What's New in Fireware

This release of Fireware includes these new and improved features:

• Reverse Proxy for the Access PortalFeature DetailsIn the Access Portal, you can now configure reverse proxy actions so remote users can connect to internal web applications and Microsoft Exchange services with an external URL.
• NetFlow egressFeature DetailsIn the NetFlow configuration, you can now select to monitor egress traffic for Firebox interfaces. NetFlow egress traffic now appears in the Firebox Configuration Report in Fireware Web UI.
• ECDSA certificates for BOVPN, BOVPN virtual interfaces, and Mobile VPN with IKEv2Feature DetailsYou can now specify ECDSA (EC) certificates for BOVPN, BOVPN virtual interfaces, and Mobile VPN with IKEv2. Mobile VPN with IKEv2 clients must support EC certificates; support varies by operating system.
• Maximum Transmission Unit (MTU) settingFeature DetailsFor BOVPN virtual interfaces, you can now specify a custom MTU setting. In Fireware v12.5, this option is available only in the CLI.
• WebBlocker Override enhancementsFeature DetailsYou can now enable WebBlocker Override for specific WebBlocker categories. You can also now allow members of a specific user group to type their credentials to override denied websites.
• Proxy Warn message customizationFeature DetailsYou can now customize the Warn message used for HTTP and Explicit proxy Warn actions.
• Support for Multiple RADIUS Servers and SecurID Configuration ChangesFeature DetailsYou can now configure multiple RADIUS servers. With this change, the ability to use SecurID is included in the RADIUS server configuration and is no longer a separate configuration.
• Support for policy-based Dynamic NAT and 1-to-1 NAT in Device Configuration templatesFeature DetailsIn a Fireware 12.0 Device Configuration template, you can configure policy-based Dynamic NAT and 1-to-1 NAT settings.

This release of Fireware includes these new and improved features:

• WatchGuard Cloud Device VisibilityFeature DetailsYou can add a Firebox to WatchGuard Cloud to enable cloud-based monitoring and reporting. Fireware v12.4 or higher is required to monitor a FireCluster from WatchGuard Cloud.
• SD-WAN action enhancementsFeature DetailsSD-WAN actions now support internal interfaces and multiple BOVPN virtual interfaces. Metric-based SD-WAN routing is also supported for these interfaces.
• SD-WAN reporting enhancementsFeature DetailsInternal interfaces and BOVPN virtual interfaces now appear on SD-WAN graphs.
• Link Monitor enhancementsFeature DetailsYou can now add internal interfaces and BOVPN virtual interfaces to Link Monitor. You can now monitor single WAN interfaces in Policy Manager.
• WebBlocker Warn actionFeature DetailsWebBlocker now includes a new Warn action that gives administrators more flexibility to enforce acceptable usage policies.
• Proxy support for TLS 1.3Feature DetailsHTTPS, SMTP, IMAP, and POP3 proxies now support TLS 1.3 protocol. Proxies no longer support the SSL v3 protocol.
• Geolocation Deny messageFeature DetailsA new Deny message now appears when Geolocation blocks access to a website. In previous releases, the connection would timeout.
• Proxy enhancements for DNSWatchFeature DetailsWhen a domain is in both the DNSWatch Blackholed Domain list and a denied WebBlocker category, the Blackhole Server page now appears instead of a WebBlocker Deny message.
• FQDN limit increaseFeature DetailsYou can now configure up to a total of 2048 Fully Qualified Domain Names (FQDNs) on some devices.
• Synchronize feature key enhancementsFeature DetailsIf Automatic Feature Key Synchronization is enabled, the Firebox now synchronizes the feature key after you restore a backup image or upgrade/downgrade Fireware OS
• Support for multiple syslog serversFeature DetailsThe Firebox can now send syslog messages to a maximum of three syslog servers.
• Device configuration template enhancementsFeature DetailsOn the WatchGuard Management Server, you can now configure global DNS settings, and QoS in policies. In WebBlocker actions you can now select the Warn action.
• Edit 1-to-1 NAT in Fireware WebUI Feature DetailsYou can now edit a 1-to-1 NAT mapping in Fireware WebUI.
• FireCluster diagnostics page enhancementsFeature DetailsAn enhanced FireCluster Diagnostics page shows you more details upfront with better organization.
• RADIUS support for IPv6 addresses and 64-Character Shared SecretFeature DetailsRADIUS now supports IPv6 addresses and 64-Character Shared Secrets.
• SecurID support for IPv6 addresses and 64-Character Shared SecretFeature DetailsSecurID now supports IPv6 addresses and 64-Character Shared Secrets.
• Improved status information about SSO componentsFeature DetailsYou can view the status of authentication requests with a configurable refresh rate: Pending IP list — Lists requests sent to SSO Agent that have not been processed Processing IP list — The request is in process with ELM, EM, SSO Client, or Active Directory Authentication Info Success — Information about currently authenticated users
• Access Portal RDP enhancementsFeature DetailsNew Automatic Display option improves the user experience. The connection will not disconnect when the user resizes the RDP display.
• Access Portal hides default Active Directory domains during log inFeature DetailsThe first domain in the Authentication Server list will be the default sign in domain for users. Users only need to type their username if they log in with the default domain. Users who log in with a different domain must type domain/username to authenticate.
• DNSWatch support for Fireboxes in Bridge ModeFeature DetailsDNSWatch on a Firebox in Bridge Mode has the same Usage Enforcement options as Mixed Routing Mode. The interface is listed as Global Bridge in the interfaces list.
• IPv6 support for BOVPNFeature DetailsYou can configure IPv6 BOVPN gateway endpoints.
• IPv6 support for BOVPN virtual interfacesFeature DetailsYou can now configure IPv6 BOVPN virtual interface gateway endpoints. 6in6 tunnel routes are now supported.

