The Fireware XTM device configuration has a policy called WatchGuard Web UI. This policy controls which XTM device interfaces can connect to Fireware XTM Web UI. By default, this policy only allows connections from Any-Trusted and Any-Optional networks. If you want to allow access to the Web UI from the external network, you must edit the WatchGuard Web UI policy and add Any-External to the From list.
In Fireware XTM Web UI:
Connect to Fireware XTM Web UI