WatchGuard Blog: Support Alerts

Knowledge Base Digest - May 2023

Sandra Takeuchi — Thu, 01 Jun 2023 15:06:08 -0700

Articles

Known Issues

AP225W does not connect to Wi-Fi Cloud after reset to factory-default settings
App Hibernation and Ignore Battery Optimizations Permission Issues in WatchGuard Mobile Security app (Android 12 and higher)
APs might reboot with the log message "Insufficient beacons transmitted. Device in error state"
DNSWatchGO: Host name resolves to public IP after internal DNS specified in Fortinet SSLVPN
DNSWatchGO and mobile VPNs
Fireware Web UI shows 5G wireless channels not available in the EU region
High connection count and proxies cause Web UI Front Panel and FireWatch Destination tab to load slowly
Mobile VPN with IKEv2 client profiles disconnect after 8 minutes on macOS and iOS devices
Phishing video link in customized DNSWatch Block page not available
Policy Manager requires global default gateway configuration with wireless as an external interface on T25/T45
SNMP polling for interface information returns "No Such Instance" error on T20-W/T40-W with Wi-Fi enabled
WatchGuard Cloud status loops between Registered and Pending Registration when Firebox time is in the past
Wireless client enabled as external interface unavailable in BOVPN configuration

New or Updated Video Tutorials

EDR Core

Knowledge Base Digest - April 2023

Sandra Takeuchi — Fri, 05 May 2023 06:50:05 -0700

Articles

Known Issues

Knowledge Base Digest - March 2023

Sandra Takeuchi — Fri, 07 Apr 2023 08:01:09 -0700

Articles

Known Issues

New or Updated Video Tutorials

Wi-Fi Cloud Maintenance and changes coming to Wi-Fi Cloud

Matthew Terry — Tue, 04 Apr 2023 08:07:41 -0700

Valued Wi-Fi Cloud WatchGuard Partners and Customers,

This notification is to inform you of the intention to remove the Manage Tile from Wi-Fi Cloud. You will no longer be able to use WatchGuard Wi-Fi Cloud Manage UI to configure your wireless network managed in Wi-Fi Cloud. The Manage tile will no longer appear on the Wi-Fi Cloud’s Launchpad dashboard.

The features and functionality of your wireless network will not be impacted, and we invite you that have not started using the Discover Tile to manage, monitor, and troubleshoot your wireless networks managed in Wi-Fi Cloud to contact the WatchGuard Sales Team to discuss a demo or some training for your team to bring your team up to speed on the Discover features and benefits.

This change will take place when WatchGuard does the Wi-Fi Cloud update to version 13.0. This firmware update is targeted to begin on April 7, 2023, and includes critical bug fixes, feature enhancements and the removal of the Manage tile as discussed in this communication.

Any remaining features that are in Manage it need to be migrated over to the Discover UI have been placed on the 2023 roadmap and will be migrated as the feature work is completed.

We apologize for any inconvenience caused by this change. WatchGuard feels like our partners and customers benefit the most from the Discover Management UI and maintaining multiple management UIs continues to become a larger challenge as additional standards and features are added to the platform.

If you have any additional questions regarding this change, please contact WatchGuard Support or your WatchGuard Sales Team.

Sincerely,

The WatchGuard Wi-Fi Team
---------------------------------------

WatchGuard Wi-Fi Cloud production servers will be upgraded to version v13.0 starting on Friday, April 7, 2023. When:

APAC region: Friday, April 7, 2023 (12:00AM – 4:00AM HKT)
EMEA region: Saturday, April 8, 2023 (12:00AM – 4:00AM GMT)
AMER region: Saturday, April 8, 2023 (12:00AM – 4:00AM PDT)

Release notes with details about the update will be available here starting April 6th.

Changes coming to WatchGuard Account Manager

Jason Vendramin — Fri, 24 Mar 2023 09:45:25 -0700

Starting on March 24th, the URLs for the “forgot user name” and “forgot password” pages will change from the accountmanager.watchguard.com domain to accountmanager.cloud.watchguard.com. This is in support of migrating that functionality into WatchGuard Cloud.

Migration activities will continue April 4th with the account portion of the account registration flow for new watchguard.com accounts (also known as “Tier-1” accounts) moving to accountmanager.cloud.watchguard.com. As a part of this change, the new account registration form will be consolidated into fewer screens, but the information requested will not be changed. We encourage partners who are onboarding new accounts to leverage the multi-tier functionality of WatchGuard Cloud and to create client accounts within the WatchGuard Cloud Account Manager.

Finally, on April 12th the remainder of the account registration flow will be migrated, with no further changes to the user experience. We will leave redirects in place for a short period of time, but if you allow-list specific WatchGuard domains you will need to add accountmanager.cloud.watchguard.com.

We appreciate your patience as we continue to update our services and expand WatchGuard Cloud!

WatchGuard Appointed CVE Certified Numbering Authority

Brendan Patterson — Mon, 06 Mar 2023 11:57:00 -0800

WatchGuard has been authorized by the CVE Program as a Certified Numbering Authority (CNA). As a CNA, WatchGuard can now assign Common Vulnerability Exposure (CVE) IDs and publish CVE records for product security disclosures discovered internally and by external researchers. Information technology and cybersecurity professionals use CVE Records to ensure they are discussing the same issue, and to coordinate their efforts to prioritize and address the vulnerabilities.

At WatchGuard, we take product security seriously and welcome working through responsible disclosure with external researchers. By completing the process of becoming a CNA, we can streamline our disclosure process and ultimately, better protect our customers.

Information for submitting WatchGuard product security disclosures, and details for contacting the WatchGuard Product Security Incident Response Team (PSIRT) are available at psirt.watchguard.com.

Knowledge Base Digest - February 2023

Sandra Takeuchi — Fri, 03 Mar 2023 14:04:08 -0800

Articles

Known Issues

Knowledge Base Digest - January 2023

Sandra Takeuchi — Wed, 08 Feb 2023 13:30:04 -0800

Articles

Known Issues

New or Updated Video Tutorials

Knowledge Base Digest - December 2022

Sandra Takeuchi — Thu, 05 Jan 2023 09:14:08 -0800

Known Issues

Knowledge Base Digest - November 2022

Sandra Takeuchi — Tue, 06 Dec 2022 15:38:19 -0800

Articles

Known Issues

Knowledge Base Digest - October 2022

Sandra Takeuchi — Fri, 18 Nov 2022 09:55:03 -0800

Each month we publish numerous new articles and known issues to the WatchGuard Knowledge Base. Here is the new content published in October.

