What's New in Fireware

This release of Fireware includes these new and improved features:

• VPN Statistics UpdateFeature Details You can view the new Login To statistic from Firebox System Manager, Fireware Web UI, and the CLI.
• WatchGuard System Manager (WSM) Quick Setup Wizard Defaults UpdateFeature Details The WatchGuard System Manager (WSM) Quick Setup Wizard now enables a DHCP server on the internal interface of a device by default.
• Release or Renew a DHCP Lease in Firebox System ManagerFeature Details In Firebox System Manager (FSM), you can now right-click an external interface that has DHCP enabled to renew or release the DHCP lease.
• WebBlocker Categories UpdateFeature Details WebBlocker now supports new Social Web, Collaboration - Office, Information Technology, and Internet Watch Foundation categories and subcategories.

This release of Fireware includes these new and improved features:

• Validation for Network Access Enforcement Account UUID and Authentication Key in Fireware Web UIFeature Details When you enable Network Access Enforcement, you must enter an Account UUID and Authentication Key.
• Configure Spanning Tree Protocol Settings in the CLIFeature Details The show stp command now shows the status of the ports that participate in the Spanning Tree Protocol of a bridge on the Firebox.
• SNMP Support for Feature Key Expiration DateFeature Details The WATCHGUARD-INFO-SYSTEM-MIB file now includes an OID that enables you to query the Firebox LiveSecurity feature key expiration date. (wgFeatureKeyExpirationInfo: 1.3.6.1.4.1.3097.6.1.5.0)
• WatchGuard Active Directory SSO Support for Computers Joined to Domain with Azure Active Directory in Hybrid EnvironmentsFeature Details With v12.10.1 of the WatchGuard Single Sign-On (SSO) Agent, WatchGuard Active Directory SSO now supports computers joined to your domain with Azure Active Directory. This support is for hybrid environments, where a local Active Directory domain controller is used for authentication by the Firebox, and the computers are added to this domain with Azure AD.

This release of Fireware includes these new and improved features:

• AIA Fetching SupportFeature Details You can now enable AIA Fetching certificate validation for HTTPS-Client proxy actions from Fireware Web UI and Policy Manager.
• New Default Microsoft365 AliasFeature Details This release adds a new default Microsoft365 alias which automatically updates a list of domain names and IP addresses used by Microsoft 365.
• Network Access Enforcement OS Version UpdatesFeature Details The Endpoint Enforcement user interface was renamed to Network Access Enforcement. The Minimum Operating System Versions options now include Windows 11 and macOS Ventura 13. You can select Custom to enter a specific OS version.
• Diffie-Hellman Group 21 SupportFeature Details Fireware now supports Diffie-Hellman Group 21 (521-bit random).
• Removal of the wg-support Default User AccountFeature Details The user account named wg-support is no longer a default account.
• Removal of Firebox Wireless Encryption Algorithm SettingFeature Details You can no longer configure the Encryption Algorithm setting for a wireless network on a Firebox. The encryption algorithm is now automatically set based on the wireless security mode configured for the SSID.
• Removal of TLS v1.0 Option for Management Server and Log ServerFeature Details The ability to enable or disable TLS v1.0 for the WatchGuard Management Server and Log Server is now deprecated and removed from WatchGuard Server Center.
• Change to the Default Name of a FireboxFeature Details The default system name of a Firebox is changed from WatchGuard-XTM to WatchGuard-Firebox.
• SNMP Query Support for Dynamic RoutingFeature Details You can now query the dynamic routing process with SNMP to obtain routing information for RIP, OSPF, and BGP.
• Firebox Storage Space Shown as a PercentageFeature Details On the Backup and Restore page, Policy Manager and Fireware Web UI now show the available storage space as a percentage.
• FireboxV Support for ESXi 8.0Feature Details You can now install a FireboxV virtual machine on VMware ESXi 8.0.
• WatchGuard Mobile VPN with SSL Client v12.10Feature Details Fireware now includes updated WatchGuard Mobile VPN for SSL clients for Windows and macOS.
• WebSocket Connections SupportFeature Details You can now specify whether HTTP proxy actions allow connections that use the WebSocket protocol.
• Removal of Web Reputation Authority Service from REDFeature Details Reputation Enabled Defense (RED) no longer includes support for the Web Reputation Authority service. Other services enabled with the RED feature key (Botnet Detection, Geolocation, and Tor Exit Node Blocking) are still supported.

This release of Fireware includes these new and improved features:

• Updated WatchGuard IPSec Mobile VPN Client for macOSFeature Details This release updates the version of the IPSec Mobile VPN Client to v4.70.

This release of Fireware includes these new and improved features:

• Updated Terminal Services Agent SoftwareFeature Details This release updates the version of the Terminal Services Agent to TOAgent v11.12 Update 1 to resolve a compatibility issue between the agent and Endpoint Security protection.
• Updated WatchGuard IPSec Mobile VPN Client for WindowsFeature Details This release updates the version of the IPSec Mobile VPN Client to v15.14.

This release of Fireware includes these new and improved features:

• DNS Settings From the Mobile VPN with IKEv2 Configuration to Mobile ClientsFeature Details When you select the Assign These Settings to Mobile Clients option, you can now specify a domain suffix.
• IPv6 Address and Link-local Default GatewayFeature Details You can now use an IPv6 static address to configure an interface when you have a link-local address as the default gateway.
• Support for New Firebox T25, T45, and T85 DevicesFeature Details Fireware v12.9.2 provides support for WatchGuard’s newest tabletop appliances, the Firebox T25, T45, and T85.

