak�OYl[`?mYj\�k�JYha\�J]khgfk]�L]Ye&�L`]k]�k][mjalq�]ph]jlk�[dgk]dq�egfalgj�Y�_Yeml�g^�Afl]jf]l�k][mjalq�kgmj[]k$�f]o�gh]jYlaf_�kqkl]e�\]n]dghe]flk�Yf\�]e]j_af_�`Y[c]j�l][`faim]k�lg�ima[cdq�a\]fla^q�f]o�Afl]jf]l�k][mjalq�l`j]Ylk&�Gf[]�a\]fla^a]\$�l`ak�l]Ye�Ykk]kk]k�alk�k]n]jalq�Yf\$�a^�YhhjghjaYl]$�ljYfkealk�Y�j]khgfk]�lg�qgm&

L`]�JYha\�J]khgfk]�L]Ye�eYpaear]k�qgmj�d]n]d�g^�Afl]jf]l�k][mjalq�oal`gml�aehY[laf_�qgmj�h]jkgff]d�[gmfl�gj�Zm\_]l&�L`]�\]eYf\�^gj�f]logjc�k][mjalq�]ph]jlk�oadd�[gflafm]�lg�gmlkljah�kmhhdq�^gj�l`]�^gjk]]YZd]�^mlmj]&�Mh\Yl]k�^jge�l`]�JYha\�J]khgfk]�L]Ye�_an]k�qgm�l`]�]ph]jlak]�oal`gml�l`]�]ph]fk]�g^�eYaflYafaf_�km[`�Y�\]hYjle]fl�af%`gmk]&

L`]�JYha\�J]khgfk]�L]Ye�Ydkg�eYaflYafk�Y�Dan]K][mjalq�9j[`an]$�daklaf_�Ydd�g^�l`]�[gfl]fl�qgm�`Yn]�j][]an]\�kg�qgm�\gf�l�`Yn]�lg�eYaflYaf�qgmj�gof�k]hYjYl]�j][gj\k&�K`gmd\�qgm�\]d]l]�Yd]jlk�gj�]Yj%da]j�n]jkagfk�g^�kg^loYj]$�l`ak�9j[`an]�Yddgok�qgm�lg�j]lja]n]�l`]e�^jge�Y�k][mj]�O]Z�kal]&

LiveSecurity Alliance

L`]�OYl[`?mYj\�Dan]K][mjalq�9ddaYf[]�ak�Y�l][`fgdg_q�Yf\�eYjc]l%af_�hYjlf]j�hjg_jYe�l`Yl�oYk�^gje]\�lg�kmhhgjl�Yf\�]f`Yf[]�l`]�OYl[`?mYj\�Dan]K][mjalq�Kqkl]e&�L`]�_gYd�g^�l`]�9ddaYf[]�ak�lg�hjg%na\]�qgm�oal`�Y�jYf_]�g^�[gehYlaZd]�kgdmlagfk�^jge�Dan]K][mjalq�9ddaYf[]�hYjlf]jk&

9k�Y�OYl[`?mYj\�Dan]K][mjalq�kmZk[jaZ]j$�qgm�Ydkg�Z]f]^al�^jge�l`]�[gdd][lan]�]ph]jlak]�Ydd�g^�l`]�hYjlf]jk�af�l`]�YddaYf[]&�L`]�OYl[`%?mYj\�Dan]K][mjalq�9ddaYf[]�Y[lk�Yk�Y�[gddYZgjYlan]�^gjme�o`]j]�]ph]jlk�^jge�]Y[`�hYjlf]j�hmjkm]�emlmYd�k`Yjaf_�g^�af^gjeYlagf�Yf\�hjg\m[l�afl]jgh]jYZadalq&

68 WatchGuard Internet Security Handbook

CHAPTER 7 Virtual Private Networking

9�NajlmYd�HjanYl]�F]logjc� NHF!�]fYZd]k�log�f]logjck� gj�Y�`gkl�lg�Y�f]logjc!�lg�[geemfa[Yl]�oal`�]Y[`�gl`]j�naY�Y�l`aj\�mfhjgl][l]\�f]logjc&�L`]�egkl�hghmdYj�hjY[la[Yd�Yhhda[Ylagf�g^�l`ak�l][`fgdg_q�ak�lg�mk]�l`]�Afl]jf]l� l`]�l`aj\$�mfhjgl][l]\�f]logjc!�lg�[Yjjq�\YlY�Z]lo]]f�\aklYfl�`gklk�gj�f]logjck�Yl�Y�em[`�dgo]j�[gkl�l`Yf�\]\a%[Yl]\�daf]k�gj�\aYd%mh�[gff][lagfk&�Lg�c]]h�l`]�[geemfa[Ylagf�k][mj]�o`]f�al�hYkk]k�l`jgm_`�l`]�mfhjgl][l]\�f]logjc$�l`]�hY[c]lk�Yj]�]f[YhkmdYl]\�af�Yfq�fmeZ]j�g^�oYqk� ^gj�]pYehd]$�]f[jqhl]\�Yf\�Yml`]fla[Yl]\!&�9�jmd]k]l�l`Yl�\]^af]k�Ydd�l`]�l`ak�k][mj]\�[gff][%lagfÈl`]�klYjl�Yf\�]f\�hgaflk$�l`]�lqh]�g^�Yml`]fla[Ylagf�Yf\�]f[jqhlagf�mk]\$�l`]�mk]jk�gj�_jgmhk�Yddgo]\�lg�mk]�alÈak�[Ydd]\�Y�lmff]d&�OYl[`?mYj\�hjgna\]k�log�eg\md]k$�]Y[`�oal`�k]n]jYd�ghlagfk$�lg�hjgna\]�k][mj]�lmff]dk2

� :jYf[`�G^^a[]�NHF$�o`a[`�[j]Yl]k�Y�k][mj]�lmff]d�Z]lo]]f�log�f]logjck�hjgl][l]\�Zq�OYl[`?mYj\�>aj]Zgp]k� gj�Z]lo]]f�Y�OYl[`?mYj\�>aj]Zgp�Yf\�Yf�AHK][%[gehdaYfl�\]na[]!&

� J]egl]�Mk]j�NHF$�o`a[`�[j]Yl]k�Y�k][mj]�[gff][lagf� ]al`]j�Zq�mkaf_�klYf\Yj\�HHLH�gj�l`]�ghlagfYd�AHK][�lmff]d!�Z]lo]]f�Y�`gkl�Yf\�Y�f]logjc�hjgl][l]\�Zq�Y�>aj]Zgp&

Mk]�OYl[`?mYj\Ìk�:jYf[`�G^^a[]�NHF�lg�k][mj]dq�[gff][l�Yf�g^^a[]�f]logjc�af�L`YadYf\�oal`�Yf�g^^a[]�f]logjc�af�RaeZYZo]�naY�l`]�Afl]jf]l&�:jYf[`�G^^a[]�NHF�[Yf�]n]f�[gff][l�eYfq�k[Yll]j]\�j]egl]�g^^a[]k�lg�Y�[]fljYd�g^^a[]&�:jYf[`�G^^a[]�NHF�j]imaj]k�log�k][mjalq�\]na[]k$�km[`�Yk�log�OYl[`?mYj\�>aj]Zgp]kÈgf]�Yl�]Y[`�]f\�g^�Y�lmff]d&�9l�Y�eafaeme�qgm�f]]\�gf]�>aj]Zgp�Yf\�Yf�AHK][%[gehdaYfl�\]na[]�Yl�l`]�gl`]j�]f\�g^�l`]�lmff]d&

J]egl]�Mk]j�NHF�[Yf�[gff][l�Yf�]ehdgq]]�ljYn]daf_�oal`�Y�dYhlgh�[gehml]j�lg�Y�[gjhgjYl]�f]logjc�l`Yl�ak�hjgl][l]\�Zq�Y�>aj]Zgp&�G^�[gmjk]�al�ogjck�]imYddq�o]dd�oal`�Y�l]d][geemlaf_�]ehdgq]]�o`g�

WatchGuard Internet Security Handbook 69

Virtual Private Networking

lmff]dk�lg�l`]�[gehYfq�>aj]Zgp�^jge�Y�`ge]�H;&�J]egl]�Mk]j�NHF�j]imaj]k�gf]�>aj]Zgp�gfdq�Yl�l`]�f]logjc&

Branch Office VPN

OYl[`?mYj\�:jYf[`�G^^a[]�NHF�]fYZd]k�k][mj]�[geemfa[Ylagfk�Z]lo]]f�qgmj�g^^a[]�dg[Ylagfk�Yf\�gl`]j�g^^a[]k�]imahh]\�oal`�Y�>aj]Zgp�gj�gl`]j�AHK][%[gehdaYfl�k][mjalq�\]na[]&�L`]k]�[gmd\�Z]�qgmj�ZjYf[`�g^^a[]k�gj�ljY\af_�hYjlf]jk&�OYl[`?mYj\�:jYf[`�G^^a[]�NHF�kmhhgjlk�log�]f[jqhlagf�hjglg[gdk2�

� AHK][� OYl[`?mYj\�k�Hjghja]lYjq�NHF�Hjglg[gd

Mk]�AHK][�lg�lmff]d�Z]lo]]f�Y�OYl[`?mYj\�>aj]Zgp�Yf\�Yf�AHK][%[gehdaYfl�\]na[]�^jge�Yfgl`]j�n]f\gj&�9dkg�mk]�AHK][�Z]lo]]f�log�>aj]Zgp]k��Yf\�gl`]j�[mklge]j�kal]k�Yhhjgn]\�^gj�kljgf_�]f[jqhlagf�Zq�OYl[`?mYj\�L][`fgdg_a]k�Yf\'gj�l`]�M&K&�?gn]jfe]fl&

Mk]�OYl[`?mYj\�NHF�a^�Yl�d]Ykl�gf]�]f\�g^�l`]�lmff]d�\g]k�fgl�mk]�Ékljgf_�]f[jqhlagf&Ê�OYl[`?mYj\�NHF�g^^]jk�,(%Zal�]f[jqhlagf� lg�[gehdq�oal`�]f[jqhlagf�j]_mdYlagfk!&�9dkg�mk]�NHF�^gj�Yfq�lmff]d�l`Yl�`Yk�OYl[`?mYj\�>aj]Zgp]k�Yl�Zgl`�]f\k&�OYl[`?mYj\�NHF�oal`�)*0%Zal�]f[jqhlagf�[Yf�Z]�mk]\�o`]f�Zgl`�]f\k�g^�l`]�lmff]d�Yj]�da[]fk]\�^gj�kljgf_�]f[jqhlagf&�A^�qgm�ogmd\�dac]�lg�mk]�kljgf_�]f[jqhlagf� )*0�Zal$�+<=K!�gj�AHK][$�hd]Yk]�[gflY[l�OYl[`?mYj\�L][`fa[Yd�Kmhhgjl�Yl�*(.&-*)&0+/-&

=Y[`�>aj]Zgp�]f[jqhlk�l`]�e]kkY_]k�lg�Z]�k]fl�lg�Y�j]egl]�>aj]Zgp$�Yf\�\][jqhlk�l`]�j]lmjfaf_�e]kkY_]k&�;geemfa[Ylagf�Z]lo]]f�l`]�log�f]logjck�ljYn]dk�kY^]dq�gn]j�l`]�Afl]jf]l$�\][jqhlYZd]�gfdq�Zq�l`]�>aj]Zgp�gj�AHK][%[gehdaYfl�\]na[]�gf�l`]�gl`]j�]f\&

Gfdq�gf]�NHF�[gff][lagf�ak�h]jeall]\�Z]lo]]f�Yfq�log�>aj]Zgp]k$�Ydl`gm_`�gf]�>aj]Zgp�eYq�`Yn]�[gff][lagfk�lg�eYfq�\a^^]j]fl�>aj]%Zgp]k&�Af�Y\\alagf$�qgm�[Yffgl�mk]�>aj]Zgp]k�lg�j]dYq�]f[jqhl]\�eYl]jaYd�lg�Y�l`aj\�>aj]Zgp&�9dd�:jYf[`�G^^a[]�NHF�>aj]Zgp]k�emkl�Z]�[gf^a_mj]\�af�Y�klYj�f]logjc&

Af[geaf_�[gff][lagfk�^jge�j]egl]�NHF�f]logjck�eYq�Y[[]kk�eY[`af]k�gf�l`]�dg[Yd�Ljmkl]\�afl]j^Y[]�j]_Yj\d]kk�g^�o`]l`]j�l`]�dg[Yd�eY[`af]k�Yj]�eYkim]jY\]\&

;gff][lagfk�eY\]�l`jgm_`�Y�NHF�Yj]�f]n]j�eYkim]jY\]\&

70 WatchGuard Internet Security Handbook

Branch Office VPN

IPSec Implementation of Branch Office VPNOYl[`?mYj\�k�:jYf[`�G^^a[]�NHF�]f[jqhlagf�hjglg[gd�ak�[gehdaYfl�oal`�l`]�[mjj]fl�AHK][�Yj[`al][lmj]�Yk�\]^af]\�Zq�l`]�A=L>� Afl]jf]l�=f_af]]jaf_�LYkc�>gj[]!&�AHK][�:jYf[`�G^^a[]�NHF�ak�YnYadYZd]�Yk�hYjl�g^�l`]�Kljgf_�=f[jqhlagf�ghlagf&�Oal`�AHK][�:jYf[`�G^^a[]�NHF$�qgm�[Yf�]klYZdak`�]f[jqhl]\�lmff]dk�Z]lo]]f�Y�>aj]Zgp�Yf\�Yfq�gl`]j�AHK][%[gehdaYfl�k][mjalq�\]na[]$�j]_Yj\d]kk�g^�ZjYf\$�l`Yl�eYq�Z]�af�k]jna[]�hjgl][laf_�ZjYf[`�g^^a[]$�ljY\af_�hYjlf]j�gj�kmhhda]j�dg[Ylagfk&

AHK][�`Yk�Z]]f�\]ka_f]\�lg�af[dm\]�log�f]o�hjglg[gdk�lg�kgdn]�l`]�hjgZd]ek�g^�\YlY�afl]_jalq�Yf\�[gf^a\]flaYdalq�o`]f�k][mjaf_�\YlY�Y[jgkk�l`]�Afl]jf]l&�L`]�9@� 9ml`]fla[Ylagf�@]Y\]j!�hjglg[gd�kgdn]k�l`]�hjgZd]e�g^�\YlY�afl]_jalq�Ydgf]$�o`ad]�l`]�=KH� =f[YhkmdYl]\�K][mjalq�HYqdgY\!�hjglg[gd�kgdn]k�l`]�hjgZd]e�g^�\YlY�afl]_jalq�Yf\�[gf^a\]flaYdalq&

=Y[`�NHF�lmff]d�[j]Yl]\�oal`�AHK][�ak�Ykka_f]\�Y�kh][a^a[�K][mjalq�HYjYe]l]j�Af\]p� KHA!&�L`ak�\a^^]j]flaYl]k�NHF�lmff]dk�[gf^a_mj]\�gf�l`]�>aj]Zgp&�9f�KHA�ak�Yf�YjZaljYjq$�+*%Zal�fmeZ]j�l`Yl�kh][a^a]k�lg�l`]�j][]anaf_�\]na[]�o`a[`�_jgmh�g^�k][mjalq�hjglg[gdkÈYd_gjal`ek$�c]qk$�`go�dgf_�l`gk]�c]qk�Yj]�nYda\Èl`]�k]f\]j�ak�mkaf_�^gj�[geem%fa[Ylagf&

Qgm�[Yf�Ydkg�gj\]j�Yf\�hjagjalar]�jgmlaf_�hgda[a]k�lg�kh][a^q�o`a[`�NHF�lmff]d�lg�mk]�^gj�[]jlYaf�ljY^^a[&�>gj�]pYehd]$�qgm�eYq�mk]�<=K�]f[jqhlagf�̂ gj�NHF�ljY^^a[�gja_afYlaf_�^jge�qgmj�kYd]k�l]Ye$�Zml�eYq�j]imaj]�kljgf_]j�Ljahd]<=K�]f[jqhlagf�^gj�Ydd�\YlY�ljYfkeall]\�^jge�qgmj�^afYf[]�\]hYjle]fl&

Internet Key Exchange (IKE)9k�l`]�fmeZ]j�g^�NHF�lmff]dk�Z]lo]]f�>aj]Zgp]k�Yf\�gl`]j�AHK][%[gehdaYfl�\]na[]k�_jgo$�qgm�Yj]�^Y[]\�oal`�l`]�[`Ydd]f_]�g^�eYaf%lYafaf_�eYfq�hYajk�g^�c]qk$�gj�k][j]lk$�^gj�]Y[`�lmff]d&�Qgm�Yj]�Ydkg�j]khgfkaZd]�^gj�eYcaf_�kmj]�l`]k]�c]qk�Yj]�[`Yf_]\�^j]im]fldq�lg�]fkmj]�l`]�k][mjalq�g^�]Y[`�NHF�[gff][lagf&

