ManageEngine Network Configuration Manager Integration Guide

Network Configuration Manager is a web-based, network configuration, change and compliance management (NCCCM) solution for switches, routers, firewalls and other devices. With NCCCM, hardware vendors, such as Cisco, can take total control of the entire life cycle of device configuration management. This document describes the steps to integrate ManageEngine Network Configuration Manager with your WatchGuard Firebox®.

Platform and Software

The hardware and software used to complete the steps in this document include:

• Firebox with Fireware version 12.8.1
• ManageEngine Network Configuration Manager
  Version 12.6.102
• Test environment: Windows 10

Test Topology

This diagram shows the test topology.

Set Up Firebox

Use these steps to set up a Firebox.

1. Log in to Fireware Web UI at:
   https://<IP address of Firebox>:8080
2. Select Firewall > Firewall Policies.

3. Click Add Policy.
   The Add Firewall Policy page opens.
4. Select the Custom check box.
5. In the Custom drop-down list, select Select a Policy Type.
6. To create a new custom policy template, click Add.
   The Add Policy Template page opens.

7. In the Name text box, type a policy name.
8. In the Type section, select Packet Filter.
9. In the Protocols list, click Add.
   The Protocol dialog box opens.

10. From the Type drop-down list, select Single Port.
11. From the Protocol drop-down list, select TCP.
12. In the Server Port text box, type 4118.
13. Click OK.
    

14. Click Save.
    

15. Click Add Policy.
16. Configure the policy to allow connections from Any Trusted to Firebox.
    You can also select Any-Optional to Firebox, depending on which port is connected.

17. Click Save and review the new policy.

Set Up Network Configuration Manager

Use these steps to set up Network Configuration Manager.

1. On a computer with Network Configuration Manager installed, open a web browser and, in the address bar, type:
   http://localhost:8060/apiclient/ember/Login.jsp
2. Log in with your user name and password.

3. Select Inventory > Devices > Add Device.

4. In the Choose Action setting, select Add Device.

5. In the Hostname/IP Address text box, type the Firebox interface IP address.
6. From the Vendor drop-down list, select WatchGuard.
7. From the Device Template Name drop-down list, select WatchGuard Firewall.
8. From Associate Tag, select No Tags.
9. Type the Series number and Model type.
10. Click Add.
    The Apply Credentials dialog box opens.
    

11. From the Protocol drop-down list, select SSH-TFTP.
12. Select the Primary tab.
13. From the Use Credential Profile drop-down list, keep the default setting.
14. In the Login Name text box, type the user name for an administrative user on the Firebox.
15. Under Authentication Mode, select Password Auth. In the password text boxes, type a password for an administrative user on the Firebox.

16. In the Prompt text box, type #.
17. Leave all other text boxes empty.
18. Select the Additional tab.
    The settings for additional credentials open.

19. Leave the TFTP/SCP Server Public IP text box empty.
20. In the SSH Port text box, type 4118.
21. For all the other text boxes, accept the default ":" entry.
22. Click Save &Test.
    At this step, make sure that a user is not currently logged in with the CLI or Web UI of the Firebox.
23. After you apply the credentials, Network Configuration Manager generates a report that shows whether the credentials are valid.

Test the Integration

This section describes how to test the integration.

Add the WatchGuard Firebox to the Network Configuration Manager

The procedure in the previous section describes the steps to directly add the Firebox by its IP address. For information about other methods to add devices, see the ManageEngine Network Configuration Manager documentation.

After you add a Firebox to Network Configuration Manager, you can back up the configuration, and you can connect to the CLI on the Firebox.

1. Log in to Network Configuration Manager.
2. Select Inventory > Devices.
3. Select the added device.
4. Click ...
5. Click Backup.

6. When done, you see that the back up is successful.

7. Click the Host Name of the device to open the device page.

8. Click SSH to open the SSH Terminal. You can execute any Fireware CLI command from here.

Firebox Restore Configuration

To restore a previous configuration to the Firebox:

1. Click Upload Config.

2. Select the version to restore, and click Upload.

Firebox Command Configlets

Network Configuration Manager can perform a variety of actions using command Configlets, which execute Fireware CLI commands. For example, you can use a Configlet to display information or modify a Firebox configuration.

To add a Configlet:

1. On the device page for your Firebox, select Config Automation > Configlets > Add Configlet.

The Add Configlet dialog box opens.

2. In the Name text box, type a name.
3. From the Execution Mode drop-down list, select Advanced Script Execution Mode.
4. In the Description text box, type a description.
5. From Associate Tag, select No Tags.
6. In the Configlet Content text box, type a command or command group to run on your Firebox.

For example, these CLI commands change the IP address of a Firebox interface:

• <command timeout='5'>show interface</command>
• <command timeout='5'>co</command>
• <command timeout='5'>interface fa 6</command>
• <command timeout='5'>ip address 1.1.1.1/24</command>
• <command timeout='5'>exit</command>
• <command timeout='5'>exit</command>
• <command >show interface</command>

7. Disable Configuration Backup (optional).
8. Click Save.
   The new Configlet is added to the Configlets list.

9. To execute a Configlet, click Execute.
   The Execute Configlet page opens.
10. Select the Device Group tab, and select a device group.
11. Select the Devices tab, and from the Selected Devices list, select the target device.

12. To execute the Configlet on the device that you select, click Execute.
    When the execution is complete, the Execution Status changes to Completed.

13. For information about a Configlet that was executed, from Configlet Name, click a Configlet.
    
14. From the Host Name section, click the IP address of the device.

15. Review the execution details and the results of each command. In this example, you can find the interface number and verify the IP address was successfully changed.