This release of Fireware includes these new and improved features:

• RADIUS and Multi-Factor Authentication Support for Management ServerFeature Details To enhance login security, you can now configure RADIUS servers and use multi-factor and RADIUS challenge/response authentication with the WatchGuard Management Server. RADIUS authentication support on the Management Server enables you to support multi-factor authentication services such as AuthPoint.
• Endpoint Enforcement UpdatesFeature Details The TDR Host Sensor Enforcement user interface is updated because you no longer have to manually enable TDR on the Firebox for endpoint enforcement. When you enable local management with cloud reporting for your Firebox, TDR is automatically enabled.
• Mobile VPN with IKEv2 Split TunnelingFeature Details You can now configure split tunneling in the Mobile VPN with IKEv2 configuration on the Firebox.
• Mobile VPN with IKEv2 DNS SuffixFeature Details The Mobile VPN with IKEv2 client configuration files for Windows, iOS, and macOS can now include a domain name suffix. You must specify the suffix in the network (global) DNS settings on the Firebox. Configuration scripts that you download from the Firebox include the suffix.
• DNS Forwarding PolicyFeature Details When you enable DNS Forwarding, a policy named Allow DNS-Forwarding now appears in the policy list. You can edit this policy.
• IP Spoofing CheckFeature Details This release simplifies how the Firebox handles IP spoofing verification.
• Routing Engine Update from Quagga to Free Range Routing (FRR)Feature Details Fireware now uses the Free Range Routing (FRR) routing engine, which replaces Quagga. Existing Quagga commands in your configuration continue to work after you upgrade. Some commands now appear in different sections.
• Routing Engine Update: BGP Configuration SectionsFeature Details With FRR, the 'network' and 'redistribute' BGP commands are under the address-family section. If your Firebox includes an existing BGP configuration, and you upgrade from Fireware v12.8.2 or lower to Fireware v12.9 or higher, the configuration conversion automatically converts your existing Quagga commands. If you add new 'network' and 'redistribute' commands after you upgrade to Fireware v12.9, make sure to add those under the address-family section.
• Routing Engine Update: Bidirectional Forwarding (BFD)Feature Details You can now use a simplified implementation of bidirectional forwarding (BFD) for dynamic routing.
• Routing Engine Update: BGP PolicyFeature Details With FRR, the Firebox cannot learn or announce routes unless you add inbound or outbound BGP filtering policies for the eBGP session. If you prefer not to add BGP policies, you can add the command 'no bgp ebgp-requires-policy', which removes the policy requirement. When you upgrade to Fireware v12.9, if you have an existing BGP configuration, the Firebox adds the 'no bgp ebgp-requires-policy' command automatically.
• Routing Engine Update: Import CheckFeature Details With FRR, bgp network import-check is enabled by default. When this setting is enabled, routes created by the network command must be validated before those routes can be advertised to neighbors. If your Firebox includes an existing BGP configuration, and you upgrade from Fireware v12.8.2 or lower to Fireware v12.9 or higher, the configuration conversion automatically disables bgp network import-check. If you add a new BGP configuration in Fireware v12.9 or higher, we recommend that you manually disable this setting so BGP peers can learn Firebox routes.
• Routing Engine Update: OSPF CostFeature Details With FRR, the OSPF cost is the reference bandwidth divided by the interface bandwidth. The reference bandwidth is 100 Gbps.
• Routing Link DetectionFeature Details In the Fireware CLI, you can now run the 'global-setting routing-link-detect enable' command to automatically update static and dynamic routes if the interface link status changes.
• Routing Engine Update: Routing Terminology ChangeFeature Details
  Fireware now uses the term distance instead of metric for the priority of static routes. When you upgrade, metric values automatically convert to distance values between 1 and 255.
• Configure LDAP AuthenticationFeature Details
  You can now assign a client certificate when you authenticate an LDAP server with LDAPS.
• Report False Positives or Missed SpamFeature Details
  You can now use a spamBlocker spam ID log message to report a false positive or missed spam message.
• Intra-Interface Traffic InspectionFeature Details
  You can now use WatchGuard System Manager (WSM) and Policy Manager to enable intra-interface inspection on physical and link aggregation interfaces.
• Cloud Connect in Feature KeyFeature Details
  With the release of Fireware v12.9, to enable WatchGuard Cloud, the feature key on the Firebox must include the Cloud Connect feature key for these models: T20/T20-W, T40/T40-W, T80, M270, M290, M370, M390, M470, M570, M590, M670, M690, M4600, M4800, M5600, M5800 FireboxV, Firebox Cloud (BYOL only). Older feature keys could include Live Security or Support, and Cloud Visibility or Dimension Basic.

This release of Fireware includes these new and improved features:

• Support for 8x1Gb Network ModuleFeature Details Fireware v12.8.2 adds support for a new 8x1Gb Copper network module (WG9022) for Firebox M290, M390, M590, and M690 devices.

This release of Fireware includes these new and improved features:

• Tor Exit Node BlockingFeature Details You can now configure the Tor Exit Node Blocking service to block Tor exit nodes.
• BOVPN virtual interface failover to Microsoft Azure VPN gatewaysFeature Details The Firebox supports certain failover configurations for BOVPN virtual interface tunnels configured to connect to Microsoft Azure VPN gateways in active-standby or active-active mode.
• WatchModeFeature Details For partners with NFR Fireboxes, WatchMode is now available again for sales demonstrations. WatchMode is supported on rack-mountable Fireboxes (M Series) and T70/T80 Fireboxes that run Fireware v12.8.1 or higher.

This release of Fireware includes these new and improved features:

• SD-WAN Round RobinFeature Details You can now configure SD-WAN actions to use the Round Robin load-balancing method.
• SD-WAN Actions in Centralized Management TemplatesFeature Details You can now create and apply SD-WAN actions in a Centralized Management policy template.
• External VLAN enhancementsFeature Details To increase network design flexibility, external VLAN configurations now have fewer restrictions.
• External Interface and VLAN ID in Web UI Quick Setup WizardFeature Details You can now select which interface you want to use as the external interface in the Fireware Web UI Quick Setup Wizard. You can also enable and specify a VLAN ID for the external interface if required by your provider.
• MOBIKE support for Mobile VPN with IKEv2Feature Details Mobile VPN with IKEv2 now automatically supports the MOBIKE mobility protocol, which means your remote workers can remain connected to the VPN even if they move to a different network.
• Intra-interface traffic inspectionFeature Details You can now specify a CLI command to enable or disable intra-interface inspection on physical and link aggregation interfaces.
• IPv6 in Bridge ModeFeature Details In Bridge mode, you can now specify a static IPv6 address and other IPv6 settings.
• Disable GARPFeature Details In Mixed Routing mode only, you can now run a Fireware CLI command to disable gratuitous ARP (GARP) on Ethernet-like interfaces.
• Disable Geolocation Deny pageFeature Details You can now enable or disable the Geolocation deny page for policies.
• Configure DF bit options for Mobile VPN with IKEv2Feature Details You can now specify a CLI command to configure a custom DF bit value for Mobile VPN with IKEv2 connections.
• OS checksum Feature Details The OS checksum feature has been deprecated and removed from Fireware Web UI and Firebox System Manager.

