What's New in Fireware

This release of Fireware includes these new and improved features:

• Support for 8x1Gb Network ModuleFeature DetailsFireware v12.8.2 adds support for a new 8x1Gb Copper network module (WG9022) for Firebox M290, M390, M590, and M690 devices.

This release of Fireware includes these new and improved features:

• Tor Exit Node BlockingFeature DetailsYou can now configure the Tor Exit Node Blocking service to block Tor exit nodes.
• BOVPN virtual interface failover to Microsoft Azure VPN gatewaysFeature DetailsThe Firebox supports certain failover configurations for BOVPN virtual interface tunnels configured to connect to Microsoft Azure VPN gateways in active-standby or active-active mode.
• WatchModeFeature DetailsFor partners with NFR Fireboxes, WatchMode is now available again for sales demonstrations. WatchMode is supported on rack-mountable Fireboxes (M Series) and T70/T80 Fireboxes that run Fireware v12.8.1 or higher.

This release of Fireware includes these new and improved features:

• SD-WAN Round RobinFeature DetailsYou can now configure SD-WAN actions to use the Round Robin load-balancing method.
• SD-WAN Actions in Centralized Management TemplatesFeature DetailsYou can now create and apply SD-WAN actions in a Centralized Management policy template.
• External VLAN enhancementsFeature DetailsTo increase network design flexibility, external VLAN configurations now have fewer restrictions.
• External Interface and VLAN ID in Web UI Quick Setup WizardFeature DetailsYou can now select which interface you want to use as the external interface in the Fireware Web UI Quick Setup Wizard. You can also enable and specify a VLAN ID for the external interface if required by your provider.
• MOBIKE support for Mobile VPN with IKEv2Feature DetailsMobile VPN with IKEv2 now automatically supports the MOBIKE mobility protocol, which means your remote workers can remain connected to the VPN even if they move to a different network.
• Intra-interface traffic inspectionFeature DetailsYou can now specify a CLI command to enable or disable intra-interface inspection on physical and link aggregation interfaces.
• IPv6 in Bridge ModeFeature DetailsIn Bridge mode, you can now specify a static IPv6 address and other IPv6 settings.
• Disable GARPFeature DetailsIn Mixed Routing mode only, you can now run a Fireware CLI command to disable gratuitous ARP (GARP) on Ethernet-like interfaces.
• Disable Geolocation Deny pageFeature DetailsYou can now enable or disable the Geolocation deny page for policies.
• Configure DF bit options for Mobile VPN with IKEv2Feature DetailsYou can now specify a CLI command to configure a custom DF bit value for Mobile VPN with IKEv2 connections.
• OS checksum Feature DetailsThe OS checksum feature has been deprecated and removed from Fireware Web UI and Firebox System Manager.

This release of Fireware includes these new and improved features:

• System integrity checks (12.7.2 Update 2) Feature DetailsThe Firebox now runs automatic integrity checks at boot time and when you upgrade. You can also run an on-demand integrity check from Fireware Web UI.
• WSM Cyclops Blink Detector (12.7.2 update 2) Feature DetailsYou can use the WSM Cyclops Blink Detector to determine if your Fireboxes are affected by Cyclops Blink.
• Firebox management policy warnings (12.7.2 Update 2) Feature DetailsYou now see a warning when your configuration includes an insecure Firebox management policy.
• Support for M290, M390, M590, and M690 devices Feature DetailsFireware v12.7.2 provides support for WatchGuard’s newest appliances, the Firebox M290, M390, M590, and M690
• Enable or disable Active Directory Mode for SSOFeature DetailsYou can now choose to enable or disable Active Directory (AD) Mode in the SSO Agent Configuration Tool. In Fireware 12.7.2, AD Mode is now disabled by default.
• Number of supported Terminal Service Agents increased to 512Feature DetailsThe number of supported Terminal Service Agents is increased to 512. The previous limit was 128.
• Support for Huawei E3372-320 USB LTE Modem Feature DetailsFireware v12.7.2 adds support for the Huawei E3372 USB LTE Modem

This release of Fireware includes these new and improved features:

• WatchGuard Cloud Connection Status in Fireware Web UI Feature DetailsThe Fireware Web UI > Information page for cloud-managed Fireboxes now indicates when there is a connection issue and the reason.
• Post-NAT information in v9 NetFlow recordsFeature DetailsIP addresses for NAT and NAT-T (NAT traversal) events now appear in flow records if you select V9 in the Firebox NetFlow configuration.
• AuthPoint Firebox Integration Support for Azure AD UsersFeature DetailsThe AuthPoint authentication server on the Firebox now supports authentication for Azure Active Directory users.
• RADIUS support for 256-Character Shared SecretFeature DetailsRADIUS now supports 256-character shared secrets.
• 4G LTE Interface Module SupportFeature DetailsFireware 12.7.1 adds support for a new LTE Interface module for the Firebox T80 that enables you to install a SIM card and use the cellular connection as an external interface on the Firebox.

