Add a Cloud-Managed FireCluster

This document applies to Fireboxes you manage in WatchGuard Cloud. For information that applies to Fireboxes managed in Fireware Web UI or WatchGuard System Manager, go to:

• Configure FireCluster (Locally-managed FireCluster)

1. Reset both Fireboxes to factory-default settings. For more information, go to Reset a Firebox.
2. Log in to your WatchGuard Cloud Subscriber account.
3. Select Configure > Devices.
4. Click Add Device.
   A list of activated devices appears. If the list does not include your devices, review the requirements in Before You Configure a Cloud-Managed FireCluster in WatchGuard Cloud.

5. Click Add FireCluster.
   The selection page for the first FireCluster member opens.

6. To add the first FireCluster member, select a Firebox name.
   The selection page for the second FireCluster member opens.

7. To add the second FireCluster member, do one of the following:
   • From the list of devices, select a Firebox name.
     Selected FireCluster members appear next to the device list.
   • Enter the serial number of the second FireCluster member and click Add.
     

8. Click Add FireCluster.
   A confirmation page opens.

9. From the FireCluster Management drop-down list, select Cloud-Managed.
10. Click Next.
    The Configuration Type page opens.
11. From the Configuration Type drop-down list, select Create a New Configuration.
    
12. Click Next.
    The Begin Setting up Your FireCluster page opens.

• Enter the FireCluster Name.
• Enter the Member1 Name.
• Enter the Member2 Name.
• Select a Time Zone. The time zone settings control the date and time that appear in the log messages and reports for your FireCluster.
• Select the device folder for your Firebox. Device Folders help you view status and summary data for groups of devices.
  If you have only one root folder, the folder list does not appear.

13. Click Next.
14. From the Cluster Interface drop-down list, select an interface.
    Cluster members use this dedicated interface to exchange heartbeat packets and to synchronize connection and session information.

15. In the Member1 Cluster IP Address and Member2 Cluster IP Address text boxes, enter an IP address that is not in use on your network.
    To avoid conflicts with routable IP addresses, we recommend APIPA addresses or IP addresses from a dedicated private subnet.
16. In the Cluster ID text box, enter a number from 1 through 255. The default cluster ID is 50.
    The Cluster ID determines the virtual MAC (VMAC) addresses that cluster member interfaces use. If you add a second FireCluster to the same subnet, enter a Cluster ID that is different enough from the Cluster ID of the first FireCluster to avoid a virtual MAC address conflict. For information about how the VMAC address is calculated, go to Active/Passive Cluster ID and the Virtual MAC Address.
17. (Optional) To add redundancy, select Assign Backup Cluster Interface. The FireCluster uses the backup cluster interface if the primary cluster interface fails. We recommend this option for FireCluster members separated by a switch without a direct cable connection between cluster members. For more information about this setting, go to Before You Configure a Cloud-Managed FireCluster in WatchGuard Cloud.
    1. From the Backup Cluster Interface drop-down list, select an interface.
    2. In the Member1 Cluster Backup IP Address and Member2 Cluster Backup IP Address text boxes, enter an IP address that is not in use on your network. To avoid conflicts with routable IP addresses, we recommend APIPA addresses or IP addresses from a dedicated private subnet.

If you use both primary and backup cluster interfaces, the interfaces must be on different subnets. We recommend that you do not use a switch between each member for the cluster interfaces. If you do use a switch between cluster members, the cluster interfaces must be logically separated from each other on different VLANs. We recommend that you configure a backup cluster interface if you separate the cluster interfaces with a switch.

18. Click Next.
19. From the IP Address Configuration drop-down list, select Static, DHCP, or PPPoE.
20. If you selected Static:
    1. In the IP Address text box, enter an IP address for the external interface.
    2. In the Gateway text box, enter an IP address for the gateway.
    3. In the Public DNS Server text box, enter the IP address of a public DNS server for name resolution.

21. If you selected DHCP or PPPoE:
    1. Select Obtain an IP Address Automatically or Use This IP Address.
    2. Enter the Client Name.
    3. Enter the Host Name.
    4. If you selected Use This IP Address, enter an IP address.
22. Click Next.
23. Enter the Internal Network IP Address.
24. (Optional) Select Enable DHCP Server on Internal Network.
    1. Enter a Starting IP Address.
    2. Enter an Ending IP Address.
25. In the Member1 Communication IP Address text box, type an IP address that is on the same subnet as your internal network. Your Dimension or syslog server must also be on this network.
26. In the Member2 Communication IP Address text box, type an IP address that is on the same subnet as your internal network. Your Dimension or syslog server must also be on this network.

27. Click Next.
28. (Optional) If your Firebox is a wireless model, on the Configure Wireless Settings page, you can enable these options:
    • Enable Wireless — If you enable this option, enter the SSID and Passphrase for your internal wireless network.
    • Enable Guest Wireless — If you enable this option, enter the SSID and Passphrase for your guest wireless network.