Articles

Known Issues

Knowledge Base Digest - August & September 2022

Sandra Takeuchi — Fri, 07 Oct 2022 09:37:29 -0700

Each month we publish numerous new articles and known issues to the WatchGuard Knowledge Base. Here is the new content published in August and September.

Articles

Known Issues

New or Updated Video Tutorials

Cloud-managed Firebox: Change to Cloud-Management

Knowledge Base Digest - July 2022

Sandra Takeuchi — Mon, 08 Aug 2022 11:02:16 -0700

Each month we publish numerous new articles and known issues to the WatchGuard Knowledge Base. Here is the new content published in June and July (note that previously published June Knowledge Base digest was incomplete):

Articles

Known Issues

Security Issue

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability (CVE-2022-30190, Follina)

Knowledge Base Digest - June 2022

Sandra Takeuchi — Tue, 05 Jul 2022 07:28:36 -0700

Each month we publish numerous new articles and known issues to the WatchGuard Knowledge Base. Here is the new content published in June:

Articles

Known Issues

Knowledge Base Digest - May 2022

Sandra Takeuchi — Thu, 09 Jun 2022 06:07:04 -0700

Each month we publish numerous new articles and known issues to the WatchGuard Knowledge Base. Here is the new content published in May:

Articles

Known Issues

New or Updated Video Tutorials

Knowledge Base Digest - April 2022

Sandra Takeuchi — Tue, 03 May 2022 09:20:26 -0700

Each month we publish numerous new articles and known issues to the WatchGuard Knowledge Base. Here is the new content published in April:

Known Issues

Security Issues

Knowledge Base Digest - March 2022

Sandra Takeuchi — Mon, 11 Apr 2022 23:29:57 -0700

Articles

Cyclops Blink: Information for devices that run in FIPS mode
Cyclops Blink: Firebox models supported by Fireware v12.7.2 U2, v12.5.9 U2, or v12.1.3 U8
Cyclops Blink FAQs This article is available in Deutsch, English, Español, Français, Italiano, 日本語, and Português.
Cyclops Blink: Remediate Firebox Cloud This article is available in Deutsch, English, Español, Français, Italiano, 日本語, and Português.
Cyclops Blink: Remediate FireboxV and XTMv This article is available in Deutsch, English, Español, Français, Italiano, 日本語, and Português.
Cyclops Blink: Remediate a locally-managed Firebox This article is available in Deutsch, English, Español, Français, Italiano, 日本語, and Português.
Cyclops Blink: Tips to rebuild your Firebox configuration This article is available in Deutsch, English, Español, Français, Italiano, 日本語, and Português.
Cyclops Blink: Recovery steps for XTM 5 and 8 Series devices This article is available in Deutsch, English, Español, Français, Italiano, 日本語, and Português.
4-Step Cyclops Blink Diagnosis and Remediation Plan This article is available in Deutsch, English, Español, Français, Italiano, 日本語, and Português.
FAQs on the Cyclops Blink Botnet This article is available in Deutsch, English, Español, Français, Italiano, 日本語, and Português.
Devices powered by Firebox PoE ports reboot when Firebox reboots
Disable SIP-ALG on the Firebox
Standalone device remains after you add the device to a FireCluster in WatchGuard Cloud
Wi-Fi in WatchGuard Cloud access point LED indicators

Known Issues

New or Updated Video Tutorials

Knowledge Base Digest - February 2022

Sandra Takeuchi — Mon, 07 Mar 2022 18:01:36 -0800

Each month we publish numerous new articles and known issues to the WatchGuard Knowledge Base. Here is the new content published in February and early March:

Articles

Wireless client MAC address randomization and reporting in Wi-Fi in WatchGuard Cloud
Support automated phone system partner verification
PCI compliance scan failures and Firebox self-signed certificates
Known issues for Cyclops Blink detection tools and related features
Data policy for WatchGuard Cyclops Blink detection tools
Cyclops Blink: Information for devices that run in FIPS mode
Cyclops Blink: Firebox models supported by Fireware v12.7.2 U2, v12.5.9 U2, or v12.1.3 U8
Cyclops Blink FAQs
This article is available in Deutsch, English, Español, Français, Italiano, 日本語, and Português.
FAQs on the Cyclops Blink Botnet
This article is available in Deutsch, English, Español, Français, Italiano, 日本語, and Português.
Cyclops Blink: Remediate Firebox Cloud
This article is available in Deutsch, English, Español, Français, Italiano, 日本語, and Português.
Cyclops Blink: Remediate FireboxV and XTMv
This article is available in Deutsch, English, Español, Français, Italiano, 日本語, and Português.
Cyclops Blink: Remediate a locally-managed Firebox
This article is available in Deutsch, English, Español, Français, Italiano, 日本語, and Português.
Cyclops Blink: Tips to rebuild your Firebox configuration
This article is available in Deutsch, English, Español, Français, Italiano, 日本語, and Português.
Cyclops Blink: Recovery steps for XTM 5 and 8 Series devices
This article is available in Deutsch, English, Español, Français, Italiano, 日本語, and Português.
4-Step Cyclops Blink Diagnosis and Remediation Plan
This article is available in Deutsch, English, Español, Français, Italiano, 日本語, and Português.

Known Issues

New or Updated Video Tutorials

New Version of MSSP Command Now Available in Partner Portal

Ben Oster — Mon, 14 Feb 2022 13:29:02 -0800

We have redesigned the MSSP Command application to provide a more responsive experience. The new user interface focuses on better analytics and reporting features to simplify the usage of points as well as how the costs can be billed to customers.

What’s New in the MSSP Command:

The updated dashboard includes new filters to manage product lines more efficiently and a new download feature to export product usage data. Other updated sections:

New widgets and notification top bar for better visualization

The new widgets provide a persistent view across all navigation screens for quick access to the most important data you need.

Improved analytics dashboard

Updated points activity to show debits and credits, allocation chart to show how your points are consumed monthly, and a transaction history with a downloadable audit report allow you a detailed view into your MSSP business. The audit report also includes user data so you can always know the who, what, and when of your points usage.

Updated Settings Tab

Easily add multiple email recipients or customize this to your notifications system to ensure that you always know what is happening. Additionally, MSSP Command will now notify you if you are below the required points threshold for your next renewal!

Improved filters and navigation for product management

Quickly filter to the products and services you want to see in both Network Security and Off-Network User Protection. We have also added the ability to download license counts for our SaaS product portfolio so you can see your current user count without having to navigate the UI.

