Nerdio for Azure Firebox Cloud Integration Guide

Nerdio for Azure provides deployment, management, and optimization technologies to help you build a successful Microsoft Azure practice. This document describes the deployment of Firebox Cloud on Microsoft Azure using a network provided by Nerdio.

Platform and Software

The hardware and software used to complete the steps outlined in this document include:

  • WatchGuard Firebox Cloud
  • Nerdio for Azure

Add a Nerdio For Azure (NFA) account on Nerdio

  1. Log in to Nerdio Admin Portal as an administrator.

Screen shot of Nerdio, picture1

  1. Select Add NFA account.
    The ADD NFA ACCOUNT dialog box opens.
  2. Select the type of Azure IT environment you want to deploy. In our example, we select NFA Enterprise.

The NFA Core Azure IT environment does not include SafeDNS.

Screen shot of Nerdio, picture2

  1. Click Next.
    The Tip dialog box opens.
  2. Click Next.
    The One more thing dialog box opens.
  3. Click Close.

Screen shot of Nerdio, picture3

  1. Click Connect and associate your account to grant access to Azure AD, Office 365 and Azure subscription.
  2. From the REGION drop-down list, select a region.

Screen shot of Nerdio, picture4

  1. Keep the default values for all other settings. Click Save.
  2. Click OK.
    Once the NFA account is deployed, a resource group will be created on your Azure account named NerdioRG. In the NerdioRG, you can view and manage the security rules in NSG-LAN and NSG-DMZ network security groups. You will see the SafeDNS rule created by default in the NSG-LAN.

Deploy WatchGuard Firebox Cloud on Azure

Before you deploy Firebox Cloud, you must identify your Firebox Cloud software plan and generate a SSH-2 RSA public key/private key pair. For more information, see Deploy WatchGuard Firebox Cloud on Azure.

Deploy WatchGuard Firebox Cloud

To create the Firebox Cloud instance:

  1. Log on to the Azure portal with your Microsoft Azure account credentials.
  2. Click Create a Resource.
    The Azure Marketplace opens.
  3. In the Search text box, type Firebox Cloud.
  4. Select WatchGuard Firebox Cloud.
    The WatchGuard Firebox Cloud license options opens.
    Screen shot of the WatchGuard Firebox Cloud software plan selection page
  5. From the Select a software plan drop-down list, select WatchGuard Firebox Cloud (BYOL) or WatchGuard Firebox Cloud (PAYG).
  6. Click Create.
    The VM configuration steps opens.

Screen shot of the Firebox Cloud template steps in Microsoft Azure

  1. In the Basics step, specify basic information about your virtual machine.

Firebox Cloud VM Name

The name for the Firebox Cloud virtual machine in the Azure portal.


The name of the Azure subscription where the virtual machine and resources are stored. This is the account that Microsoft bills for VM use and storage.

Resource group

A resource group is a collection of resources that share the same lifecycle, permissions, and policies. All objects, such as networks and interfaces, and data for the Firebox Cloud instance will be associated with the resource group you specify. The resource group does not affect networking or connectivity from the Firebox to existing Azure resources.

Microsoft Azure does not support deployment of a managed application to a resource group with existing resources. You must create a new resource group or use an empty resource group.


The Azure region for this Firebox Cloud instance.

  1. In the VM Size and Key Data step, specify virtual machine configuration details.

Firebox Cloud License Type and VM Size — for Firebox Cloud (BYOL)

For a BYOL license, select the Firebox Cloud License Type. This is the Firebox Cloud license you purchased from WatchGuard or a WatchGuard reseller. Select Small, Medium, Large or Extra Large. After you select the License Type, an appropriate VM size is selected by default. To select a different size, click Change size. An Availability Set is created as part of the BYOL deployment.

Azure VM Tier and VM Size — for Firebox Cloud (PAYG)

For a PAYG license, select the Azure VM tier for the virtual machine. Select Free Tier Eligible or Standard. After you select the VM tier, an appropriate VM size is selected by default. To select a different size, click Change size.

SSH public key

The public key for this Firebox. You can use a tool such as puttygen, or ssh-keygen command in Linux to generate the key pair. You must use the private key associated with this public key to connect to the Firebox Cloud CLI.

Storage account

The name of the storage account to store boot diagnostic log files. The storage account you select must not be in another resource group in your subscription. Boot diagnostic log files contain information that can help WatchGuard support troubleshoot issues.

  1. Click Next : Network Settings.
  2. From the Virtual network drop-down list, select NerdioVnet.
  3. From the External (Public) subnet drop-down list, select a subnet. In our example, we select DMZ (
  4. From the Trusted (Private) subnet drop-down list, select LAN (
  5. For External Network Security Group, select Management Only.
  6. For Public IP address, select or create a public IP address to use for your Firebox Cloud external interface. In our example, we create a new public IP address. Keep the Domain name label setting as the default value.

Screen shot of Azure, picture5

  1. Click Next : Review + create.
  2. Click Create.
    After the deployment is complete, you can go to the Resource group.
  3. You can find the public IP address in the Network interface of the resource group.

Screen shot of Azure, picture6

  1. Go to the NerdioRG resource group.
  2. Click the NSG-DMZ network security group.
    If you select LAN ( as your Firebox Cloud external subnet, you must click NSG-LAN to add an Inbound security rule.
  3. Select Settings > Inbound security rules > Add.
  4. From the Destination drop-down list, select IP Addresses.
  5. In the Destination IP addresses/CIDR ranges text box, type the Firebox Cloud public IP address.
  6. In the Destination port ranges text box, type *.
  7. In the Priority text box, type the number higher than block-inbound-DMZ priority. In our example, we type 101.
  8. In the Name text box, type the name.
  9. Keep all other settings as default values.

Screen shot of Azure, picture7

  1. Click Add.

For information about how to find the Instance ID, activate your Firebox Cloud License, run the Firebox Cloud Setup Wizard, connect to Fireware Web UI, and add the Feature Key, see Deploy WatchGuard Firebox Cloud on Azure.

Test the Integration

  1. Log in to Fireware Web UI (https://<Eth0_public_IP>:8080).
  2. Select System Status > Diagnostics.
  3. Select the Network tab.
  4. From the Task drop-down list, select Ping.
  5. In the Address text box, type an address or fully qualified domain name (FQDN).
  6. Click Run Task.
  7. Verify the Firebox Cloud can ping Internet.

Screen shot of Firebox, picture8