Click Next.

29. Set the Status and Admin user device passwords for connections to Fireware Web UI on the Firebox. Device passwords must be 8–32 characters long, and must contain uppercase and lowercase letters, at least one number, and at least one symbol. The Status and Admin passwords cannot be the same.

30. To complete the FireCluster configuration, click Next.
    
31. Follow the instructions on the Connect Your FireCluster page.
    • Connect the primary cluster interface on one Firebox to the primary cluster interface on the other Firebox.
    • On both Fireboxes, connect interface 0 to an Internet connection.
    • Plug in and power on both Fireboxes.

    For information about cabling and network topology, go to Connect the Hardware for a Cloud-Managed FireCluster.

    

32. Click Done.

This feature is available only to participants in the WatchGuard Cloud Beta program.

When you import a configuration from a Firebox, you can import some configuration settings from an existing Firebox configuration file to a cloud-managed FireCluster configuration. Some configuration settings are not importable. For more information about how to import configuration settings, go to Import Configuration Settings from a Firebox Configuration File.

If the file contains settings that conflict with Firebox default objects such as a default alias, the Add Device wizard uses the default objects. For more information about duplicate settings, go to Import Configuration Settings from a Firebox Configuration File.

Before you import an .XML configuration file to add a cloud-managed FireCluster, make sure that you have exported a valid .XML configuration file from a Firebox. For more information, go to Configuration File Requirements.

You configure the Cluster Interface and Cluster ID in the Add Device wizard. The wizard does not import cluster interface settings from the .XML file.

1. Reset both Fireboxes to factory-default settings. For more information, go to Reset a Firebox.
2. Log in to your WatchGuard Cloud Subscriber account.
3. Select Configure > Devices.
4. Click Add Device.
   
   A list of activated devices appears. If the list does not include your devices, review the requirements in Before You Configure a Cloud-Managed FireCluster in WatchGuard Cloud.

5. Click Add FireCluster.
   
   The selection page for the first FireCluster member opens.

6. To add the first FireCluster member, select a Firebox name.
   
   The selection page for the second FireCluster member opens.

7. To add the second FireCluster member, select a Firebox name or enter the serial number of the second FireCluster member and click Add.

8. Click Add FireCluster.
   
   A confirmation page opens.

9. From the FireCluster Management drop-down list, select Cloud-Managed.
   
10. Click Next.
    The Configuration Type page opens.
11. From the Configuration Type drop-down list, select Import an XML Configuration File.

12. Click Next.
    The Begin Setting Up Your FireCluster page opens.
13. Configure these FireCluster system settings:
    • Enter the FireCluster Name.
    • Enter the Member1 Name.
    • Enter the Member2 Name.
    • From the Time Zone drop-down list, select the time zone of the location where the FireCluster is installed.
    • Select the device folder for your FireCluster. Device Folders help you view status and summary data for groups of devices.
      If you have only one root folder, the folder list does not appear.

14. Click Next.
15. From the Cluster Interface drop-down list, select an interface.
    Cluster members use this dedicated interface to exchange heartbeat packets and to synchronize connection and session information. Networks in the .XML file that use this interface are not importable.

16. In the Member1 Cluster IP Address and Member2 Cluster IP Address text boxes, enter an IP address that is not in use on your network.
    To avoid conflicts with routable IP addresses, we recommend APIPA addresses or IP addresses from a dedicated private subnet.
17. In the Cluster ID text box, enter a number from 1 through 255. The default cluster ID is 50.
    The Cluster ID determines the virtual MAC (VMAC) addresses that cluster member interfaces use. If you add a second FireCluster to the same subnet, enter a Cluster ID that is different enough from the Cluster ID of the first FireCluster to avoid a virtual MAC address conflict. For information about how the VMAC address is calculated, go to Active/Passive Cluster ID and the Virtual MAC Address.
18. (Optional) To add redundancy, select Assign Backup Cluster Interface. The FireCluster uses the backup cluster interface if the primary cluster interface fails. We recommend this option for FireCluster members separated by a switch without a direct cable connection between cluster members. For more information about this setting, go to Before You Configure a Cloud-Managed FireCluster in WatchGuard Cloud.
    1. From the Backup Cluster Interface drop-down list, select an interface.
    2. In the Member1 Cluster Backup IP Address and Member2 Cluster Backup IP Address text boxes, enter an IP address that is not in use on your network. To avoid conflicts with routable IP addresses, we recommend APIPA addresses or IP addresses from a dedicated private subnet.