This release of Fireware includes these new and improved features:

• System integrity checks (12.7.2 Update 2) Feature Details The Firebox now runs automatic integrity checks at boot time and when you upgrade. You can also run an on-demand integrity check from Fireware Web UI.
• WSM Cyclops Blink Detector (12.7.2 update 2) Feature Details You can use the WSM Cyclops Blink Detector to determine if your Fireboxes are affected by Cyclops Blink.
• Firebox management policy warnings (12.7.2 Update 2) Feature Details You now see a warning when your configuration includes an insecure Firebox management policy.
• Support for Firebox M290, M390, M590, and M690 devices Feature Details Fireware v12.7.2 provides support for WatchGuard’s newest appliances, the Firebox M290, M390, M590, and M690
• Enable or disable Active Directory Mode for SSOFeature Details You can now choose to enable or disable Active Directory (AD) Mode in the SSO Agent Configuration Tool. In Fireware 12.7.2, AD Mode is now disabled by default.
• Number of supported Terminal Service Agents increased to 512Feature Details The number of supported Terminal Service Agents is increased to 512. The previous limit was 128.
• Support for Huawei E3372-320 USB LTE Modem Feature Details Fireware v12.7.2 adds support for the Huawei E3372 USB LTE Modem

This release of Fireware includes these new and improved features:

• WatchGuard Cloud Connection Status in Fireware Web UI Feature Details The Fireware Web UI > Information page for cloud-managed Fireboxes now indicates when there is a connection issue and the reason.
• Post-NAT information in v9 NetFlow recordsFeature Details IP addresses for NAT and NAT-T (NAT traversal) events now appear in flow records if you select V9 in the Firebox NetFlow configuration.
• AuthPoint Firebox Integration Support for Azure AD UsersFeature Details The AuthPoint authentication server on the Firebox now supports authentication for Azure Active Directory users.
• RADIUS support for 256-Character Shared SecretFeature Details RADIUS now supports 256-character shared secrets.
• 4G LTE Interface Module SupportFeature Details Fireware 12.7.1 adds support for a new LTE Interface module for the Firebox T80 that enables you to install a SIM card and use the cellular connection as an external interface on the Firebox.

This release of Fireware includes these new and improved features:

• AuthPoint Integration with a Firebox Feature Details You can now use AuthPoint as an authentication server on your Firebox.
  • Mobile VPN with IKEv2 and AuthPoint integrationFeature Details You can now configure Mobile VPN with IKEv2 to authenticate mobile VPN users directly through AuthPoint.
  • Mobile VPN with SSL and AuthPoint integrationFeature Details You can now configure Mobile VPN with SSL to authenticate mobile VPN users directly through AuthPoint.
  • Firebox Authentication Portal and AuthPoint integrationFeature Details You can now configure the Firebox Authentication Portal to authenticate users directly through AuthPoint.
  • Fireware Web UI and AuthPoint integrationFeature Details You can now configure the Firebox to authenticate device management users directly through AuthPoint.
• Default authentication server for Fireware Web UI Feature Details You can now specify the default authentication server to use when users log in to Fireware Web UI
• Support for HTTP proxy server settings for APT BlockerFeature Details You can connect to the APT Blocker server with an HTTP proxy server
• Send PDF files to the APT Blocker data center for analysisFeature Details You can now specify whether APT Blocker submits unrecognized PDF files to the data center for analysis.
• 802.1p marking for VLAN interfacesFeature Details You can now enable 802.1p marking for VLAN interfaces.
• DHCP lease information for IPv4 clientsFeature Details In Fireware Web UI, you can now see the total number of DHCP leases included in each IPv4 DHCP range configured on the Firebox. You can also see the number of leases in use.
• Intra-bridge traffic inspectionFeature Details You can now select to apply firewall policies to traffic that passes between bridge member interfaces.
• Configure log rate limitsFeature Details You can now control how many log messages the Firebox sends when it denies different types of traffic
• HTTPS predefined exceptions list automatic updatesFeature Details The HTTPS exceptions list can now automatically update without a Fireware upgrade
• FQDN limits replaced by a warningFeature Details There is no longer a limit on the number of fully qualified domain names you can use in your Firebox configuration.
• Disable the DNS cache Feature Details For configurations with DNS Forwarding or DNSWatch enabled, you can now select an option in Fireware Web UI or Policy Manager to disable the DNS cache on the Firebox.

This release of Fireware includes these new and improved features:

• Support for Firebox configuration and management from WatchGuard CloudFeature Details Fireware v12.5.7/v12.6.4 include enhancements to support the management and configuration of Fireboxes from WatchGuard Cloud.
• Disable the DNS cache (CLI only)Feature Details For configurations with DNS Forwarding or DNSWatch enabled, you can now specify a CLI command to disable the DNS cache on the Firebox.

This release of Fireware includes these new and improved features:

• Flood protection logging enhancementsFeature Details The Firebox now generates log messages when traffic from a site on the Blocked Site Exceptions list exceeds a Flood Attack threshold. As in previous Fireware versions, the Firebox continues to allow the traffic.

• Default route announcements for dynamic routingFeature Details For an IPv4 dynamic routing configuration that includes the command "default-information originate," if Link Monitor detects a link failure for all WAN connections, BGP, OSPF, and RIP no longer announce the default route to neighbors.

This release of Fireware includes these new and improved features:

• Certificate verification for BOVPN peersFeature Details In the BOVPN and BOVPN virtual interface configurations, you can now specify a root or intermediate CA certificate for VPN peer verification.
• TLS version requirements for the Mobile VPN with SSL client download pageFeature Details To download the Mobile VPN with SSL client from the Firebox, your web browser must now support TLS 1.2 or higher.
• TLS version requirements for Fireware Web UIFeature Details To connect to Fireware Web UI, your browser must now support TLS 1.2 or higher.
• TLS version requirements for the Hotspot Guest Administration portalFeature Details To connect to the Hotspot Guest Administration portal, your browser must now support TLS 1.2 or higher.
• Additional DHCP lease information in the Firebox System Manager status reportFeature Details In the FSM status report, the DHCP Leases section now includes the number of DHCP leases in use and the total number of DHCP leases available in the configuration.
• About Blocked SitesFeature Details To allow connections to Panda products and services through the Firebox, Panda URLs were added to exceptions lists.
• (12.6.2 only) FireboxV support on KVMFeature Details You can now deploy and configure a FireboxV virtual machine in a Linux KVM (Kernel Virtual Machine) hypervisor.
• (12.6.2 only) Configure Source PortFeature Details Firewall policy properties now include an option to limit policy scope based on the source port of the connection.
• (12.6.2 only) Create or Edit a Custom Policy TemplateFeature Details You can configure a custom firewall policy template for ICMPv6 (Internet Control Message Protocol v6).
• (12.6.2 only) ICMPv6 Custom Policy Templates in Configuration TemplatesFeature Details In configuration templates for Fireware v12.6 or higher, you can now configure a custom firewall policy template for ICMPv6.
• (12.6.2 only) Logon Disclaimer on Web UI Login page and CLIFeature Details When the Logon Disclaimer is enabled, the Logon Disclaimer message now appears on the Fireware Web UI login page instead of after a user logs log on. The Logon Disclaimer also now appears in the CLI.
• (12.6.2 only) CSfC ModeFeature Details You can now use the CLI to enable CSfC mode on the Firebox to enable functionality required for compliance with Common Criteria CSfC requirements.
• (12.6.2 only) Define Advanced WebBlocker OptionsFeature Details By default, WebBlocker allows users to view a website when the WebBlocker Server times out.
• (12.6.2 only) Create a Certificate CSR Feature Details Certificate Signing Requests (CSRs) now support RSA 3072, RSA 4096, ECDSA P-256, and ECDSA P-38 encryption settings.
• (12.6.2 U2 only) Test WebBlocker ActionsFeature Details Before you enable a WebBlocker action, you can test the action to confirm whether WebBlocker will allow or block a URL.
• (12.6.2 U2 only) About Default Packet Handling OptionsFeature Details In the Default Packet Handling dialog box, the Drop IP Source Route and Record Route Attacks check box was updated to better reflect the action that occurs.

This release of Fireware includes these new and improved features:

• Improved spamBlocker engineFeature Details The new spamBlocker spam engine provides improved spam detection rates with lower impact on Firebox performance. spamBlocker now submits the entire email for inspection.
• Default multi-WAN methodFeature Details The default multi-WAN method is now Failover.
• Custom MTU valueFeature Details You can now configure a custom MTU setting in Fireware Web UI and Policy Manager.
• Dynamic DNS support for CloudflareFeature Details You can now configure the Firebox for dynamic DNS through Cloudflare.
• Hex-based pre-shared keysFeature Details BOVPN and BOVPN virtual interface configurations now support hex-based pre-shared keys.
• SD-WAN default metricsFeature Details The default value for the SD-WAN latency metric is now 400 ms. The default value for the jitter SD-WAN metric is now 100 ms.
• Firebox sends diagnostic logs to WatchGuard Cloud only when Support Access is enabledFeature Details The Firebox now sends diagnostic log messages to WatchGuard Cloud only when Support Access is enabled. To request diagnostic log messages stored in WatchGuard Cloud you must open a support case.
• Disable the client download page for Mobile VPN with SSLFeature Details You can now disable the Mobile VPN with SSL client download page hosted by the Firebox. In Fireware v12.5.4, this option is available only through the CLI.
• TLS version requirements for Mobile VPN with SSL clientsFeature Details The Firebox now requires SSL VPN clients to support TLS 1.2 or higher.
• Custom timeout value for Mobile VPN with IKEv2Feature Details You can now specify a custom timeout value for Mobile VPN with IKEv2 EAP user authentication. You must use Fireware CLI to configure this setting.
• Default packet handling options in configuration templatesFeature Details You can now configure default packet handling settings in device configuration templates for Fireware v12.0 or higher.
• (12.6.1 only) New engine and signature set for Intrusion Prevention Service and Application ControlFeature Details Signature IDs have changed, and in some cases multiple signatures are consolidated into a single, more efficient signature. The engine upgrade is transparent to users.
• (12.6.1 only) Application Control categoriesFeature Details Network Protocols (1), Network Protocols (2), and Network Protocols (3) have been merged into a single category.
• (12.6.1 only) Security Portal URLs updated to accommodate the new IPS and Application Control engineFeature Details There are new Applications and Threats pages in the Security Portal. The URL for main landing page remains the same.
• (WSM 12.6.1 only) New Fireware OS Compatibility version for Fireware version 12.6 and higherFeature Details The OS Compatibility setting in Firebox configuration files and configuration templates has a new setting for Fireware version 12.6 and higher

This release of Fireware includes these new and improved features:

• Wireless enabled by default and configurable in setup wizardsFeature Details On wireless Fireboxes, wireless is enabled by default. You can use wireless to connect to the Firebox to run the setup wizards. Setup wizards now configure settings to enable wireless access to the trusted network.
• Web Setup Wizard RapidDeploy OptionFeature Details The Web Setup Wizard has a new RapidDeploy configuration method. Use this method to configure the external interface settings for RapidDeploy.
• Firebox Registration to WatchGuard Cloud with TPMFeature Details For Firebox models that have a TPM chip, it is not necessary to paste a Verification Code to register the Firebox with WatchGuard Cloud.
• Disk Statistics in Fireware CLIFeature Details Disk statistics are now available through Fireware CLI. Use the command: diagnose hardware disk. Prior to Fireware v12.5.1, this information was available in the Firebox Status Report.
• Autotask Integration Requires API UsersFeature Details From 15 April 2020, only an API user account can access Autotask API services and the Firebox Autotask integration. To continue to use Autotask integration with your Firebox after 15 April 2020, you must: 1. Create a new API User account in Autotask. 2. Update your Firebox Autotask integration configuration with the new API User account username and password.
• AP225W Wall Plate Access Point SupportFeature Details This release adds support for the AP225W. The AP225W is an enterprise-grade 2x2 MU-MIMO tri-radio 802.11ac Wave 2 wall plate access point that you can manage with the Gateway Wireless Controller.
• Mobile VPN with SSL Client Update PromptsFeature Details The Mobile VPN with SSL client now prompts a user to upgrade only if the user has administrator privileges on the computer.
• Office 365 Traffic and Full-Tunnel Mobile VPN with SSLFeature Details For full-tunnel Mobile VPN with SSL configurations, you can enable the "sslvpn resource default-route-client" CLI command to ensure Office 365 traffic uses the VPN tunnel.

