Configure Link Monitoring for a Cloud-Managed Firebox

Applies To: Cloud-managed Fireboxes

This document applies to Fireboxes you manage in WatchGuard Cloud. For information that applies to Fireboxes managed in Fireware Web UI or WatchGuard System Manager, go to Configure Link Monitor.

Overview

Some of the features described in this topic are available only to participants in the WatchGuard Cloud Beta program. If a feature described in this topic is not available in your version of WatchGuard Cloud, it is a beta-only feature.

To monitor the status of network connectivity from a cloud-managed Firebox, we recommend that you enable link monitoring. In the Link Monitoring settings for a network, you configure link monitoring targets, which are remote hosts beyond your network perimeter. The Firebox probes these targets to determine whether the interface is active or inactive. You can configure up to three targets for a network. Link monitoring is disabled by default.

You can configure link monitoring settings for a network in an individual Firebox configuration or in a Firebox template. If a Firebox subscribes to a template with networks configured, a lock icon shows next to the networks inherited from the template, and you cannot edit those networks in the Firebox configuration. To view the name of the template where the networks are configured, hover over the lock icon. For more information about Firebox templates, go to About Firebox Templates.

For more information about how link monitoring works and for best practices, go to About Link Monitoring for Cloud-Managed Fireboxes.

Your operator role determines what you can view and do in WatchGuard Cloud. Your role must have the Devices permission to view or configure this feature. For more information, go to Manage WatchGuard Cloud Operators and Roles.

Configure Link Monitoring Settings

To configure link monitoring for a network, you must enable link monitoring and then configure the link monitoring settings. The configuration options for link monitoring depend on the network type (external, internal, or guest).

To enable link monitoring for a network, from WatchGuard Cloud:

  1. Select Configure > Devices.
  2. Select the cloud-managed Firebox.
  3. Click Device Configuration.
  4. Click the Networks widget.
    The Networks configuration page opens.
  5. Click the widget for the network you want to edit.
  6. In the network settings, select the Link Monitoring tab.

    Screenshot of the Link Monitoring tab with Link Monitoring disabled

  7. Turn on the Enable Link Monitoring toggle.
  8. Configure the link monitoring settings for your external, internal, or guest network.
  9. To save configuration changes to the cloud, click Save.

Configure Link Monitoring for an External Network

For an external network, you can use the default settings or configure custom settings.

If you use the default link monitoring settings, the Firebox pings the network gateway. To monitor connectivity to any network beyond the gateway, or to configure multiple targets and custom probe settings, you must configure custom link monitoring settings.

To use default link monitoring settings for an external network:

  1. Enable link monitoring.
  2. Select Use Default Link Monitoring Settings.
  3. Click Save.

    Screenshot of the Link Monitoring settings for an external network with default settings selected

For configuration changes to take effect on a cloud-managed Firebox, you must deploy the configuration update to the Firebox. For more information, go to Manage Device Configuration Deployment for Fireboxes.

To configure custom link monitoring settings for an external network:

  1. Enable link monitoring.
  2. Select Use Custom Link Monitoring Settings.
  3. Under Targets, from the drop-down list, select Ping, TCP, or DNS, then click The Add icon. Tip!
    The settings for the selected target type appear.
  4. Configure the target:
    • If you selected Ping, in the Ping Domain or IP Address text box, type an IP address or a domain name.
    • If you selected TCP:
      1. In the TCP Domain or IP Address text box, type an IP address or a domain name.
      2. In the Port text box, type a port number.
    • If you selected DNS:
      1. In the DNS IP Address text box, type the IP address of the DNS server.
      2. In the Query Domain text box, type a domain name for the DNS server to resolve.
  5. (Optional) To add another target, from the Targets drop-down list, select a target type, then click The Add icon. Complete the settings for that target. You can configure up to three targets for the network, in any combination of target types. To remove a target, click The Options menu icon and select Delete.