This release of Fireware includes these new and improved features:

• AuthPoint Integration with a Firebox Feature DetailsYou can now use AuthPoint as an authentication server on your Firebox.
  • Mobile VPN with IKEv2 and AuthPoint integrationFeature DetailsYou can now configure Mobile VPN with IKEv2 to authenticate mobile VPN users directly through AuthPoint.
  • Mobile VPN with SSL and AuthPoint integrationFeature DetailsYou can now configure Mobile VPN with SSL to authenticate mobile VPN users directly through AuthPoint.
  • Firebox Authentication Portal and AuthPoint integrationFeature DetailsYou can now configure the Firebox Authentication Portal to authenticate users directly through AuthPoint.
  • Fireware Web UI and AuthPoint integrationFeature DetailsYou can now configure the Firebox to authenticate device management users directly through AuthPoint.
• Default authentication server for Fireware Web UI Feature DetailsYou can now specify the default authentication server to use when users log in to Fireware Web UI
• Support for HTTP proxy server settings for APT BlockerFeature DetailsYou can connect to the APT Blocker server with an HTTP proxy server
• Send PDF files to the APT Blocker data center for analysisFeature DetailsYou can now specify whether APT Blocker submits unrecognized PDF files to the data center for analysis.
• 802.1p marking for VLAN interfacesFeature DetailsYou can now enable 802.1p marking for VLAN interfaces.
• DHCP lease information for IPv4 clientsFeature DetailsIn Fireware Web UI, you can now see the total number of DHCP leases included in each IPv4 DHCP range configured on the Firebox. You can also see the number of leases in use.
• Intra-bridge traffic inspectionFeature DetailsYou can now select to apply firewall policies to traffic that passes between bridge member interfaces.
• Configure log rate limitsFeature DetailsYou can now control how many log messages the Firebox sends when it denies different types of traffic
• HTTPS predefined exceptions list automatic updatesFeature DetailsThe HTTPS exceptions list can now automatically update without a Fireware upgrade
• FQDN limits replaced by a warningFeature DetailsThere is no longer a limit on the number of fully qualified domain names you can use in your Firebox configuration.
• Disable the DNS cache Feature DetailsFor configurations with DNS Forwarding or DNSWatch enabled, you can now select an option in Fireware Web UI or Policy Manager to disable the DNS cache on the Firebox.

This release of Fireware includes these new and improved features:

• Support for Firebox configuration and management from WatchGuard CloudFeature DetailsFireware v12.5.7/v12.6.4 include enhancements to support the management and configuration of Fireboxes from WatchGuard Cloud.
• Disable the DNS cache (CLI only)Feature DetailsFor configurations with DNS Forwarding or DNSWatch enabled, you can now specify a CLI command to disable the DNS cache on the Firebox.

This release of Fireware includes these new and improved features:

• Flood protection logging enhancementsFeature DetailsThe Firebox now generates log messages when traffic from a site on the Blocked Site Exceptions list exceeds a Flood Attack threshold. As in previous Fireware versions, the Firebox continues to allow the traffic.

• Default route announcements for dynamic routingFeature DetailsFor an IPv4 dynamic routing configuration that includes the command "default-information originate," if Link Monitor detects a link failure for all WAN connections, BGP, OSPF, and RIP no longer announce the default route to neighbors.

This release of Fireware includes these new and improved features:

• Certificate verification for BOVPN peersFeature DetailsIn the BOVPN and BOVPN virtual interface configurations, you can now specify a root or intermediate CA certificate for VPN peer verification.
• TLS version requirements for the Mobile VPN with SSL client download pageFeature DetailsTo download the Mobile VPN with SSL client from the Firebox, your web browser must now support TLS 1.2 or higher.
• TLS version requirements for Fireware Web UIFeature DetailsTo connect to Fireware Web UI, your browser must now support TLS 1.2 or higher.
• TLS version requirements for the Hotspot Guest Administration portalFeature DetailsTo connect to the Hotspot Guest Administration portal, your browser must now support TLS 1.2 or higher.
• Additional DHCP lease information in the Firebox System Manager status reportFeature DetailsIn the FSM status report, the DHCP Leases section now includes the number of DHCP leases in use and the total number of DHCP leases available in the configuration.
• About Blocked SitesFeature DetailsTo allow connections to Panda products and services through the Firebox, Panda URLs were added to exceptions lists.
• (12.6.2 only) FireboxV support on KVMFeature DetailsYou can now deploy and configure a FireboxV virtual machine in a Linux KVM (Kernel Virtual Machine) hypervisor.
• (12.6.2 only) Configure Source PortFeature DetailsFirewall policy properties now include an option to limit policy scope based on the source port of the connection.
• (12.6.2 only) Create or Edit a Custom Policy TemplateFeature DetailsYou can configure a custom firewall policy template for ICMPv6 (Internet Control Message Protocol v6).
• (12.6.2 only) ICMPv6 Custom Policy Templates in Configuration TemplatesFeature DetailsIn configuration templates for Fireware v12.6 or higher, you can now configure a custom firewall policy template for ICMPv6.
• (12.6.2 only) Logon Disclaimer on Web UI Login page and CLIFeature DetailsWhen the Logon Disclaimer is enabled, the Logon Disclaimer message now appears on the Fireware Web UI login page instead of after a user logs log on. The Logon Disclaimer also now appears in the CLI.
• (12.6.2 only) CSfC ModeFeature DetailsYou can now use the CLI to enable CSfC mode on the Firebox to enable functionality required for compliance with Common Criteria CSfC requirements.
• (12.6.2 only) Define Advanced WebBlocker OptionsFeature DetailsBy default, WebBlocker allows users to view a website when the WebBlocker Server times out.
• (12.6.2 only) Create a Certificate CSR Feature DetailsCertificate Signing Requests (CSRs) now support RSA 3072, RSA 4096, ECDSA P-256, and ECDSA P-38 encryption settings.
• (12.6.2 U2 only) Test WebBlocker ActionsFeature DetailsBefore you enable a WebBlocker action, you can test the action to confirm whether WebBlocker will allow or block a URL.
• (12.6.2 U2 only) About Default Packet Handling OptionsFeature DetailsIn the Default Packet Handling dialog box, the Drop IP Source Route and Record Route Attacks check box was updated to better reflect the action that occurs.