Afl]jf]l�C]q�=p[`Yf_]� AC=!�YmlgeYl]k�l`]�hjg[]kk�g^�f]_glaYlaf_�c]qk$�[`Yf_af_�c]qk�Yf\�\]l]jeafaf_�o`]f�lg�[`Yf_]�c]qk&�OYl[`%?mYj\�kmhhgjlk�l`]�dYl]kl�\jY^l�g^�l`]�AHK][�klYf\Yj\�l`Yl�mk]k�l`]�Afl]jf]l�C]q�=p[`Yf_]�hjglg[gd�^gj�\qfYea[Yddq�f]_glaYlaf_�c]qk&�AC=�]f`Yf[]k�k][mjalq�Yf\�]fYZd]k�l`]�>aj]Zgp�lg�]klYZdak`�Y�k][mj]�klYf\Yj\k%ZYk]\�NHF�[gff][lagf�oal`�gl`]j�f]logjc�\]na[]k�l`Yl�kmhhgjl�AC=&�

WatchGuard’s Proprietary Encryption ProtocolL`]�OYl[`?mYj\�Hjghja]lYjq�=f[jqhlagf�Hjglg[gd�mk]k�JK9�J;,�]f[jqhlagf�klYf\Yj\k�lg�]klYZdak`�Y�k][mj]�lmff]d�Yegf_�emdlahd]�OYl[`?mYj\�>aj]Zgp]k&�JK9�J;,�)*0%Zal�]f[jqhlagf�ak�YnYadYZd]�af�

WatchGuard Internet Security Handbook 71

Virtual Private Networking

l`]�M&K&�Yf\�;YfY\Y�Yf\�J;,�-.%Zal�]f[jqhlagf�ak�YnYadYZd]�^gj�afl]j%fYlagfYd�mk]&

OYl[`?mYj\�k�NHF�OarYj\�oYdck�qgm�l`jgm_`�l`]�kljYa_`l^gjoYj\�hjg[]kk�g^�k]llaf_�mh�l`]�NHF&�L`]�OarYj\�Z]_afk�Zq�a\]fla^qaf_�l`]�>aj]Zgp�Yl�l`]�gl`]j�]f\�g^�]Y[`�lmff]d�Yf\�]Y[`�f]logjc�Z]`af\�l`]�>aj]Zgp&�L`]�NHF�OarYj\�Ydkg�Ykkaklk�qgm�af�k]llaf_�mh�hY[c]l�^adl]j�jmd]k�^gj�mf]f[jqhl]\�j][]an]\�hY[c]lk&�Jmffaf_�l`]�NHF�OarYj\�^jge�Y��`]Y\imYjl]jk��g^^a[]�eYc]k�al�n]jq�]Ykq�lg�kYn]�[gf^a_mjYlagf�af^gjeYlagf�lg�j]egl]�ZjYf[`�g^^a[]�>aj]Zgp]k&

Configuration Checklist@]j]�ak�Y�dakl�g^�\][akagfk�lg�eYc]�Z]^gj]�hjg[]]\af_�oal`�NHF�[gf%^a_mjYlagf2

� AH�Y\\j]kk�g^�Zgl`�>aj]Zgp]k� AH�f]logjc�Y\\j]kk]k�^gj�l`]�f]logjck�[geemfa[Ylaf_�oal`�gf]�

Yfgl`]j� 9�[geegf�hYkk%h`jYk]$�cfgof�Yk�Y�k`Yj]\�k][j]l&�� A^�qgm�Yj]�fgl�mkaf_�:jYf[`�G^^a[]�NHF�oal`�AHK][$�]Y[`�>aj]Zgp�

emkl�`Yn]�Y�dg[Yd�NHF�AH�Y\\j]kk&�L`ak�emkl�Z]�k]d][l]\�^jge�Y�j]k]jn]\�f]logjc�Y\\j]kk�l`Yl�ak�fgl�af�mk]�gf�]al`]j�g^�l`]�f]l%ogjck�Z]af_�[gff][l]\&�>gj�egj]�af^gjeYlagf�k]]�J>;�)1)0&

� �:gl`�>aj]Zgp]k�emkl�mk]�l`]�kYe]�e]l`g\�g^�]f[jqhlagf

Al�ak�g^l]f�`]dh^md�lg�\jYo�Y�\aY_jYe�oal`�Ydd�l`]�AH�Y\\j]kk]k$�kaf[]�l`af_k�[Yf�_]l�Y�dalld]�[gf^mkaf_&�>gj�]pYehd]2

FIGURE 4. Branch Office VPN Diagram

Internet(insecure)

Home OfficeTrusted Network:

Kokomo

172.16.18.0/24

Trusted Network:192.168.6.0/24

External address: 212.134.34.25VPN IP address: 10.10.10.10Unwrapping, decryption, andfinal destination routing occurhere.

Over the Internet, packetsare encrypted and sent via UDP to the reciprocatingFirebox’s external IP addresswhere they are unwrapped, decrypted, and sent on to theirreal destination.

External address: 194.34.54.2VPN IP address: 10.20.20.20Unwrapping, decryption, andfinal destination routing occurhere.

72 WatchGuard Internet Security Handbook

Branch Office VPN

EncryptionQgm�[Yf�k]d][l�Z]lo]]f�,(�gj�)*0�Zal�]f[jqhlagf�a^�qgm�Yj]�Y�M&K&�[mk%lge]j$�;YfY\aYf�[mklge]j$�gj�[mklge]j�o`g�`Yk�Z]]f�Yhhjgn]\�^gj�mk]�g^�kljgf_�]f[jqhlagf�Zq�OYl[`?mYj\�Yf\'gj�l`]�M&K&�?gn]jf%e]fl&�A^�qgm�ogmd\�dac]�lg�mk]�kljgf_�]f[jqhlagf� )*0�Zal$�+<=K!�gj�AHK][$�hd]Yk]�[gflY[l�OYl[`?mYj\�L][`fa[Yd�Kmhhgjl�Yl�*(.&-*)&0+/-&�

Logging9[lanYlaf_�af[geaf_�gj�gml_gaf_�dg__af_�mkmYddq�_]f]jYl]k�Y�dYj_]�fmeZ]j�g^�dg_�]flja]k$�o`a[`�ogmd\�dac]dq�kdgo�l`]�hYkkY_]�g^�NHF�ljY^^a[�ka_fa^a[Yfldq� kaf[]�]Y[`�hY[c]l�ak�dg__]\!&�Dg__af_�g^�l`]k]�]n]flk�Yj]�_]f]jYddq�mk]^md�gfdq�^gj�\]Zm__af_&

Branch Office VPN Special Considerations� L`]j]�ak�Y�hgl]flaYd�AH�khgg^af_�hjgZd]e�a^�l`]�j]egl]�>aj]Zgp�AH�ak�

gf�l`]�kYe]�f]logjc�Yk�Y�j]egl]�f]logjc&�Al�ak�l`]gj]la[Yddq�hgkka%Zd]�lg�khgg^�hY[c]lk�^jge�l`Yl�kaf_d]�AH�Y\\j]kk� l`]�j]egl]�>aj]Zgp�AH!&�K`gmd\�l`ak�Z]�l`]�[Yk]$�l`]�hYjYfga\�Y\eafakljYlgj�k`gmd\�eYc]�kmj]�lg�\akYddgo�Y[[]kk�lg�afl]jfYd�k]jn]jk�^jge�l`Yl�gf]�AH�Y\\j]kk&

� Gf[]�NHF�ak�k]l�mh$�[gf^a_mj]�af[geaf_�k]jna[]k�lg�Yddgo�NHF�[gff][lagfk&�Al�ak�g^l]f�]Yka]kl�lg�[j]Yl]�É@gkl�9daYk]kÊ� ^jge�K]lmh'9[[]kk�Yf\�9ml`]fla[Ylagf&&&!�[gjj]khgf\af_�lg�NHF�j]egl]�f]logjck�kg�l`Yl�k]jna[]k�eYq�Z]�egj]�]Ykadq�[gf^a_mj]\� k]]É9daYkaf_Ê�gf�hY_] -)!$�gj�mk]�l`]�9fq�k]jna[]&

� �OYl[`?mYj\�mk]k�hgjl�,)(,�^gj�NHF�[gff][lagfk&

Sample ConfigurationsL`]j]�Yj]�log�eYaf�lqh]k�g^�NHF�[gff][lagfk2�Y�log�Zgp�[gf^a_mjY%lagf$�Yf\�Y�emdlahd]�Zgp�[gf^a_mjYlagf&

Two Box ConfigurationL`ak�[gf^a_mjYlagf�[gff][lk�log�f]logjck�gn]j�l`]�Afl]jf]l�mkaf_�log�>aj]Zgp]k&�L`ak�ak�l`]�[gf^a_mjYlagf�addmkljYl]\�af�>a_mj] ,$�É:jYf[`�G^^a[]�NHF�<aY_jYe$Ê�gf�hY_] /*&���

Multiple Box ConfigurationLg�]klYZdak`�egj]�l`Yf�gf]�NHF�[gff][lagf�Z]lo]]f�egj]�l`Yf�log�>aj]Zgp]k$�kaehdq�Y\\�emdlahd]�NHF�[gf^a_mjYlagfk�lg�l`]�É[]fljYdÊ�>aj]Zgp$�Yf\�[gf^a_mj]�j]egl]�>aj]Zgp]k�Y[[gj\af_dq&�EYc]�kmj]�l`Yl�hYkk�h`jYk]k�Yj]�mfaim]�lg�Y�kaf_d]�NHF�[gff][lagf&�

WatchGuard Internet Security Handbook 73

Virtual Private Networking

Lg�\]l]jeaf]�a^�Y�[gf^a_mjYlagf�`Yk�Z]]f�km[[]kk^md$�oYl[`�^gj�dg_�]flja]k�Yk�l`]�>aj]Zgp�j]Zgglk�l`Yl�k`go�dg[Yd�Yf\�j]egl]�AH�Y\\j]kk]k�^gj�NHF&�Af�Y\\alagf�[`][c�l`]�KlYlmk�g^�l`]�>aj]Zgp�gf[]�al�`Yk�Zggl]\$�Yf\�l`]j]�k`gmd\�Z]�Yf�]fljq�^gj�Y�NHF�afl]j^Y[]�\aj][ldq�^gddgoaf_�l`]�]fljq�^gj�]l`*&

A^�f]al`]j�g^�l`]k]�af\a[Ylagfk�Yj]�hj]k]fl$�j]na]o�Ydd�k]llaf_k�gf�Zgl`�>aj]Zgp]k$�\gmZd]%[`][c�l`Yl�l`]�hYkk�h`jYk]k�Yj]�l`]�kYe]$�Yf\�l`Yl�l`]�[gjj][l�=pl]jfYd�AH�Y\\j]kk]k�]fl]j]\&

Branch Office VPN with IPSecAHK][�ak�Y�hjglg[gd�l`Yl�]f[jqhlk�Yf\'gj�Yml`]fla[Yl]k�AH�ljY^^a[� Yl�l`]�AH�d]n]d!�Z]lo]]f�Yfq�eap�g^�YjZaljYjq�`gklk�Yf\�k][mjalq�_Yl]%oYqk� ^gj�]pYehd]$�l`]�OYl[`?mYj\�>aj]Zgp!&�AHK][�[j]Yl]k�k]n]jYd�lmff]dk�Z]lo]]f�l`]�kYe]�log�AHK][�`gklk$�]Y[`�oal`�\a^^]j]fl�e]l`%g\k�g^�Yml`]fla[Ylagf�Yf\�]f[jqhlagf&�OYl[`?mYj\Ìk�:jYf[`�G^^a[]�NHF�oal`�AHK][�gj_Yfar]k�l`]�[geemfa[Ylagf�dafck�aflg�Y�+%^mf[lagf�`a]jYj[`qÈ?Yl]oYqk$�Lmff]dk$�Yf\�Hgda[a]k$�]Y[`�g^�o`a[`�qgm�[j]%Yl]�Yf\�[gf^a_mj]�^gj�\a^^]j]fl�hYjYe]l]jk�l`Yl�mdlaeYl]dq�ogjc�lg_]l`]j&�?Yl]oYqk$�Lmff]dk$�Yf\�Hgda[a]k�Yj]�kmeeYjar]\�Z]dgo2

Gateway9�?Yl]oYq�kh][a^a]k�]f\hgaflk�Yk�Y�^jYe]ogjc�^gj�gf]�gj�egj]�lmff]dk&�O`Yl]n]j�qgm�kh][a^q�^gj�Y�_Yl]oYq$�km[`�Yk�AK9CEH�YmlgeYl]\�c]q�f]_glaYlagf$�Z][ge]k�klYf\Yj\�̂ gj�Yfq�lmff]dk�qgm�[j]Yl]�oal`�l`Yl�_Yl]oYq&

Tunnel9�Lmff]d�]f[YhkmdYl]k�hY[c]lk�Z]lo]]f�log�_Yl]oYqk&�Al�kh][a^a]k�o`Yl�lqh]�g^�]f[jqhlagf�Yf\'gj�Yml`]fla[Ylagf�ak�Yhhda]\�lg�l`]�hY[c]lk�l`Yl�mk]�l`Yl�lmff]d&�9�lmff]d�Ydkg�kh][a^a]k�Yk�]f\hgaflk�Y�>aj]Zgp�Yf\�Yf�AHK][%[gehdaYfl�\]na[]� km[`�Yk�Yfgl`]j�>aj]Zgp!&

Policy9�Hgda[q�kh][a^a]k�o`a[`�hY[c]lk�_g�l`jgm_`�o`a[`�lmff]dk&�>gj�]pYehd]$�o`]j]�Y�lmff]d�ea_`l�kh][a^q�l`]�AH�Y\\j]kk]k�g^�Y�`ge]�g^^a[]�>aj]Zgp�Yf\�Y�ZjYf[`�g^^a[]�>aj]Zgp$�Y�hgda[q�ea_`l�kh][a^q�l`]�;=GÌk�`gkl�Yl�l`]�`ge]�g^^a[]�Yf\�>a]d\�K]jna[]Ìk�`gkl�Yl�Y�ZjYf[`�g^^a[]&�O`]f�l`]�;=G�Yll]ehlk�lg�[gflY[l�l`]�>a]d\�K]jna[]�`gkl$�AHK][�dggck�^gj�Y�hgda[q�l`Yl�k]jna[]k�l`]�afl]f\]\�jgml]�Yf\�eYl[`]k�l`Yl�hgda[q�lg�alk�Ykkg[aYl]\�lmff]d&

!NOTE

On the central Firebox, the same local IP address can be used, for multiple remote Fireboxes but it cannot be used anywhere else in any networks on any of the remote Fireboxes.

74 WatchGuard Internet Security Handbook

Branch Office VPN

O`]f�[gf^a_mjaf_�:jYf[`�G^^a[]�NHF�oal`�AHK][$�l`]j]�Yj]�k]n%]jYd�gl`]j�hYjYe]l]jk�Yf\�lg�[`ggk]�Yf\�[gf^a_mj]&�L`]k]�af[dm\]2

Key Negotiation TypeOYl[`?mYj\Ìk�aehd]e]flYlagf�g^�AHK][�af[dm\]k�l`]�ghlagf�lg�k]d][l�AK9CEH� L`]�Afl]jf]l�K][mjalq�9kkg[aYlagf�Yf\�C]q�EYf%Y_]e]fl�Hjglg[gd!�lg�YmlgeYla[Yddq�f]_glaYl]�k]kkagf�c]qk$�o`a[`�Yj]�mk]\�Zgl`�lg�]f[jqhl�l`]�\YlY�Yf\�Yml`]fla[Yl]�l`]�mk]jk&�Qgm�[Yf�Ydkg�k]d][l�eYfmYd�c]q�f]_glaYlagf$�af�o`a[`�qgm�eYfmYddq�]fl]j�k]kkagf�c]qk�^gj�]Y[`�lmff]d&�

Key ExpirationQgm�[Yf�k]l�k]kkagf�c]qk�lg�]phaj]�Y^l]j�Y�[]jlYaf�fmeZ]j�g^�Zql]k�`Yn]�Z]]f�ljYfk^]jj]\�gj�o`]f�Y�kh][a^a]\�Yegmfl�g^�k]kkagf�lae]�`Yk�ljYfkhaj]\&�Oal`�AK9CEH$�f]o�k]kkagf�c]qk�Yj]�YmlgeYla[Yddq�_]f]jYl]\3�l`]�koal[`�ak�ljYfkhYj]fl�lg�l`]�mk]jk�Yl�]al`]j�]f\�g^�l`]�lmff]d$�Zml�^jmkljYl]k�`Y[c]jk�^jge�Yk[]jlYafaf_�Y�k]kkagf�c]q�af�lae]�lg�]Yn]k\jgh&�

Qgm�[Yf�Ydkg�\akYZd]�]phajYlagf�a^�\]kaj]\&

Traffic Security Protocols;`ggk]�^jge�=KH� =f[YhkmdYl]\�K][mjalq�HYqdgY\!�gj�9@� 9ml`]fla[Ylagf�@]Y\]j!&�

Ò =f[YhkmdYlaf_�K][mjalq�HYqdgY\� =KH!�Ak�mk]\�lg�hjgna\]�Y�eap�g^�k][mjalq�k]jna[]k$�af[dm\af_�]f[jqhlagf�Yf\�daeal]\�Yml`]fla[Ylagf�k]jna[]k�^gj�hYqdgY\k$�Zml�fgl�`]Y\]jk&�Al�ak�Y�hgo]j^md�Yf\�^d]paZd]�hjglg[gd&�=KH�[Yf�]f[jqhl�Yf\�Yml`]fla%[Yl]$�]f[jqhl�oal`gml�Yml`]fla[Ylagf$�gj�Yml`]fla[Yl]�oal`gml�]f[jqhlagf&�=f[jqhlagf�[Yf�Z]�]al`]j�<=K� -.%Zal!�gj�ljahd]%<=K� ).0%Zal�^gj�mk]�af�l`]�Mfal]\�KlYl]k$�;YfY\Y�Yf\�Zq�[mklge]jk�o`g�`Yn]�Z]]f�Yhhjgn]\�^gj�mk]�g^�kljgf_�]f[jqhlagf�Zq�OYl[`?mYj\�Yf\'gj�l`]�M&K&�?gn]jfe]fl!�]f[jqhlagf�Yd_g%jal`ek&� 9@�g^^]jk�Yml`]fla[Ylagf�gfdq&!

