Add a Cloud-Managed Firebox to WatchGuard Cloud

For a Firebox to successfully connect to WatchGuard Cloud as a cloud-managed device, it must run Fireware v12.5.7 or higher.

The Fireware version your new Firebox was manufactured with is printed on a sticker on the Firebox packaging. The version of Fireware originally manufactured on the device also appears in the Device Information section of the Product Details page in the WatchGuard website.

If your Firebox runs a lower version of Fireware, you must first set up the Firebox as a locally-managed device and upgrade it to Fireware v12.5.7 or higher before you can add it as a cloud-managed device. The device automatically upgrades to the latest Fireware version for that device. For information about Fireware upgrade methods, go to Firebox Upgrade, Downgrade, and Migration.

If you previously configured the Firebox as a locally-managed device, you must reset it to factory-default settings before it can connect to WatchGuard Cloud as a cloud-managed device. For the steps to reset your Firebox, go to Reset a Firebox.

1. From the Device Management drop-down list, select Cloud-Managed, then click Next.
2. Select Create a New Configuration or Copy a Configuration from Another Cloud-Managed Firebox.

If you copy configuration settings from another cloud-managed Firebox, you must select the Firebox you want to copy from. The Firebox must be in the same account.

3. Click Next.
   The Begin Setting Up Your Firebox page opens.
4. Configure Firebox system settings:
   • Device Name — The name to identify the Firebox in WatchGuard Cloud.
   • Time Zone — The time zone of the location where the Firebox is installed.
   • From the Device Folder drop-down list, select the folder that you want to add your device to. Device Folders help you view status and summary data for groups of devices.
     If you have only one root folder, the folder list does not appear.

5. Click Next.
6. From the Connection Type drop-down list, select an option for the Firebox external interface. Select and configure one of these options:

DHCP

Select this option to configure the Firebox to use DHCP to request an IP address on the external network.

If you select DHCP, there are no other network settings to configure.

Static IP

Select this option to configure the Firebox to use a static IP address on the external network.

If you select Static IP, configure the Firebox external network IP address and netmask, a network gateway on the same subnet, and the IP address for a public DNS server.

PPPoE

Select this option to configure the Firebox to use PPPoE to get an IP address on the external network.

If you select PPPoE, configure the user name and password, and select whether to obtain an IP address automatically or to configure a specific IP address.

4G LTE or 5G Modem

If you have a Firebox with a 4G LTE interface module or integrated 5G modem, you can enable the cellular connection.

To establish a connection for a cellular modem, some wireless service providers require an Access Point Name (APN). To determine the requirements to configure your cellular modem, verify with your provider whether an APN is required to connect.

7. For a wireless Firebox, you can enable wireless on the internal and guest networks.
   • Enable Wireless — Enable this option to configure an SSID and passphrase for wireless connections to the internal network.
   • Enable Guest Wireless — Enable this option to configure an SSID and passphrase for wireless connections to the guest network.

8. Click Next.
9. Set the Status and Admin user device passwords for connections to Fireware Web UI on the Firebox. Device passwords must be 8–32 characters long, and must contain uppercase and lowercase letters, at least one number, and at least one symbol. The Status and Admin passwords cannot be the same.

Caution: We recommend that you specify unique passwords for each Firebox you manage and change them frequently.

For a cloud-managed Firebox, you can use Web UI to recover the Firebox connection to WatchGuard Cloud. You cannot use Web UI to modify the Firebox configuration.

10. Click Next.
11. On the last page of the Add Device wizard, review the steps to connect the Firebox.

If the Firebox uses factory-default settings and you created a new configuration, the Firebox connects to WatchGuard Cloud and the new configuration deploys to it.

When you copy a configuration from an existing Firebox, review the additional steps you might need to complete before you deploy your configuration. WatchGuard Cloud holds the updated configuration until you deploy it to the Firebox.

If the Connection Type is Static IP or PPPoE, you must complete additional steps to configure the Firebox to connect.

• To print the entire page of instructions, click Print Instructions.
• To download the connection settings, click Download the Connection Settings File. These requirements apply when you download the file: 
  • The USB drive must be formatted with the FAT, VFAT, or FAT32 file system and must be writable. 
  • The file must be saved as the CSV (Comma Delimited) (*.csv) file type.

For more information, go to Use a USB Drive to Configure Interface Settings.

After you add a cloud-managed Firebox, the device configuration is immediately deployed and available for the Firebox to download.

If you re-add a Firebox that you removed from WatchGuard Cloud, and if the current configuration does not include a branch office virtual private network (BOVPN), you can revert to a previous configuration version that includes a BOVPN. The BOVPN tunnel rejoins if you did not remove the BOVPN configuration on the peer endpoint Firebox. If you deployed any configuration on the peer endpoint Firebox after you removed the other Firebox, but before you re-added the other Firebox, you must deploy the configuration on the peer endpoint Firebox if you receive a message about undeployed BOVPN changes.

The availability of previous configuration versions depends on your data retention settings. For information about data retention, go to About Data Retention and Data Deletion.

If the configuration was not successfully deployed, a default name for the new device shows in the WatchGuard Cloud list of devices.

When you import a configuration from a Firebox, you can import some configuration settings from an existing Firebox configuration file to a cloud-managed Firebox configuration. Some configuration settings are not importable. For more information about how to import configuration settings, go to Import Configuration Settings from a Firebox Configuration File.

If the file contains settings that conflict with Firebox default objects such as a default alias, the Add Device wizard uses the default objects. For more information about duplicate settings, go to Import Configuration Settings from a Firebox Configuration File.

