Migrate Fireboxes to WatchGuard Cloud — Checklist

1

Verify the supported features in WatchGuard Cloud.

Recommendation:

• If a specific feature is not yet supported in WatchGuard Cloud, consider whether you really need the feature.
• Contact your Sales Engineer representative with questions.

2

Plan the scope of your change to cloud management.

Recommendation:

Based on the size and complexity of your environment, determine whether you can change your Fireboxes to cloud management quickly at the same time or if your deployment is more complex and requires a gradual transition. Define your maintenance windows based on the scope of your deployment.

Is your network large or complex? For example: Fireboxes with many unique policies, special VPN configurations or legacy VPNs, or unique routing configurations?

• Yes — Migrate your Fireboxes gradually.
• No — Migrate your Fireboxes at the same time.

3

Determine which Fireboxes to change to cloud management first.

Create an inventory of your Fireboxes and a diagram of your network topology. Do any devices have dependencies?

Recommendation:

We recommend you migrate your Fireboxes in this order:

1. Test or internal Fireboxes.
2. Fireboxes for accounts that use a common, standard configuration.
   Configure a top level template and use the copy configuration feature.
3. Fireboxes with complex configurations.
   Migrate these devices individually to make sure they are configured correctly.

4

Identify and document unique requirements of your network.

Recommendation:

Some unique configurations might require careful planning before you change to cloud management, such as:

• Special VPN configurations or legacy VPNs you must support. Some VPNs might need to be recreated after you change to cloud management.
• Unique routing configurations for your network.

5

Identify groups of Fireboxes with a common configuration that you can easily move to cloud management.

6

Save a backup copy of up-to-date versions of all Firebox configurations.

1

Create a WatchGuard Cloud account.

2

Add operators to your WatchGuard Cloud account.

Operators are users who can log in to WatchGuard Cloud to view and manage account information, configure services, and see reports.

3

Add managed Subscriber and Service Provider accounts.

WatchGuard Cloud is a multi-tenant, multi-tier system. A Service Provider account can create and manage customer accounts up to five tiers.

Do you manage other MSPs?

• Yes — Add a tier-2 Service Provider account to your account for each MSP. Add Subscriber accounts for each customer managed by an MSP to their Service Provider account.
• No — Add a Subscriber account for each customer you work with.

You can manage multiple Fireboxes for a customer within one Subscriber account.

4

(Optional) Add account groups.

Use account groups to restrict access to all or specific accounts in WatchGuard Cloud. To simplify account access management, you can assign an operator permissions to manage a group of similar accounts instead of each individual account.

Example: Some support staff manage only a specific subset of all your Subscriber accounts. You want to make sure that you only enable access to the Subscribers the operators manage, and not all Subscribers in your WatchGuard Cloud Service Provider account. You can create different account groups and only allow access to the appropriate account group in the settings for the support staff operators.

• Add account groups to restrict access to all or specific accounts.
  Operators with Auditor and Helpdesk roles can only manage accounts in their assigned account group.
• Assign operators to account groups.

5

(Optional) Add device folders to organize devices.

Folders enable you to see status and summarized data for groups of devices.

Example: If you have devices at several geographic locations, you can create a folder for each location. This enables you to open the folder to see only the devices at that location, and to see summary status and aggregated reports for those devices.

6

Allocate devices to accounts.

Fireboxes activated by a Service Provider appear in the Service Provider Inventory in WatchGuard Cloud. After you allocate a Firebox to a Subscriber account, the device appears in the list of devices you can add to that account.

1. To identify which Fireboxes to allocate to specific Subscriber accounts, map your internal POS system to your WatchGuard Cloud Subscriber accounts.
2. Allocate Fireboxes to the relevant Subscriber or Service Provider account.
3. Tier-n Service Providers can then allocate devices to their managed accounts.

1

Review current policies and templates to find opportunities to reorganize how you apply settings to your devices.

Recommendation:

Run the Policy Usage Report for the device in WatchGuard Cloud:

• Determine how your current policies are used.
• Identify unused policies you can remove.
• Identify common policies you can consolidate.

2

Identify common Firebox policies and services to group together in templates.

Recommendation:

Use multiple templates based on specific groups of policies and services. This approach enables you to use a base template for standard settings that apply to all devices, and then apply additional templates to specific Fireboxes to enable different policies and services, as required.

3

Set up the new configuration for the Firebox in WatchGuard Cloud before you change to cloud management.

• Create a Service Provider level template for standard settings that apply to all Fireboxes in all accounts the Service Provider manages.
• Create a Subscriber level template for standard settings that apply to all Fireboxes in a specific customer environment.
• Update device settings for device-specific configurations.

1

Change the locally-managed Firebox to cloud management.

(Optional) Copy configuration settings from an existing cloud-managed Firebox during the change to cloud management. This is helpful when Fireboxes in a managed account have the same device level configuration settings.