This release of Fireware includes these new and improved features:

• Improved spamBlocker engineFeature DetailsThe new spamBlocker spam engine provides improved spam detection rates with lower impact on Firebox performance. spamBlocker now submits the entire email for inspection.
• Default multi-WAN methodFeature DetailsThe default multi-WAN method is now Failover.
• Custom MTU valueFeature DetailsYou can now configure a custom MTU setting in Fireware Web UI and Policy Manager.
• TDR Host Sensor Enforcement for mobile VPNFeature DetailsTDR Host Sensor Enforcement adds integrity checks that limit mobile VPN connections to devices that follow corporate policy.
• Dynamic DNS support for CloudflareFeature DetailsYou can now configure the Firebox for dynamic DNS through Cloudflare.
• Hex-based pre-shared keysFeature DetailsBOVPN and BOVPN virtual interface configurations now support hex-based pre-shared keys.
• SD-WAN default metricsFeature DetailsThe default value for the SD-WAN latency metric is now 400 ms. The default value for the jitter SD-WAN metric is now 100 ms.
• Firebox sends diagnostic logs to WatchGuard Cloud only when Support Access is enabledFeature DetailsThe Firebox now sends diagnostic log messages to WatchGuard Cloud only when Support Access is enabled. To request diagnostic log messages stored in WatchGuard Cloud you must open a support case.
• Disable the client download page for Mobile VPN with SSLFeature DetailsYou can now disable the Mobile VPN with SSL client download page hosted by the Firebox. In Fireware v12.5.4, this option is available only through the CLI.
• TLS version requirements for Mobile VPN with SSL clientsFeature DetailsThe Firebox now requires SSL VPN clients to support TLS 1.2 or higher.
• Custom timeout value for Mobile VPN with IKEv2Feature DetailsYou can now specify a custom timeout value for Mobile VPN with IKEv2 EAP user authentication. You must use Fireware CLI to configure this setting.
• Default packet handling options in configuration templatesFeature DetailsYou can now configure default packet handling settings in device configuration templates for Fireware v12.0 or higher.
• (12.6.1 only) New engine and signature set for Intrusion Prevention Service and Application ControlFeature DetailsSignature IDs have changed, and in some cases multiple signatures are consolidated into a single, more efficient signature. The engine upgrade is transparent to users.
• (12.6.1 only) Application Control categoriesFeature DetailsNetwork Protocols (1), Network Protocols (2), and Network Protocols (3) have been merged into a single category.
• (12.6.1 only) Security Portal URLs updated to accommodate the new IPS and Application Control engineFeature DetailsThere are new Applications and Threats pages in the Security Portal. The URL for main landing page remains the same.
• (WSM 12.6.1 only) New Fireware OS Compatibility version for Fireware version 12.6 and higherFeature DetailsThe OS Compatibility setting in Firebox configuration files and configuration templates has a new setting for Fireware version 12.6 and higher

This release of Fireware includes these new and improved features:

• Wireless enabled by default and configurable in setup wizardsFeature DetailsOn wireless Fireboxes, wireless is enabled by default. You can use wireless to connect to the Firebox to run the setup wizards. Setup wizards now configure settings to enable wireless access to the trusted network.
• Web Setup Wizard RapidDeploy OptionFeature DetailsThe Web Setup Wizard has a new RapidDeploy configuration method. Use this method to configure the external interface settings for RapidDeploy.
• Firebox Registration to WatchGuard Cloud with TPMFeature DetailsFor Firebox models that have a TPM chip, it is not necessary to paste a Verification Code to register the Firebox with WatchGuard Cloud.
• Disk Statistics in Fireware CLIFeature DetailsDisk statistics are now available through Fireware CLI. Use the command: diagnose hardware disk. Prior to Fireware v12.5.1, this information was available in the Firebox Status Report.
• Autotask Integration Requires API UsersFeature DetailsFrom 15 April 2020, only an API user account can access Autotask API services and the Firebox Autotask integration. To continue to use Autotask integration with your Firebox after 15 April 2020, you must: 1. Create a new API User account in Autotask. 2. Update your Firebox Autotask integration configuration with the new API User account username and password.
• AP225W Wall Plate Access Point SupportFeature DetailsThis release adds support for the AP225W. The AP225W is an enterprise-grade 2x2 MU-MIMO tri-radio 802.11ac Wave 2 wall plate access point that you can manage with the Gateway Wireless Controller.
• Mobile VPN with SSL Client Update PromptsFeature DetailsThe Mobile VPN with SSL client now prompts a user to upgrade only if the user has administrator privileges on the computer.
• Office 365 Traffic and Full-Tunnel Mobile VPN with SSLFeature DetailsFor full-tunnel Mobile VPN with SSL configurations, you can enable the "sslvpn resource default-route-client" CLI command to ensure Office 365 traffic uses the VPN tunnel.