Ò 9ml`]fla[Ylagf�@]Y\]j� 9@!�Ak�mk]\�lg�hjgna\]�[gff][lagfd]kk�afl]_jalq�Yf\�\YlY�gja_af�Yml`]fla[Ylagf&�9@�hjgna\]k�Yml`]f%la[Ylagf�^gj�Yk�em[`�g^�l`]�AH�`]Y\]j�Yk�hgkkaZd]� ]p[]hl�^gj�emlYZd]�^a]d\k�l`Yl�Yj]�fgf%\]l]jeafakla[$�km[`�Yk�LLD�^a]d\k�Yf\�l`]�dac]!�Yf\�Ydd�mhh]j�hjglg[gdk�Yf\�hYqdgY\&�

Policy OrderingGf[]�Y�dakl�g^�hgda[a]k�ak�[j]Yl]\$�k]l�l`]aj�gj\]j�kg�l`]�ja_`l�lmff]d�ak�mk]\�^gj�l`]�ja_`l�[geemfa[Ylagf&�Hgda[q�gj\]jaf_�ak�]kk]flaYd�lg�]fkmj]�l`Yl�Y�kh][a^a[�[gff][lagf�j][]an]k�l`]�\]kaj]\�d]n]d�g^�]f[jqhlagf�Yf\'gj�Yml`]fla[Ylagf&�Qgm�emkl�eYc]�kmj]�hgda[a]k�Yj]�k]l�lg�l`]�kYe]�gj\]j�Yl�Zgl`�]f\k�g^�l`]�lmff]d&

>gj�]pYehd]$�kmhhgk]�qgm�\]^af]�Y�`a_`%k][mjalq�lmff]d�oal`�).0%Zal� ljahd]%<=K!�]f[jqhlagf�hdmk�Yml`]fla[Ylagf$�Yf\�Y�k][gf\�_]f%]jYd�hmjhgk]�lmff]d�oal`�Yml`]fla[Ylagf�gfdq&�9dgf_�oal`�l`ak$�kmhhgk]�qgm�`Yn]�[j]Yl]\�log�hgda[a]k$�gf]�l`Yl�kh][a^a]k�l`]�f]l%ogjck�YllY[`]\�lg�l`]�log�AHK][�`gklk� ]&_&$�>aj]Zgp]k!$�Yf\�

WatchGuard Internet Security Handbook 75

Virtual Private Networking

Yfgl`]j�l`Yl�kh][a^a]k�gf]�]f\hgafl�Yk�l`]�;=GÌk�`gkl� [Ydd�l`]�`gkl�;=G!�Yf\�l`]�gl`]j�Yk�k]fkalan]�eYjc]laf_�kljYl]_q�`gkl� [Ydd�al�Ecl_!�Yl�Y�j]egl]�g^^a[]&�Qgmj�afl]flagf�ak�lg�`Yn]�_]f]jYd�[ge%emfa[Ylagf� dgo�jakc$�`a_`�ngdme]!�^dgo�ima[cdq�Z]lo]]f�l`]�f]l%ogjck�mkaf_�l`]�d]kk%k][mj]\�lmff]d$�o`ad]�kh][a^a[$�k]fkalan]�dafck� `a_`�jakc$�dgo�ngdme]!�Yj]�`Yf\d]\�oal`�egj]�k][mjalq$�Zml�Yl�Y�kdgo]j�kh]]\&

FIGURE 5. Branch Office VPN with IPSec

O`]f�`gkl�;=G�Yll]ehlk�lg�Y[[]kk�Ecl_$�AHK][�dggck�^gj�l`]�^ajkl�hgda[q�af�alk�dakl�l`Yl�[Yf�jgml]�l`]�hY[c]lk&�A^�l`]�^ajkl�hgda[q�dakl]\�ak�^jge�l`]�dg[Yd�f]logjc�lg�l`]�j]egl]�f]logjc$�AHK][�k]]k�Y�eYl[`�Yf\�mk]k�l`]�d]kk%k][mj]�lmff]d$�o`a[`�ak�fgl�o`Yl�l`]�mk]j�afl]f\]\&�A^�l`]�hgda[q�kh][a^qaf_�;=G�Yf\�Ecl_�`gklk�Yk�]f\%hgaflk�ak�dakl]\�^ajkl$�AHK][�k]]k�l`Yl�eYl[`�Yf\�mk]k�l`]�Ykkg[aYl]\�`a_`%k][mjalq�lmff]d&�;gfn]jk]dq$�o`]f�gl`]j�`gklk�gf�l`]�dg[Yd�f]logjc�lmff]d�lg�Y�`gkl�gf�l`]�gl`]j�f]logjc$�AHk][�a_fgj]k�l`]�;=G%lg%Ecl_�hgda[q�Z][Ymk]�al�ak�fgl�Y�eYl[`$�Yf\�hjg[]]\k�lg�l`]�f]logjc%lg%f]logjc�hgda[q�Yf\�alk�Ykkg[aYl]\�dgo]j%k][mjalq�lmf%f]d�Yk�afl]f\]\&�L`ak�]pYehd]�`a_`da_`lk�l`]�aehgjlYf[]�g^�k]llaf_�qgmj�hgda[q�gj\]j�[gjj][ldq&

,QWHUQHW

205.123.222.11

147.212.197.45

&(2

0NWJ

+RPH�2IILFH1HWZRUN

%UDQFK�2IILFH1HWZRUN

3ROLF\�2UGHU�1. CEO to Mktg

2. Home Office network to Branch Office network

7XQQHOV�1. 205.123.222.11 to 147.212.197.45 with triple-DES encryption and

2. 205.123.222.11 to 147.212.197.45

authentication.

with authentication only

Tech Support

Sales

NewsletterProduction

76 WatchGuard Internet Security Handbook

Branch Office VPN

Creating Policies for IPSec�Hgda[a]k�Yj]�k]lk�g^�jmd]k$�em[`�dac]�hY[c]l�^adl]j�jmd]k$�l`Yl�\]l]jeaf]�`go�gml_gaf_�AHK][�hY[c]lk�Yj]�Zmadl�Yf\�k]fl$�Yf\�`go�lg�\]l]j%eaf]�a^�af[geaf_�AHK][�hY[c]lk�[Yf�Z]�Y[[]hl]\&�Hgda[a]k�Yj]�\]^af]\�Zq�l`]aj�]f\hgaflk&�L`]k]�Yj]�fgl�l`]�kYe]�Yk�l`]�lmff]dÌk�gj�_Yl]%oYqÌk�]f\hgaflkÈl`]q�Yj]�l`]�kh][a^a[�`gklk�gj�f]logjck�YllY[`]\�lg�l`]�lmff]dÌk�>aj]Zgp]k� gj�gl`]j�AHK][%[gehdaYfl�\]na[]!�l`Yl�oadd�Z]�[geemfa[Ylaf_�l`jgm_`�l`]�lmff]d�qgm�`Yn]�k]l�mh&

The Importance of IPSec Policy OrderOYl[`?mYj\�`Yf\d]k�hgda[a]k�daf]Yjdq�af�l`]�gj\]j�dakl]\�lgh�lg�Zgl%lge�gf�l`]�AHK][�;gf^a_mjYlagf�\aYdg_�Zgp&�O`]f�qgm�^ajkl�[j]Yl]�hgda[a]k$�l`]�AHK][�;gf^a_mjYlagf�\aYdg_�Zgp�daklk�l`]e�af�l`]�gj\]j�[j]Yl]\&�Qgm�emkl�eYfmYddq�j]%gj\]j�l`]�hgda[a]k�^jge�egj]�kh][a^a[�lg�d]kk�kh][a^a[�lg�]fkmj]�l`Yl�k]fkalan]�[gff][lagfk�Yj]�jgml]\�Ydgf_�l`]�`a_`]j%k][mjalq�lmff]dk&�Af�_]f]jYd$�gj\]j�Ydd�`gkl%lg%`gkl�hgda[a]k�^ajkl$�^gddgo]\�Zq�`gkl%lg%f]logjc�Yf\�f]logjc%lg%`gkl�[gff][lagfk$�oal`�f]logjc%lg%f]logjc�hgda[a]k�dakl]\�dYkl&

Policy Ordering CompatibilityHgda[a]k�emkl�Z]�k]l�lg�l`]�kYe]�gj\]j�Yl�Zgl`�]f\k�g^�l`]�lmff]d&�L`ak�e]Yfk�qgm�emkl�eYc]�kmj]�l`Yl�qgmj�hgda[a]k�Yf\�hgda[q�gj\]j�Yj]�[geemfa[Yl]\�lg�o`ge]n]j�ak�[gf^a_mjaf_�l`]�j]egl]�>aj]Zgp$�Yf\�l`Yl�l`]�hgda[q�gj\]jk�Yj]�k]l�a\]fla[Yddq&

>gj�]pYehd]$�^gj�Y�lmff]d�Z]lo]]f�@gZgc]f$�F]o�B]jk]q�Yf\�K`]%Zgq_Yf$�Oak[gfkaf$�l`]�hgda[q�gj\]jaf_�k`gmd\�dggc�kge]l`af_�dac]�l`ak2

Hoboken Policies:/RFDO�����������5HPRWH�����������'LVSRVLWLRQ��7XQQHO����'HVWLQDWLRQ��6RXUFH���������������������������������6HFXUH�������7XQQHO���������������������������������������������������6HFXUH�������7XQQHO���������������������

Sheboygan Policies:/RFDO������������5HPRWH�����������'LVSRVLWLRQ��7XQQHO����'HVWLQDWLRQ��6RXUFH����������������������������������6HFXUH�������7XQQHO�����������������������������������������������������6HFXUH�������7XQQHO�����������������������

Lmff]dk�Lmff]d)�Yf\�Lmff]d*�Yj]�dakl]\�af�l`]�kYe]�gj\]j�Yf\�kh][%a^q�l`]�kYe]�]f\hgaflk$�Zml�j]n]jk]�l`]�]f\hgaflk�Yf\�hgjlk�j]dYlan]�lg�o`a[`�ak�dg[Yd�Yf\�o`a[`�ak�j]egl]$�o`a[`�ak�kgmj[]�Yf\�o`a[`�ak�\]klafYlagf&

IPSec Implementation Example::gZ� o`gk]�[gehml]j�ak�:gZ`gkl!�oak`]k�lg�l]df]l�^jge�Z]`af\�Y�>aj]Zgp�lg�Y�j]egl]�k]jn]j� fYe]\�J]eKnj!�Z]`af\�Yfgl`]j�>aj]Zgp&

1. :gZ�^aj]k�mh�`ak�l]df]l�[da]fl$�Yf\�gh]fk�mh�Y�[gff][lagf�lg�K]jn]j&�

WatchGuard Internet Security Handbook 77

Virtual Private Networking

2. L`]�\YlY�d]Yn]k�`ak�l]df]l�[da]fl&�L`]�AHK][�aehd]e]flYlagf�dggck�l`jgm_`�alk�Hgda[q�\YlYZYk]�Yf\�[`][ck�^gj�hY[c]lk�_gaf_�^jge�:gZ`gkl�lg�J]eKnj�gf�hgjl�*+&�

3. OYl[`?mYj\�^af\k�l`]�hgda[q�eYl[`af_�l`]�hY[c]l&�L`]�>aj]Zgp�fgo�cfgok�o`a[`�lmff]d�lg�k]f\�l`]�hY[c]l�l`jgm_`&�

4. OYl[`?mYj\�h]j^gjek�]Y[`�gj\]j]\�kl]h�g^�hjg[]kkaf_�gf�l`]�hY[c]l$�Y[[gj\af_�lg�l`]�lmff]d&

5. >afYddq$�l`]�hY[c]l�ak�ojYhh]\�af�Yf�Égmlka\]Ê�AH�`]Y\]j�lg�_]l�al�lg�l`]�j]egl]�AHK][%[gehdaYfl�k][mjalq�_Yl]oYq$�oal`�l`]�hjglg[gd�k]l�lg�Yf�AHK][�hjglg[gd&�

6. L`]�hY[c]l�ak�l`]f�k]fl�lg�l`]�gl`]j�k][mjalq�_Yl]oYq&�

O`]f�l`]�hY[c]l�j]Y[`]k�l`]�j]egl]�>aj]Zgp2�

1. L`]�hY[c]l�ak�j][]an]\�Zq�l`]�]pl]jfYd�afl]j^Y[]�g^�l`]�>aj]Zgp&�

2. L`]�AH�klY[c�l`]f�[`][ck�l`]�hgda[q�\YlYZYk]�lg�k]]�a^�l`]�kl]hk�al�`Yk�bmkl�h]j^gje]\�lg�mfojYh�l`]�hY[c]l�eYl[`�Y�hgda[q&�L`ak�ak�kaehdq�Y�j]n]jk]�g^�l`]�]f[YhkmdYlagf�hjg[]kk�l`Yl�l`]�`gkl�h]j%^gje]\�o`ad]�ljYfkeallaf_�l`]�hY[c]l&�

3. A^�l`]�mfojYhhaf_�kl]hk�eYl[`�Y�hgda[q$�l`]f�l`]�afl]jfYd$�mf]f%[jqhl]\�hY[c]lk�Yj]�k]fl�gml�gf�l`]�Ljmkl]\�afl]j^Y[]�lg�J]eKnj&�

>gj�egj]�af^gjeYlagf�k]]�l`]�Afl]jf]l�=f_af]]jaf_�LYkc�>gj[]�k][lagf�gf�AHK][�Yl�KWWS���ZZZ�LHWI�RUJ�KWPO�FKDUWHUV�LSVHF�FKDUWHU�KWPO&�

Configuring Services to work with VPNNHF%[gff][l]\�eY[`af]k�Yj]�lj]Yl]\�dac]�Yfq�gl`]j�eY[`af]�l`Yl�ak�Z]af_�Yddgo]\�Y[[]kk�lg�l`]�f]logjc&�>gj�]pYehd]$�lg�Yddgo�NHF�j]egl]�f]logjck�lg�Y[[]kk�qgmj�afl]jfYd�@LLH�k]jn]j$�[gf^a_mj]�Yf�@LLH�a[gf�Yddgoaf_�eY[`af]�>jge�l`]�j]egl]�NHF�f]logjc�lg�Y[[]kk�l`]�afl]jfYd�@LLH�k]jn]j&

Af�l`ak�oYq�qgm�[gfljgd�l`]�]pl]fl�lg�o`a[`�j]egl]�f]logjck�[Yf�Y[[]kk�l`]�k]jna[]k�l`Yl�Yj]�hjgna\]\�lg�l`]e$�bmkl�dac]�qgm�[gfljgd�Yfq�gl`]j�lqh]�g^�Y[[]kk�lg�eY[`af]k�Z]`af\�l`]�>aj]Zgp&

Qgm�[Yf�[gf^a_mj]�Ydd�k]jna[]k�^gj�qgmj�lmff]dk�Yl�gf[]�Zq�Y\\af_�l`]�9fq�k]jna[]�lg�l`]�[gf^a_mjYlagf&�:]�YoYj]$�`go]n]j$�l`Yl�l`ak�af[j]Yk]k�k][mjalq�jakck�[gehYj]\�lg�[gf^a_mjaf_�l`]�af\ana\mYd�k]j%na[]k&�>gj�Y�\]k[jahlagf�g^�l`]�9fq�k]jna[]$�k]]�l`]�\]k[jahlagf�af�l`]�K]jna[]k�Yhh]f\ap�g^�l`]�OYl[`?mYj\�Mk]jÌk�?ma\]&

:]�[Yj]^md�YZgml�o`Yl�qgm�Yddgo�]n]f�eY[`af]k�gf�l`]�j]egl]�NHF�f]logjck�lg�Y[[]kk3�a^�eY[`af]k�gf�l`]�j]egl]�NHF�f]logjck�Yj]�[gehjgeak]\$�NHF�gfdq�hjgna\]k�Y�k][mj]�lmff]d�aflg�l`]�Ljmkl]\�f]logjck&�9[[]kk�[gfljgd�ak�Y�[jala[Yd�hYjl�g^�[gf^a_mjaf_�Y�k][mj]�NHF�]fnajgfe]fl&

78 WatchGuard Internet Security Handbook

Branch Office VPN

Authenticating an IPSec Tunnel via a Windows NT ServerQgm�[Yf�k]l�mh�:jYf[`�G^^a[]�NHF�oal`�AHK][�kg�l`]�ZjYf[`�g^^a[]�mk]jk�Yj]�Yml`]fla[Yl]\�Y_Yafkl�Y�Oaf\gok�FL�9ml`]fla[Ylagf�K]jn]j�Yl�l`]�`ge]�g^^a[]$�Yk�addmkljYl]\�af�>a_mj] .�gf�hY_] /1&�@ge]�G^^a[]�>aj]Zgp�;gf^a_mjYlagf�=pYehd]