This release of Fireware includes these new and improved features:

• Geolocation actionsFeature DetailsThe Geolocation service now supports multiple actions so you can specify different geographical restrictions by policy.
• WebBlocker global exceptions listFeature DetailsWebBlocker has a new global exceptions list which eliminates the need to add the same exceptions to multiple WebBlocker actions.
• Export and import WebBlocker actionsFeature DetailsTo make it easier to use the same WebBlocker settings on different Fireboxes, you can now export and import WebBlocker actions in Policy Manager.
• STARTTLS support for the IMAP ProxyFeature DetailsThe IMAP proxy now supports STARTTLS, which enables IMAP clients to use the STARTTLS command to upgrade an IMAP connection to a secure channel and perform content inspection on the encrypted data.
• TCP-UDP proxy action redirection settingsFeature DetailsIn the TCP-UDP Proxy Action settings, you can now specify when idle TCP and UDP connections will timeout.
• IntelligentAV usability updatesFeature DetailsIntelligentAV is now a separate item in the Subscription Services menu.
• File Exceptions usability updatesFeature DetailsThe File Exceptions option has moved from the Subscription Services menu to a button in the APT Blocker, Gateway AV, Intelligent AV, and Data Loss Prevention services.
• New policy highlighting optionsFeature DetailsIn Policy Manager, the Policy Highlighting dialog box now includes options to highlight disabled, allow, and deny policies.
• USB backup enhancementsFeature DetailsIn the Web UI, Backup and Restore Image page, you can now back up and restore images from a connected USB drive. When you save a backup image to the USB drive, you can now choose whether to include the Fireware OS.
• SD-WAN actions Feature DetailsIf you have multiple WAN connections, you can use SD-WAN actions in policies to route traffic based on network performance metrics or the up/down status of the interface. SD-WAN replaces policy-based routing.
• SD-WAN reporting enhancementsFeature DetailsThe accuracy of SD-WAN reporting is improved. To calculate loss, latency, and jitter, the Firebox now uses the 100 most recent probe results from link monitor targets. To calculate jitter, the standard deviation is now used instead of the corrected standard deviation.
• Link Monitor enhancements Feature DetailsLink Monitor settings are now separate from multi-WAN settings. You can configure link monitor targets for an external interface regardless of whether multi-WAN is enabled. If multi-WAN is enabled, you can configure link monitor targets for an external interface that is not a multi-WAN member. You can now specify DNS targets.
• Tigerpaw IntegrationFeature DetailsYou can configure your Firebox to integrate with Tigerpaw, a professional services automation tool.
• NetFlow supportFeature DetailsYou can configure the Firebox as a NetFlow exporter.
• Active Directory configuration wizardFeature DetailsYou can now use a wizard to add a new Active Directory server to the Firebox.
• Mobile VPN with SSL configuration wizardFeature DetailsYou can now use a wizard to configure Mobile VPN with SSL.
• Centralized FireCluster diagnosticsFeature DetailsFireCluster diagnostic information is now centralized on one page for efficient troubleshooting.
• Two-factor authentication support for connections to Mobile VPN with SSL from native OpenVPN clientsFeature DetailsMobile VPN with SSL users who have OpenVPN clients can type a one-time password to connect to the Firebox.
• IPv6 support for Active Directory SSO Feature Details The Firebox, SSO Agent, SSO Client, and Event Log Monitor now support IPv6.
• SSO Agent enhancementsFeature DetailsIn the SSO Agent, you can now view the version number of the SSO Agent, and the version and build number of each SSO component.
• Manual failback for SD-WAN connectionsFeature DetailsIf you select No Failback or Gradual Failback in an SD-WAN action, you can select to manually fail back SD-WAN connections on the SD-WAN Status page (Web UI) or the SD-WAN tab (FSM).