This release of Fireware includes these new and improved features:

• Support for WatchGuard Cloud System ActionsFeature DetailsWatchGuard Cloud now supports reboot, upgrade, backup, and restore system actions for Fireboxes that run Fireware v12.5.2.
• WebBlocker Server UpdatesFeature DetailsWebBlocker Server 1.1 is now available. This WebBlocker Server release includes minor updates and bug fixes.
• Support Access enhancementsFeature DetailsExternal IP addresses now appear in the Support Access user interface.

This release of Fireware includes these new and improved features:

• AP License EnforcementFeature DetailsBeginning with the Fireware v12.5.1 release, WatchGuard enforces licensing requirements for Basic Wi-Fi APs. Each WatchGuard AP managed by a Gateway Wireless Controller on a Firebox must be activated with a Basic Wi-Fi subscription.
• WebBlocker Warn message enhancementsFeature DetailsWhen a user clicks Continue to Site in a WebBlocker warning message, the message does not appear again for other websites until the user has been inactive for 15 minutes.
• WebBlocker Override enhancementsFeature DetailsWhen a user types a password or credentials in a Deny message to override WebBlocker, the override now applies to websites in all categories that have override enabled.

This release of Fireware includes these new and improved features:

• Reverse Proxy for the Access PortalFeature DetailsIn the Access Portal, you can now configure reverse proxy actions so remote users can connect to internal web applications and Microsoft Exchange services with an external URL.
• NetFlow egressFeature DetailsIn the NetFlow configuration, you can now select to monitor egress traffic for Firebox interfaces. NetFlow egress traffic now appears in the Firebox Configuration Report in Fireware Web UI.
• ECDSA certificates for BOVPN, BOVPN virtual interfaces, and Mobile VPN with IKEv2Feature DetailsYou can now specify ECDSA (EC) certificates for BOVPN, BOVPN virtual interfaces, and Mobile VPN with IKEv2. Mobile VPN with IKEv2 clients must support EC certificates; support varies by operating system.
• Maximum Transmission Unit (MTU) settingFeature DetailsFor BOVPN virtual interfaces, you can now specify a custom MTU setting. In Fireware v12.5, this option is available only in the CLI.
• WebBlocker Override enhancementsFeature DetailsYou can now enable WebBlocker Override for specific WebBlocker categories. You can also now allow members of a specific user group to type their credentials to override denied websites.
• Proxy Warn message customizationFeature DetailsYou can now customize the Warn message used for HTTP and Explicit proxy Warn actions.
• Support for Multiple RADIUS Servers and SecurID Configuration ChangesFeature DetailsYou can now configure multiple RADIUS servers. With this change, the ability to use SecurID is included in the RADIUS server configuration and is no longer a separate configuration.
• Support for policy-based Dynamic NAT and 1-to-1 NAT in Device Configuration templatesFeature DetailsIn a Fireware 12.0 Device Configuration template, you can configure policy-based Dynamic NAT and 1-to-1 NAT settings.

This release of Fireware includes these new and improved features:

• WatchGuard Cloud Device VisibilityFeature DetailsYou can add a Firebox to WatchGuard Cloud to enable cloud-based monitoring and reporting. Fireware v12.4 or higher is required to monitor a FireCluster from WatchGuard Cloud.
• SD-WAN action enhancementsFeature DetailsSD-WAN actions now support internal interfaces and multiple BOVPN virtual interfaces. Metric-based SD-WAN routing is also supported for these interfaces.
• SD-WAN reporting enhancementsFeature DetailsInternal interfaces and BOVPN virtual interfaces now appear on SD-WAN graphs.
• Link Monitor enhancementsFeature DetailsYou can now add internal interfaces and BOVPN virtual interfaces to Link Monitor. You can now monitor single WAN interfaces in Policy Manager.
• WebBlocker Warn actionFeature DetailsWebBlocker now includes a new Warn action that gives administrators more flexibility to enforce acceptable usage policies.
• Proxy support for TLS 1.3Feature DetailsHTTPS, SMTP, IMAP, and POP3 proxies now support TLS 1.3 protocol. Proxies no longer support the SSL v3 protocol.
• Geolocation Deny messageFeature DetailsA new Deny message now appears when Geolocation blocks access to a website. In previous releases, the connection would timeout.
• Proxy enhancements for DNSWatchFeature DetailsWhen a domain is in both the DNSWatch Blackholed Domain list and a denied WebBlocker category, the Blackhole Server page now appears instead of a WebBlocker Deny message.
• FQDN limit increaseFeature DetailsYou can now configure up to a total of 2048 Fully Qualified Domain Names (FQDNs) on some devices.
• Synchronize feature key enhancementsFeature DetailsIf Automatic Feature Key Synchronization is enabled, the Firebox now synchronizes the feature key after you restore a backup image or upgrade/downgrade Fireware OS
• Support for multiple syslog serversFeature DetailsThe Firebox can now send syslog messages to a maximum of three syslog servers.
• Device configuration template enhancementsFeature DetailsOn the WatchGuard Management Server, you can now configure global DNS settings, and QoS in policies. In WebBlocker actions you can now select the Warn action.
• Edit 1-to-1 NAT in Fireware WebUI Feature DetailsYou can now edit a 1-to-1 NAT mapping in Fireware WebUI.
• FireCluster diagnostics page enhancementsFeature DetailsAn enhanced FireCluster Diagnostics page shows you more details upfront with better organization.
• RADIUS support for IPv6 addresses and 64-Character Shared SecretFeature DetailsRADIUS now supports IPv6 addresses and 64-Character Shared Secrets.
• SecurID support for IPv6 addresses and 64-Character Shared SecretFeature DetailsSecurID now supports IPv6 addresses and 64-Character Shared Secrets.
• Improved status information about SSO componentsFeature DetailsYou can view the status of authentication requests with a configurable refresh rate: Pending IP list — Lists requests sent to SSO Agent that have not been processed Processing IP list — The request is in process with ELM, EM, SSO Client, or Active Directory Authentication Info Success — Information about currently authenticated users
• Access Portal RDP enhancementsFeature DetailsNew Automatic Display option improves the user experience. The connection will not disconnect when the user resizes the RDP display.
• Access Portal hides default Active Directory domains during log inFeature DetailsThe first domain in the Authentication Server list will be the default sign in domain for users. Users only need to type their username if they log in with the default domain. Users who log in with a different domain must type domain/username to authenticate.
• DNSWatch support for Fireboxes in Bridge ModeFeature DetailsDNSWatch on a Firebox in Bridge Mode has the same Usage Enforcement options as Mixed Routing Mode. The interface is listed as Global Bridge in the interfaces list.
• IPv6 support for BOVPNFeature DetailsYou can configure IPv6 BOVPN gateway endpoints.
• IPv6 support for BOVPN virtual interfacesFeature DetailsYou can now configure IPv6 BOVPN virtual interface gateway endpoints. 6in6 tunnel routes are now supported.