FIGURE 6. IPSec VPN Tunnel with NT Authentication

Mkaf_�l`]�addmkljYlagf�af�>a_mj] .$�ÉAHK][�NHF�Lmff]d�oal`�FL�9ml`]fla[Ylagf$Ê�gf�hY_] /1$�`]j]�ak�`go�qgm�ogmd\�[gf^a_mj]�l`]�KE:�k]jna[]�gf�l`]�@ge]�G^^a[]�>aj]Zgp2

Incoming Tab:

� Af[geaf_�Yddgo]\� >jge2�*(0&)-*&*,&)((� Lg2�)1*&).0&*(&)

Outgoing Tab:

� Gml_gaf_�Yddgo]\� >jge2�)1*&).0&)(&)� Lg2�*(0&)-*&*,&)((

IPSec Policies:/RFDO����������5HPRWH����������'LVSRVLWLRQ��7XQQHO������6UF��3URWR��'HVW�3RUW�������������������������������6HFXUH�������7XQQHO1DPH������� ��������������������������������������%\SDVV��������QRQH!�����������8GS�������

Internet

Home OfficeFirebox:

Kokomo

105.102.33.50

FIrebox:208.152.24.100

IPSec VPN

Tunnel

Windows NT Authentication Server192.168.10.1

Workstation172.16.15.1

WatchGuard Internet Security Handbook 79

Virtual Private Networking

Branch Office Firebox Configuration ExampleMkaf_�l`]�addmkljYlagf�af�>a_mj] .$�ÉAHK][�NHF�Lmff]d�oal`�FL�9ml`]fla[Ylagf$Ê�gf�hY_] /1$�`]j]�ak�`go�qgm�ogmd\�[gf^a_mj]�l`]�KE:�k]jna[]�gf�l`]�:jYf[`�G^^a[]�>aj]Zgp2

Incoming Tab:

� Af[geaf_�Yddgo]\� >jge2�)1*&).0&)(&)� Lg2�*(0&)-*&*,&)((

Outgoing Tab:

� Gml_gaf_�Yddgo]\� >jge2�*(0&)-*&*,&)((� Lg2�)1*&).0&)(&)

IPSec Policies:/RFDO����������5HPRWH����������'LVSRVLWLRQ��7XQQHO������6UF��3URWR��'HVW�3RUW��������������������������������6HFXUH�������7XQQHO1DPH������� ���������������������������������������%\SDVV��������QRQH!�����������8GS�������

Remote User VPN

OYl[`?mYj\�J]egl]�Mk]j�NHF�hjgna\]k�ljYn]daf_�]ehdgq]]k�gj�l]d][geeml]jk�oal`�Y�k][mj]�[gff][lagf�lg�qgmj�gj_YfarYlagfÌk�f]l%ogjc&�:][Ymk]�al�mk]k�l`]�Afl]jf]l�lg�]daeafYl]�]ph]fkan]�dgf_%\ak%lYf[]�[`Yj_]k$�l`ak�kgdmlagf�ak�]plj]e]dq�[gkl%]^^][lan]&�J]egl]�Mk]j�NHF�Ydkg�]daeafYl]k�l`]�f]]\�^gj�qgm�lg�eYaflYaf�\]\a[Yl]\�eg\]e�ZYfck�Yf\�j]egl]�Y[[]kk�k]jn]jk&

J]egl]�Mk]j�NHF�mkaf_�HHLH� Hgafl%lg%Hgafl�Lmff]daf_�Hjglg[gd!�ak�af[dm\]\�oal`�l`]�klYf\Yj\�Dan]K][mjalq�hjg\m[l&�J]egl]�Mk]j�NHF�oal`�AHK][�ak�YnYadYZd]�Yk�Yf�ghlagf&

Remote User VPN with PPTPL`]�klYf\Yj\�OYl[`?mYj\�J]egl]�Mk]j�NHF�j]da]k�gf�Hgafl%lg%Hgafl�Lmff]daf_�Hjglg[gd� HHLH!$�Y�oa\]dq�Y[[]hl]\�klYf\Yj\&�9Êlmff]dÊ�[j]Yl]\�Z]lo]]f�l`]�j]egl]�`gkl�Yf\�l`]�>aj]Zgp�Yddgok�Ydd�ljY^^a[�lg�^dgo�k][mj]dq�Y[jgkk�l`]�Afl]jf]l&�Fg�Y\\alagfYd�[da]fl�kg^loYj]�ak�j]imaj]\&�Ea[jgkg^l�Oaf\gok�1-$�Oaf\gok�10$�Yf\�Oaf\gok�FL�ogjcklYlagfk�[ge]�]imahh]\�oal`�HHLH�gj�Yj]�HHLH%j]Y\q&�>j]]�<aYd%Mh�F]logjcaf_�mh_jY\]k�Yj]�j]Y\adq�YnYadYZd]�^jge�Ea[jgkg^l�lg�]fkmj]�[gehYlaZadalq�oal`�l`]�dYl]kl�klYf\Yj\k&

9f�JMNHF�mk]j�]klYZdak`]k�Y�HHLH�lmff]d�Zq�mkaf_�l`]�<aYd%Mh�F]logjcaf_�\aYdg_m]�gf�Y�Oaf\gok�ogjcklYlagf&�OYl[`?mYj\�Yml`]fla[Yl]k�l`]k]�j]egl]�mk]jk�naY�EK%;@9H�Y_Yafkl�Y�hYkkogj\�

80 WatchGuard Internet Security Handbook

Remote User VPN

dakl�eYaflYaf]\�af�l`]�>aj]Zgp�[gf^a_mjYlagf�gf�l`]�Y\eafakljYlagf�klYlagf&�EK%;@9H�j]da]k�gf�Y�[`Ydd]f_]%j]khgfk]�e][`Yfake�l`Yl�]fkmj]k�l`Yl�Yf�]f[jqhl]\�c]qÈYf\�fgl�l`]�[da]fl�k�hYkkogj\Èak�hYkk]\�Y[jgkk�l`]�Afl]jf]l�l`jgm_`�l`]�k][mj]\�lmff]d&�L`]�hYkk%ogj\k�l`]ek]dn]k�Yj]�f]n]j�ljYfkeall]\�af�Yfq�^gje&

Gf[]�l`]�lmff]d�`Yk�Z]]f�]klYZdak`]\$�Ydd�\YlY�]p[`Yf_]\�Z]lo]]f�l`]�>aj]Zgp�Yf\�j]egl]�[da]fl�ak�]f[jqhl]\�mkaf_�l`]�JK9�J;,�]f[jqhlagf�Yd_gjal`e&�L`]�>aj]Zgp�\][jqhlk�Yf\�^adl]jk�]Y[`�hY[c]l�j][]an]\�^jge�l`]�j]egl]�[da]fl�Y[[gj\af_�lg�l`]�[gf^a_mj]\�jmd]k&�Qgm�`Yn]�l`]�ghlagf�lg�dg_�Ydd�J]egl]�NHF�ljY^^a[&

Configuration Checklist:]^gj]�Z]_affaf_�lg�k]l�mh�J]egl]�Mk]j�NHF$�_Yl`]j2

� L`]�AH�Y\\j]kk]k�lg�Ykka_f�Yk�l]ehgjYjq�`gklk�\mjaf_�J]egl]�Mk]j�NHF�k]kkagfk&�L`]�AH�Y\\j]kk]k�[Yffgl�Z]�Y\\j]kk]k�[mj%j]fldq�af�mk]�af�l`]�f]logjc&�L`]�kY^]kl�e]l`g\�ak�lg�^YZja[Yl]�Y�J]dYl]\�F]logjc�Y\\j]kk� k]]�É9Zgml�J]dYl]\�F]logjck�Yf\�J]dYl]\�@gklkÊ�gf�hY_] +-!�Yf\�[`ggk]�l`]�AH�Y\\j]kk]k�^jge�l`Yl�f]logjc�jYf_]&�L`Yl�oYq$�qgm�Yj]�\jYoaf_�^jge�Y�jYf_]�g^�Y\\j]kk]k�l`Yl�Yj]�\][dYj]\�lg�l`]�K][mjalq�EYfY_]e]fl�Kqkl]e$�Zml�o`a[`�[Yffgl�[dYk`�oal`�j]Yd�`gkl�Y\\j]kk]k�af�mk]�Z]`af\�l`]�>aj]Zgp&

� L`]�AH�Y\\j]kk]k�g^�l`]�<FK�Yf\�OAFK�k]jn]jk�af�l`]�ljmkl]\�f]l%ogjc�l`Yl�h]j^gje�AH�Y\\j]kk�dggcmh�gf�`gkl�YdaYk�fYe]k&

� L`]�mk]j�A<�fYe]k�g^�l`gk]�Yml`gjar]\�lg�[gff][l�lg�l`]�>aj]Zgp�naY�J]egl]�Mk]j�NHF&

Preparing the Client Computers9fq�[gehml]j�l`Yl�oadd�Z]�mk]\�Yk�Y�j]egl]�[da]fl�lg�Y[[]kk�Y�ljmkl]\�f]logjc�naY�l`]�>aj]ZgpÌk�J]egl]�NHF�emkl�Z]�hjgh]jdq�[gf^a_mj]\�^gj�[gehYlaZadalq&�=Y[`�j]egl]�`gkl�emkl�`Yn]�l`]�egkl�j][]fl�EK<MF� Ea[jgkg^l�<aYd%mh�F]logjcaf_!�mh_jY\]k�afklYdd]\$�Yf\�eYq�f]]\�gl`]j�]pl]fkagfk�Yf\�mh\Yl]k�afklYdd]\�^gj�hjgh]j�[gf^a_m%jYlagf&�;mjj]fldq$�J]egl]�Mk]j�NHF�j]imaj]k�l`]k]�mh_jY\]k�Y[[gj\%af_�lg�hdYl^gje2

� Oaf\gok�1-2�<MF�)&+�� Oaf\gok�102�<MF�,&(� Oaf\gok�FL2�K]jna[]�HY[c�,

J]egl]�NHF�\g]k�fgl�ogjc�oal`�]Yjda]j�n]jkagfk�g^�EK<MF&

L`]�[gf^a_mjYlagf�afkljm[lagfk�lg�hj]hYj]�Oaf\gok�1-$�Oaf\gok�10$�Yf\�Oaf\gok�FL�eY[`af]k�^gj�mk]�oal`�J]egl]�Mk]j�NHF�Yj]�[gf%lYaf]\�af�l`]�OYl[`?mYj\�Dan]K][mjalq�Mk]j�?ma\]&

WatchGuard Internet Security Handbook 81

Virtual Private Networking

Remote User VPN with IPSecJ]egl]�Mk]j�NajlmYd�HjanYl]�F]logjcaf_�oal`�AHK][� JMNHF�oal`�AHK][!�[j]Yl]k�Y�k][mj]�AHK][�lmff]d�Z]lo]]f�Yf�mfk][mj]\�j]egl]�`gkl�Yf\�qgmj�f]logjc�gn]j�Yf�mfk][mj]\�f]logjc&�>gj�]pYehd]$�qgm�[Yf�[gff][l�Yf�]ehdgq]]�gf�l`]�jgY\�gj�ogjcaf_�^jge�`ge]�lg�qgmj�ljmkl]\�Yf\�ghlagfYd�f]logjck�mkaf_�Y�klYf\Yj\�Afl]jf]l�\aYd%mh�[gff][lagf�oal`gml�k]jagmkdq�[gehjgeakaf_�k][mjalq&�Al�j]imaj]k�gfdq�gf]�>aj]Zgp�^gj�l`]�hjanYl]�f]logjc�Yf\�l`]�J]egl]�Mk]j�NHF�oal`�AHK][�kg^loYj]�eg\md]&�JMHNF�oal`�AHK][�ak�Yf�ghlagfYd�^]Y%lmj]�g^�l`]�OYl[`?mYj\�Dan]K][mjalq�Kqkl]e&

JMNHF�oal`�AHK][�j]imaj]k�[Yj]^md�[gf^a_mjYlagf�g^�Zgl`�l`]�>aj]Zgp�Yf\�l`]�j]egl]�[da]fl�[gehml]jk&�@go]n]j�mfdac]�JMNHF�oal`�HHLH$�l`]�>aj]Zgp�Y\eafakljYlgj�j]lYafk�egj]�[gfljgd�gn]j�l`]�[da]fl�[gf^a_mjYlagf�l`jgm_`�Yf�]f\%mk]j�[gf^a_mjYlagf�^ad]&�Aehd]e]flaf_�JMNHF�oal`�AHK][�j]imaj]k�l`]�^gddgoaf_�kl]hk2

� GZlYaf�Y�da[]fk]�c]q�^jge�OYl[`?mYj\&� 9\\�mk]j�fYe]k�lg�l`]�Zmadl%af�>aj]Zgp�_jgmh�ahk][Wmk]jk&� =fl]j�l`]�AHK][�da[]fk]�c]q�aflg�l`]�>aj]Zgp�[gf^a_mjYlagf�^ad]&� N]ja^q�OAFK�Yf\�<FK�k]jn]j�k]llaf_k&� Mk]�l`]�Hgda[q�EYfY_]j�lg�kaemdlYf]gmkdq�[gf^a_mj]�l`]�>aj]Zgp�

Yf\�[j]Yl]�]f\%mk]j�[gf^a_mjYlagf�^ad]k&� Eg\a^q�k]jna[]k�lg�]fYZd]�JMNHF�oal`�AHK][&� Hj]hYj]�l`]�j]egl]�[da]fl�[gehml]jk&� <akljaZml]�l`]�]f\%mk]j�[gf^a_mjYlagf�^ad]k�Ydgf_�oal`�l`]�JMNHF�

[da]fl�kg^loYj]�Yf\�\g[me]flYlagf&� AfklYdd�l`]�JMNHF�[da]fl�kg^loYj]�gf�l`]�j]egl]�[gehml]j&

<]lYad]\�hjg[]\mj]k�^gj�l`]k]�lYkck�Yj]�[gflYaf]\�af�l`]�OYl[`?mYj\�Dan]K][mjalq�Mk]j�?ma\]&�

82 WatchGuard Internet Security Handbook

CHAPTER 8 Logging and Notification

L`ak�[`Yhl]j�]phdYafk�o`Yl�dg__af_�Yf\�fgla^a[Ylagf�Yj]�Yf\�o`q�l`]q�Yj]�aehgjlYfl�lg�Y�k][mjalq�kqkl]e&�Al�Ydkg�hjgna\]k�k][mjalq�Yf\�dg_akla[Yd�lahk�^gj�^gjemdYlaf_�qgmj�gof�dg__af_�Yf\�fgla^a[Ylagf�hgd%a[a]k&

What Logging Is

Dg__af_�ak�l`]�Y[l�g^�j][gj\af_�É]n]flk$Ê�l`Yl�g[[mj�Yl�l`]�>aj]Zgp&�9f�]n]fl�ak�Yfq�kaf_d]�Y[lanalq�l`Yl�g[[mjk�Yl�l`]�>aj]Zgp$�km[`�Yk�Yddgoaf_�Y�hY[c]lÈgj�egj]�aehgjlYfldqÈ\]fqaf_�Y�hY[c]l�^jge�hYkkaf_�l`jgm_`�l`]�>aj]Zgp&�

Dg__af_�afngdn]k�l`]�afl]jY[lagf�g^�l`]�>aj]Zgp$�l`]�=n]fl�Hjg[]kkgj$�Yf\�l`]�Dg_�@gkl&�O`]f�Yf�]n]fl� ^gj�]pYehd]$�Y�\]fa]\�af[geaf_�hY[c]l!�g[[mjk�Yl�l`]�>aj]Zgp$�al�af^gjek�l`]�=n]fl�Hjg[]kkgj$�o`a[`�^gjeYlk�l`]�]n]fl�Yk�Y�daf]�af�Y�klYf\Yj\ar]\�^gjeYl�Yf\�k]f\k�al�lg�l`]�Dg_�@gkl$�o`a[`�Y\\k�l`]�]n]fl�lg�l`]�dg_^ad]&�

Dg__af_�ak�afl]f\]\�lg�j][gj\�l`]�caf\k�g^�Y[lanala]k�l`Yl�[Yf�af\a[Yl]�k][mjalq�[gf[]jfk$�km[`�Yk�\]fa]\�hY[c]lk&�Af�^Y[l$�\]fa]\�hY[c]lk$�l`]aj�hYll]jfk$�Yf\�[aj[meklYf[]k�[gehjak]�l`]�egkl�aehgjlYfl�]d]%e]flk�g^�o`Yl�]n]flk�qgm�k`gmd\�dg_&�;]jlYaf�hYll]jfk�g^�\]fa]\�hY[c]lk�[Yf�af\a[Yl]�l`]�lqh]�g^�YllY[c�l`Yl�ak�Z]af_�Yll]ehl]\&