This release of Fireware includes these new and improved features:

• Support for WatchGuard Cloud System ActionsFeature Details WatchGuard Cloud now supports reboot, upgrade, backup, and restore system actions for Fireboxes that run Fireware v12.5.2.
• WebBlocker Server UpdatesFeature Details WebBlocker Server 1.1 is now available. This WebBlocker Server release includes minor updates and bug fixes.
• Support Access enhancementsFeature Details External IP addresses now appear in the Support Access user interface.

This release of Fireware includes these new and improved features:

• AP License EnforcementFeature Details Beginning with the Fireware v12.5.1 release, WatchGuard enforces licensing requirements for Basic Wi-Fi APs. Each WatchGuard AP managed by a Gateway Wireless Controller on a Firebox must be activated with a Basic Wi-Fi subscription.
• WebBlocker Warn message enhancementsFeature Details When a user clicks Continue to Site in a WebBlocker warning message, the message does not appear again for other websites until the user has been inactive for 15 minutes.
• WebBlocker Override enhancementsFeature Details When a user types a password or credentials in a Deny message to override WebBlocker, the override now applies to websites in all categories that have override enabled.

This release of Fireware includes these new and improved features:

• Reverse Proxy for the Access PortalFeature Details In the Access Portal, you can now configure reverse proxy actions so remote users can connect to internal web applications and Microsoft Exchange services with an external URL.
• NetFlow egressFeature Details In the NetFlow configuration, you can now select to monitor egress traffic for Firebox interfaces. NetFlow egress traffic now appears in the Firebox Configuration Report in Fireware Web UI.
• ECDSA certificates for BOVPN, BOVPN virtual interfaces, and Mobile VPN with IKEv2Feature Details You can now specify ECDSA (EC) certificates for BOVPN, BOVPN virtual interfaces, and Mobile VPN with IKEv2. Mobile VPN with IKEv2 clients must support EC certificates; support varies by operating system.
• Maximum Transmission Unit (MTU) settingFeature Details For BOVPN virtual interfaces, you can now specify a custom MTU setting. In Fireware v12.5, this option is available only in the CLI.
• WebBlocker Override enhancementsFeature Details You can now enable WebBlocker Override for specific WebBlocker categories. You can also now allow members of a specific user group to type their credentials to override denied websites.
• Proxy Warn message customizationFeature Details You can now customize the Warn message used for HTTP and Explicit proxy Warn actions.
• Support for Multiple RADIUS Servers and SecurID Configuration ChangesFeature Details You can now configure multiple RADIUS servers. With this change, the ability to use SecurID is included in the RADIUS server configuration and is no longer a separate configuration.
• Support for policy-based Dynamic NAT and 1-to-1 NAT in Device Configuration templatesFeature Details In a Fireware 12.0 Device Configuration template, you can configure policy-based Dynamic NAT and 1-to-1 NAT settings.

This release of Fireware includes these new and improved features:

• WatchGuard Cloud Device VisibilityFeature Details You can add a Firebox to WatchGuard Cloud to enable cloud-based monitoring and reporting. Fireware v12.4 or higher is required to monitor a FireCluster from WatchGuard Cloud.
• SD-WAN action enhancementsFeature Details SD-WAN actions now support internal interfaces and multiple BOVPN virtual interfaces. Metric-based SD-WAN routing is also supported for these interfaces.
• SD-WAN reporting enhancementsFeature Details Internal interfaces and BOVPN virtual interfaces now appear on SD-WAN graphs.
• Link Monitor enhancementsFeature Details You can now add internal interfaces and BOVPN virtual interfaces to Link Monitor. You can now monitor single WAN interfaces in Policy Manager.
• WebBlocker Warn actionFeature Details WebBlocker now includes a new Warn action that gives administrators more flexibility to enforce acceptable usage policies.
• Proxy support for TLS 1.3Feature Details HTTPS, SMTP, IMAP, and POP3 proxies now support TLS 1.3 protocol. Proxies no longer support the SSL v3 protocol.
• Geolocation Deny messageFeature Details A new Deny message now appears when Geolocation blocks access to a website. In previous releases, the connection would timeout.
• Proxy enhancements for DNSWatchFeature Details When a domain is in both the DNSWatch Blackholed Domain list and a denied WebBlocker category, the Blackhole Server page now appears instead of a WebBlocker Deny message.
• FQDN limit increaseFeature Details You can now configure up to a total of 2048 Fully Qualified Domain Names (FQDNs) on some devices.
• Synchronize feature key enhancementsFeature Details If Automatic Feature Key Synchronization is enabled, the Firebox now synchronizes the feature key after you restore a backup image or upgrade/downgrade Fireware OS
• Support for multiple syslog serversFeature Details The Firebox can now send syslog messages to a maximum of three syslog servers.
• Device configuration template enhancementsFeature Details On the WatchGuard Management Server, you can now configure global DNS settings, and QoS in policies. In WebBlocker actions you can now select the Warn action.
• Edit 1-to-1 NAT in Fireware WebUI Feature Details You can now edit a 1-to-1 NAT mapping in Fireware WebUI.
• FireCluster diagnostics page enhancementsFeature Details An enhanced FireCluster Diagnostics page shows you more details upfront with better organization.
• RADIUS support for IPv6 addresses and 64-Character Shared SecretFeature Details RADIUS now supports IPv6 addresses and 64-Character Shared Secrets.
• SecurID support for IPv6 addresses and 64-Character Shared SecretFeature Details SecurID now supports IPv6 addresses and 64-Character Shared Secrets.
• Improved status information about SSO componentsFeature Details You can view the status of authentication requests with a configurable refresh rate: Pending IP list — Lists requests sent to SSO Agent that have not been processed Processing IP list — The request is in process with ELM, EM, SSO Client, or Active Directory Authentication Info Success — Information about currently authenticated users
• Access Portal RDP enhancementsFeature Details New Automatic Display option improves the user experience. The connection will not disconnect when the user resizes the RDP display.
• Access Portal hides default Active Directory domains during log inFeature Details The first domain in the Authentication Server list will be the default sign in domain for users. Users only need to type their username if they log in with the default domain. Users who log in with a different domain must type domain/username to authenticate.
• DNSWatch support for Fireboxes in Bridge ModeFeature Details DNSWatch on a Firebox in Bridge Mode has the same Usage Enforcement options as Mixed Routing Mode. The interface is listed as Global Bridge in the interfaces list.
• IPv6 support for BOVPNFeature Details You can configure IPv6 BOVPN gateway endpoints.
• IPv6 support for BOVPN virtual interfacesFeature Details You can now configure IPv6 BOVPN virtual interface gateway endpoints. 6in6 tunnel routes are now supported.