If you are already an MSSP Command user, the new version should feel very familiar while layering several much asked for improvements. This new experience launched on January 11th and is now live for all MSSP partners through the partner portal. If you haven’t opted in to use our points program yet, please reach out to your WatchGuard account representative to get started!

Knowledge Base Digest - January 2022

Sandra Takeuchi — Fri, 04 Feb 2022 12:50:45 -0800

Each month we publish numerous new articles and known issues to the WatchGuard Knowledge Base. Here is the new content published in January:

Articles

Known Issues

Security Issue

Polkit pkexec Local Privilege Escalation Vulnerability (CVE-2021-4034)

Video Tutorials

Knowledge Base Digest - December 2021

Sandra Takeuchi — Fri, 07 Jan 2022 07:34:10 -0800

Each month we publish numerous new articles and known issues to the WatchGuard Knowledge Base. Here is the new content published in December:

Articles

Known Issues

Security Issue

Log4j2 Remote Code Execution Vulnerability (CVE-2021-44228)

Apache Log4J vulnerability

Brendan Patterson — Mon, 13 Dec 2021 13:53:25 -0800

Late last week security researchers disclosed a critical, unauthenticated remote code execution (RCE) vulnerability in log4j2, a popular and widely used logging library for Java applications. CVE-2021-44228 scores the maximum 10.0 on the Common Vulnerability Scoring System (CVSS) due to a combination of how trivial the exploit is and the potential for significant damage. Since Friday, the WatchGuard Security operations team has been sharing details about the vulnerability along with any potential impact on WatchGuard products at the Secplicity blog. We've also updated a Knowledge Base article with details.

IPS Signature Update
WatchGuard has released new IPS signatures to detect exploits of the vulnerability. Please make sure that all your WatchGuard appliances are configured to receive the latest IPS signature sets:

Fireware v12.6.2 and higher: IPS v18.188
Fireware v12.6.1 and lower: IPS v4.1232

Are WatchGuard products impacted?
The WatchGuard engineering team is doing a comprehensive review of all our products:

Firebox, WatchGuard System Manager, and Dimension - Not affected
WatchGuard EPDR and Panda AD360 - Not affected

Some product components in WatchGuard Cloud were running a vulnerable version of log4j2, but use a version of JVM that is not vulnerable to the common and trivial LDAP attack vector. We have updated these components out of an abundance of caution.

AuthPoint - Updated
Threat Detection and Response - Updated
Wi-Fi Cloud - Updated

We are continuing to investigate internally for any additional potential impact. Please continue to check Secplicity and the KB article for latest updates.

Knowledge Base Digest - November 2021

Sandra Takeuchi — Thu, 09 Dec 2021 07:58:47 -0800

Each month we publish numerous new articles and known issues to the WatchGuard Knowledge Base. Here is the new content published in November:

Articles

Known Issues

New or Updated Video Tutorials

VPN Connectivity for Access Points

Knowledge Base Digest - October 2021

Sandra Takeuchi — Tue, 02 Nov 2021 09:28:05 -0700

Each month we publish numerous new articles and known issues to the WatchGuard Knowledge Base. Here is the new content published in October:

Articles

Known Issues

Knowledge Base Digest - September 2021

Sandra Takeuchi — Wed, 06 Oct 2021 09:38:52 -0700

Each month we publish numerous new articles and known issues to the WatchGuard Knowledge Base. Here is the new content published in August:

Articles

Known Issues

Introducing Our New Status Page

Austin Clark — Wed, 29 Sep 2021 18:49:11 -0700

Today we’re pleased to announce the new WatchGuard Technologies status page.

People across the globe trust WatchGuard’s products and services to keep their users, devices, and networks secure. We understand it can be frustrating when things aren’t working as expected and you don’t have any insights into the issue. That’s why we designed our new status page to provide simple, relevant, and timely information about scheduled maintenance events and unexpected service interruptions.

Navigating our new status page

We deliver WatchGuard’s services from different locations around the world. This means that an event affecting partners and users in the Americas may not impact those in Europe. At the top of our status page, you’ll see top-level regional status in the selector and can filter to the details relevant to you by clicking.

In each region, you’ll find the current status separated by products and the major features that they provide. Every line has a simple status indicator to communicate its condition:

Green Check Mark: Systems Operational
Everything is working as expected.
Yellow Triangle: Performance Degraded
Everything is working but may be slow or degraded in some way.
Orange Triangle: Minor Event
Some users are experiencing a service interruption, but services are working for others.
Red Exclamation Circle: Major Event
Most users are experiencing a service interruption.
Blue Gear: Under Maintenance
We’re performing scheduled maintenance that could impact your experience.

Also, following the above information, we’ll show any upcoming maintenance along with past events.

We strive for perfect operational performance

We know that you rely on us to provide industry-leading cybersecurity protection and to quickly identify, triage, communicate, and fix issues when they inevitably arise. This new status page is one of the many improvements we’re currently working on to serve you better and increase the reliability of our products. We hope this page makes it easier for you to find all the details you want, and we appreciate the opportunity to meet your security needs.

Next Steps: Please bookmark our new status page and make it your first visit any time you run into an issue relating to one of the monitored services.

Upcoming WGID Maintenance

Chloe Sabo — Tue, 14 Sep 2021 09:00:00 -0700

WatchGuard is working on some important maintenance to our services.

On 17 September 2021, starting at 11:30pm UTC WatchGuard will be performing maintenance that may cause service interruptions, as well as some small changes to the product. The duration of this maintenance is expected to last from 17 September 2021 through end of day on 20 September 2021.

You will notice a few impacts while using WatchGuard services as we update and consolidate the underlying Identity Providers we use. Some changes will only persist during the maintenance period, and some will persist after the maintenance period is complete.

These impacts include:

During the maintenance period, on Saturday, September 18, 2021 from 12am UTC to 1am UTC you may experience an inability to log into WatchGuard Cloud. If you are already logged in, your session should not be interrupted. We expect these service interruptions to be less than one hour. If you anticipate needing to access WatchGuard Cloud during this maintenance window, we suggest you start a new session in WatchGuard Cloud 2 hours before the maintenance begins.

During the maintenance period, from Friday, September, 17th, 2021 11:30pm UTC to Saturday, September 18th 2021 3am UTC you may experience service interruptions with WatchGuard services like Activations, Rapid Deploy, Partner Portal and Support Center access, changing passwords, Account Mapping between WatchGuard and Panda, WiFi Cloud Logins, User Forum and the Learning Center.

In some instances after the maintenance period is complete, you may need to log in to certain WatchGuard services twice. For example, if you have logged in to WatchGuard.com and navigate to DNSWatch, you will be asked for your login information again. Services where you will notice this behavior are:

DNSWatch
Learning Center
Aether
WiFi Cloud

After the maintenance period is complete, the user interface of some login pages might appear slightly different than what you are used to.

