Quick Start — Set Up a Cloud-Managed FireCluster

This document applies to Fireboxes you manage in WatchGuard Cloud. For information that applies to Fireboxes managed in Fireware Web UI or WatchGuard System Manager, go to:

• Quick Start — Set Up a FireCluster (Locally-managed FireCluster)

Before you add a cloud-managed FireCluster, learn about the requirements and plan your configuration. For more information, go to Before You Configure a Cloud-Managed FireCluster in WatchGuard Cloud.

1. Reset both Fireboxes to factory-default settings. For more information, go to Reset a Firebox.
2. Log in to your WatchGuard Cloud Subscriber account.
3. Select Configure > Devices.
4. Click Add Device.
   A list of activated devices appears. If the list does not include your devices, review the requirements in Before You Configure a Cloud-Managed FireCluster in WatchGuard Cloud.

5. Click Add FireCluster.
   The selection page for the first FireCluster member opens.

6. To add the first FireCluster member, click a Firebox name.
   The selection page for the second FireCluster member opens.

7. To add the second FireCluster member, do one of the following:
   • Enter the serial number of the second FireCluster member and click Add.
   • From the list of devices, click a Firebox name.
     Selected FireCluster members appear next to the device list.
     

8. Click Add FireCluster.
   A confirmation page opens.

9. From the FireCluster Management drop-down list, select Cloud Management.
   
10. Click Next.

• Enter the FireCluster Name.
• Enter the Member1 Name.
• Enter the Member2 Name.
• Select a Time Zone. The time zone settings control the date and time that appear in the log messages and reports for your FireCluster.
• Select the device folder for your Firebox. Device Folders help you to view status and summary data for groups of devices.
  If you only have one root folder, the folder list does not appear.

Click Next.

11. From the Cluster Interface drop-down list, select an interface.
    Cluster members use this dedicated interface to exchange heartbeat packets and to synchronize connection and session information.
    
12. In the Member1 Cluster IP Address and Member2 Cluster IP Address text boxes, enter an IP address that is not in use on your network.
    To avoid conflicts with routable IP addresses, we recommend APIPA addresses or IP addresses from a dedicated private subnet.
13. In the Cluster ID text box, enter a number between 1 and 255. The default cluster ID is 50.
    The Cluster ID determines the virtual MAC (VMAC) addresses that cluster member interfaces use. If there is another FireCluster or any devices that use the VRRP protocol on the same subnet, enter a Cluster ID that is different from the Cluster ID of another FireCluster to avoid a virtual MAC address conflict. For information about how the VMAC address is calculated, go to Active/Passive Cluster ID and the Virtual MAC Address.

14. (Optional) To add redundancy, select Assign Backup Cluster Interface. The FireCluster uses the backup cluster interface if the primary cluster interface fails. We recommend this option for FireCluster configurations without a direct cable connection between cluster members. For more information about this setting, go to Before You Configure a Cloud-Managed FireCluster in WatchGuard Cloud.
    1. From the Backup Cluster Interface drop-down list, select an interface.
    2. In the Member1 Cluster Backup IP Address and Member2 Cluster Backup IP Address text boxes, enter an IP address that is not in use on your network. To avoid conflicts with routable IP addresses, we recommend APIPA addresses or IP addresses from a dedicated private subnet.

    If you use both primary and backup cluster interfaces, the interfaces must be on different subnets. We recommend that you do not use a switch between each member for the cluster interfaces. If you do use a switch between cluster members, the cluster interfaces must be logically separated from each other on different VLANs. We recommend that you configure a backup cluster interface if you separate the cluster interfaces with a switch.

15. Click Next.
16. From the IP Address Configuration drop-down list, select Static, DHCP, or PPPoE.
17. If you selected Static:
    1. In the IP Address text box, enter an IP address for the external interface.
    2. In the Gateway text box, enter an IP address for the gateway.
    3. In the Public DNS Server text box, enter the IP address of a public DNS server for name resolution.

18. If you selected DHCP or PPPoE:
    1. Select Obtain an IP address automatically or Use this IP address.
    2. Enter the Client Name.
    3. Enter the Host Name.
    4. If you selected Use this IP address, enter an IP address.
19. Click Next.
20. Enter the Internal Network IP Address.
21. (Optional) Select Enable DHCP server on Internal Network.
    1. Enter a Starting IP Address.
    2. Enter an Ending IP Address.
22. In the Member1 Communication IP Address text box, type an IP address that is on the same subnet as your internal network. Your Dimension or syslog server must also be on this network.
23. In the Member2 Communication IP Address text box, type an IP address that is on the same subnet as your internal network. Your Dimension or syslog server must also be on this network.

24. Click Next.
25. (Optional) If your Firebox is a wireless model, on the Configure Wireless Settings page, you can enable these options:
    • Enable Wireless — If you enable this option, enter the SSID and Passphrase for your internal wireless network.
    • Enable Guest Wireless — If you enable this option, enter the SSID and Passphrase for your guest wireless network.

26. Enter a Status Password.
27. Enter an Admin Password. This password must be different than the status password.

28. To complete the FireCluster configuration, click Next.
29. Follow the instructions on the Connect Your FireCluster page.

For information about cabling and network topology, go to Step 3 — Connect the Hardware.

36. Click Done.

In WatchGuard Cloud, go to Monitor > Devices and view the Device Summary of the FireCluster to verify the connection to WatchGuard Cloud.

Only the cluster master connects to WatchGuard Cloud.

• The status of the cluster master is Connected.
• The status of the backup master is Never Connected or Not Connected because the backup master will only be connected if the current cluster master is unavailable.