This release of Fireware includes these new and improved features:

• Geolocation actionsFeature Details The Geolocation service now supports multiple actions so you can specify different geographical restrictions by policy.
• WebBlocker global exceptions listFeature Details WebBlocker has a new global exceptions list which eliminates the need to add the same exceptions to multiple WebBlocker actions.
• Export and import WebBlocker actionsFeature Details To make it easier to use the same WebBlocker settings on different Fireboxes, you can now export and import WebBlocker actions in Policy Manager.
• STARTTLS support for the IMAP ProxyFeature Details The IMAP proxy now supports STARTTLS, which enables IMAP clients to use the STARTTLS command to upgrade an IMAP connection to a secure channel and perform content inspection on the encrypted data.
• TCP-UDP proxy action redirection settingsFeature Details In the TCP-UDP Proxy Action settings, you can now specify when idle TCP and UDP connections will timeout.
• IntelligentAV usability updatesFeature Details IntelligentAV is now a separate item in the Subscription Services menu.
• File Exceptions usability updatesFeature Details The File Exceptions option has moved from the Subscription Services menu to a button in the APT Blocker, Gateway AV, Intelligent AV, and Data Loss Prevention services.
• New policy highlighting optionsFeature Details In Policy Manager, the Policy Highlighting dialog box now includes options to highlight disabled, allow, and deny policies.
• USB backup enhancementsFeature Details In the Web UI, Backup and Restore Image page, you can now back up and restore images from a connected USB drive. When you save a backup image to the USB drive, you can now choose whether to include the Fireware OS.
• SD-WAN actions Feature Details If you have multiple WAN connections, you can use SD-WAN actions in policies to route traffic based on network performance metrics or the up/down status of the interface. SD-WAN replaces policy-based routing.
• SD-WAN reporting enhancementsFeature Details The accuracy of SD-WAN reporting is improved. To calculate loss, latency, and jitter, the Firebox now uses the 100 most recent probe results from link monitor targets. To calculate jitter, the standard deviation is now used instead of the corrected standard deviation.
• Link Monitor enhancements Feature Details Link Monitor settings are now separate from multi-WAN settings. You can configure link monitor targets for an external interface regardless of whether multi-WAN is enabled. If multi-WAN is enabled, you can configure link monitor targets for an external interface that is not a multi-WAN member. You can now specify DNS targets.
• Tigerpaw IntegrationFeature Details You can configure your Firebox to integrate with Tigerpaw, a professional services automation tool.
• NetFlow supportFeature Details You can configure the Firebox as a NetFlow exporter.
• Active Directory configuration wizardFeature Details You can now use a wizard to add a new Active Directory server to the Firebox.
• Mobile VPN with SSL configuration wizardFeature Details You can now use a wizard to configure Mobile VPN with SSL.
• Centralized FireCluster diagnosticsFeature Details FireCluster diagnostic information is now centralized on one page for efficient troubleshooting.
• Two-factor authentication support for connections to Mobile VPN with SSL from native OpenVPN clientsFeature Details Mobile VPN with SSL users who have OpenVPN clients can type a one-time password to connect to the Firebox.
• IPv6 support for Active Directory SSO Feature Details The Firebox, SSO Agent, SSO Client, and Event Log Monitor now support IPv6.
• SSO Agent enhancementsFeature Details In the SSO Agent, you can now view the version number of the SSO Agent, and the version and build number of each SSO component.
• Manual failback for SD-WAN connectionsFeature Details If you select No Failback or Gradual Failback in an SD-WAN action, you can select to manually fail back SD-WAN connections on the SD-WAN Status page (Web UI) or the SD-WAN tab (FSM).

This release of Fireware includes these new and improved features:

• Backup and restore enhancementsFeature Details Backup images are now saved on the Firebox and no longer include the Fireware OS. Use the new Backup and Restore Image page to see and manage the backup images stored on your Firebox.
• SafeSearch enforcement level for YouTubeFeature Details In HTTP and Explicit proxy actions, you can now specify the level at which SafeSearch is enforced on YouTube - either Strict or Moderate.
• SMTP-proxy action updatesFeature Details In SMTP-proxy actions, you can now select Deny when you configure Gateway AV actions and spamBlocker Virus Outbreak Detection actions.
• WebBlocker usability updatesFeature Details In the WebBlocker Action dialog box, Categories tab, you can now use the Quick Action drop-down list to update multiple selected categories.
• Configure DF bit and PMTU options for BOVPN gateway endpointsFeature Details In the gateway endpoint settings for BOVPN and BOVPN virtual interface configurations, you can now specify DF bit and PMTU settings.
• View loss, latency, and jitter data for WAN interfacesFeature Details View realtime and historical network performance data for WAN interfaces that are configured with link monitor targets.
• Specify a minimum passphrase length for Firebox Authentication (Firebox-DB) accountsFeature Details For added security, you must now specify a minimum passphrase length for Firebox-DB accounts. This setting applies when you create a new account or change the passphrase for an existing account.
• Specify DNS, WINS, and domain name settings in the Mobile VPN with IPSec configurationFeature Details You can now select to specify DNS, WINS, and domain name settings in the mobile VPN configuration or in the Network (global) DNS/WINS settings.
• Specify DNS and WINS settings in the Mobile VPN with IKEv2 configuration Feature Details You can now select to specify DNS and WINS servers in the mobile VPN configuration or in the Network (global) DNS/WINS settings.
• Specify DNS settings in the Mobile VPN with L2TP configurationFeature Details You can now select to specify DNS servers in the mobile VPN configuration or in the Network (global) DNS/WINS settings.
• DNS setting enhancements in the Mobile VPN with SSL configuration Feature Details You can now select to specify DNS, WINS, and domain name settings in the mobile VPN configuration or in the Network (global) DNS/WINS settings.
• File exceptions statistics added to the Subscription Services dashboard Feature Details The number of files allowed and dropped by the File Exceptions list are now shown in the Subscription Services Dashboard in Fireware Web UI and Firebox System Manager.
• Support for loopback interface IP addresses in static NAT actionsFeature Details You can now specify the primary or secondary IP address of the loopback interface in a static NAT action.