9dl`gm_`�qgm�[Yf�[gf^a_mj]�Y�k]jna[]�lg�dg_�Yddgo]\�]n]flk$�l`ak�ak�afl]f\]\�egkldq�Yk�Y�\aY_fgkla[�lggd�lg�]fkmj]�l`Yl�Yddgo]\�hY[c]lk�Yj]�hYkkaf_�l`jgm_`�l`]�>aj]Zgp&�A^�qgm�ljq�lg�dg_�Ydd�]n]flk�^gj�qgmj�fgjeYd$�gfdaf]�gh]jYlagf$�qgm�oadd�egkl�dac]dq�[j]Yl]�Y�ZYf\oa\l`�Yf\�klgjY_]�hjgZd]e�Yk�qgmj�=n]fl�Hjg[]kkgj�Yf\�Dg_�@gkl�Yll]ehl�lg�hjg[]kk�Yf\�dg_�]n]jq�hY[c]l�l`Yl�hYkk]k�l`jgm_`�l`]�>aj]Zgp&�

WatchGuard Internet Security Handbook 83

Logging and Notification

What Notification Is

Fgla^a[Ylagf�ak�l`]�k][mjalq�kqkl]eÌk�Y[l�g^�k]f\af_�Y�e]kkY_]�lg�l`]�f]logjc�Y\eafakljYlgj�l`Yl�Y�hYll]jf�g^�\]fa]\�hY[c]lk�e]jalk�l`]�Y\eafakljYlgjÌk�Yll]flagf&�L`ak�fgla^a[Ylagf�[gmd\�Z]�af�l`]�^gje�g^�]%eYad$�Y�hgh%mh�oaf\go�gf�l`]�eYfY_]e]fl�ogjcklYlagf$�gj�Yf�Ymlg%eYla[Yddq�\aYd]\�l]d]h`gf]�fmeZ]j�lg�Y�hY_]j&

>gj�]pYehd]$�a^�l`]�>aj]Zgp�jYf\gedq�j]b][lk�Y�hY[c]l�`]j]�gj�l`]j]$�al�ak�\gaf_�alk�bgZ�Yf\�l`]j]�ak�hjgZYZdq�fg�[Ymk]�^gj�[gf[]jf&�:ml�kge]�\]faYd�hYll]jfk�af\a[Yl]�ZdYlYfl�afnYkagf�Yll]ehlk�Yf\�k`gmd\�lja__]j�Y�fgla^a[Ylagf&�

>gj�]pYehd]$�o]�j][gee]f\�l`Yl�qgm�[gf^a_mj]�\]^Ymdl�hY[c]l�`Yf%\daf_�lg�akkm]�Y�fgla^a[Ylagf�o`]f�l`]�>aj]Zgp�\]l][lk�Y�hgjl�khY[]�hjgZ]&�9�hgjl�khY[]�hjgZ]�ak�o`]f�Yf�YllY[c]j�_]f]jYl]k�Y�k]im]f[]�g^�hgjlk$�̀ ghaf_�lg�^af\�gf]�l`Yl�j]khgf\k&�Gf[]�l`]�>aj]Zgp�\]l][lk�Y�hgjl�khY[]�hjgZ]$�l`]�=n]fl�Hjg[]kkgj�k]f\k�fgla^a[Ylagf�lg�l`]�f]l%ogjc�k][mjalq�Y\eafakljYlgj�YZgml�l`]�j]b][l]\�hY[c]lk&�

9l�l`ak�hgafl$�l`]�f]logjc�k][mjalq�Y\eafakljYlgj�[Yf�]pYeaf]�l`]�dg_k�Yf\�\][a\]�o`Yl�lg�\g�lg�^mjl`]j�k][mj]�l`]�gj_YfarYlagfÌk�f]l%ogjc&�Kge]�hgkkaZd]�[gmjk]k�g^�Y[lagf�ogmd\�Z]2

� :dg[c�l`]�hgjlk�^gj�l`]�>LH�k]jna[]� :dg[c�l`]�AH�Y\\j]kk�l`YlÌk�k]f\af_�l`]�hY[c]lk� ;gflY[l�l`]�AKH�l`jgm_`�o`a[`�l`]�hY[c]lk�Yj]�Z]af_�k]fl

Qgm�[Yf�Ydkg�k]l�mh�l`]�>aj]Zgp�lg�YmlgeYla[Yddq�Zdg[c�l`]�\]klafYlagf�hgjl�gj�l`]�hjgZ]�kgmj[]Ìk�AH�Y\\j]kk&�Dg__af_�Yf\�Fgla^a[Ylagf�ogjc�lg_]l`]j�lg�]fYZd]�Y�kljgf_�YmlgeYl]\�k][mjalq�kqkl]e�lg�ka_fYd�^gj�`meYf�afl]jn]flagf�Yl�l`]�ja_`l�lae]&�L`]f�al�Yf\�kmhhda]k�\YlY�mk]%^md�^gj�klj]f_l`]faf_�gj�^af]%lmfaf_�\]^]fk]k�Y_Yafkl�^mlmj]�YllY[ck&

Developing Logging and Notification Policies

Af�dg__af_�Yf\�fgla^a[Ylagf�hgda[a]k$�qgm�kh]dd�gml�o`Yl�_]lk�dg__]\�Yf\�o`]f�Yf�]n]fl�gj�k]ja]k�g^�]n]flk�oYjjYflk�k]f\af_�gml�fgla^a[Y%lagf�lg�l`]�gf%\mlq�Y\eafakljYlgj&�9jla[mdYlaf_�qgmj�dg__af_�Yf\�fgla^a[Ylagf�hgda[a]k�eYc]k�al�]Yka]j�lg�k]l�mh�af\ana\mYd�k]jna[]k�af�l`]�OYl[`?mYj\�Dan]K][mjalq�Kqkl]e&�A^�qgm�`Yn]�^mddq�eYhh]\�gml�qgmj�hgda[q$�qgm�[Yf�egj]�]Ykadq�\]d]_Yl]�[gf^a_mjYlagf�\mla]k�Yf\�]fkmj]�l`Yl�af\ana\mYd�]^^gjlk�\gfÌl�[gfljY\a[l�l`]�gn]jYdd�k][mjalq�hgda[q�gj�dg__af_�Yf\�fgla^a[Ylagf�hgda[a]k&

Kh][a^a[Yddq$�l`]�dg__af_�hgda[q�\]daf]Yl]k2�

� O`Yl�]n]flk�qgm�afl]f\�lg�dg_�

84 WatchGuard Internet Security Handbook

Developing Logging and Notification Policies

� O`a[`�k]jna[]k�]n]flk�qgm�oak`�lg�dg_� O`a[`�k]jn]j k!�qgm�Yddg[Yl]�Yk�dg_�`gklk� @go�dYj_]�qgm�Yddgo�Y�dg_�^ad]�lg�_]l�Yf\'gj�`go�g^l]f�l`]�dg_^ad]�

ak�gn]jojall]f�oal`�f]o�dg_k�

L`]�fgla^a[Ylagf�hgda[q�\]daf]Yl]k2

� O`a[`�]n]flk�gj�k]ja]k�g^�]n]flk�oadd�lja__]j�fgla^a[Ylagf�^gj�]Y[`�k]jna[]

� O`Yl�^gje�g^�fgla^a[Ylagf�qgm�oadd�mk]

L`]�j]kl�g^�l`ak�k][lagf�\]k[jaZ]k�l`]�jYea^a[Ylagfk�g^�]Y[`�g^�l`]k]�Zmdd]l]\�al]ek&

What Events to Log L`]j]�Yj]�log�eYaf�Yj]Yk�af�l`]�OYl[`?mYj\�Hgda[q�EYfY_]j�o`]j]�qgm�[Yf�\]l]jeaf]�o`a[`�]n]flk�lg�dg_2

� L`]�dg__af_�Yf\�fgla^a[Ylagf�[gfljgdk�YllY[`]\�lg�l`]�<]^Ymdl�HY[c]l�@Yf\daf_�\aYdg_

� L`]�dg__af_�Yf\�fgla^a[Ylagfk�[gfljgdk�YllY[`]\�lg�]Y[`�af\ana\mYd�k]jna[]�\aYdg_&

L`]�<]^Ymdl�HY[c]l�@Yf\daf_�lggd�\]Ydk�hjaeYjadq�oal`�`a_`%jakc�]n]flk$�o`a[`�k`gmd\�Ydegkl�YdoYqk�Z]�dg__]\� Yf\�lja__]j�fgla^a[Y%lagf!&�L`]k]�]n]flk�af[dm\]2

� Khgg^af_�YllY[ck� AH�Ghlagfk� Hgjl�khY[]�HjgZ]k� 9\\j]kk�khY[]�hjgZ]k� J]b][l]\�hY[c]lk

>gj�]Y[`�k]jna[]�l`Yl�qgm�Y\\�lg�qgmj�[gf^a_mjYlagf�^ad]$�qgm�[Yf�Ydkg�dg_�mh�lg�]a_`l�\a^^]j]fl�caf\k�g^�]n]flk2

� Af[geaf_�ljY^^a[2Ò 9ddgo]\�af[geaf_�hY[c]lkÒ <]fa]\�af[geaf_�hY[c]lkÒ 9ddgo]\�gml_gaf_�hY[c]lkÒ <]fa]\�gml_gaf_�hY[c]lk

� Gml_gaf_�ljY^^a[Ò 9ddgo]\�af[geaf_�hY[c]lkÒ <]fa]\�af[geaf_�hY[c]lkÒ 9ddgo]\�gml_gaf_�hY[c]lkÒ <]fa]\�gml_gaf_�hY[c]lk

WatchGuard Internet Security Handbook 85

Logging and Notification

Af�_]f]jYd$�qgm�oYfl�lg�dg_�gfdq�l`Yl�o`a[`�ak�af\a[Ylan]�g^�hgl]flaYd�k][mjalq�l`j]Ylk$�Yf\�a_fgj]�]n]flk�l`Yl�ogmd\�oYkl]�ZYf\oa\l`�Yf\�k]jn]j�klgjY_]�khY[]&�L`ak�_]f]jYddq�ljYfkdYl]k�aflg�dg__af_�khgg^k$�AH�ghlagfk$�hjgZ]k$�Yf\�\]fa]\�hY[c]lk$�Yf\�fgl�dg__af_�Yddgo]\�hY[c%]lk&�9^l]j�Ydd$�a^�l`]�hY[c]lk�Yj]�Yddgo]\$�l`]q�k`gmd\fÌl�Z]�af\a[Ylan]�g^�Y�k][mjalq�l`j]Yl&�>mjl`]jegj]$�Yddgo]\�ljY^^a[�mkmYddq�^Yj�]p[]]\k�l`]�ngdme]�g^�\]fa]\�ljY^^a[$�Yf\�ogmd\�kaehdq�kdgo�j]khgfk]�lae]k�Yf\�[Ymk]�qgmj�dg_�^ad]�lg�_jgo�Yf\�lmjf�gn]j�lgg�ima[cdq&

OYl[`?mYj\�_an]k�qgm�l`]�ghlagf�lg�dg_�Yddgo]\�]n]flk�hjaeYjadq�^gj�\aY_fgkla[�hmjhgk]k�o`]f�k]llaf_�mh�gj�ljgmZd]k`gglaf_�qgmj�afklYddYlagf&

Qgm�Ydkg�eYq�fgl�f]]\�lg�dg_�Ydd�\]fa]\�]n]flk&�>gj�]pYehd]$�a^�qgm�`Yn]�[gf^a_mj]\�af[geaf_�>LH�lg�\]fq�Ydd�af[geaf_�ljY^^a[�^jge�Yfq�kgmj[]�gmlka\]�lg�Yfq�\]klafYlagf�afka\]$�l`]j]�ak�dalld]�hgafl�af�dg_%_af_�af[geaf_�\]fa]\�hY[c]lk�^gj�l`Yl�k]jna[]�Z][Ymk]�Ydd�ljY^^a[�^gj�l`Yl�k]jna[]�af�l`Yl�\aj][lagf�ak�Zdg[c]\&

Which Services’ Events to Log9k�klYl]\�Z]^gj]$�af�_]f]jYd�gf]�oYflk�lg�dg_�\]fa]\�hY[c]lk�^gj�Y�_an]f�k]jna[]&�L`]j]�Yj]�[aj[meklYf[]k$�`go]n]j$�o`]f�qgm�ea_`l�oYfl�lg�dg_�]n]jql`af_&�>gj�]pYehd]$�kmhhgk]�qgm�`Yn]�k]l�mh�Y�n]jq�kh][aYdar]\�k]jna[]�l`Yl�mk]k�Yf�gZk[mj]$�n]jq�`a_`�hgjl�fmeZ]j$�Yf\�l`]�k]jna[]�ak�afl]f\]\�^gj�mk]�gfdq�Zq�Y�keYdd�fmeZ]j�g^�h]ghd]�af�qgmj�gj_YfarYlagf&�Af�l`Yl�[Yk]�qgm�ea_`l�oYfl�lg�dg_�Ydd�ljY^^a[�^gj�l`Yl�k]jna[]$�lg�egfalgj�l`Yl�k]jna[]Ìk�Y[lanalq�gj�Yl�d]Ykl�Z]�YZd]�lg�j]na]o�Ydd�g^�l`Yl�k]jna[]Ìk�Y[lanalq&

Which Server(s) to Allocate as Log Hosts>gj�keYdd�gh]jYlagfk$�qgm�[Yf�kaehdq�\]ka_fYl]�qgmj�Y\eafakljYlagf�ogjcklYlagf�Yk�l`]�dg_�`gkl&�9l�l`]�gl`]j�]f\�g^�l`]�k[YdYZadalq�kh][%ljme$�qgm�ea_`l�\]ka_fYl]�l]f�gj�egj]�\]\a[Yl]\�`a_`�[YhY[alq�dg_�`gklk&�L`]�lqha[Yd�e]\ame%kar]\�gh]jYlagf�ogmd\�`Yn]�log�gj�l`j]]�`a_`%[YhY[alq�dg_�`gklk$�g^�o`a[`�l`]�hjaeYjq�dg_�`gkl�ak�\]\a[Yl]\$�Yf\�fgf]�g^�o`a[`�ak�Ydkg�l`]�Y\eafakljYlagf�ogjcklYlagf&�Emdlahd]�dg_`gklk�gh]jYl]�af�^Yadgn]j$�fgl�j]\mf\Yfl�eg\]&�L`]�hjaeYjq�dg_�`gkl�`Yf\d]k�l`]�Zmdc�g^�l`]�dg__af_�\mla]k3�gl`]jk�Yj]�[Ydd]\�af�Yk�f]]\]\�o`]f�l`]�`a_`]kl%jYfcaf_�dg_�`gkl�ak�mfYnYadYZd]�lg�j][]an]�dg_k&

Log File Size and Turnover FrequencyQgm�[Yf�k]l�l`]�eYpaeme�kar]�g^�l`]�dg_�^ad]�af�e]_YZql]k�gj�fmeZ]j�g^�dg_�]flja]k&�O`]f�l`]�dg_^ad]�j]Y[`]k�l`]�eYpaeme�kar]�qgm�k]l$�l`]�=n]fl�Hjg[]kkgj�Z]_afk�gn]jojalaf_�l`]�dg_�^ad]�klYjlaf_�Yl�alk�Z]_affaf_&

86 WatchGuard Internet Security Handbook

Developing Logging and Notification Policies

>gj�]pYehd]$�kmhhgk]�qgm�`Yn]�k]l�qgmj�dg_�̂ ad]�eYpaeme�lg�)(($(((�]flja]k&�Gh]jYlagf�g^�qgmj�>aj]Zgp�Z]_afk�gf�K]hl]eZ]j�+j\&�:q�K]h%l]eZ]j�0l`$�l`]�dg_�^ad]�`Yk�)(($(((�]flja]k&�9l�l`ak�hgafl$�l`]�]n]fl�hjg[]kkgj�klYjlk�ojalaf_�K]hl]eZ]j�1l`�dg_�]flja]k�gn]j�l`]�gja_afYd�K]hl]eZ]j�+j\�]flja]k&�Kg�^Yj$�l`]�K]hl]eZ]j�,l`�l`jgm_`�0l`�]flja]k�Yj]�kladd�aflY[l�Yf\�[Yf�Z]�j]lja]n]\�^gj�_]f]jYlaf_�`aklgja[Yd�j]hgjlk� k]]�ÉJ]hgjlaf_Ê�gf�hY_] 1/!&�=n]flmYddq$�`go]n]j$�l`]�dg_�^ad]�ak�[gehd]l]dq�gn]jojall]f�oal`�]n]flk�^jge�K]hl]eZ]j�1l`�jgm_`�l`]�),l`�gj�kg&

Gfdq�qgm�[Yf�\]l]jeaf]�l`]�a\]Yd�eYpaeme�kar]�g^�qgmj�dg_�^ad]&�Al�oadd�Z]�ZYk]\�gf�l`]�klgjY_]�khY[]�YnYadYZd]$�`go�eYfq�\Yqk�dg_�]flja]k�qgm�oYfl�gf�`Yf\�Yl�Yfq�lae]$�Yf\�`go�dgf_�Y�dg_�^ad]�ak�hjY[%la[Yd�lg�c]]h$�gh]f$�Yf\�na]o&�@go�ima[cdq�qgmj�^ad]�`alk�alk�eYpa%eme�kar]�Yf\�ak�gn]jojall]f�ak�Ydkg�\]l]jeaf]\�Zq�`go�eYfq�]n]fl�lqh]k�qgm�Yj]�dg__af_�Yf\�`go�em[`�ljY^^a[�ak�YhhjgY[`af_�qgmj�>aj]Zgp&

