Configure Subnets and Organizations

Applies To: WatchGuard NDR This topic applies to the WatchGuard NDR product.

A subnet is a smaller network created by the division of a larger network into equal parts. On the Manage Subnets page, you configure subnets and ranges of IP addresses to label your internal networks and important systems to help WatchGuard NDR identify rogue devices.

Internal systems that are not part of a subnet or IP address range are identified as members of an Untrusted Private group.

WatchGuard NDR treats any subnet or IP address range configured on the Subnets and Organizations page as an internal network. If you add public IP address ranges, WatchGuard NDR classifies those addresses as Internal IP addresses during analysis and threat detection.

On the Manage Subnets page, you also specify how much of the network you want WatchGuard NDR to monitor traffic for. You can monitor all network traffic, monitor only critical systems, or you can exclude networks from monitoring.

Specify Traffic Monitoring Behavior

You can specify subnets and IP address ranges to label internal networks and important systems and to limit how much traffic you want WatchGuard NDR to monitor. You can exclude a subnet or IP address range from network traffic monitoring.

WatchGuard recommends that you monitor all traffic.

To specify traffic monitoring behavior, there are three options to control how much of your network WatchGuard NDR monitors:

• Monitor All Traffic — Monitors all traffic without restrictions. This includes all subnets and exceptions listed. This option is enabled by default.
• Monitor Only My Critical Systems — Monitors a core set of systems only, based on the subnets and IP addresses you include in the list. To configure this option, go to Monitor Only My Critical Systems.

If your included devices interact with devices outside your defined subnets and IP address ranges, those external devices are also monitored. This provides visibility into potentially harmful traffic. If monitoring is limited to interactions within the included group, real threats might go undetected.

Monitoring included and connected devices means that the total number of monitored devices might exceed the number within your specified ranges. To control costs, use the Exclude Address Ranges from Monitoring option.

• Exclude Address Ranges from Monitoring — Monitors all traffic except for the subnets and IP address ranges you exclude in the list. Excluded subnets and IP address ranges are not monitored, regardless of the direction of traffic. To configure this option, go to Exclude Address Ranges From Monitoring.

Create a Subnet in WatchGuard NDR

Create a subnet and ranges of IP addresses to label internal networks and important systems.

Add only IP address ranges that belong to your organization. WatchGuard NDR treats all subnets and IP address ranges configured on the Subnets and Organizations page as internal networks, regardless of whether the addresses are public or private.

To create a subnet, from WatchGuard Cloud:

1. Select Configure > NDR > Subnets and Organizations.
2. Click New Subnet.
3. In the Create a Subnet section, enter the CIDR subnet range (for example, 192.168.34.0/24) or the start and end of an IP address range (for example, 192.168.34.1 and 192.168.34.88).
   An end IP Address is required when you do not enter a CIDR subnet range.

4. In the Organization text box, enter a name for the address range.
   The organization name shows in other summary and detail pages.
5. From the Device Type drop-down list, select a default device type and icon to used in the user interface for this range (for example, a computer, server, or gateway).
6. In the Organization Tags text box, enter a label to further describe the system in the address range.
   Organization tags are useful to group assets.
7. If the addresses in this range are allocated by your DHCP servers, select the Managed by DHCP check box.
   This helps improve network analytics.
8. Click Save.
   The new subnet or IP address range shows in the list. You can filter the list and export the list to CSV file. To edit an existing IP address range or subnet, click next to the row you want to edit. Click to delete the IP address range or subnet.

Monitor Only My Critical Systems

To monitor only selected systems:

1. Select Configure > NDR > Subnets and Organizations.
2. Select Monitor only my critical systems. Click Save.
3. Next to the IP address range or subnet you want to include, click .
4. Select Include.
5. Click .
   The selected subnet or IP address range is included in network monitoring.

Exclude Address Ranges From Monitoring

When you exclude subnets or IP address ranges from monitoring, NDR cannot observe traffic to or from those addresses. Because NDR analyzes bidirectional traffic flows, these exclusions can also affect visibility into communications involving monitored devices. For example, if a monitored device communicates with an excluded IP address, NDR cannot observe the response traffic from the excluded address and cannot correlate the flow. As a result, the flow does not appear in NDR monitoring data. Before you exclude address ranges, verify that the exclusion does not remove visibility into traffic you want NDR to analyze.

To exclude address ranges from monitoring:

1. Select Configure > NDR > Subnets and Organizations.
2. Select Exclude address ranges from monitoring. Click Save.
3. Next to the IP address range or subnet you want to exclude, click .
4. Select Exclude.
5. Click .
   The selected subnet or IP address range is excluded from network monitoring.

Related Topics

Configure NDR

WatchGuard NDR Best Practices