After the maintenance period is complete, the URLs of some login pages may have changed so you will need to update your bookmarks.

The benefits of this maintenance are:

Better Availability - This maintenance will enable higher availability for WatchGuard ID.
Increased Security - These improvements will facilitate the use of AuthPoint MFA for Tier N users for the first time. (Coming Soon!)
Common login user interface - This maintenance will allow for common login pages across all WatchGuard services and applications.

We appreciate your patience as we work to improve WatchGuard services!

Knowledge Base Digest - August 2021

Sandra Takeuchi — Tue, 07 Sep 2021 10:47:20 -0700

Each month we publish numerous new articles and known issues to the WatchGuard Knowledge Base. Here is the new content published in August:

Articles

Known Issues

Knowledge Base Digest - July 2021

Sandra Takeuchi — Wed, 11 Aug 2021 09:39:02 -0700

Each month we publish numerous new articles and known issues to the WatchGuard Knowledge Base. Here is the new content published in July:

Articles

Known Issues

Knowledge Base Digest - June 2021

Sandra Takeuchi — Thu, 08 Jul 2021 06:53:22 -0700

Each month we publish numerous new articles and known issues to the WatchGuard Knowledge Base. Here is the new content published in June:

Articles

Known Issues

Video Refresh

Get Started with Application Control

Knowledge Base Digest - May 2021

Sandra Takeuchi — Fri, 04 Jun 2021 07:11:50 -0700

Each month we publish numerous new articles and known issues to the WatchGuard Knowledge Base. Here is the new content published in May:

Articles

Known Issues

Security Issues

WatchGuard Wi-Fi products and the FragAttacks vulnerabilities

Video Tutorials

Discover Reports with WatchGuard Wi-Fi Cloud

Knowledge Base Digest - April 2021

Sandra Takeuchi — Mon, 10 May 2021 21:31:27 -0700

Each month we publish numerous new articles and known issues to the WatchGuard Knowledge Base. Here is the new content published in April:

Articles

Known Issues

Security Issues

6 April 2021 Authentication Attack Against Firebox Web Management

New/Updated Video Tutorials

Updates to WatchGuard Technical Support Case Processing

George Grinnell — Mon, 10 May 2021 15:26:47 -0700

WatchGuard’s Support and Service team is continually looking for ways to improve how we provide support to our customers. We are pleased to announce several enhancements to our support case experience, starting on 11 May.

Panda corporate products cases now routed into WatchGuard systems

As part of our ongoing integration with Panda Security, support cases for Panda corporate products created through the Panda support site, via email or by phone, will now be tracked in WatchGuard systems. Customers with WatchGuard website logins can now submit Panda product cases and view open cases in WatchGuard Support Center. For Panda customers who do not have a WatchGuard Support Center login, the support contact methods are unchanged, but you will see the support case emails replies now come from WatchGuard.

Email now supported for case updates

You can now communicate with support by email, reducing the need to log in to the support site to review and respond to your support case. After a case is created, in addition to alerting you of the update, the email now contains case comments. You can reply to the email to communicate with your support representative. If case comments include sensitive information, WatchGuard retains the option to post comments directly to the case and not include those comments in email.

Enhanced case categorization and routing to best skilled technician

Going forward, we will ask for additional information when you create a new support case. We use this information to better categorize your case. You will see expanded pick lists for Product Family, Product, Product Area, and additional details in the online case submittal form.
The enhanced categorization improves routing of cases to the support specialist with the best skill set to resolve the case.

For more information, see WatchGuard Support Case Integration Update: 11 May 2021

Knowledge Base Digest - March 2021

Sandra Takeuchi — Fri, 09 Apr 2021 10:41:26 -0700

Each month we publish numerous new articles and known issues to the WatchGuard Knowledge Base. Here is the new content published in March:

Articles

Known Issues

Security Issues

HAFNIUM Exchange Server Exploit Protection Measures

New Video Tutorials

Knowledge Base Digest - February 2021

Sandra Takeuchi — Tue, 02 Mar 2021 12:59:28 -0800

Each month we publish numerous new articles and known issues to the WatchGuard Knowledge Base. Here is the new content published in February:

Articles

Known Issues

New/Updated Video Tutorials

Migration action for TDR Integration into WatchGuard Cloud

Ricardo Arroyo — Mon, 22 Feb 2021 06:13:11 -0800

Greetings, WatchGuard Partners!

We would like to inform you that before you can manage accounts and licenses for Threat Detection and Response (TDR), you are required to perform a one-time migration procedure. During this migration, you manually link an existing WatchGuard Cloud Tier-2 account to an existing TDR Managed child account. During these first few weeks of releasing TDR 6.0.0, we have had reports of usability issues in the migration process, which we have greatly improved with the 6.0.1 and 6.0.2 releases that are now available. When you first browse to the Migrate TDR page, you are presented with a wizard which will guide you through the migration process. While we suggest leveraging the wizard to complete the migration, you can also follow the steps in this article to consolidate your accounts. We highly recommend completing this migration as soon as possible in order to take advantage of all of the improvements planned to both WatchGuard Cloud and ThreatSync throughout 2021!

Thank you,

WatchGuard Product Team

Knowledge Base Digest - December 2020

Sandra Takeuchi — Fri, 08 Jan 2021 14:50:36 -0800

Each month we publish numerous new articles and known issues to the WatchGuard Knowledge Base. Here is the new content published in December:

Articles

Known Issues

New and Updated Video Tutorials

Introduction to spamBlocker

New Courseware Videos
Available in WatchGuard Learning Center or in Support Center > Technical Courseware

Firebox Access Portal - New multi-module course

Knowledge Base Digest - November 2020

Sandra Takeuchi — Fri, 04 Dec 2020 15:33:23 -0800

Each month we publish numerous new articles and known issues to the WatchGuard Knowledge Base. Here is the new content published in November:

Articles

Firebox Cloud supports accelerated networking in Azure

Known Issues

TDR Outage in EU

Ricardo Arroyo — Wed, 02 Dec 2020 11:10:23 -0800

On 1 December 2020, the TDR EU AWS environment suffered from an intermittent outage which resulted in some Host Sensors being unable to contact ThreatSync. This seems to be linked to the deployment of new TDR infrastructure on the night of 30 November 2020. Despite Engineering's extensive efforts, the root cause of the connection issues could not be determined, and the deployment was reverted on 1 December 2020 at 7:30pm EST. Connectivity issues should be resolved with the reversion to previous environment infrastructure. As WatchGuard continues the analysis, we will postpone the deployment of the new infrastructure.