>gj�]pYehd]$�Y�keYdd�gh]jYlagf�ea_`l�fgl�k]]�)($(((�]flja]k�af�log�o]]ck$�o`]j]�Y�dYj_]�gf]�oal`�eYfq�k]jna[]k�]fYZd]\�ea_`l�]Ykadq�dg_�)(($(((�]flja]k�af�Y�\Yq&

Gf]�hjY[la[]�l`Yl�ogmd\�eYc]�qgmj�dg__af_�\][akagfk�]Yka]j�ak�o`]l`]j�gj�`go�g^l]f�qgm�ogmd\�akkm]�j]hgjlk�g^�l`]�>aj]Zgp�Y[lan%alq&�OYl[`?mYj\Ìk�@aklgja[Yd�J]hgjlk�eg\md]�mk]k�Y�dg_�^ad]�Yk�alk�kgmj[]�lg�Zmad\�j]hgjlk&�A^�qgm�akkm]�o]]cdq�j]hgjlk�lg�eYfY_]e]fl$�qgm�ogmd\�oYfl�Y�dg_�^ad]�dYj_]�]fgm_`�lg�`gd\�Y�lqha[Yd�]a_`l�gj�faf]�\YqÌk�ogjl`�g^�]n]flk&�Kg�ZYka[Yddq�qgm�ogmd\�oYfl�lg�oYl[`�qgmj�afalaYd�dg_�^ad]�[gf^a_mjYlagf�lg�k]]�`go�eYfq�\YqkÌ�]n]flk�al�[gdd][lk�Z]^gj]�lmjfaf_�gn]j$�Yf\�l`]f�Y\bmkl�l`]�kar]�lg�qgmj�j]hgjl%af_�f]]\k&�

Which Events will Trigger Notification?L`]�egkl�aehgjlYfl�]n]flk�l`Yl�k`gmd\�lja__]j�fgla^a[Ylagf�Yj]�AH�ghlagfk$�hgjl�khY[]�hjgZ]k$�Y\\j]kk�khY[]�hjgZ]k$�Yf\�khgg^af_�YllY[ck� o`]j]�Yf�afZgmf\�hY[c]l�hj]l]f\k�lg�Z]�^jge�Yf�AH�Y\\j]kk�oal`af�qgmj�gj_YfarYlagf!&�L`]k]�Yj]�[gf^a_mjYZd]�af�l`]�Hgda[q�EYf%Y_]jÌk�<]^Ymdl�HY[c]l�@Yf\daf_�\aYdg_$�Yf\�k`gmd\�Ydegkl�YdoYqk�lja__]j�]n]fl�dg_k�Yf\�fgla^a[Ylagf&

Gl`]j�fgla^a[Ylagfk�\]h]f\�gf�gl`]j�^Y[lgjk�af�qgmj�k][mjalq�hgda[q2

� @go�Égh]fÊ�ak�qgmj�>aj]Zgp�[gf^a_mjYlagf7� @go�Zmkq�\g�qgm�oYfl�lg�Z]�afl]jY[laf_�oal`�Yf\�afl]j[]\af_�^gj�

qgmj�^aj]oYdd7

>gj�]pYehd]$�a^�qgm�k]l�mh�Y�kaehd]�[gf^a_mjYlagf�l`Yl�]fYZd]k�gfdq�Y�^]o�k]jna[]k$�Yf\�\]fa]k�egkl�gj�Ydd�af[geaf_�ljY^^a[$�l`]j]�Yj]�^]o�[aj[meklYf[]k�l`Yl�oYjjYfl�fgla^a[Ylagf&�Gf�l`]�gl`]j�`Yf\$�a^�qgm�

WatchGuard Internet Security Handbook 87

Logging and Notification

`Yn]�Y�dYj_]�[gf^a_mjYlagf�oal`�eYfq�k]jna[]k$�oal`�eYfq�Yddgo]\�`gklk�gj�f]logjck�^gj�af[geaf_�ljY^^a[$�hghmdYj�hjglg[gdk�lg�kh][a^a[$�gZk[mj]�hgjlk$�Yf\�k]n]jYd�hY[c]l�^adl]j�k]jna[]k�Y\\]\�g^�qgmj�gof�\]ka_f$�qgm�oadd�f]]\�lg�k]l�mh�Y�dYj_]$�[gehd]p�fgla^a[Ylagf�k[`]e]&�L`ak�lqh]�g^�[gf^a_mjYlagf�ak�egj]�nmdf]jYZd]�lg�YllY[c&�Fgl�gfdq�Yj]�l`]j]�eYfq�egj]�k]jna[]k�l`Yl�j]imaj]�Y�fgla^a[Ylagf�hgda[q$�l`]�`a_`�fmeZ]j�g^�jgml]k�l`jgm_`�l`]�>aj]Zgp�af[j]Yk]k�l`]�dac]da`gg\�l`Yl�l`]�=n]fl�Hjg[]kkgj�oadd�akkm]�^j]im]fl�fgla^a[Ylagfk&

L`]j]^gj]$�a^�qgm�k]l�mh�Y�n]jq�Y[[geeg\Ylaf_�^aj]oYdd$�Z]�hj]hYj]\�lg�kh]f\�qgmj�\Yqk� Yf\�fa_`lk!�afl]jY[laf_�oal`�qgmj�k][mjalq�kqk%l]e�gj�^apaf_�k][mjalq�Zj]Y[`]k&

Lg�^gjemdYl]�Y�fgla^a[Ylagf�hgda[q$�dggc�Yl�l`]�fmeZ]j�Yf\�fYlmj]�g^�l`]�k]jna[]k�qgm�]fYZd]�^gj�l`]�>aj]Zgp$�Yf\�`go�gh]f�gj�daeal]\�]Y[`�k]jna[]�ak&�Af�_]f]jYd$�^gj�l`]�`a_`%ljY^^a[�hjgpa]k�km[`�Yk�KELH�Yf\�>LH$�qgm�ea_`l�Y[lanYl]�Y�j]h]Yl�fgla^a[Ylagf�a^�l`]�k]jna[]�j]b][lk�^an]�lg�l]f�hY[c]lk�oal`af�+(�k][gf\k&�A^�qgm�`Yn]�k]l�mh�Y�kh][aYdar]\�k]jna[]�daeal]\�lg�ljY^^a[�Z]lo]]f�log�gj�l`j]]�`gklk�mkaf_�Y�`a_`�hgjl�fmeZ]j$�qgm�ea_`l�oYfl�lg�Y[lanYl]�fgla^a[Ylagf�gf�l`ak�k]jna[]�o`]f]n]j�al�\]fa]k�gj�hYkk]k�Y�hY[c]l&

What form of notification you will useKlYf\Yj\�fgla^a[Ylagf�e]l`g\k�Yj]�]%eYad$�Y[lanYlaf_�Y�hY_]j$�Y�hghmh�oaf\go�gf�l`]�Y\eafakljYlagf�ogjcklYlagf$�gj�Y�[mklge�hjg%_jYe&�L`]�[mklge]j�ak�j]khgfkaZd]�^gj�[j]Ylaf_�Y�[mklge�hjg_jYe$�o`a[`�[gmd\�akkm]�fgla^a[Ylagf�Yfq�oYq�gj�[geZafYlagf�g^�oYqk�qgm�ogmd\�dac]&�>gj�]pYehd]$�qgm�ea_`l�oYfl�fgla^a[Ylagf�lg�hgh�mh�gf�l`]�Y\eafakljYlagf�ogjcklYlagfÌk�k[j]]f�Yf\�hY_]�l`]�gf%\mlq�f]l%ogjc�Y\eafakljYlgj&

How Notification Counts and Handles Events

L`]�fgla^a[Ylagf�[gf[]hlk�g^�dYmf[`�afl]jnYd$�j]h]Yl�[gmfl$�Yf\�j]h]Yl�afl]jnYd$�Yf\�]kh][aYddq�`go�l`]q�afl]jY[l$�[Yf�Z]�[gf^mkaf_&�:]dgo�ak�Yf�]pYehd]�g^�`go�l`]q�ogjc�lg_]l`]j�lg�Ya\�qgm�af�Yjjanaf_�Yl�mkYZd]�k]llaf_k�o`]f�qgm�[gf^a_mj]�l`]k]�hYjYe]l]jk�af�nYjagmk�hdY[]k�af�l`]�Hgda[q�EYfY_]j&

ExampleKmhhgk]�qgm�`Yn]�k]l�mh�fgla^a[Ylagf�oal`�l`]k]�nYdm]k2

� DYmf[`�Afl]jnYd�5�-�eafml]k� k]l�af�l`]�af\ana\mYd�k]jna[]Ìk�Dg_%_af_�\aYdg_!

� J]h]Yl�[gmfl�5�,� k]l�af�l`]�af\ana\mYd�k]jna[]Ìk�Dg__af_�\aYdg_!� J]h]Yl�Afl]jnYd�5�)-�eafml]k� k]l�_dgZYddq�af�l`]�=n]fl�Hjg[]kkgj�

mk]j�afl]j^Y[]!

88 WatchGuard Internet Security Handbook

How Notification Counts and Handles Events

L`]f�Y�hgjl�khY[]�hjgZ]�Z]_afk�Yl�)(2((�Y&e&�Yf\�[gflafm]k�gf[]�h]j�eafml]$�lja__]jaf_�l`]�dg__af_�Yf\�fgla^a[Ylagf�e][`Yfakek&�@]j]�ak�l`]�lae]�daf]�g^�Y[lanala]k�l`Yl�ogmd\�j]kmdl�^jge�l`ak�]n]fl�oal`�l`ak�laeaf_�Yf\�j]h]Ylaf_�k]lmh2

1. )(2((ÈAfalaYd�hgjl�khY[]�hjgZ]� ^ajkl�]n]fl!

2. )(2()ÈOYl[`?mYj\�dYmf[`]k�^ajkl�fgla^a[Ylagf�

3. )(2(.ÈOYl[`?mYj\�dYmf[`]k�k][gf\�fgla^a[Ylagf� j]hgjlk�^an]�]n]flk!

4. )(2))ÈOYl[`?mYj\�dYmf[`]k�l`aj\�fgla^a[Ylagf� j]hgjlk�^an]�]n]flk!

5. )(2).ÈOYl[`?mYj\�dYmf[`]k�^gmjl`�fgla^a[Ylagf� j]hgjlk�^an]�]n]flk!

6. )(2+)ÈOYl[`?mYj\�ojal]k�Y�dg_�e]kkY_]�l`Yl�l`]�fgla^a[Ylagf�]n]fl�`Yk�j]h]Yl]\�^an]�lae]k

7. )(2,.ÈOYl[`?mYj\�ojal]k�Yfgl`]j�dg_�e]kkY_]�l`Yl�l`]�fgla^a[Y%lagf�]n]fl�`Yk�j]h]Yl]\�^a^l]]f�lae]k

L`]�lae]�afl]jnYdk�Z]lo]]f�Y[lanala]k�)$�*$�+$�,$�Yf\�-�Yj]�[gfljgdd]\�Zq�l`]�dYmf[`�afl]jnYd$�o`a[`�oYk�k]l�lg�-�eafml]k&

L`]�lae]�afl]jnYdk�Z]lo]]f�-$�.$�Yf\�/�Yj]�[gfljgdd]\�Zq�l`]�j]h]Yl�afl]jnYd$�o`a[`�oYk�k]l�lg�)-�eafml]k&

L`]�j]h]Yl�[gmfl�emdlahda]\�Zq�l`]�dYmf[`�afl]jnYd�_an]k�l`]�lae]�Yf�]n]fl�emkl�[gflafmgmkdq�`Yhh]f�Z]^gj]�OYl[`?mYj\�`Yf\d]k�al�Yk�Y�Éj]h]Ylaf_�fgla^a]j&Ê

L`ak�hjg_j]kkan]�fgla^a[Ylagf�Yf\�dg__af_�k[`]e]�hjgna\]k�Y�\]lYad]\�fgla^a[Ylagf�Yl�l`]�afalaYd�]n]fl$�^gddgo]\�Zq�khY[]%�Yf\�lae]%kYnaf_�[memdYlan]�kmeeYja]k�lg�c]]h�l`]�Y\eafakljYlgj�mh\Yl]\&�L`ak�j]\m[]k�l`]�Yegmfl�g^�dg__af_�Yf\�fgla^a[Ylagf�g^�Y�j]h]Ylaf_�]n]fl&�A^�o]�[gflafm]�lg�_]l�]n]flk�^gj�l`]�j]h]Yl�[gmfl�emdlahda]\�Zq�l`]�dYmf[`�afl]jnYd$�OYl[`?mYj\�kaehdq�dg_k�l`Yl�l`]�]n]flk�Yj]�[gflafm%af_�]n]jq�j]h]Yl�afl]jnYd&

A^�Yf�]n]fl�klghk�[gehd]l]dq�^gj�Y�o`gd]�dYmf[`�afl]jnYd$�l`]�o`gd]�hjg[]kk�klYjlk�Y_Yaf&

WatchGuard Internet Security Handbook 89

Logging and Notification

90 WatchGuard Internet Security Handbook

CHAPTER 9 Monitoring your Security System

L`]�OYl[`?mYj\�Dan]K][mjalq�Kqkl]e�hjgna\]k�k]n]jYd�egfalgjaf_�lggdk$�eYfq�g^�o`a[`�Yj]�_jYh`a[Yd�Yf\'gj�j]Yd%lae]$�lg�`]dh�qgm�nakmYdar]�f]logjc�eYfY_]e]fl�Yf\�Ykk]kk�l`]�]^^][lan]f]kk�g^�qgmj�k][mjalq�hgda[a]k&

L`]�OYl[`?mYj\�Dan]K][mjalq�Kqkl]e�af[dm\]k�@gkloYl[`$�Y�klYf\Y%dgf]�_jYh`a[Yd�j]Yd%lae]�egfalgjaf_�lggd$�hdmk�k]n]jYd�lggdk�oal`af�l`]�>aj]Zgp�Egfalgj&�L`]�egfalgjaf_�lggdk�af[dm\]2�

HostWatch (standalone)<akhdYqk�j]Yd%lae]�egfalgjaf_�g^�f]logjc�mkY_]�eYhh]\�lg�Yml`]fla%[Yl]\�mk]jk�Yf\�`gkl�[gehml]jk&�;gdgj%[g\]\�[gff][lagf�lqh]k� 9ddgo]\$�<]fa]\$�Hjgpa]\�gj�EYkim]jY\]\!�Z]lo]]f�afl]jfYd']pl]jfYd�`gklk�Yj]�a\]fla^a]\�Zq�AH�Y\\j]kk$�<FK�fYe]�gj�mk]j�fYe]&�

Bandwidth Meter (Firebox Monitor)<akhdYqk�j]Yd%lae]�egfalgjaf_�g^�ZYf\oa\l`�mkY_]�^gj�]Y[`�=l`]jf]l�hgjl&�:Yf\oa\l`�mkY_]�ak�\akhdYq]\�^gj�af[geaf_�Yf\�gml_gaf_�[geem%fa[Ylagfk&�H]jag\k�g^�h]Yc�mladarYlagf�Yj]�Ydkg�af\a[Yl]\�gf�Y�[gf^a_mjYZd]�k[Yd]�mh�lg�)((EZ'k][&�

ServiceWatch (Firebox Monitor)<akhdYqk�j]Yd%lae]�egfalgjaf_�g^�k]jna[]k�Z]af_�mk]\�gf�l`]�f]logjc&�L`]�_jYh`a[Yd�j]hj]k]flYlagfk�k`goaf_�l`]�[gdgj%[g\]\�[gff][lagfk�g^�]Y[`�[gf^a_mj]\�k]jna[]�[Yf�Z]�j]^j]k`]\�Yl�mk]j%kh][a^a]\�afl]jnYdk&�

Status Report (Firebox Monitor)J]lja]n]k�Y�kmeeYjq�g^�l`]�>aj]ZgpÌk�klYlmk�j]hgjl$�\akhdYq]\�af�Y�k[jgd%dYZd]�oaf\go&�

Authentication List (Firebox Monitor)K`gok�l`]�lqh]k�g^�Yml`]fla[Ylagf�Z]af_�mk]\$�hdmk�l`]�AH�Y\\j]kk�g^�l`]�Yml`]fla[Ylagf�k]jn]j&

Blocked Site List (Firebox Monitor)<akhdYqk�l`]�AH�Y\\j]kk]k� af�kdYk`�fglYlagf!�g^�Yfq�]pl]jfYd�kal]k�l`Yl�Yj]�l]ehgjYjadq�Zdg[c]\�Zq�hgjl�khY[]�hjgZ]k$�khgg^af_�Yll]ehlk$�Y\\j]kk�khY[]�hjgZ]k$�gj�o`Yl]n]j�`Yk�Z]]f�[gf^a_mj]\�lg�lja__]j�Yf�Ymlg%Zdg[c&

WatchGuard Internet Security Handbook 91

Monitoring your Security System

HostWatch

@gklOYl[`�\akhdYqk�Y[lan]�[gff][lagfk�g[[mjjaf_�gf�Y�>aj]Zgp�af�j]Yd%lae]&�Al�[Yf�Ydkg�_jYh`a[Yddq�j]hj]k]fl�l`]�[gff][lagfk�dakl]\�af�Y�dg_�^ad]$�]al`]j�hdYqaf_�ZY[c�Y�hj]nagmk�^ad]�^gj�j]na]o$�gj�\akhdYqaf_�[gff][lagfk�Yk�l`]q�Yj]�dg__]\�aflg�l`]�[mjj]fl�dg_�^ad]&