This release of Fireware includes these new and improved features:

• Backup and restore enhancementsFeature DetailsBackup images are now saved on the Firebox and no longer include the Fireware OS. Use the new Backup and Restore Image page to see and manage the backup images stored on your Firebox.
• SafeSearch enforcement level for YouTubeFeature DetailsIn HTTP and Explicit proxy actions, you can now specify the level at which SafeSearch is enforced on YouTube - either Strict or Moderate.
• SMTP-proxy action updatesFeature DetailsIn SMTP-proxy actions, you can now select Deny when you configure Gateway AV actions and spamBlocker Virus Outbreak Detection actions.
• WebBlocker usability updatesFeature DetailsIn the WebBlocker Action dialog box, Categories tab, you can now use the Quick Action drop-down list to update multiple selected categories.
• Configure DF bit and PMTU options for BOVPN gateway endpointsFeature DetailsIn the gateway endpoint settings for BOVPN and BOVPN virtual interface configurations, you can now specify DF bit and PMTU settings.
• View loss, latency, and jitter data for WAN interfacesFeature DetailsView realtime and historical network performance data for WAN interfaces that are configured with link monitor targets.
• Specify a minimum passphrase length for Firebox Authentication (Firebox-DB) accountsFeature DetailsFor added security, you must now specify a minimum passphrase length for Firebox-DB accounts. This setting applies when you create a new account or change the passphrase for an existing account.
• Specify DNS, WINS, and domain name settings in the Mobile VPN with IPSec configurationFeature DetailsYou can now select to specify DNS, WINS, and domain name settings in the mobile VPN configuration or in the Network (global) DNS/WINS settings.
• Specify DNS and WINS settings in the Mobile VPN with IKEv2 configuration Feature DetailsYou can now select to specify DNS and WINS servers in the mobile VPN configuration or in the Network (global) DNS/WINS settings.
• Specify DNS settings in the Mobile VPN with L2TP configurationFeature DetailsYou can now select to specify DNS servers in the mobile VPN configuration or in the Network (global) DNS/WINS settings.
• DNS setting enhancements in the Mobile VPN with SSL configuration Feature DetailsYou can now select to specify DNS, WINS, and domain name settings in the mobile VPN configuration or in the Network (global) DNS/WINS settings.
• File exceptions statistics added to the Subscription Services dashboard Feature DetailsThe number of files allowed and dropped by the File Exceptions list are now shown in the Subscription Services Dashboard in Fireware Web UI and Firebox System Manager.
• Support for loopback interface IP addresses in static NAT actionsFeature DetailsYou can now specify the primary or secondary IP address of the loopback interface in a static NAT action.