This release of Fireware includes these new and improved features:

• TLS profiles for the SMTP proxyFeature Details The SMTP proxy now supports TLS profiles for content inspection
• TLS profiles for the POP3 proxyFeature Details The Pop3 proxy now supports TLS profiles for content inspection
• Firebox Cloud management by WatchGuard System ManagerFeature Details Firebox Cloud can now be managed by WatchGuard System Manager and WSM Management Server.
• Firebox Cloud new supported featuresFeature Details Firebox Cloud now supports Single Sign-On (SSO), spamBlocker, and Quarantine Server.
• IntelligentAVFeature Details IntelligentAV adds another layer of protection to the Gateway AV security service. When IntelligentAV is enabled, Gateway AV uses two scan engines to detect and block malware before it can enter your network.
• Configure File ExceptionsFeature Details You can now add exceptions for files that you do not want to scan with APT Blocker, Data Loss Prevention, Gateway AntiVirus, and IntelligentAV security services.
• Restore Configuration from Fireware Web UIFeature Details You can now restore a saved configuration file from the System > Configuration page in Fireware Web UI.
• Geolocation by PolicyFeature Details You can now enable or disable Geolocation at the policy level.
• FQDN EnhancementsFeature Details FQDN support has been extended to provide greater granularity and flexibility, including wildcard support for multi-level subdomains, more than one FQDN can now resolve to the same IP address, you can use the same FQDN in more than one policy, and FQDN support for SNAT.
• Certificate Management EnhancementsFeature Details This release includes several enhancements for certificate management on a Firebox, including improvements to the certificate list and certificate detail views, the ability to define a certificate display name​, and improvements to the certificate import process.
• Multiple Certificate Support for Inbound HTTPS ProxyFeature Details You can now select and use separate certificates for content inspection for an inbound HTTPS proxy. This enables you to host several different public-facing web servers and applications behind one Firebox and allow different applications to use different certificates for inbound HTTPS traffic.
• Control of Firebox-Generated TrafficFeature Details Configure policies that apply to traffic generated by the Firebox, such as subscription services traffic, Dimension log traffic, SSL management tunnel traffic, and BOVPN over TLS tunnel traffic.
• Loopback interface IP address support for dynamic NATFeature Details You can now specify loopback IP addresses for global dynamic NAT (DNAT) and per-policy dynamic NAT.
• Support for AES-GCM Feature Details AES-GCM is now supported for BOVPN, BOVPN virtual interfaces, BOVPN over TLS, Mobile VPN with IKEv2, and Mobile VPN with SSL. GCM (Galois/Counter Mode) is an authenticated encryption algorithm known for its security, efficiency, and performance.
• Support for Secondary Interface IP Addresses for BOVPN and BOVPN Virtual Interfaces Feature Details When you configure a gateway endpoint in a BOVPN or BOVPN virtual interface configuration, you can now specify a secondary interface IP address.
• Support for Multiple SSO AgentsFeature Details You can now configure up to four SSO Agents on your Firebox for redundancy. If an SSO Agent is not available, failover automatically occurs to the next SSO Agent specified in the Firebox configuration.
• SSO Agent Connection Status Tool Feature Details In the SSO Agent, a new tool shows the connection status for SSO components on your network.
• FQDN Support for Static NAT (SNAT)Feature Details You can now specify an FQDN in a static NAT (SNAT) action to help make policy management easier and to avoid downtime from IP address changes.
• Enhancements to Settings Shared by the Access Portal and Mobile VPN with SSLFeature Details For a better user experience, VPN Portal settings moved to the Access Portal and Mobile VPN with SSL configurations.
• Enhancements to the WatchGuard SSLVPN PolicyFeature Details The WatchGuard SSLVPN policy no longer includes the WG-VPN-Portal alias. Interfaces that appeared in the WG-VPN-Portal alias appear in the WatchGuard SSLVPN policy, which means the policy matches the same traffic.

This release of Fireware includes these new and improved features:

• DNSWatch   Feature Details DNSWatch is a cloud-based security service that monitors DNS requests through the Firebox to prevent connections to known malicious domains.
• TLS Profiles for HTTPS Content Inspection   Feature Details TLS Profiles are now used to configure content inspection settings for the HTTPS proxy.
• Multiple Dynamic DNS providers   Feature Details Fireware now supports multiple dynamic DNS vendors.
• BOVPN over TLS Support in Policy Manager   Feature Details BOVPN over TLS is now supported in Policy Manager. This feature was first supported in Fireware Web UI in Fireware v12.1.
• Hot Plug Support for Modems   Feature Details You can now hot plug USB modems into the Firebox. A reboot of the Firebox is not required.
• USB Modem Support   Feature Details Fireware now supports the Verizon Global modem USB730L (Vendor ID 0x1410, Product ID 0x9032).
• Different Default Gateway for DHCP Server   Feature Details For a Firebox interface configured as a DHCP server, you can now specify a default gateway IP address that is not the Firebox interface IP address.
• Firewall Policies for Intra-LAN Traffic   Feature Details When you create a new external VLAN interface, the option to apply firewall policies to intra-VLAN traffic option is now enabled by default.
• Per-Interface DHCP Relay   Feature Details When you enable DHCP Relay on an interface, the DHCP relay servers you specify now apply only to that interface.
• Disconnect wireless client from the Wireless Statistics page    Feature Details You can now disconnect a wireless client from the Firebox from the Wireless Statistics page.
• WEP encryption is not supported for Open System and Shared Key wireless authentication  Feature Details You can no longer save a configuration with WEP encryption enabled.