TDR Product Team

Knowledge Base Digest - October 2020

Sandra Takeuchi — Wed, 11 Nov 2020 15:25:12 -0800

Each month we publish numerous new articles and known issues to the WatchGuard Knowledge Base. Here is the new content published in October:

Articles

Known Issues

TDR Outage in Preparation for WatchGuard Cloud Integration

Ricardo Arroyo — Tue, 10 Nov 2020 11:41:47 -0800

BLUF: TDR Outage – 30 minutes
EU – 30 November 2020 at 5PM PST
NA – 1 December 2020 at 11PM PST

We have listened to your feedback and we are excited to announce that with the release of TDR 6.0.0, WatchGuard will deploy a TDR UI integrated into WatchGuard Cloud. To prepare for this, WatchGuard must deploy new TDR infrastructure before the TDR 6.0.0 release that is scheduled for late December or early January.

During the outage, all Host Sensors will show as disconnected from ThreatSync and the TDR UI will be unavailable. Host Ransomware Prevention and its built-in ransomware hash list will continue to function. I hope you are all as excited about the new WatchGuard Cloud integration as we are.

Thank you all for your loyalty and understanding as we march towards the future.

TDR Product Team

Knowledge Base Digest - September 2020

Sandra Takeuchi — Thu, 08 Oct 2020 16:34:05 -0700

Each month we publish numerous new articles and known issues to the WatchGuard Knowledge Base. Here is the new content published in August:

Articles

Known Issues

Video Tutorials

Wi-Fi Cloud

Client Connectivity Test

Certificates

Knowledge Base Digest - August 2020

Sandra Takeuchi — Tue, 08 Sep 2020 15:31:17 -0700

Each month we publish numerous new articles and known issues to the WatchGuard Knowledge Base. Here is the new content published in August:

Articles

Known Issues

Video Tutorials

Knowledge Base Digest - July 2020

Sandra Takeuchi — Fri, 07 Aug 2020 12:12:10 -0700

Each month we publish numerous new articles and known issues to the WatchGuard Knowledge Base. Here is the new content published in July:

Articles

Known Issues

Video Tutorials

Action needed (AuthPoint) - Upgrade RD Web agent to v1.1.1.79 or higher by 26 September 2020

Marcus Suniga — Wed, 29 Jul 2020 12:50:22 -0700

As part of an effort to continuously improve the security of our services, we are making upgrades to the RD Web service. If you use AuthPoint agent for RD Web v1.1.0.58 or lower, you must upgrade the RD Web agent to v1.1.1.79 or higher by 26 September 2020.

If you already use v1.1.1.79 or higher of the AuthPoint agent for RD Web, no action is required.

To upgrade the agent for RD Web:

1. Log in to WatchGuard Cloud.

2. Select Configure > AuthPoint.

3. Select Downloads.

4. In the RD Web section, click Download Installer.

5. Download the latest version of the agent for RD Web. You do not have to download the configuration file to upgrade the agent.

6. Run the downloaded installer (.msi file) on your server as a local administrator. You do not have to uninstall the agent for RD Web when you install an updated version.

Note: If the wizard shows a “Files in use” message that prompts you to close the IIS Worker Process, click Ignore and continue the installation process.

To see which version of the agent is installed:

1. From the Windows menu, select Control Panel.

2. Select Uninstall a Program.

3. From the list of programs, find WatchGuard AuthPoint RD Web. The Version column indicates which version of the agent is installed.

Sincerely,

Your WatchGuard Team

Knowledge Base Digest - June 2020

Sandra Takeuchi — Mon, 06 Jul 2020 12:03:58 -0700

Each month we publish numerous new articles and known issues to the WatchGuard Knowledge Base. Here is the new content published in June:

Articles

Known Issues

Video Tutorials

Juneteenth, WatchGuard Closes for a Day of Reflection and Learning

Prakash Panjwani — Thu, 18 Jun 2020 12:54:15 -0700

We have declared Juneteenth – Friday, June 19, 2020 – as a day of reflection and learning. We are treating this day as a bank holiday; no meetings, no work. For those of you contacting our Sales and Support teams, a small group of employees have volunteered to be present, but please understand if wait times are longer than normal.

I recently wrote a post addressing my feelings about the death of George Floyd, the racial and social injustice in our world, and my next steps for contributing to permanent and lasting change. Thanks to all of you who read the post, and to all of you who engaged publicly via comments, as well as those who reached out to me personally.

Since writing that post, I’ve been immersed in learning and conversations, and a resounding theme is “How can I help now; What should I do differently now?” The answer to these questions is personal to each of our experiences, but what is universal is the need to deeply reflect on our feelings, and to learn, before we make lasting impact. With that in mind, we have declared Juneteenth as a day of reflection and learning; no meetings, no work. Our employees may use the day for learning and reflection on how we all can contribute to a culture of anti-racism and allyship at WatchGuard and in our communities.

It is appropriate to reflect on the work ahead of us on Juneteenth. On this day in 1865, almost two and half years after the Emancipation Proclamation, enslaved African Americans in Texas were informed of their freedom. I plan to use the day to chart my next steps. I have divided them into three areas:

Continue Learning: I want to increase my comfort engaging with everyone in my ecosystem (employees, peers, friends, family) on the topic of race and social inequality.
Become an Ally: Learn how to make an impact through allyship; I plan to start distilling those ideas down.
Make an Institutional Impact: Work with the WatchGuard management team to identify what changes we can make – big or small – to create the right environment to encourage, celebrate, and promote diversity.

Through many conversations, and by reading books and articles, and attending webinars this week, I find myself becoming more comfortable engaging others on the topic of racism, and also being a better sounding board for others who are willing to talk about it. If possible, I hope you use June 19th to take the next steps in your learning and understanding on this topic, truly internalize what’s happening, and further develop your thoughts on how you want to engage.

Below is a list of resources about anti-racism and being an ally for your reference. I would like to end by sharing an article that had so much impact on me that I have read it daily to remind myself the need for deeper reflection, as captured by this closing quote in the article:

“Oh, and as we do it, be better than me. Remember, I had to change where I sat before I could change where I stood. If you first change where you stand, then the next generation will sit in a very different and better place.”