Before you import an .XML configuration file to add a cloud-managed Firebox, make sure that you have exported a valid .XML configuration file from the Firebox you are adding to WatchGuard Cloud. For more information, go to Configuration File Requirements.

You cannot use the .XML configuration import in the Add Device wizard for Firebox Cloud.

To import an .XML configuration file from another device:

1. From the Device Management drop-down list, select Cloud-Managed, then click Next.
2. From the Configuration Type drop-down list, select Upload an XML Configuration File.

3. Click Next.
4. Configure these Firebox system settings:
   • Device Name — The name to identify the Firebox in WatchGuard Cloud.
   • Time Zone — The time zone of the location where the Firebox is installed.
   • From the Device Folder drop-down list, select the folder that you want to add your device to. Device Folders help you view status and summary data for groups of devices.
     If you only have only one root folder, the folder list does not appear.
5. Click Next.
6. Set the Status and Admin user Firebox device passwords for connections to Fireware Web UI on the Firebox. Device passwords must be 8–32 characters long, and must contain uppercase and lowercase letters, at least one number, and at least one symbol. The Status and Admin passwords cannot be the same.

Caution: To keep your device secure, make sure you do not use the default passwords for the admin account (readwrite) and status account (readonly). We recommend that you specify unique passwords for each Firebox you manage and change them frequently.

For a cloud-managed Firebox, you can use Web UI to recover the Firebox connection to WatchGuard Cloud. You cannot use Web UI to modify the Firebox configuration.

7. Click Next.
   The Import Configuration page opens.
8. Drag the .XML configuration file to the import box, or click the import box and click Browse to select the file.

9. Click Next.
   The Aliases page opens.

10. To import an alias, select the check box next to each alias. The page shows the number of aliases available to import and the number of aliases found in the configuration file.
11. Click Next.
    The Exceptions page opens.
12. Select the check box next to each exception to import. The page shows the number of exceptions available to import and the number of exceptions found in the configuration file.
13. Click Next.
    The Routes page opens.
14. Select the check box next to each route to import. The page shows the number of routes available to import and the routing distance found in the configuration file.
15. Click Next.
    The Blocked Ports page opens.
16. Select the check box next to each blocked port to import. The page shows the number of blocked ports available to import in the configuration file.
17. Click Next.
    The Blocked Sites page opens.
18. Select the check box next to each blocked site to import. The page shows the number of blocked sites available to import and their description in the configuration file.
19. Click Next.
    The Dimension Servers page opens and shows the Dimension servers on the cloud-managed Firebox.
20. (Optional) To change the list of Dimension servers, click Select Server.
    A dialog box opens and shows the list of available Dimension servers.
    1. Select the check box next to the Dimension servers that you want to use with WatchGuard Cloud. You can select up to two Dimension servers from the list.
    2. Click OK.
       

21. To prioritize Dimension servers, click the move handle for a server and drag it to a new position in the list.
22. Click Next.
    The Syslog Servers page opens. The list of servers includes syslog servers from both the import file and the cloud-managed configuration.
23. Select the check box next to each syslog server that you want to use with WatchGuard Cloud. You can select up to three syslog servers.
24. Click Next.
    The Technology Integrations page opens.
25. Select the check box next to each technology integration to import.

When you import a technology integration, it replaces an existing technology integration of the same type. For more information, go to About Firebox Technology Integrations.

26. Click Next.
    The Networks page opens. The page shows the number of networks available to import and the number of networks found in the configuration file.

    When you import a network, WatchGuard Cloud imports the network and the associated interface and network settings from the configuration file. Depending on the configuration, this can include:

    • Physical, VLAN, bridge, and link aggregation (LAG) interfaces
    • Internal, external, and wireless networks
    • IP address and secondary network settings
    • DHCP client or server settings, including DHCP reservations
    • DNS and WINS settings
    • MAC address control lists
    • Other cloud-supported interface properties, such as MTU and link speed

You must import an entire network and the network settings. You cannot import only part of a network configuration, such as only DHCP reservations or secondary networks. The Add Device wizard does not import network settings that WatchGuard Cloud does not support. For example, loopback interfaces are not imported. The wizard also does not import SD-WAN actions, even though WatchGuard Cloud supports SD-WAN actions. Unsupported settings or settings that are not imported can appear as not importable in the Import Configuration wizard. For more information, go to Not Importable Settings.

27. Select the check box next to each network you want to import.
28. (Optional) If you want to manually configure an external network or create a default internal network:
    • To configure an external network later in the wizard, select Manually Configure.
    • To create a default internal network, select Default Internal.

    

29. If you import an Optional or Custom network from a locally-managed Firebox configuration, the Import Configuration wizard prompts you to select a different network type.

    WatchGuard Cloud does not support Optional or Custom network types. If the configuration file includes an Optional or Custom network, select Internal or Guest as the network type for the cloud-managed configuration.

To select a different network type, from the Optional or Custom drop-down list, select Internal or Guest.

30. Click Next.
    The Finish page opens.

31. Click Next.
32. If you did not import an external network, configure an external network manually. From the IP Address Configuration drop-down list, select Static, DHCP, or PPPoE, then complete the settings. For more information, go to Select External Interface Connection Type.

33. If the imported XML configuration contains unused interfaces, select how to handle them. By default, Disable Unused Interfaces is selected.

If you select Bridge, a drop-down list opens with all networks currently associated with the configuration. Select the network to which you want to bridge the unused interfaces.

34. Click Next.
    The Finish page opens.

35. Click Done to stage your changes, or click Deploy Now to deploy the changes immediately.