This release of Fireware includes these new and improved features:

• Geolocation actionsFeature DetailsThe Geolocation service now supports multiple actions so you can specify different geographical restrictions by policy.
• WebBlocker global exceptions listFeature DetailsWebBlocker has a new global exceptions list which eliminates the need to add the same exceptions to multiple WebBlocker actions.
• Export and import WebBlocker actionsFeature DetailsTo make it easier to use the same WebBlocker settings on different Fireboxes, you can now export and import WebBlocker actions in Policy Manager.
• STARTTLS support for the IMAP ProxyFeature DetailsThe IMAP proxy now supports STARTTLS, which enables IMAP clients to use the STARTTLS command to upgrade an IMAP connection to a secure channel and perform content inspection on the encrypted data.
• TCP-UDP proxy action redirection settingsFeature DetailsIn the TCP-UDP Proxy Action settings, you can now specify when idle TCP and UDP connections will timeout.
• IntelligentAV usability updatesFeature DetailsIntelligentAV is now a separate item in the Subscription Services menu.
• File Exceptions usability updatesFeature DetailsThe File Exceptions option has moved from the Subscription Services menu to a button in the APT Blocker, Gateway AV, Intelligent AV, and Data Loss Prevention services.
• New policy highlighting optionsFeature DetailsIn Policy Manager, the Policy Highlighting dialog box now includes options to highlight disabled, allow, and deny policies.
• USB backup enhancementsFeature DetailsIn the Web UI, Backup and Restore Image page, you can now back up and restore images from a connected USB drive. When you save a backup image to the USB drive, you can now choose whether to include the Fireware OS.
• SD-WAN actions Feature DetailsIf you have multiple WAN connections, you can use SD-WAN actions in policies to route traffic based on network performance metrics or the up/down status of the interface. SD-WAN replaces policy-based routing.
• SD-WAN reporting enhancementsFeature DetailsThe accuracy of SD-WAN reporting is improved. To calculate loss, latency, and jitter, the Firebox now uses the 100 most recent probe results from link monitor targets. To calculate jitter, the standard deviation is now used instead of the corrected standard deviation.
• Link Monitor enhancements Feature DetailsLink Monitor settings are now separate from multi-WAN settings. You can configure link monitor targets for an external interface regardless of whether multi-WAN is enabled. If multi-WAN is enabled, you can configure link monitor targets for an external interface that is not a multi-WAN member. You can now specify DNS targets.
• Tigerpaw IntegrationFeature DetailsYou can configure your Firebox to integrate with Tigerpaw, a professional services automation tool.
• NetFlow supportFeature DetailsYou can configure the Firebox as a NetFlow exporter.
• Active Directory configuration wizardFeature DetailsYou can now use a wizard to add a new Active Directory server to the Firebox.
• Mobile VPN with SSL configuration wizardFeature DetailsYou can now use a wizard to configure Mobile VPN with SSL.
• Centralized FireCluster diagnosticsFeature DetailsFireCluster diagnostic information is now centralized on one page for efficient troubleshooting.
• Two-factor authentication support for connections to Mobile VPN with SSL from native OpenVPN clientsFeature DetailsMobile VPN with SSL users who have OpenVPN clients can type a one-time password to connect to the Firebox.
• IPv6 support for Active Directory SSO Feature Details The Firebox, SSO Agent, SSO Client, and Event Log Monitor now support IPv6.
• SSO Agent enhancementsFeature DetailsIn the SSO Agent, you can now view the version number of the SSO Agent, and the version and build number of each SSO component.
• Manual failback for SD-WAN connectionsFeature DetailsIf you select No Failback or Gradual Failback in an SD-WAN action, you can select to manually fail back SD-WAN connections on the SD-WAN Status page (Web UI) or the SD-WAN tab (FSM).