If you use both primary and backup cluster interfaces, the interfaces must be on different subnets. We recommend that you do not use a switch between each member for the cluster interfaces. If you do use a switch between cluster members, the cluster interfaces must be logically separated from each other on different VLANs. We recommend that you configure a backup cluster interface if you separate the cluster interfaces with a switch.

19. Click Next.
20. Set the Status and Admin user device passwords for connections to Fireware Web UI on the Firebox. Device passwords must be 8–32 characters long, and must contain uppercase and lowercase letters, at least one number, and at least one symbol. The Status and Admin passwords cannot be the same.

Caution: To keep your device secure, make sure you do not use the default passwords for the admin account (readwrite) and status account (readonly). We recommend that you specify unique passwords for each Firebox you manage and change them frequently.

21. Click Next.
    The Import Configuration page opens.
22. Drag the .XML configuration file to the import box, or click the import box, and click Browse to select the file.

23. Click Next.
    The Aliases page opens.

24. To import an alias, select the check box next to each alias. The page shows the number of aliases available for import and the number of aliases found in the configuration file.
25. Click Next.
    The Exceptions page opens.
26. Select the check box next to each exception to import. The page shows the number of exceptions available for import and the number of exceptions found in the configuration file.
27. Click Next.
    The Routes page opens.
28. Select the check box next to each route to import. The page shows the number of routes available for import and the routing distance found in the configuration file.
29. Click Next.
    The Blocked Ports page opens.
30. Select the check box next to each blocked port to import. The page shows the number of blocked ports available for import in the configuration file.
31. Click Next.
    The Blocked Sites page opens.
32. Select the check box next to each blocked site to import. The page shows the number of blocked sites available for import and their description in the configuration file.
33. Click Next.
    The Dimension Servers page opens and shows the Dimension servers on the cloud-managed FireCluster.
34. (Optional) To change the list of Dimension servers, click Select Server.
    A dialog box opens and shows the list of available Dimension servers.
    1. Select the check box next to the Dimension servers that you want to use with WatchGuard Cloud. You can select up to two Dimension servers from the list.
    2. Click OK.
       
35. To prioritize Dimension servers, click the move handle for a server and drag it to a new position in the list.
36. Click Next.
    The Syslog Servers page opens. The list of servers includes syslog servers from both the import file and the cloud-managed configuration.
37. Select the check box next to each syslog server that you want to use with WatchGuard Cloud. You can select up to three syslog servers.
38. Click Next.
    The Technology Integrations page opens.
39. Select the check box next to each technology integration to import.

When you import a technology integration, it replaces an existing technology integration of the same type. For more information, go to About Firebox Technology Integrations.

40. Click Next.
    The Networks page opens. The page shows the number of networks available for import and the number of networks found in the configuration file.

When you import a network, WatchGuard Cloud imports the network and the associated interface and network settings from the configuration file. Depending on the configuration, this can include:

• Physical, VLAN, bridge, and link aggregation (LAG) interfaces
• Internal, external, and wireless networks
• IP address and secondary network settings
• DHCP client or server settings, including DHCP reservations
• DNS and WINS settings
• MAC address control lists
• Other cloud-supported interface properties, such as MTU and link speed

You must import an entire network and its settings. Partial network configurations, such as DHCP reservations or secondary networks only, are not supported. Unsupported or non-imported settings can appear as not importable in the Import Configuration wizard. For more information, go to Not Importable Settings.

For a FireCluster, the primary and backup cluster interfaces that you selected for the FireCluster are already in use. Networks that include those interfaces are not importable.

41. Select the check box next to each network you want to import.
42. (Optional) If you want to manually configure an external network or create a default internal network:
    • To configure an external network later in the wizard, select Manually Configure.
    • To create a default internal network, select Default Internal.

    

43. If you import an Optional or Custom network from a locally-managed Firebox configuration, the Import Configuration wizard prompts you to select a different network type.

    WatchGuard Cloud does not support Optional or Custom network types. If the configuration file includes an Optional or Custom network, select Internal or Guest as the network type for the cloud-managed configuration.

    To select a different network type, from the Optional or Custom drop-down list, select Internal or Guest.

44. Click Next.
    If you imported networks, the Finish page opens. If you did not import networks, a network configuration page opens.

45. If you did not import an external network, configure an external network manually. From the IP Address Configuration drop-down list, select Static, DHCP, or PPPoE, then complete the settings.

46. Click Next.
    The page to configure FireCluster member communication IP addresses opens.
47. From the Select an Internal Network drop-down list, select an internal network for the member communication IP addresses.
48. In the Member1 Communication IP Address text box, type an IP address that is on the same subnet as the selected internal network. Your Dimension or syslog server must also be on this network.
49. In the Member2 Communication IP Address text box, type an IP address that is on the same subnet as the selected internal network. Your Dimension or syslog server must also be on this network.