This release of Fireware includes these new and improved features:

• Access Portal   Feature Details Access Portal is a new feature that connects users to web applications, RDP sessions, and SSH sessions within a web browser. SAML single sign-on is supported.
• Mobile VPN with IKEv2   Feature Details Mobile VPN with IKEv2 is a new feature that supports VPN connections from native IKEV2 clients on Windows, Mac OS, and iOS. Android devices are supported with the third-party strongSwan app.
• BOVPN over TLS   Feature Details Configure the new BOVPN over TLS feature to create VPN tunnels that use TLS for secure communication between Fireboxes.
• IPv4 Wildcard Addresses in Aliases in Device Configuration Templates   Feature Details When you add an alias, you can specify a Host IPv4, Wildcard IPv4, Network IPv4, Host Range IPv4, Host IPv6, Network IPv6, Host Range IPv6, or Host Name (DNS lookup), or import a list of FQDN addresses.
• Modem Interfaces   Feature Details When you add a modem to your Firebox, it is configured as a dedicated external interface that can participate in multi-WAN.
• Wildcard IP Addresses    Feature Details Specify wildcard IPv4 addresses in aliases and policies.
• Minimum Association RSSI, Smart Steering, and Band Steering    Feature Details AP120, AP300, AP320, AP322, and AP420 now support minimum association RSSI and smart steering on the Gateway Wireless Controller. Formerly known as Fast Handover, these options are now configured for each SSID with advanced steering parameters configured in the AP settings. Band Steering parameters are also now configured per SSID.
• Import and Export Alias Members from a Text File    Feature Details You can import a list of alias members from a text file. You can also export a list of alias members to a text file. These options were only available in the Web UI in Fireware v12.0.1. In Fireware v12.1, these options are now also available in Policy Manager.
• Multi-WAN Link Monitor Enhancements   Feature Details You can now disable link monitor for any interface. When you add a new interface, link monitor is enabled by default for all interfaces except modem interfaces.

This release of Dimension includes these new and improved features:

• Logging Authentication Key  Feature Details The Logging Encryption Key has been renamed to Logging Authentication Key to align with the same change in Fireware.
• Email Encryption Allowed by Default    Feature Details The email encryption option is now set to Allowed by default.

This release of Fireware includes these new and improved features:

• Support Access  Feature Details You can now enable Support Access to create a temporary read-only account and enable connections to your Firebox from WatchGuard Support.
• Policy Manager save a configuration for a specific Fireware version  Feature Details In Policy Manager you can now save a configuration for a specific version of Fireware. This is most useful for RapidDeploy.
• Gateway AV Scan Size Limit defaults updated   Feature Details The default and maximum scan size limits changed in Fireware v12.0.1. Gateway AntiVirus default and maximum scan size limits are set based on the hardware capabilities of each Firebox model.
• Gateway AV actions updated in proxy action settings   Feature Details The Gateway AV proxy action settings now include an Enable Gateway AV check box that automatically changes all Allow actions in the proxy action to AV Scan. You can also now configure the action to take when a file cannot be scanned because it is encrypted or exceeds the scan limit.
• Gateway AV decompression is always enabled  Feature Details Gateway AntiVirus file decompression is always enabled, and there are no configurable settings. The number of levels to scan depends on the Firebox model.
• Setup wizards default configuration settings updates  Feature Details In the Default-HTTP-Client proxy action, the action for the Windows EXE/DLL Body Content Rule is set to AV Scan instead of Deny. The APT Blocker action for High level threats is set to Drop instead of Block. The action for IPS Low level threats is set to Drop instead of Allow.
• YouTube for Schools settings removed from the HTTP proxy    Feature Details The YouTube for Schools option has been removed from the General Settings in the HTTP proxy action configuration. YouTube for schools is no longer supported by Google.
• KRACK WPA/WPA2 wireless vulnerability mitigation   Feature Details Mitigate KRACK WPA/WPA2 vulnerabilities by blocking handshake messages that can potentially exploit clients and force clients to reauthenticate.
• Integration support for Autotask    Feature Details You can configure your Firebox to integrate with Autotask, a professional services automation tool.
• Import and export a list of alias members from a text file    Feature Details You can import a list of alias members from a text file with Fireware Web UI. You can also export a list of alias members from Fireware Web UI to a text file. These options are not available in Policy Manager in Fireware v12.0.1.

This release of Fireware includes these new and improved features:

• Content Actions for HTTP Host Header Redirection   Feature Details You can now use a content action in an HTTP server proxy policy or HTTPS server proxy action to redirect inbound HTTP requests based on the domain and path in the host header. This feature includes an option for TLS/SSL offloading for inspected HTTPS content.
• Routing Actions in HTTPS Server Proxy Actions   Feature Details In the domain name rules for an HTTPS server proxy action you can now specify a routing action to route inbound HTTPS requests to a specific server IP address and port based on a domain name match.
• IMAP Proxy   Feature Details Fireware now supports an IMAP proxy. This does not include support for encrypted IMAP over TLS/SSL.
• APT Blocker Zero Day Protection in the SMTP Proxy   Feature Details When APT Blocker is enabled in the SMTP proxy, the SMTP proxy does not deliver the message until the file has been analyzed for APT threats. The same behavior applies to APT Blocker in the new IMAP proxy.
• Gateway AV Signatures   Feature Details Gateway AV now uses updated signatures for improved virus detection and better performance.
• APT Blocker Scanning of JavaScript Email Attachments   Feature Details APT Blocker can now scan JavaScript (.js) files attached to email messages.
• Mobile VPN with PPTP Feature Removed  Feature Details Mobile VPN with PPTP is now not available with Fireware OS. PPTP is an older VPN protocol that is not considered secure.
• Updated Default BOVPN and BOVPN Virtual Interface Security Settings   Feature Details New BOVPN, BOVPN virtual interface, and Mobile VPN connections created in Fireware v12.0 have stronger default authentication and encryption settings.
• Updated Default Mobile VPN Security Settings   Feature Details New BOVPN, BOVPN virtual interface, and Mobile VPN connections created in Fireware v12.0 have stronger default authentication and encryption settings.
• Removed Obsolete Security Settings from Mobile VPN with SSL  Feature Details Three obsolete security settings were removed from Mobile VPN with SSL: Blowfish, DES, and MD5.
• Updated Mobile VPN with SSL Status Icons Feature Details The connection status icons for Mobile VPN with SSL that appear in your Windows system tray or Mac OS X menu bar were redesigned. The new icons are easier to see and understand.
• Renamed Authentication Exceptions list in the Hotspot Settings    Feature Details The Authentication Exceptions list in the Hotspot settings is now called Walled Garden.
• Wireless Rate Shaping Enhancements   Feature Details You can now configure separate upload and download rate limits per SSID and per user in an SSID configuration.
• ConnectWise Default Service Ticket Priority   Feature Details You can now configure the default ticket priority for service tickets generated by a Firebox defined in ConnectWise.
• Multicast Routing   Feature Details Fireware now includes support for multicast routing, a networking method for efficient distribution of one-to-many traffic.