This release of Fireware includes these new and improved features:

• Backup and restore enhancementsFeature DetailsBackup images are now saved on the Firebox and no longer include the Fireware OS. Use the new Backup and Restore Image page to see and manage the backup images stored on your Firebox.
• SafeSearch enforcement level for YouTubeFeature DetailsIn HTTP and Explicit proxy actions, you can now specify the level at which SafeSearch is enforced on YouTube - either Strict or Moderate.
• SMTP-proxy action updatesFeature DetailsIn SMTP-proxy actions, you can now select Deny when you configure Gateway AV actions and spamBlocker Virus Outbreak Detection actions.
• WebBlocker usability updatesFeature DetailsIn the WebBlocker Action dialog box, Categories tab, you can now use the Quick Action drop-down list to update multiple selected categories.
• Configure DF bit and PMTU options for BOVPN gateway endpointsFeature DetailsIn the gateway endpoint settings for BOVPN and BOVPN virtual interface configurations, you can now specify DF bit and PMTU settings.
• View loss, latency, and jitter data for WAN interfacesFeature DetailsView realtime and historical network performance data for WAN interfaces that are configured with link monitor targets.
• Specify a minimum passphrase length for Firebox Authentication (Firebox-DB) accountsFeature DetailsFor added security, you must now specify a minimum passphrase length for Firebox-DB accounts. This setting applies when you create a new account or change the passphrase for an existing account.
• Specify DNS, WINS, and domain name settings in the Mobile VPN with IPSec configurationFeature DetailsYou can now select to specify DNS, WINS, and domain name settings in the mobile VPN configuration or in the Network (global) DNS/WINS settings.
• Specify DNS and WINS settings in the Mobile VPN with IKEv2 configuration Feature DetailsYou can now select to specify DNS and WINS servers in the mobile VPN configuration or in the Network (global) DNS/WINS settings.
• Specify DNS settings in the Mobile VPN with L2TP configurationFeature DetailsYou can now select to specify DNS servers in the mobile VPN configuration or in the Network (global) DNS/WINS settings.
• DNS setting enhancements in the Mobile VPN with SSL configuration Feature DetailsYou can now select to specify DNS, WINS, and domain name settings in the mobile VPN configuration or in the Network (global) DNS/WINS settings.
• File exceptions statistics added to the Subscription Services dashboard Feature DetailsThe number of files allowed and dropped by the File Exceptions list are now shown in the Subscription Services Dashboard in Fireware Web UI and Firebox System Manager.
• Support for loopback interface IP addresses in static NAT actionsFeature DetailsYou can now specify the primary or secondary IP address of the loopback interface in a static NAT action.

This release of Fireware includes these new and improved features:

• TLS profiles for the SMTP proxyFeature DetailsThe SMTP proxy now supports TLS profiles for content inspection
• TLS profiles for the POP3 proxyFeature DetailsThe Pop3 proxy now supports TLS profiles for content inspection
• Firebox Cloud management by WatchGuard System ManagerFeature DetailsFirebox Cloud can now be managed by WatchGuard System Manager and WSM Management Server.
• Firebox Cloud new supported featuresFeature DetailsFirebox Cloud now supports Single Sign-On (SSO), spamBlocker, and Quarantine Server.
• IntelligentAVFeature DetailsIntelligentAV adds another layer of protection to the Gateway AV security service. When IntelligentAV is enabled, Gateway AV uses two scan engines to detect and block malware before it can enter your network.
• Configure File ExceptionsFeature DetailsYou can now add exceptions for files that you do not want to scan with APT Blocker, Data Loss Prevention, Gateway AntiVirus, and IntelligentAV security services.
• Restore Configuration from Fireware Web UIFeature DetailsYou can now restore a saved configuration file from the System > Configuration page in Fireware Web UI.
• Geolocation by PolicyFeature DetailsYou can now enable or disable Geolocation at the policy level.
• FQDN EnhancementsFeature DetailsFQDN support has been extended to provide greater granularity and flexibility, including wildcard support for multi-level subdomains, more than one FQDN can now resolve to the same IP address, you can use the same FQDN in more than one policy, and FQDN support for SNAT.
• Certificate Management EnhancementsFeature DetailsThis release includes several enhancements for certificate management on a Firebox, including improvements to the certificate list and certificate detail views, the ability to define a certificate display name​, and improvements to the certificate import process.
• Multiple Certificate Support for Inbound HTTPS ProxyFeature DetailsYou can now select and use separate certificates for content inspection for an inbound HTTPS proxy. This enables you to host several different public-facing web servers and applications behind one Firebox and allow different applications to use different certificates for inbound HTTPS traffic.
• Control of Firebox-Generated TrafficFeature DetailsConfigure policies that apply to traffic generated by the Firebox, such as subscription services traffic, Dimension log traffic, SSL management tunnel traffic, and BOVPN over TLS tunnel traffic.
• Loopback interface IP address support for dynamic NATFeature DetailsYou can now specify loopback IP addresses for global dynamic NAT (DNAT) and per-policy dynamic NAT.
• Support for AES-GCM Feature DetailsAES-GCM is now supported for BOVPN, BOVPN virtual interfaces, BOVPN over TLS, Mobile VPN with IKEv2, and Mobile VPN with SSL. GCM (Galois/Counter Mode) is an authenticated encryption algorithm known for its security, efficiency, and performance.
• Support for Secondary Interface IP Addresses for BOVPN and BOVPN Virtual Interfaces Feature DetailsWhen you configure a gateway endpoint in a BOVPN or BOVPN virtual interface configuration, you can now specify a secondary interface IP address.
• Support for Multiple SSO AgentsFeature DetailsYou can now configure up to four SSO Agents on your Firebox for redundancy. If an SSO Agent is not available, failover automatically occurs to the next SSO Agent specified in the Firebox configuration.
• SSO Agent Connection Status Tool Feature DetailsIn the SSO Agent, a new tool shows the connection status for SSO components on your network.
• FQDN Support for Static NAT (SNAT)Feature DetailsYou can now specify an FQDN in a static NAT (SNAT) action to help make policy management easier and to avoid downtime from IP address changes.
• Enhancements to Settings Shared by the Access Portal and Mobile VPN with SSLFeature DetailsFor a better user experience, VPN Portal settings moved to the Access Portal and Mobile VPN with SSL configurations.
• Enhancements to the WatchGuard SSLVPN PolicyFeature DetailsThe WatchGuard SSLVPN policy no longer includes the WG-VPN-Portal alias. Interfaces that appeared in the WG-VPN-Portal alias appear in the WatchGuard SSLVPN policy, which means the policy matches the same traffic.