Prakash

Resources about anti-racism and being an ally

Read

American Racism: We've Got So Very Far to Go – article that Prakash previously shared
White Fragility: Why It's So Hard For White People To Talk Racism - book by Robin DiAngelo
Just Mercy book by Bryan Stevenson – shares his experiences as a young attorney that inspired him to find the Equal Justice Initiative
Born A Crime: Stories from a South African Childhood autobiography by Trevor Noah – shares his struggles as a biracial child
Guide to Allyship – an online guide
7 Examples of What Being an Ally at Work Really Looks Like article by Better Allies

Watch

George Floyd and the Dominos of Racial Injustice – Trevor Noah’s 20-minute monologue
13th – documentary on Netflix that analyzes criminalization of African Americans
Just Mercy – film based on life of Bryan Stevenson, whose book in listed in the reading resources above
The Hate U Give – powerful film about a teen who witnesses a fatal shooting of a friend
The Value of Diverse Teams During Crisis – presented by featured speaker Lauren Sato, CEO of Ada Developers Academy, to WatchGuard and PayScale employees

Listen

1619 Podcasts

Looking for more materials

Infographic on Becoming Anti-Racist
For a much longer list of articles, books, blogs, movies, and podcasts

Knowledge Base Digest - May 2020

Sandra Takeuchi — Thu, 04 Jun 2020 16:09:51 -0700

Each month we publish numerous new articles and known issues to the WatchGuard Knowledge Base. Here is the new content published in May:

Articles

Known Issues

Knowledge Base Digest - April 2020

Sandra Takeuchi — Tue, 05 May 2020 13:58:21 -0700

Each month we publish numerous new articles and known issues to the WatchGuard Knowledge Base. Here is the new content published in April:

Articles

Known Issues

Knowledge Base Digest - March 2020

Sandra Takeuchi — Mon, 06 Apr 2020 12:24:51 -0700

Each month we publish numerous new articles and known issues to the WatchGuard Knowledge Base. Here is the new content published in March:

Articles

Known Issues

New Video Tutorials

Important Changes to DNSWatch and DNSWatchGO

Ben Oster — Mon, 06 Apr 2020 10:37:28 -0700

Hello everyone!

This is going to be a short entry, but we wanted to make everyone that is using DNSWatch alerts to create tickets in their own PSA, RMM, or other ticketing systems aware of an upcoming change. Currently, communication for alerts and other account related communication comes from the email address support@strongarm.io. We are replacing this address with the WatchGuard Cloud standard product notification email of noreply@notifications.dnswatch.watchguard.com.

This roll-over is slated for Wednesday April 15, 2020. We ask that between now and then you update any impacted ticketing systems and workflows.

Additionally, we wanted to inform you of a couple of changes we are making to our feeds to update your security during the COVID-19 crisis. We are actively evaluating and adding two new feeds to cover emerging threats during this time. There have been a number of targeted attacks using this emergency as leverage and, as always, we are working hard to add relative intelligence to keep you safe.

Have a great week and stay safe,

Ben, Stephen, and the DNSWatch team

WatchGuard’s Response to COVID-19

Stephen Helm — Mon, 23 Mar 2020 18:53:39 -0700

As the world confronts the COVID-19 pandemic, we want to extend our heartfelt wishes that all remain in health and safety during this difficult time. Our hearts go out to the families of those afflicted by the virus. We also want to thank the members of the community on the front lines of this crisis for their tireless and selfless dedication.

Addressing Implications of a Remote Workforce with WatchGuard

While the response to coronavirus has been unprecedented, for many businesses this “work-from-home” experiment launches them into decidedly unfamiliar territory. Home networks are overwhelmed, VPN use has spiked, and the need to secure remote workers has never been greater.

WatchGuard is dedicated to providing a seamless sales and support experience for our partners and customers. We’ve prepared a short FAQ to explain our corporate approach to both safety and business continuity:

WatchGuard Response to COVID-19

As businesses confront this challenge, WatchGuard has also created several guides on howresources to help manage security and connectivity for your workforce during the crisis and to answer some of the common questions that we have received over the last couple of weeks:

WatchGuard Resources to Aid with Remote Worker Security – Landing Page
eBook – Learning from COVID-19: Security and Continuity Planning
Checklist – IT Business Continuity
Free AuthPoint MFA Trial – 60 Days
Free DNSWatchGO Trial – 60 Days
Free FireboxV Trial for Mobile VPN Support – 30 Days
Which Mobile VPN client should I use?
60 Day Trial Activation Guide – DNSWatchGO and AuthPoint
443 Podcast – Securing Remote Workers
FAQ - How can I help my users work remotely during the COVID-19 crisis?
FAQ - Use AuthPoint MFA to protect remote worker connections and credentials

This blog post will be updated as any new information becomes available.

Contact

For Sales or Support questions, you can find phone numbers for your region online. If you contact WatchGuard Technical Support, please have your registered appliance Serial Number or Partner ID available.

Knowledge Base Digest - February 2020

Sandra Takeuchi — Wed, 04 Mar 2020 12:42:52 -0800

Each month we publish numerous new articles and known issues to the WatchGuard Knowledge Base. Here is the new content published in February:

Articles

Known Issues

Knowledge Base Digest - January 2020

Sandra Takeuchi — Mon, 03 Feb 2020 17:56:22 -0800

Each month we publish numerous new articles and known issues to the WatchGuard Knowledge Base. Here is the new content published in January:

Articles

Known Issues

Knowledge Base Digest - December 2019

Sandra Takeuchi — Mon, 06 Jan 2020 21:44:33 -0800

Each month we publish numerous new articles and known issues to the WatchGuard Knowledge Base. Here is the new content published in December:

Articles

Known Issues

Security Issues

Inferring and Hijacking VPN-tunneled TCP Connections

Knowledge Base Digest - November 2019

Sandra Takeuchi — Tue, 03 Dec 2019 14:43:43 -0800

Each month we publish numerous new articles and known issues to the WatchGuard Knowledge Base. Here is the new content published in November:

Articles

Known Issues

Knowledge Base Digest - October 2019

Sandra Takeuchi — Tue, 05 Nov 2019 08:16:23 -0800

Each month we publish numerous new articles and known issues to the WatchGuard Knowledge Base. Here is the new content published in October:

Articles

Known Issues

Knowledge Base Digest - September 2019

Sandra Takeuchi — Fri, 04 Oct 2019 17:36:52 -0700

Each month we publish numerous new articles and known issues to the WatchGuard Knowledge Base. Here is the new content published in September:

Articles

Known Issues

Critical Update to AuthPoint customers

Alexandre Cagnoni — Mon, 30 Sep 2019 08:38:18 -0700

If you use AuthPoint, your AuthPoint Gateway software must be updated to the latest available version (v5.1.5) by 10 October 2019 (APAC cloud region users), by 16 October 2019 (EMEA region), and by 17 October 2019 (AMER region) in order to avoid an outage in your service. If you do not update your AuthPoint Gateway before this time, all users who try to use AuthPoint to authenticate will experience a failure.