@gklOYl[`�hjgna\]k�_jYh`a[Yd�^]]\ZY[c�gf�f]logjc�[gff][lagfk�Z]lo]]f�l`]�Ljmkl]\�Yf\�=pl]jfYd�f]logjck&�9\\alagfYd�\]lYadk�YZgml�mk]jk$�[gff][lagfk$�Yf\�eYkim]jY\af_�Yj]�YnYadYZd]�^jge�@gklOYl[`&

L`]�af^gjeYlagf�\akhdYq]\�af�@gklOYl[`�ak�ZYk]\�gf�l`]�dg__af_�k]l%laf_k�[gf^a_mj]\�af�l`]�>aj]Zgp&�>gj�afklYf[]$�lg�k]]�Ydd�\]fa]\�Yll]ehlk�Yl�af[geaf_�l]df]l$�[gf^a_mj]�l`]�>aj]Zgp�lg�dg_�af[geaf_�\]fa]\�l]df]l�Yll]ehlk&

L`]�daf]�[gff][laf_�l`]�kgmj[]�`gkl�Yf\�\]klafYlagf�`gkl�ak�[gdgj%[g\]\�lg�\akhdYq�l`]�lqh]�g^�[gff][lagf�Z]af_�eY\]&�J]hj]k]flYlan]�a[gfk�Yhh]Yj�f]pl�lg�l`]�k]jn]j�]flja]k�^gj�@LLH$�l]df]l$�KELH$�Yf\�>LH&

O`]f�@gklOYl[`�ak�^ajkl�klYjl]\$�fYe]�j]kgdmlagf�eYq�fgl�g[[mj�aee]\aYl]dq&�9k�fYe]k�Yj]�j]kgdn]\$�l`]�\akhdYq]\�AH�Y\\j]kk]k�Yj]�j]hdY[]\�Zq�`gkl�fYe]k�gj�mk]j�fYe]k$�\]h]f\af_�gf�l`]�k]d][l]\�\akhdYq�k]llaf_k&�Kge]�eY[`af]k�eYq�f]n]j�j]kgdn]$�Yf\�l`]�AH�Y\\j]kk]k�j]eYaf�af�l`]�@gklOYl[`�oaf\go&

The HostWatch DisplayL`]�eYaf�oaf\go�ak�khdal�aflg�log�ka\]k$�Afka\]�Yf\�Gmlka\]&�<gm%Zd]%[da[caf_�Yf�al]e�gf�]al`]j�ka\]�hjg\m[]k�Y�hgh%mh�oaf\go�\ak%hdYqaf_�\]lYad]\�af^gjeYlagf�YZgml�[mjj]fl�[gff][lagfk�̂ gj�l`Yl�al]e&�L`ak�hgh%mh�oaf\go�k`gok�l`]�AH�Y\\j]kk]k$�hgjl�fmeZ]j$�[gff][%lagf�lqh]$�\aj][lagf$�Yf\�gl`]j�\]lYad]\�af^gjeYlagf�YZgml�l`]k]�[gf%f][lagfk&�

Qgm�[Yf�na]o�\]lYad]\�af^gjeYlagf�^gj�Yfq�[gff][lagf�l`Yl�afngdn]k�l`]�>aj]Zgp&�Af�l`]�eYaf�\akhdYq$�l`]�dgo]j�oaf\go�k`gok�l`]�[gf%f][lagfk�j]dYlan]�lg�l`]�>aj]Zgp&�L`]�hgh%mh�oaf\go�k`gok�\]lYad]\�af^gjeYlagf�j]dYlan]�lg�l`]�k]d][l]\�`gkl&

92 WatchGuard Internet Security Handbook

Bandwidth Meter

FIGURE 7. HostWatch Display

Bandwidth Meter

L`]�:Yf\oa\l`�E]l]j�k`gok�j]Yd%lae]�ZYf\oa\l`�mkY_]�^gj�Y�_an]f�afl]j^Y[]�g^�Y�>aj]Zgp&�Kaf[]�al�ak�Y�j]Yd%lae]�\akhdYq$�:Yf\oa\l`�E]l]j�\akhdYqk�[mjj]fl�gf_gaf_�ZYf\oa\l`�mk]�Zq�Y�^mf[lagfaf_�>aj]Zgp&

The Bandwidth Meter Display

L`]�\]^Ymdl�:Yf\oa\l`�E]l]j�k`gok�l`]�Y�_jYh`�kmjjgmf\]\�Zq�k]n%]jYd�gl`]j�[gfljgdk�Yf\�\akhdYqk&�:Yf\oa\l`�E]l]j�[Yf�Z]�Y�`Yf\q�lggd�^gj�eYcaf_�kmj]�qgm�`Yn]�l`]�hjgh]j�j]kgmj[]k�Yddg[Yl]\�lg�]Y[`�afl]j^Y[]&�Al�[Yf�ima[cdq�a\]fla^q�o`a[`�afl]j^Y[]k�k]]�l`]�egkl�ljY^^a[&

ServiceWatch

K]jna[]OYl[`�_jYh`k�l`]�fmeZ]j�g^�[gff][lagfk�Zq�k]jna[]$�hjgna\%af_�Y�k]jna[]%[]flja[�na]o�g^�f]logjc�Y[lanalq&

WatchGuard Internet Security Handbook 93

Monitoring your Security System

L`]�Q�Ypak�k`gok�l`]�fmeZ]j�g^�[gff][lagfk$�Yf\�l`]�P�Ypak�k`gok�lae]$�[gflafmgmkdq�_jYh`af_�f]logjc�Y[lanalq&�=Y[`�k]jna[]�Z]af_�_jYh`]\�ak�Ykka_f]\�Y�\a^^]j]fl�[gdgj]\�daf]�lg�\a^^]j]flaYl]�Yegf_�k]jna[]k&

9k�l`]�_jYh`�k[jgddk�^jge�d]^l�lg�ja_`l$�l`]�daf]k�oadd�_g�mh�gj�\gof�j]^d][laf_�l`]�[mjj]fl�fmeZ]j�g^�[gff][lagfk&

StatusReport

L`]�KlYlmkJ]hgjl�lYZ�\akhdYqk�[gehj]`]fkan]�af^gjeYlagf�YZgml�l`]�[mjj]fl�klYlmk�g^�l`]�>aj]Zgp&�>jge�lgh�lg�Zgllge�al�daklk�l`]�^gddgo%af_2

Uptime and Version InformationL`]�lae]�jYf_]�gf�l`]�klYlakla[k$�l`]�>aj]Zgp�mhlae]�Yf\�l`]�OYl[`?mYj\�K][mjalq�Kqkl]e�kg^loYj]�n]jkagf&

Packet CountsL`]�fmeZ]j�g^�hY[c]lk�Yddgo]\$�\]fa]\$�Yf\�j]b][l]\�Z]lo]]f�klYlmk�im]ja]k&�J]b][l]\�hY[c]lk�Yj]�\]fa]\�hY[c]lk�^gj�o`a[`�OYl[`?mYj\�k]f\k�Yf�A;EH�]jjgj�e]kkY_]&

Log and Notification HostsL`]�AH�Y\\j]kk]k�g^�l`]�Dg_�Yf\�Fgla^a[Ylagf�@gklk&

Network ConfigurationKlYlakla[k�YZgml�l`]�f]logjc�[Yj\k�\]l][l]\�oal`af�l`]�^aj]oYdd$�af[dm\af_�l`]�afl]j^Y[]�fYe]$�alk�`Yj\oYj]�Yf\�kg^loYj]�Y\\j]kk]k�Yf\�alk�f]l%eYkc&�Af�Y\\alagf$�dg[Yd�jgmlaf_�af^gjeYlagf$�Yf\�AH�YdaYk]k�Yj]�af[dm\]\&

Blocked Site ListL`]�[mjj]fl�eYfmYddq�Zdg[c]\�kal]k$�a^�Yfq&�L]ehgjYjadq�Zdg[c]\�kal]�]flja]k�Yhh]Yj�gf�l`]�:dg[c]\�Kal]k�lYZ&

Active TCP Connections9�dakl�g^�Yfq�Y[lan]�L;H�[gff][lagfk�g[[mjjaf_�Y[jgkk�l`]�>aj]Zgp&

Active FTP Connections9�dakl�g^�Yfq�Y[lan]�>LH�[gff][lagfk�g[[mjjaf_�Y[jgkk�l`]�^aj]oYdd&�L`]�\aj][lagf�Yf\�o`]l`]j�gj�fgl�l`]j]�ak�Yf�gh]f�\YlY�[`Yff]d�Yj]�dakl]\�af�hYj]fl`]k&

Spoofing InformationL`]�AH�Y\\j]kk]k�g^�Zdg[c]\�`gklk�Yf\�f]logjck&�A^�Éfgf]Ê�ak�dakl]\$�OYl[`?mYj\�j]b][lk�l`]k]�hY[c]lk�gf�Ydd�g^�alk�afl]j^Y[]k&

Logging OptionsDg__af_�ghlagfk�[gf^a_mj]\�oal`�]al`]j�l`]�Ima[cK]lmh�OarYj\�gj�Zq�Y\\af_�Yf\�[gf^a_mjaf_�k]jna[]k�^jge�l`]�Hgda[q�EYfY_]j&

Authentication Host InformationL`]�lqh]k�g^�Yml`]fla[Ylagf�Z]af_�mk]\�Yf\�l`]�AH�Y\\j]kk�g^�l`]�Yml`]f%la[Ylagf�k]jn]j&

94 WatchGuard Internet Security Handbook

Authentication List

MemoryKlYlakla[k�gf�l`]�e]egjq�mkY_]�g^�l`]�[mjj]fldq�jmffaf_�^aj]oYdd&�Fme%Z]jk�k`gof�Yj]�Zql]k�g^�e]egjq&

Load AverageL`]�fmeZ]j�g^�bgZk�af�l`]�jmf�im]m]�Yn]jY_]\�gn]j�)$�-$�Yf\�)-�eafml]k&�L`]�^gmjl`�fmeZ]j�hYaj�ak�fmeZ]j�g^�hjg[]kk]k�Y[lan]'fmeZ]j�g^�lglYd�hjg[]kk]k�jmffaf_�Yf\�l`]�dYkl�fmeZ]j�ak�l`]�f]pl�hjg[]kk�A<�fmeZ]j&

ProcessesL`]�hjg[]kk�A<$�l`]�fYe]�g^�l`]�hjg[]kk$�l`]�klYlmk�g^�l`]�hjg[]kk2

Ò J2�Jmffaf_Ò K2�Kd]]haf_Ò R2�RgeZa]

Al�Ydkg�\akhdYqk�^gmj�fmeZ]jk�k`goaf_�e]egjq�af^gjeYlagf�^gj�]Y[`�hjg[]kk2

Ò Kar]�g^�l`]�]p][mlYZd]Ò CadgZql]k�g^�hjg_jYe�af�e]egjqÒ Kar]�g^�l`]�]p][mlYZd]�eafmk�l`]�k`Yj]\�e]egjq�hgjlagfÒ <YlY�kar]�hdmk�klY[c

Interfaces=Y[`�f]logjc�afl]j^Y[]�ak�\akhdYq]\�af�l`ak�k][lagf$�Ydgf_�oal`�\]lYad]\�af^gjeYlagf�j]_Yj\af_�alk�klYlmk�Yf\�hY[c]l�[gmfl&

RoutesL`]�^aj]oYdd�c]jf]d�jgmlaf_�lYZd]&�L`]k]�jgml]k�Yj]�mk]\�lg�\]l]jeaf]�o`a[`�afl]j^Y[]�l`]�>aj]oYdd�mk]k�^gj�]Y[`�\]klafYlagf�Y\\j]kk&

ARP Table9�kfYhk`gl�g^�l`]�9JH�lYZd]�gf�l`]�jmffaf_�^aj]oYdd&�L`]�9JH�lYZd]�ak�mk]\�lg�eYh�AH�Y\\j]kk]k�lg�`Yj\oYj]�Y\\j]kk]k&

Authentication List

L`]�9ml`]fla[Ylagf�Dakl�lYZ�\akhdYqk�l`]�`gkl�AH�Y\\j]kk]k�Yf\�mk]j�fYe]k�g^�]n]jqgf]�[mjj]fldq�Yml`]fla[Yl]\�lg�l`]�>aj]Zgp&�A^�qgm�Yj]�mkaf_�<@;H$�l`]�AH�Y\\j]kk�lg�mk]j�fYe]�eYhhaf_�[`Yf_]k�o`]f%]n]j�eY[`af]k�j]Zggl�gj�j]klYjl&

Blocked Site List

T`]�:dg[c]\�Kal]k�lYZ�daklk�l`]�AH�Y\\j]kk]k� af�kdYk`�fglYlagf!�g^�Yfq�]pl]jfYd�kal]k�l`Yl�Yj]�l]ehgjYjadq�Zdg[c]\�Zq�hgjl�khY[]�hjgZ]k$�khgg^af_�Yll]ehlk$�Y\\j]kk�khY[]�hjgZ]k$�gj�o`Yl]n]j�`Yk�Z]]f�[gf%^a_mj]\�lg�lja__]j�Yf�Ymlg%Zdg[c&�

WatchGuard Internet Security Handbook 95

Monitoring your Security System

9mlg%Zdg[caf_�`Yk�Y�kaf_d]�lae]gml�o`a[`�[Yf�Z]�Y\bmkl]\�^jge�l`]�:dg[c]\�Kal]k�\aYdg_�Zgp�YnYadYZd]�naY�l`]�Hgda[q�EYfY_]j&�F]pl�lg�]Y[`�Zdg[c]\�kal]�l`ak�lYZ�ak�l`]�Yegmfl�g^�lae]�j]eYafaf_�gf�l`]�l]ehgjYjq�Ymlg%Zdg[c&�

96 WatchGuard Internet Security Handbook

CHAPTER 10 Reporting

9�[`Ydd]f_af_�f]logjc�Y\eafakljYlagf�lYkc�ak�Y[[gmflaf_�^gj�Afl]jf]l�mkY_]&��Gf]�g^�l`]�Z]kl�oYqk�lg�hjgna\]�`Yj\�\YlY�^gj�Y[[gmflaf_�Yf\�eYfY_]e]fl�hmjhgk]k�ak�lg�_]f]jYl]�\]lYad]\�j]hgjlk�k`goaf_�`go�l`]�Afl]jf]l�[gff][lagf�ak�Z]af_�mk]\�Yf\�Zq�o`ge&�

L`]�dg_�j]na]o�^mf[lagfk�g^�l`]�OYl[`?mYj\�L][`fgdg_a]k�K][mjalq�Kqkl]e�Yj]�k]hYjYl]\�aflg�log�ZYka[�[gehgf]flk3�j]Yd�lae]�Yf\�`ak%lgja[Yd�j]hgjlk&�L`]�j]Yd�lae]�dg_k�Yj]�l]pl�^ad]k�l`Yl�[Yf�]Ykadq�Z]�aehgjl]\�aflg�Yfq�j]hgjl�eYc]j�gj�dg_�hYjk]j&�L`]�OYl[`?mYj\�L][`fgdg_a]k�@aklgja[Yd�J]hgjl�Ojal]j�ak�Yf�]Ykq�lg�mk]�j]hgjl�eYc]j�l`Yl�`Yk�eYfq�klYf\Yj\�j]hgjlk�\]ka_f]\�lg�_an]�Y�kfYhk`gl�g^�l`]�[mjj]fl�Yf\�`aklgja[Yd�>aj]Zgp�Y[lanalq&�

Why Reporting?