50. Click Next.
    The Connect Your FireCluster page opens.
51. Follow the instructions on the Connect Your FireCluster page.
    • Connect the primary cluster interface on one Firebox to the primary cluster interface on the other Firebox.
    • On both Fireboxes, connect interface 0 to an Internet connection.
    • Plug in and power on both Fireboxes.

For information about cabling and network topology, go to Connect the Hardware for a Cloud-Managed FireCluster.

52. Click Done to stage your changes, or click Deploy Now to deploy the changes immediately.
    

1. Log in to your WatchGuard Cloud Subscriber account.
   For Service Provider operators, from Account Manager, select My Account.
2. Select Configure > Devices.
3. Select the FireCluster.
   The Device Settings page opens.
4. In the Cloud Management section, click Change to Cloud Management.
   The Add Device wizard opens.
5. (Optional) Edit the FireCluster Name.
6. (Optional) Edit the Member1 Name.
7. (Optional) Edit the Member2 Name.
8. (Optional) Edit the Time Zone.
9. Click Next.
10. From the Cluster Interface drop-down list, select an interface.
    Cluster members use this dedicated interface to exchange heartbeat packets and to synchronize connection and session information.
    
11. In the Member1 Cluster IP Address and Member2 Cluster IP Address text boxes, enter an IP address that is not in use on your network.
    To avoid conflicts with routable IP addresses, we recommend APIPA addresses or IP addresses from a dedicated private subnet.
    
12. In the Cluster ID text box, enter a number from 1 through 255.
    The Cluster ID determines the virtual MAC (VMAC) addresses used by the interfaces of the clustered devices. If you add a second FireCluster to the same subnet, set the Cluster ID to a number that is different enough from the Cluster ID of the first FireCluster to avoid a virtual MAC address conflict. For information on how the VMAC address is calculated, go to Active/Passive Cluster ID and the Virtual MAC Address.
    

13. (Optional) To add redundancy, select Assign Backup Cluster Interface. The FireCluster uses the backup cluster interface if the primary cluster interface fails. We recommend this option for FireCluster configurations without a direct cable connection between cluster members. For more information about this setting, go to Before You Configure a Cloud-Managed FireCluster in WatchGuard Cloud.
    1. From the Backup Cluster Interface drop-down list, select an interface.
    2. In the Member1 Cluster Backup IP Address and Member2 Cluster Backup IP Address text boxes, enter an IP address that is not in use on your network. To avoid conflicts with routable IP addresses, we recommend APIPA addresses or IP addresses from a dedicated private subnet.

If you use both primary and backup cluster interfaces, the interfaces must be on different subnets. We recommend that you do not use a switch between each member for the cluster interfaces. If you do use a switch between cluster members, the cluster interfaces must be logically separated from each other on different VLANs. We recommend that you configure a backup cluster interface if you separate the cluster interfaces with a switch.

14. Click Next.
15. (Optional) Edit the IP Address Configuration. From the drop-down list, select Static, DHCP, or PPPoE.
16. In the IP Address text box, enter an IP address for the external interface.
17. In the Gateway text box, enter an IP address for the gateway.
18. In the Public DNS Server text box, enter the IP address of a public DNS server for name resolution.

19. Click Next.
20. (Optional) Edit the Internal Network IP Address.
21. (Optional) Select Enable DHCP Server on Internal Network.
    1. Enter a Starting IP Address.
    2. Enter an Ending IP Address.
22. In the Member1 Communication IP Address text box, type an IP address that is on the same subnet as your internal network. Your Dimension or syslog server must also be on this network.
23. In the Member2 Communication IP Address text box, type an IP address that is on the same subnet as your internal network. Your Dimension or syslog server must also be on this network.

24. Click Next.
25. (Optional) If your Firebox is a wireless model, on the Configure Wireless Settings page, you can enable these options:
    • Enable Wireless — If you enable this option, enter the SSID and Passphrase for your internal wireless network.
    • Enable Guest Wireless — If you enable this option, enter the SSID and Passphrase for your guest wireless network.

26. Enter the passwords for the built-in Status and Admin user accounts. The passwords must be different.

    

27. To complete the configuration and change to cloud management, click OK.
    The confirmation page opens.

28. Click Done.

After you deploy the configuration change, the cloud-managed configuration replaces the locally-managed configuration on the Firebox. You can no longer locally manage the FireCluster in WatchGuard System Manager, Fireware Web UI, or CLI.

29. Schedule a deployment.
    For more information, go to Manage Device Configuration Deployment.
30. In WatchGuard Cloud, select Monitor > Devices and view the Device Summary of the FireCluster to verify the connection to WatchGuard Cloud.

Only the cluster master connects to WatchGuard Cloud.

• The status of the cluster master is Connected.
• The status of the backup master is Never Connected or Not Connected because the backup master connects only if the current cluster master is unavailable.