Please read the Knowledge Base article for more information and to get detailed upgrade instructions.

Knowledge Base Digest - August 2019

Sandra Takeuchi — Sun, 08 Sep 2019 09:45:55 -0700

Each month we publish numerous new articles and known issues to the WatchGuard Knowledge Base. Here is the new content published in August:

Articles

Known Issues

Knowledge Base Digest - July 2019

Sandra Takeuchi — Mon, 12 Aug 2019 11:17:47 -0700

Each month we publish numerous new articles and known issues to the WatchGuard Knowledge Base. Here is the new content published in July:

Articles

Why is the VPN throughput number on the Firebox T55 and T70 datasheets lower than expected?

Known Issues

WatchGuard Website Maintenance Alert

Marcus Suniga — Thu, 25 Jul 2019 17:11:25 -0700

Summary: We will be performing maintenance on our website which will prevent authentication to www.watchguard.com

When: Friday, 2 August, 1:00 AM to 3:00 AM UTC

Maintenance Window: 2 hours

Expected Impact Duration: 2 hours, during which time a maintenance window page will be presented intermittently to users attempting to login to all WatchGuard websites.

Contact Information: For Sales or Support questions, you can find phone numbers for your region online. If you contact WatchGuard Technical Support, please have your registered appliance Serial Number or Partner ID available.

Sincerely,

Your WatchGuard Team

Knowledge Base Digest - June 2019

Sandra Takeuchi — Tue, 09 Jul 2019 13:59:34 -0700

Each month we publish numerous new articles and known issues to the WatchGuard Knowledge Base. Going forward, as requested by many of our Partners, we will publish a monthly digest of new Knowledge Base content to this blog so you can easily review it.

Here is the new content published in June:

Vulnerabilities

TCP SACK PANIC – Kernel Vulnerabilities (CVE-2019-11477, CVE-2019-11478, CVE-2019-11479)

Articles

Known Issues

Firebox Gateway Antivirus Engine Upgrade - ACTION REQUIRED

Julian Matossian — Wed, 12 Jun 2019 11:49:34 -0700

This notice impacts Fireware v12.1 and earlier. Fireware versions 12.1.1 and later are not affected.

This year, WatchGuard will upgrade the engine used to power the Gateway AntiVirus (GAV) service. To continue to use Gateway AV, you must upgrade your Firebox to the latest version of Fireware (or a minimum of Fireware v12.1.1). WatchGuard recommends you upgrade to Fireware v12.4.1 for all the latest updates.

What is Gateway AntiVirus?
Gateway AntiVirus is WatchGuard’s first line of defense against known malware. It leverages a combination of signature-based and heuristic scanning technologies to provide real-time protection against known threats such as viruses, trojans, worms, spyware, and rogueware.

Do I have Gateway AntiVirus?
All Fireboxes with Basic Security Suite and Total Security Suite licenses have the Gateway AntiVirus service included.

What Fireware versions are affected?
Fireware v12.1 and earlier are affected and must be upgraded to Fireware version 12.1.1 or later. WatchGuard recommends you upgrade to Fireware v12.4.1 for all the latest updates.

What happens if I do not upgrade my Fireware?
If you do not upgrade, your Firebox will no longer get GAV signature updates and you will experience reduced heuristic scanning and protection. Efficacy will degrade over time, leaving you more exposed to malware-based attacks.

Do I need to do anything more than upgrade my Fireware to v12.1.1?
No. Once you upgrade your Firebox(es) to Fireware v12.1.1 or later, the engine update will occur automatically. Gateway AV protection will not be interrupted.

How long do I have until the old Gateway AV engine is no longer supported?
Support for the old Gateway AV engine will continue through 31 December 2019. Beginning 1 January 2020, Fireboxes on the old engine will no longer receive signature updates or be able to scan files correctly.

If you have any questions, please contact WatchGuard Support.

Regards,

WatchGuard Technologies

AuthPoint Alert: The certificate for early AuthPoint adopters expires soon. We recommend you check the expiration date.

Marcus Suniga — Tue, 30 Apr 2019 14:24:17 -0700

The AuthPoint identity provider certificate will expire soon for some early adopters of the product. If your account is affected, and you do not replace this certificate before it expires, your AuthPoint users will not be able to authenticate to any of your SAML resources.

What is the AuthPoint IdP certificate used for?

The AuthPoint certificate is used to provide your SAML resources with the information necessary to identify AuthPoint as a trusted identity provider.

What happens when the certificate expires?

When the certificate expires, users cannot authenticate to any SAML resources.

How do I know when the certificate will expire?

You can see the expiration date of your AuthPoint certificate from the Certificate Management page in the AuthPoint management UI.

How do I replace my AuthPoint certificate?

For instructions on how to replace your certificate, see this Knowledge Base article.

Will I have to replace my AuthPoint certificate again?

As of April 25th, 2019, all new certificates will have a ten-year expiration date, and alerts will be sent prior to the expiration.

AuthPoint Service Providers: It is important to understand that each of your customer’s accounts will also need to have their certificate replaced and they may not see this email.

If you have questions, you can create a case online or call into WatchGuard Customer Support for immediate assistance.

WatchGuard Website Maintenance Alert

Kimberly Taylor — Thu, 02 Aug 2018 11:20:52 -0700

Summary: We will be performing maintenance on our website which will prevent authentication to www.watchguard.com

When: Friday, 3 August, 3:00 AM to 8:00 AM UTC

Maintenance Window: 5 hours

Expected Impact Duration: 1 – 5 hours during which time a maintenance window page will be presented to users attempting to login to all WatchGuard websites.

Contact Information: For Sales or Support questions, you can find phone numbers for your region online. If you contact WatchGuard Technical Support, please have your registered appliance Serial Number or Partner ID available.

Sincerely,

Your WatchGuard Team

WatchGuard will be doing website maintenance

Kimberly Taylor — Mon, 07 May 2018 14:54:10 -0700

When: Sunday, May 20, 2018 at 12AM PDT / 7AM UTC

Maintenance Window: 1 hour

Expected Impact/Duration: During the maintenance window, users will not be able to log into to the WatchGuard.com website and will receive a maintenance notification page in lieu of the authentication page.

Customers who are already logged into the website prior to the start of maintenance may receive an error page upon navigating to a new portal page.