This release of Fireware includes these new and improved features:

• TLS profiles for the SMTP proxyFeature DetailsThe SMTP proxy now supports TLS profiles for content inspection
• TLS profiles for the POP3 proxyFeature DetailsThe Pop3 proxy now supports TLS profiles for content inspection
• Firebox Cloud management by WatchGuard System ManagerFeature DetailsFirebox Cloud can now be managed by WatchGuard System Manager and WSM Management Server.
• Firebox Cloud new supported featuresFeature DetailsFirebox Cloud now supports Single Sign-On (SSO), spamBlocker, and Quarantine Server.
• IntelligentAVFeature DetailsIntelligentAV adds another layer of protection to the Gateway AV security service. When IntelligentAV is enabled, Gateway AV uses two scan engines to detect and block malware before it can enter your network.
• Configure File ExceptionsFeature DetailsYou can now add exceptions for files that you do not want to scan with APT Blocker, Data Loss Prevention, Gateway AntiVirus, and IntelligentAV security services.
• Restore Configuration from Fireware Web UIFeature DetailsYou can now restore a saved configuration file from the System > Configuration page in Fireware Web UI.
• Geolocation by PolicyFeature DetailsYou can now enable or disable Geolocation at the policy level.
• FQDN EnhancementsFeature DetailsFQDN support has been extended to provide greater granularity and flexibility, including wildcard support for multi-level subdomains, more than one FQDN can now resolve to the same IP address, you can use the same FQDN in more than one policy, and FQDN support for SNAT.
• Certificate Management EnhancementsFeature DetailsThis release includes several enhancements for certificate management on a Firebox, including improvements to the certificate list and certificate detail views, the ability to define a certificate display name​, and improvements to the certificate import process.
• Multiple Certificate Support for Inbound HTTPS ProxyFeature DetailsYou can now select and use separate certificates for content inspection for an inbound HTTPS proxy. This enables you to host several different public-facing web servers and applications behind one Firebox and allow different applications to use different certificates for inbound HTTPS traffic.
• Control of Firebox-Generated TrafficFeature DetailsConfigure policies that apply to traffic generated by the Firebox, such as subscription services traffic, Dimension log traffic, SSL management tunnel traffic, and BOVPN over TLS tunnel traffic.
• Loopback interface IP address support for dynamic NATFeature DetailsYou can now specify loopback IP addresses for global dynamic NAT (DNAT) and per-policy dynamic NAT.
• Support for AES-GCM Feature DetailsAES-GCM is now supported for BOVPN, BOVPN virtual interfaces, BOVPN over TLS, Mobile VPN with IKEv2, and Mobile VPN with SSL. GCM (Galois/Counter Mode) is an authenticated encryption algorithm known for its security, efficiency, and performance.
• Support for Secondary Interface IP Addresses for BOVPN and BOVPN Virtual Interfaces Feature DetailsWhen you configure a gateway endpoint in a BOVPN or BOVPN virtual interface configuration, you can now specify a secondary interface IP address.
• Support for Multiple SSO AgentsFeature DetailsYou can now configure up to four SSO Agents on your Firebox for redundancy. If an SSO Agent is not available, failover automatically occurs to the next SSO Agent specified in the Firebox configuration.
• SSO Agent Connection Status Tool Feature DetailsIn the SSO Agent, a new tool shows the connection status for SSO components on your network.
• FQDN Support for Static NAT (SNAT)Feature DetailsYou can now specify an FQDN in a static NAT (SNAT) action to help make policy management easier and to avoid downtime from IP address changes.
• Enhancements to Settings Shared by the Access Portal and Mobile VPN with SSLFeature DetailsFor a better user experience, VPN Portal settings moved to the Access Portal and Mobile VPN with SSL configurations.
• Enhancements to the WatchGuard SSLVPN PolicyFeature DetailsThe WatchGuard SSLVPN policy no longer includes the WG-VPN-Portal alias. Interfaces that appeared in the WG-VPN-Portal alias appear in the WatchGuard SSLVPN policy, which means the policy matches the same traffic.

This release of Fireware includes these new and improved features:

• DNSWatch   Feature DetailsDNSWatch is a cloud-based security service that monitors DNS requests through the Firebox to prevent connections to known malicious domains.
• TLS Profiles for HTTPS Content Inspection   Feature DetailsTLS Profiles are now used to configure content inspection settings for the HTTPS proxy.
• Multiple Dynamic DNS providers   Feature DetailsFireware now supports multiple dynamic DNS vendors.
• BOVPN over TLS Support in Policy Manager   Feature DetailsBOVPN over TLS is now supported in Policy Manager. This feature was first supported in Fireware Web UI in Fireware v12.1.
• Hot Plug Support for Modems   Feature DetailsYou can now hot plug USB modems into the Firebox. A reboot of the Firebox is not required.
• USB Modem Support   Feature DetailsFireware now supports the Verizon Global modem USB730L (Vendor ID 0x1410, Product ID 0x9032).
• Different Default Gateway for DHCP Server   Feature DetailsFor a Firebox interface configured as a DHCP server, you can now specify a default gateway IP address that is not the Firebox interface IP address.
• Firewall Policies for Intra-LAN Traffic   Feature DetailsWhen you create a new external VLAN interface, the option to apply firewall policies to intra-VLAN traffic option is now enabled by default.
• Per-Interface DHCP Relay   Feature DetailsWhen you enable DHCP Relay on an interface, the DHCP relay servers you specify now apply only to that interface.
• Disconnect wireless client from the Wireless Statistics page    Feature DetailsYou can now disconnect a wireless client from the Firebox from the Wireless Statistics page.
• WEP encryption is not supported for Open System and Shared Key wireless authentication  Feature DetailsYou can no longer save a configuration with WEP encryption enabled.

This release of Fireware includes these new and improved features:

• Access Portal   Feature DetailsAccess Portal is a new feature that connects users to web applications, RDP sessions, and SSH sessions within a web browser. SAML single sign-on is supported.
• Mobile VPN with IKEv2   Feature DetailsMobile VPN with IKEv2 is a new feature that supports VPN connections from native IKEV2 clients on Windows, Mac OS, and iOS. Android devices are supported with the third-party strongSwan app.
• BOVPN over TLS   Feature DetailsConfigure the new BOVPN over TLS feature to create VPN tunnels that use TLS for secure communication between Fireboxes.
• IPv4 Wildcard Addresses in Aliases in Device Configuration Templates   Feature DetailsWhen you add an alias, you can specify a Host IPv4, Wildcard IPv4, Network IPv4, Host Range IPv4, Host IPv6, Network IPv6, Host Range IPv6, or Host Name (DNS lookup), or import a list of FQDN addresses.
• Modem Interfaces   Feature DetailsWhen you add a modem to your Firebox, it is configured as a dedicated external interface that can participate in multi-WAN.
• Wildcard IP Addresses    Feature DetailsSpecify wildcard IPv4 addresses in aliases and policies.
• Minimum Association RSSI, Smart Steering, and Band Steering    Feature DetailsAP120, AP300, AP320, AP322, and AP420 now support minimum association RSSI and smart steering on the Gateway Wireless Controller. Formerly known as Fast Handover, these options are now configured for each SSID with advanced steering parameters configured in the AP settings. Band Steering parameters are also now configured per SSID.
• Import and Export Alias Members from a Text File    Feature DetailsYou can import a list of alias members from a text file. You can also export a list of alias members to a text file. These options were only available in the Web UI in Fireware v12.0.1. In Fireware v12.1, these options are now also available in Policy Manager.
• Multi-WAN Link Monitor Enhancements   Feature DetailsYou can now disable link monitor for any interface. When you add a new interface, link monitor is enabled by default for all interfaces except modem interfaces.

This release of Dimension includes these new and improved features:

• Logging Authentication Key  Feature DetailsThe Logging Encryption Key has been renamed to Logging Authentication Key to align with the same change in Fireware.
• Email Encryption Allowed by Default    Feature DetailsThe email encryption option is now set to Allowed by default.

This release of Fireware includes these new and improved features:

• Support Access  Feature DetailsYou can now enable Support Access to create a temporary read-only account and enable connections to your Firebox from WatchGuard Support.
• Policy Manager save a configuration for a specific Fireware version  Feature DetailsIn Policy Manager you can now save a configuration for a specific version of Fireware. This is most useful for RapidDeploy.
• Gateway AV Scan Size Limit defaults updated   Feature DetailsThe default and maximum scan size limits changed in Fireware v12.0.1. Gateway AntiVirus default and maximum scan size limits are set based on the hardware capabilities of each Firebox model.
• Gateway AV actions updated in proxy action settings   Feature DetailsThe Gateway AV proxy action settings now include an Enable Gateway AV check box that automatically changes all Allow actions in the proxy action to AV Scan. You can also now configure the action to take when a file cannot be scanned because it is encrypted or exceeds the scan limit.
• Gateway AV decompression is always enabled  Feature DetailsGateway AntiVirus file decompression is always enabled, and there are no configurable settings. The number of levels to scan depends on the Firebox model.
• Setup wizards default configuration settings updates  Feature DetailsIn the Default-HTTP-Client proxy action, the action for the Windows EXE/DLL Body Content Rule is set to AV Scan instead of Deny. The APT Blocker action for High level threats is set to Drop instead of Block. The action for IPS Low level threats is set to Drop instead of Allow.
• YouTube for Schools settings removed from the HTTP proxy    Feature DetailsThe YouTube for Schools option has been removed from the General Settings in the HTTP proxy action configuration. YouTube for schools is no longer supported by Google.
• KRACK WPA/WPA2 wireless vulnerability mitigation   Feature DetailsMitigate KRACK WPA/WPA2 vulnerabilities by blocking handshake messages that can potentially exploit clients and force clients to reauthenticate.
• Integration support for Autotask    Feature DetailsYou can configure your Firebox to integrate with Autotask, a professional services automation tool.
• Import and export a list of alias members from a text file    Feature DetailsYou can import a list of alias members from a text file with Fireware Web UI. You can also export a list of alias members from Fireware Web UI to a text file. These options are not available in Policy Manager in Fireware v12.0.1.

This release of Fireware includes these new and improved features:

• Content Actions for HTTP Host Header Redirection   Feature DetailsYou can now use a content action in an HTTP server proxy policy or HTTPS server proxy action to redirect inbound HTTP requests based on the domain and path in the host header. This feature includes an option for TLS/SSL offloading for inspected HTTPS content.
• Routing Actions in HTTPS Server Proxy Actions   Feature DetailsIn the domain name rules for an HTTPS server proxy action you can now specify a routing action to route inbound HTTPS requests to a specific server IP address and port based on a domain name match.
• IMAP Proxy   Feature DetailsFireware now supports an IMAP proxy. This does not include support for encrypted IMAP over TLS/SSL.
• APT Blocker Zero Day Protection in the SMTP Proxy   Feature DetailsWhen APT Blocker is enabled in the SMTP proxy, the SMTP proxy does not deliver the message until the file has been analyzed for APT threats. The same behavior applies to APT Blocker in the new IMAP proxy.
• Gateway AV Signatures   Feature DetailsGateway AV now uses updated signatures for improved virus detection and better performance.
• APT Blocker Scanning of JavaScript Email Attachments   Feature DetailsAPT Blocker can now scan JavaScript (.js) files attached to email messages.
• Mobile VPN with PPTP Feature Removed  Feature DetailsMobile VPN with PPTP is now not available with Fireware OS. PPTP is an older VPN protocol that is not considered secure.
• Updated Default BOVPN and BOVPN Virtual Interface Security Settings   Feature DetailsNew BOVPN, BOVPN virtual interface, and Mobile VPN connections created in Fireware v12.0 have stronger default authentication and encryption settings.
• Updated Default Mobile VPN Security Settings   Feature DetailsNew BOVPN, BOVPN virtual interface, and Mobile VPN connections created in Fireware v12.0 have stronger default authentication and encryption settings.
• Removed Obsolete Security Settings from Mobile VPN with SSL  Feature DetailsThree obsolete security settings were removed from Mobile VPN with SSL: Blowfish, DES, and MD5.
• Updated Mobile VPN with SSL Status Icons Feature DetailsThe connection status icons for Mobile VPN with SSL that appear in your Windows system tray or Mac OS X menu bar were redesigned. The new icons are easier to see and understand.
• Renamed Authentication Exceptions list in the Hotspot Settings    Feature DetailsThe Authentication Exceptions list in the Hotspot settings is now called Walled Garden.
• Wireless Rate Shaping Enhancements   Feature DetailsYou can now configure separate upload and download rate limits per SSID and per user in an SSID configuration.
• ConnectWise Default Service Ticket Priority   Feature DetailsYou can now configure the default ticket priority for service tickets generated by a Firebox defined in ConnectWise.
• Multicast Routing   Feature DetailsFireware now includes support for multicast routing, a networking method for efficient distribution of one-to-many traffic.