This release of Fireware includes these new and improved features:

• DNSWatch   Feature DetailsDNSWatch is a cloud-based security service that monitors DNS requests through the Firebox to prevent connections to known malicious domains.
• TLS Profiles for HTTPS Content Inspection   Feature DetailsTLS Profiles are now used to configure content inspection settings for the HTTPS proxy.
• Multiple Dynamic DNS providers   Feature DetailsFireware now supports multiple dynamic DNS vendors.
• BOVPN over TLS Support in Policy Manager   Feature DetailsBOVPN over TLS is now supported in Policy Manager. This feature was first supported in Fireware Web UI in Fireware v12.1.
• Hot Plug Support for Modems   Feature DetailsYou can now hot plug USB modems into the Firebox. A reboot of the Firebox is not required.
• USB Modem Support   Feature DetailsFireware now supports the Verizon Global modem USB730L (Vendor ID 0x1410, Product ID 0x9032).
• Different Default Gateway for DHCP Server   Feature DetailsFor a Firebox interface configured as a DHCP server, you can now specify a default gateway IP address that is not the Firebox interface IP address.
• Firewall Policies for Intra-LAN Traffic   Feature DetailsWhen you create a new external VLAN interface, the option to apply firewall policies to intra-VLAN traffic option is now enabled by default.
• Per-Interface DHCP Relay   Feature DetailsWhen you enable DHCP Relay on an interface, the DHCP relay servers you specify now apply only to that interface.
• Disconnect wireless client from the Wireless Statistics page    Feature DetailsYou can now disconnect a wireless client from the Firebox from the Wireless Statistics page.
• WEP encryption is not supported for Open System and Shared Key wireless authentication  Feature DetailsYou can no longer save a configuration with WEP encryption enabled.

This release of Fireware includes these new and improved features:

• Access Portal   Feature DetailsAccess Portal is a new feature that connects users to web applications, RDP sessions, and SSH sessions within a web browser. SAML single sign-on is supported.
• Mobile VPN with IKEv2   Feature DetailsMobile VPN with IKEv2 is a new feature that supports VPN connections from native IKEV2 clients on Windows, Mac OS, and iOS. Android devices are supported with the third-party strongSwan app.
• BOVPN over TLS   Feature DetailsConfigure the new BOVPN over TLS feature to create VPN tunnels that use TLS for secure communication between Fireboxes.
• IPv4 Wildcard Addresses in Aliases in Device Configuration Templates   Feature DetailsWhen you add an alias, you can specify a Host IPv4, Wildcard IPv4, Network IPv4, Host Range IPv4, Host IPv6, Network IPv6, Host Range IPv6, or Host Name (DNS lookup), or import a list of FQDN addresses.
• Modem Interfaces   Feature DetailsWhen you add a modem to your Firebox, it is configured as a dedicated external interface that can participate in multi-WAN.
• Wildcard IP Addresses    Feature DetailsSpecify wildcard IPv4 addresses in aliases and policies.
• Minimum Association RSSI, Smart Steering, and Band Steering    Feature DetailsAP120, AP300, AP320, AP322, and AP420 now support minimum association RSSI and smart steering on the Gateway Wireless Controller. Formerly known as Fast Handover, these options are now configured for each SSID with advanced steering parameters configured in the AP settings. Band Steering parameters are also now configured per SSID.
• Import and Export Alias Members from a Text File    Feature DetailsYou can import a list of alias members from a text file. You can also export a list of alias members to a text file. These options were only available in the Web UI in Fireware v12.0.1. In Fireware v12.1, these options are now also available in Policy Manager.
• Multi-WAN Link Monitor Enhancements   Feature DetailsYou can now disable link monitor for any interface. When you add a new interface, link monitor is enabled by default for all interfaces except modem interfaces.