O]dd%lYj_]l]\�j]hgjl�_]f]jYlagf�`]dhk�a\]fla^q�Yf\�]f^gj[]�Yf�Y[[]hl%YZd]�mk]�hgda[q�^gj�l`]�gj_YfarYlagfÌk�Afl]jf]l�[gff][lagf&�L`]�[gf%[]hl�g^�ÉY[[]hlYZd]�mk]Ê�fgl�gfdq�Z]Yjk�gf�hjg\m[lanalq$�Zml�Ydkg�gf�l`]�gj_YfarYlagfÌk�nmdf]jYZaalq�lg�k]pmYd�`YjYkke]fl�[`Yj_]k�Yf\�gl`]j�h]jkgff]d%j]dYl]\�[gf[]jfk&

9�_gg\�j]hgjl�_]f]jYlagf�^Y[adalq�k`gmd\�Z]�YZd]�lg�a\]fla^q�Yf\�kme%eYjar]�c]q�akkm]k�km[`�Yk2�

� O`]f�\g�A�f]]\�Y�oa\]j�ZYf\oa\l`�[gff][lagf�lg�l`]�Afl]jf]l�Yf\�o`q7�

� O`Yl�Yj]�l`]�mkY_]�hYll]jfk�l`Yl�eq�mk]jk�Yj]�\]n]dghaf_�Yf\�`go�\g�l`gk]�hYll]jfk�j]dYl]�lg�l`]�k][mjalq�g^�l`]�f]logjc�Yf\�l`]�_gYdk�g^�l`]�[gjhgjYlagf7�

WatchGuard Internet Security Handbook 97

Reporting

� @go�\g�[mjj]fl�mk]j�hYll]jfk�j]^d][l�l`]�nYdm]k�Yf\�[gf[]jfk�g^�l`]�[gjhgjYlagf�oal`�j]_Yj\k�lg�[j]Ylaf_�Y�hjg\m[lan]�ogjchdY[]7

L`]�@aklgja[Yd�J]hgjlaf_�Eg\md]�Yddgok�kmeeYja]k�lg�Z]�Zmadl�k`goaf_�lqh]k�g^�k]kkagfk$�egkl�Y[lan]�`gklk$�egkl�mk]\�k]jna[]k$�MJDk$�EYkim]jY\af_�af^gjeYlagf�Yf\�eYfq�gl`]j�j]hgjlk&��L`]k]�klYf\Yj\�j]hgjlk�o]j]�\]n]dgh]\�^gj�gmj�[mklge]jk�ZYk]\�gf�l`]aj�j]im]klk�^gj�[d]Yj$�[gf[ak]$�Yf\�j]d]nYfl�af^gjeYlagf�gf�l`]aj�[gjhg%jYl]�Afl]jf]l�mkY_]&�

The WatchGuard Historical Reports Module

@aklgja[Yd�J]hgjlaf_�kmeeYjar]k�qgmj�f]logjc�Y[lanalq&�9f�YjjYq�g^�^d]paZd]�j]hgjlaf_�ghlagfk�hjgna\]k�qgm�Y�jYf_]�g^�klYf\Yj\ar]\�j]hgjlk�Zq�lae]�khYf$�`gkl�Yf\�k]jna[]&�Qgm�[Yf�na]o�j]hgjlk�af�l]pl�eg\]�gj�mk]�k]n]jYd�_jYh`af_�ghlagfk�af[dm\]\�af�l`]�@aklgja[Yd�J]hgjlaf_�hY[cY_]&�L`]k]�klYf\Yj\ar]\�j]hgjlk�[Yf�Z]�[mklgear]\�gj�]phgjl]\�aflg�l`aj\%hYjlq�Yhhda[Ylagfk�^gj�]phYf\]\�YfYdqkak�Yf\�hj]k]flYlagf&

O`]f�qgm�[gdd][l�Y�j]hgjl�h]jag\Ìk�]n]flk$�[ghq�l`]�dg_�^ad]�lg�klYZa%dar]�al�^gj�_]f]jYlaf_�j]hgjlk&

Types of Reports

KlYf\Yj\�j]hgjlk�af[dm\]2�

Exception reportsDakl�\]fa]\�[gff][lagf�j]im]klk$�j]Zgglk$�k[Yf�Yll]ehlk�Yf\�gl`]j�Y[lan%alq�dg__]\�Zq�l`]�>aj]Zgp&�

Time Series reportsK`go�[gff][lagf�kmeeYja]k�\mjaf_�Y�kh][a^a]\�lae]�h]jag\&�

Host reportsK`go�l`]�fmeZ]j�g^�[gff][lagfk�lg�l`]�lgh�)(�af[geaf_�Yf\�gml_gaf_�`gklk&�

Service reportsK`go�l`]�fmeZ]j�g^�[gff][lagfk�lg�l`]�lgh�)(�af[geaf_�Yf\�gml_gaf_�k]jna[]k&�

Session reportsNa]o�Y[lanalq�Zq�af\ana\mYd�mk]j�k]kkagf&�

Suspicious Activity reportsOYjf�g^�hgl]flaYd�k][mjalq�Zj]Y[`]k&�

URL reports lDakl�@LLH�Y[lanalq$�af[dm\af_�hY_]k�j]lja]n]\$�aeY_]k�j]lja]n]\�Yf\�kal]k�nakal]\�Zq�`gkl�gj�mk]j&�

98 WatchGuard Internet Security Handbook

Building Reports

Building Reports

:mad\af_�Y�j]hgjl�e]Yfk�k]d][laf_�Y�[]jlYaf�hgafl�g^�na]o�gj�klYlakla[�qgm�oYfl�lg�kmeeYjar]$�kh][a^qaf_�l`]�[jal]jaY�l`Yl�oadd�hjgna\]�l`ak�hgafl�g^�na]o$�Yf\�afalaYlaf_�l`]�Zmad\&�9�j]hgjl�akgdYl]k�kh][a^a[�af^gjeYlagf�^jge�Y�em[`�dYj_]j�\YlYZYk]&

>gj�]pYehd]$�Y�ÉmkY_]�Zq�`gklÊ�j]hgjl�\akhdYqk�o`Yl�h]j[]flY_]�g^�ljY^^a[�l`jgm_`�l`]�>aj]Zgp�ak�YlljaZmlYZd]�lg�l`]�nYjagmk�[gehml]jk�af�l`]�gj_YfarYlagfÌk�f]logjc&�Lg�Zmad\�Y�mkY_]�Zq�`gkl�j]hgjl$�qgm�ogmd\�kh][a^q�o`Yl�lae]�h]jag\�l`]�Y[lanalq�[gn]jk$�o`a[`�`gklk�qgm�Yj]�[gfka\]jaf_� ^gj�]pYehd]$�l`]�lgh�l]f�gj�lo]flq!$�Yf\�o`a[`�_jYh`a[�Z]kl�j]hj]k]flk�l`]�mkY_]� ^gj�]pYehd]$�Y�+%<�ha]%[`Yjl!&

Exporting Reports

@aklgja[Yd�j]hgjlk�[Yf�Z]�]phgjl]\�lg�gl`]j�^gjeYlk�^gj�af[gjhgjYlagf�aflg�hghmdYj�j]hgjl�hjg_jYek&�

CDF ReportsL`]�]phgjl�^]Ylmj]�]fYZd]k�qgm�lg�]phgjl�l`]�[mjj]fldq�dgY\]\�dg_\Z�^ad]�aflg�l`j]]�\a^^]j]fl�[geeY�\]daeal]\�l]pl�^ad]k� ;<>!$�o`a[`�qgm�[Yf�l`]f�mk]�af�gl`]j�hjg_jYek�km[`�Yk�\YlYZYk]k�Yf\�khj]Y\k`]]lk&�L`]�l`j]]�^ad]k�Yj]2

� =phgjl&lpl��Daklk�l`]�]flaj]�^ad]�af�;<>�^gjeYl&� =p[=phgjl&lpl��Daklk�l`]�]p[]hlagfk�gj�\]fa]\�[gff][lagfk&� Mjd=phgjl&lpl��Daklk�l`]�MJDk�gj�<FK�fYe]k�g^�l`]�`gklk�l`Yl�

[gff][l]\�lg�]Y[`�gl`]j&

=phgjl�ghlagfk�]fYZd]�qgm�lg�[mklgear]�l`]�gmlhml�^gj�lae]�h]jag\�[gn]j]\$�dg[Yd�gj�?EL�lae]$�Yf\�MJD�gj�<FK�fYe]k&

L`]�]phgjl�^ad]�^a]d\�fYe]k�Yj]2

� Dg[Yd�\Yl]��<Yl]�af�l`]�>aj]Zgp�lae]�rgf]&� Dg[Yd�lae]��Lae]�af�l`]�>aj]Zgp�lae]�rgf]&� ?E<��Dg_k�mk]�?j]]foa[`�E]Yf�<Yl]�^gj�Ydd�dg_k�kaf[]�l`]�dg_k�

[Yf�g[[mj�af�Yfq�lae]�rgf]&� ?EL��Dg_k�mk]�?j]]foa[`�E]Yf�Lae]�^gj�Ydd�dg_k�kaf[]�l`]�dg_k�

[Yf�g[[mj�af�Yfq�lae]�rgf]&� Kj[��Kgmj[]�Yk�]al`]j�AH�Y\\j]kk�gj�<FK�YdaYk$�\]h]f\af_�gf�l`]�

<FK�k]llaf_k&� <]kl��<]klafYlagf�Yk�]al`]j�AH�Y\\j]kk�gj�<FK�YdaYk$�\]h]f\af_�

gf�l`]�<FK�k]llaf_k&� Kj[�hgjl��L`]�hgjl�mk]\�lg�k]f\�l`]�ljYfkeakkagf&

WatchGuard Internet Security Handbook 99

Reporting

� <]kl�hgjl�È�L`]�hgjl�lg�o`a[`�l`]�ljYfkeakkagf�oYk�k]fl&� Af'Gml�È�<aj][lagf�g^�ljYfkY[lagf$�]al`]j�ÉAf[geaf_Ê�gj�ÉGml_g%

af_Ê&� Mk]j�fYe]�È�L`]�fYe]�g^�l`]�gja_afYlgj�g^�gml_gaf_�ljYfkY[lagfk&

L`]�mk]j�fYe]�ak�j]hgjl]\�a^�Yml`]fla[Ylagf�lg�l`]�>aj]Zgp�ak�Y[lan]�Yf\�l`]�mk]j�fYe]�ak�j]kgdn]\�af�l`]�dg_�^ad]&�Al�ak�hgkkaZd]�^gj�Y�[gff][lagf�lg�Z]�ojall]f�lg�l`]�]phgjl�o`]j]�l`]�mk]j�fYe]�ak�fgl�j]kgdn]\&�L`ak�ak�Z][Ymk]�l`]�dg_�^ad]�ak�gn]jojall]f�k]im]flaYddq�ZYk]\�gf�Y�eYpaeme�dg_�kar]&�L`]j]^gj]$�Y�j][gj\�l`Yl�j]hgjlk�Y�mk]jÌk�Yml`]fla[Ylagf�[gmd\�Z]�gn]jojall]f�Z]lo]]f�l`]�lae]�al�\akhdYqk�af�@aklgja[Yd�J]hgjlk�Yf\�o`]f�al�ak�]phgjl]\&

WebTrends for Firewalls and VPNs® Reports@aklgja[Yd�J]hgjlk�[Yf�Ydkg�]phgjl�l`]�dg_�^ad]�aflg�Y�^gjeYl�l`Yl�[Yf�Z]�aehgjl]\�aflg�O]ZLj]f\k�^gj�>aj]oYddk�Yf\�NHFk�&��

O]ZLj]f\k�^gj�>aj]oYddk�Yf\�NHFk�[Yd[mdYl]k�af^gjeYlagf�\a^^]j%]fldq�l`Yf�OYl[`?mYj\�@aklgja[Yd�J]hgjlk&�OYl[`?mYj\�@aklgja[Yd�J]hgjlk�[gmflk�l`]�fmeZ]j�g^�ljYfkY[lagfk�l`Yl�g[[mj�gf�Hgjl�0(&�O]ZLj]f\k�^gj�>aj]oYddk�Yf\�NHFk�[Yd[mdYl]k�l`]�fmeZ]j�g^�MJD�j]im]klk&�L`]k]�fmeZ]jk�nYjq�\m]�lg�emdlahd]�MJD�j]im]kl�eYq�_g�gn]j�l`]�kYe]�Hgjl�0(�[gff][lagf�Yf\�ÉC]]h�9dan]k&Ê

100 WatchGuard Internet Security Handbook

Internet Security Handbook Index

9Y[lan]�[gff][lagfk 1,9@

AHK][ /-YdaYk

AH +.9JH�lYZd] 1-Yml`]fla[Ylagf

;JQHLG;Yj\ -/\akhdYqaf_�dakl 1->aj]Zgp --na]oaf_�`gkl�af^gjeYlagf 1,Oaf\gok�FL�K]jn]j --

9ml`]fla[Ylagf�@]Y\]j� 9@! /-Ymlg%Zdg[c]\�kal]k ,-

:Zdg[c]\�hgjlk

[gf^da[lk ,0mk]^mdf]kk ,/OYl[`?mYj\�\]^Ymdl�dakl ,/

Zdg[c]\�kal]k ,-YmlgeYla[ ,-dakl 1,$�1-h]jeYf]fl ,-

:jYf[`�G^^a[]�NHF .1\aY_jYe /*AHK][�mk]k /(kYehd]�[gf^a_mjYlagfk /+

:jYf[`�G^^a[]�NHF�oal`�AHK][\aY_jYe /.

;;`Yf_af_�Y�K]jna[] ,*;@9H�Yml`]fla[Ylagf�hjglg[gd -.[gf^a_mjaf_

Hgjl�>gjoYj\af_ -)k]jna[]k�lg�ogjc�oal`�NHF /0

;JQHLG;Yj\ -/

<\]^Ymdl�Zdg[c]\�\]klafYlagf�hgjlk ,/\]^Ymdl�hY[c]l�`Yf\daf_ ,-$�,.$�,0<]d]laf_�Y�K]jna[] ,+<=K�]f[jqhlagf /-\jgh%af�[gf^a_mjYlagf +-$�+.<jgh%af�f]logjc

j]dYl]\�`gkl�akkm] +.

==f[YhkmdYlaf_�K][mjalq�HYqdgY\� =KH! /-]f[jqhlagf

)*0%Zal /(,(%Zal /(kaf_d]%<=K /-ljahd]%<=K /-$�/.

=KH /-]phgjlaf_�j]hgjlk )((

>>aj]Zgp +-

Y\\af_�j]dYl]\�`gkl +.Y\\af_�j]dYl]\�f]logjc +-Yml`]fla[Ylagf --=pl]jfYd�afl]j^Y[] ,-afl]j^Y[]k 1-eYkim]jY\af_ -(hgjl�^gjoYj\af_ -)JY\amk�Yml`]fla[Ylagf -.k][j]l�k`Yj]\�oal`�JY\amk�k]jn]j -.mk]jk -*mk]jk�Yf\�_jgmhk -*mk]jk�afka\] ,*mk]jk�gmlka\] ,*

>aj]Zgp$�afl]j^Y[]k +/

@`gkl�YdaYk -*

AA9F9 ,/Afl]jf]l�9kka_f]\�FmeZ]j�9ml`gjalq ,.AH�YdaYk +.AH�eYkim]jY\af_

f]logjck -(AHK][ /,$�/-

9@ /-=KH /-aehd]e]flYlagf�]pYehd] //hgda[q /,lmff]d /,

AHK][�k]lmhHgda[a]k //

DdgY\�Yn]jY_] 1-dg_�`gkl

daklaf_ 1,dg__af_

ghlagfk 1,O]Z:dg[c]j .*

Ee]egjq 1-Emdlahd]�f]logjc�[gf^a_mjYlagf +/emdlahd]�f]logjc�[gf^a_mjYlagf +.

FF]l:AGK�k]jna[]k ,0F]logjc�[gf^a_mjYlagf$�emdlahd] +/F]logjc�>ad]�Kqkl]e ,0fgla^a[Ylagf

daklaf_�`gklk 1,Fgn]dd�AHP ,0FL�K]jn]j�Yml`]fla[Ylagf --

GGh]fOaf\gok ,0

HhY[c]l�^adl]jaf_

\]k[jahlagf +1jmd]�k]lk ,(

hgda[qAHK][ /,

hgda[q�gj\]jaf_ /-AHK][ /-

hgjl�khY[]�hjgZ] ,($�,-hgjlk$�jYf\ge ,0hjgZ]

hghmdYj�hgjlk ,0hgjl�khY[] ,-

hjgZ]khgjl�khY[] ,(

hjg[]kk 1-hjgpa]k

\]k[jahlagf ,(

JJY\amk

k][j]l -.k]jn]j�j]imaj]e]flk -.

JY\amk�Yml`]fla[Ylagfhgjl�mk]\ -.

j[h ,0j]dYl]\�`gklk +.j]dYl]\�f]logjck +-J]egl]�Mk]j�NHF .1$�0(j]hgjlk

]phgjlaf_ 11O]ZLj]f\k )((

jdg_af ,0jgml]k 1-JH;�hgjleYhh]j ,0

jk` ,0jmd]�k]lk

hY[c]l�^adl]jaf_ ,(

KkYehd]�[gf^a_mjYlagf

:jYf[`�G^^a[]�NHF /+k][j]l� JY\amk! -.K]jna[]k

[`Yf_af_ ,*\]d]laf_ ,+

khgg^af_ ,-$�,.$�1,KlYlmk�Na]o]j

Afl]j^Y[]k 1-KlYlmkJ]hgjl 1,

LljYfkhYj]fl�Yhhda[Ylagf�hjgpa]k +1ljahd]%<=K�]f[jqhlagf /-$�/.Ljmkl]\�afl]j^Y[] /(lmff]d

AHK][ /,

Mmhlae] 1,

Nn]jkagf 1,NajlmYd�HjanYl]�F]logjc� NHF!

[gf^a_mjYlagf�[`][cdakl /*[gf^a_mjaf_�k]jna[]k�lg�ogjc�oal` /0

NHF .1[gf^a_mjaf_�k]jna[]k�lg�ogjc�oal` /0

OOYl[`?mYj\�K][mjalq�LjaYf_d] *1OYl[`?mYj\�NHF

mk]k /(O]Z:dg[c]j

:dg[c]\�MJD�<YlYZYk] .+manually downloading .+

;gfljgdk�lYZ .)=p[]hlagfk�LYZ .)_jgmhk .)?jgmhk�LYZ .)`go�al�ogjck .*dg__af_ .*e]kkY_]�^gj�Zdg[c]\�mk]j .)K[`]\md]�LYZ .)

O]ZLj]f\k )((Oaf\gok�FL

_jgmhk -*mk]jk -*mk]jk�Yf\�_jgmhk -*

PP�Oaf\gok ,/

top related