    Screenshot of custom Link Monitoring settings for an external network with targets and probe settings

  6. (Optional) From the Measure Loss, Latency, and Jitter for SD-WAN drop-down list, select the target to use for Software-Defined WAN (SD-WAN) performance measurements. If you select loss, latency, and jitter measures in an SD-WAN action, connections fail over if the values you specified for those measures are exceeded. For more information, go to Configure SD-WAN.
  7. (Optional) To require a response from all targets before the Firebox considers the interface active, select the Require a Successful Probe to All Targets to Define the Interface as Active check box.
  8. (Optional) Configure the probe settings:
    1. To change how often the Firebox verifies the status of the interface, in the Probe Interval text box, type the number of seconds between probe attempts. The default value is 5.
    2. To change the number of consecutive probe failures that must occur before the Firebox fails over to the next specified interface, in the Deactivate After text box, type the number of consecutive failures. The default value is 3.
    3. To change the number of consecutive successful probe attempts that must occur before an inactive interface can become active again, in the Reactivate After text box, type the number of consecutive successes. The default value is 3.
  9. To save configuration changes to the cloud, click Save.

For configuration changes to take effect on a cloud-managed Firebox, you must deploy the configuration update to the Firebox. For more information, go to Manage Device Configuration Deployment for Fireboxes.

Configure Link Monitoring for an Internal or Guest Network

When you enable link monitoring for an internal or guest network, you can optionally specify the next hop. An SD-WAN action that includes this network uses the next hop address to route link monitor traffic. If you do not specify a next hop, the SD-WAN action uses standard routing for link monitor traffic.

To configure link monitoring for an internal or guest network:

  1. Enable link monitoring.
  2. (Optional) In the Next Hop text box, type the IP address of the next hop.
  3. Under Targets, from the drop-down list, select Ping, TCP, or DNS, then click The Add icon. Tip!
    The settings for the selected target type appear.
  4. Configure the target:
    • If you selected Ping, in the Ping Domain or IP Address text box, type an IP address or a domain name.
    • If you selected TCP:
      1. In the TCP Domain or IP Address text box, type an IP address or a domain name.
      2. In the Port text box, type a port number.
    • If you selected DNS:
      1. In the DNS IP Address text box, type the IP address of the DNS server.
      2. In the Query Domain text box, type a domain name for the DNS server to resolve.
  5. (Optional) To add another target, from the Targets drop-down list, select a target type, then click The Add icon. Complete the settings for that target. You can configure up to three targets for the network, in any combination of target types. To remove a target, click The Options menu icon and select Delete.

    Screenshot of Link Monitoring for an internal network with targets and probe settings

  6. (Optional) From the Measure Loss, Latency, and Jitter for SD-WAN drop-down list, select the target to use for SD-WAN performance measurements. If you select loss, latency, and jitter measures in an SD-WAN action, connections fail over if the values you specified for those measures are exceeded. For more information, go to Configure SD-WAN.
  7. (Optional) To require a response from all targets before the Firebox considers the interface active, select the Require a Successful Probe to All Targets to Define the Interface as Active check box.
  8. (Optional) Configure the probe settings:
    1. To change how often the Firebox verifies the status of the interface, in the Probe Interval text box, type the number of seconds between probe attempts. The default value is 5.
    2. To change the number of consecutive probe failures that must occur before the Firebox fails over to the next specified interface, in the Deactivate After text box, type the number of consecutive failures. The default value is 3.
    3. To change the number of consecutive successful probe attempts that must occur before an inactive interface can become active again, in the Reactivate After text box, type the number of consecutive successes. The default value is 3.
  9. To save configuration changes to the cloud, click Save.

For configuration changes to take effect on a cloud-managed Firebox, you must deploy the configuration update to the Firebox. For more information, go to Manage Device Configuration Deployment for Fireboxes.

Related Topics

About Link Monitoring for Cloud-Managed Fireboxes

Configure SD-WAN

About Firebox Networking Settings