This release of Dimension includes these new and improved features:

• Logging Authentication Key  Feature DetailsThe Logging Encryption Key has been renamed to Logging Authentication Key to align with the same change in Fireware.
• Email Encryption Allowed by Default    Feature DetailsThe email encryption option is now set to Allowed by default.

This release of Fireware includes these new and improved features:

• Support Access  Feature DetailsYou can now enable Support Access to create a temporary read-only account and enable connections to your Firebox from WatchGuard Support.
• Policy Manager save a configuration for a specific Fireware version  Feature DetailsIn Policy Manager you can now save a configuration for a specific version of Fireware. This is most useful for RapidDeploy.
• Gateway AV Scan Size Limit defaults updated   Feature DetailsThe default and maximum scan size limits changed in Fireware v12.0.1. Gateway AntiVirus default and maximum scan size limits are set based on the hardware capabilities of each Firebox model.
• Gateway AV actions updated in proxy action settings   Feature DetailsThe Gateway AV proxy action settings now include an Enable Gateway AV check box that automatically changes all Allow actions in the proxy action to AV Scan. You can also now configure the action to take when a file cannot be scanned because it is encrypted or exceeds the scan limit.
• Gateway AV decompression is always enabled  Feature DetailsGateway AntiVirus file decompression is always enabled, and there are no configurable settings. The number of levels to scan depends on the Firebox model.
• Setup wizards default configuration settings updates  Feature DetailsIn the Default-HTTP-Client proxy action, the action for the Windows EXE/DLL Body Content Rule is set to AV Scan instead of Deny. The APT Blocker action for High level threats is set to Drop instead of Block. The action for IPS Low level threats is set to Drop instead of Allow.
• YouTube for Schools settings removed from the HTTP proxy    Feature DetailsThe YouTube for Schools option has been removed from the General Settings in the HTTP proxy action configuration. YouTube for schools is no longer supported by Google.
• KRACK WPA/WPA2 wireless vulnerability mitigation   Feature DetailsMitigate KRACK WPA/WPA2 vulnerabilities by blocking handshake messages that can potentially exploit clients and force clients to reauthenticate.
• Integration support for Autotask    Feature DetailsYou can configure your Firebox to integrate with Autotask, a professional services automation tool.
• Import and export a list of alias members from a text file    Feature DetailsYou can import a list of alias members from a text file with Fireware Web UI. You can also export a list of alias members from Fireware Web UI to a text file. These options are not available in Policy Manager in Fireware v12.0.1.

This release of Fireware includes these new and improved features:

• Content Actions for HTTP Host Header Redirection   Feature DetailsYou can now use a content action in an HTTP server proxy policy or HTTPS server proxy action to redirect inbound HTTP requests based on the domain and path in the host header. This feature includes an option for TLS/SSL offloading for inspected HTTPS content.
• Routing Actions in HTTPS Server Proxy Actions   Feature DetailsIn the domain name rules for an HTTPS server proxy action you can now specify a routing action to route inbound HTTPS requests to a specific server IP address and port based on a domain name match.
• IMAP Proxy   Feature DetailsFireware now supports an IMAP proxy. This does not include support for encrypted IMAP over TLS/SSL.
• APT Blocker Zero Day Protection in the SMTP Proxy   Feature DetailsWhen APT Blocker is enabled in the SMTP proxy, the SMTP proxy does not deliver the message until the file has been analyzed for APT threats. The same behavior applies to APT Blocker in the new IMAP proxy.
• Gateway AV Signatures   Feature DetailsGateway AV now uses updated signatures for improved virus detection and better performance.
• APT Blocker Scanning of JavaScript Email Attachments   Feature DetailsAPT Blocker can now scan JavaScript (.js) files attached to email messages.
• Mobile VPN with PPTP Feature Removed  Feature DetailsMobile VPN with PPTP is now not available with Fireware OS. PPTP is an older VPN protocol that is not considered secure.
• Updated Default BOVPN and BOVPN Virtual Interface Security Settings   Feature DetailsNew BOVPN, BOVPN virtual interface, and Mobile VPN connections created in Fireware v12.0 have stronger default authentication and encryption settings.
• Updated Default Mobile VPN Security Settings   Feature DetailsNew BOVPN, BOVPN virtual interface, and Mobile VPN connections created in Fireware v12.0 have stronger default authentication and encryption settings.
• Removed Obsolete Security Settings from Mobile VPN with SSL  Feature DetailsThree obsolete security settings were removed from Mobile VPN with SSL: Blowfish, DES, and MD5.
• Updated Mobile VPN with SSL Status Icons Feature DetailsThe connection status icons for Mobile VPN with SSL that appear in your Windows system tray or Mac OS X menu bar were redesigned. The new icons are easier to see and understand.
• Renamed Authentication Exceptions list in the Hotspot Settings    Feature DetailsThe Authentication Exceptions list in the Hotspot settings is now called Walled Garden.
• Wireless Rate Shaping Enhancements   Feature DetailsYou can now configure separate upload and download rate limits per SSID and per user in an SSID configuration.
• ConnectWise Default Service Ticket Priority   Feature DetailsYou can now configure the default ticket priority for service tickets generated by a Firebox defined in ConnectWise.
• Multicast Routing   Feature DetailsFireware now includes support for multicast routing, a networking method for efficient distribution of one-to-many traffic.