Affected Services:

Deployment Services
Product Activation
AP Activation Service
Case creation

Contact Information
For Sales or Support questions, you can find phone numbers for your region online. If you contact WatchGuard Technical Support, please have your registered appliance Serial Number or Partner ID available.

Gateway Antivirus Issue: Root Cause Analysis

Brendan Patterson — Wed, 21 Feb 2018 16:24:05 -0800

Summary:
WatchGuard had an issue with Gateway Antivirus (GAV) signatures on February 7th , 2018 that affected M300, M200, and T35 appliances running firmware version 12.0 and later. An error in the signature file resulted in scan errors on the appliance. Depending on the appliance configuration, the Firebox may have prevented access to files received by email.

Root Cause
The issue was specific to PowerPC processor with 64-bit architectures (i.e., Firebox M300, M200, and T35/T35-W) running firmware version 12.0 and later with the Bitdefender Antimalware engine. A signature definition file, intended to update the Bitdefender Antimalware engine, contained two incorrectly matched code modules that resulted in faulty initialization behavior for WatchGuard’s GAV scanning capability. WatchGuard automatically tests application of each definition delivery to the various Firebox models (updates can average up to 15x per day); however this event revealed insufficient functional testing on both the vendor and WatchGuard’s testing responsibility domain.

Furthermore, the action that the Firebox takes in response to a scan error is defined by configuration. By default, HTTP proxy allows files to pass through after a scan error while the SMTP proxy “locks” the file (i.e. scrambles the binary composition of a file to prevent read-write access) from non-administrator access. Once a file is “locked” it can only be reversed by the system administrator through a dedicated file restoration utility.

To mitigate the issue, WatchGuard reverted the signatures to a previous version from earlier in February 7th , 2018. Once we tested and verified that the signature file had been fixed for all platforms, we updated the signature definition file for all platforms.

Detailed Timeline – (All times in US Pacific Time)
2:28 AM – WatchGuard receives first customer-reported incident related to GAV scan errors
3:12 AM – WatchGuard support organization begins troubleshooting operations with internal IT team
5:23 AM – WatchGuard initiates communication with vendor
8:00 AM – Rollback of definitions completed; all Fireboxes operational, however definitions levels are no longer current
9:00 AM – Verified fixed definition files
6:00 PM – Verified all Fireboxes have access to current definition levels

Corrective Measures
WatchGuard has initiated several improvements to ensure that incidents like this do not happen again:

WatchGuard is expanding the automatic testing and monitoring service for these signature definition files to encourage greater fault tolerance in our monitoring and verification infrastructure.
WatchGuard has identified new contact procedures, escalation paths, and service level guarantees with applicable technology partners so that we can decrease the time between initial incident reports and the time to remediation for any issues that may arise.
WatchGuard also recommends that customers review their SMTP proxy configurations and allow files to pass through when there are scan errors. We are considering updating this default configuration in a future firmware release.

On behalf of WatchGuard, we apologize for any inconvenience this has caused our partners and customers.

Recent WebBlocker Issue in Europe

Brendan Patterson — Wed, 31 Jan 2018 12:56:30 -0800

WebBlocker Incident Report
Users of the WebBlocker service in Europe experienced an outage late Thursday night that lasted into Friday morning, January 25 – 26, 2018. WatchGuard has worked closely with our partner Forcepoint over the last few days to analyze the failure and to put processes in place to ensure that events like this do not happen again. We are sharing details here so our partners and users are confident that we have addressed this issue.

Background
WebBlocker uses the Forcepoint ThreatSeeker Cloud URL database for web categorization, which is hosted in their ThreatSeeker Cloud Service. The URL database is hosted at 5 different locations around the world. The Firebox selects the appropriate location of the service based on the location of the DNS server that it uses. Unfortunately, there was an outage at the UK server last week that affected HTTPS lookups and led to our service outage. With Fireware version 12.0, WatchGuard switched to using the more secure HTTPS instead of HTTP for web category lookups, so only customers running Fireware version 12.0 or later were affected. Customers all over Europe use the UK server.

Incident Summary & Root Cause Analysis

Incident start time: Thursday January 25 2018 20:49 UTC
Incident end time: Friday January 26 2018 08:35 UTC.
Root Cause: As part of routine maintenance of firewall infrastructure in Heathrow (A) the active Virtual IP for the ThreatSeeker Cloud service was moved to another firewall device. During this process, the firewall for the HTTPS ThreatSeeker Cloud service did not start correctly on the new device. As a result, the ThreatSeeker cloud server in the UK was not accepting HTTPS lookups, causing our service to fail. The unavailability of the HTTPS ThreatSeeker Cloud service in Heathrow (A) was not immediately detected by WatchGuard. Sufficient monitoring was not in place to check for responses to both HTTP and HTTPS requests.
Customer Impact: Users who have the server timeout in WebBlocker configured to deny access would have lost internet connectivity during this period. Users with the alternative “fail open” setting would have seen web connections allowed but no categorization would have been provided.
Incident Tracking: Fireboxes were unable to connect to Heathrow London aka UK (A) ThreatSeeker Cloud service using HTTPS. The incident is tracked on the Forcepoint Cloud status page at https://status.forcepoint.net/ in the ThreatSeeker Cloud section.

Process Updates
Forcepoint has increased monitoring from both HTTP and HTTPS connections to all ThreatSeeker servers around the world. WatchGuard is also planning to put more monitoring in place to supplement the Forcepoint efforts. WatchGuard and Forcepoint have reviewed our support escalation procedures and initiated a process to immediately elevate critical network impacting issues so they get immediate attention.

The new and enhanced monitoring, combined with more streamlined support processes, will ensure this type of incident does not occur again, as well as better and faster escalations should any future issues occur.

On behalf of WatchGuard, we apologize for any inconvenience this has caused our partners and customers.

GAV Outage for 11.10.5 and earlier software versions

Kimberly Taylor — Tue, 02 Jan 2018 13:46:58 -0800

AV Signatures in 11.x releases

With the release of 12.0, WatchGuard introduced a new GAV engine to take advantage of new AV industry technology and would discontinue support for older AVG engines in Fireware 11.x by January 2018. GAV signature support for 11.10.7 and above will remain in place until April 2018.

As of December 31, 2017, appliances running 11.10.5 and earlier Fireware versions may be experiencing scan errors and observing the following messaging in the log files:

01-02 13:41:58 scand license init failed(The license has expired.) Debug

2018-01-02 13:41:58 scand Instance_Create failed. Debug

The licensing error is in relation to the license key expiration of the AV scanning engine provided by AVG and not the appliance’s feature key. The licensing of AVG’s scanning engine has been extended until April 2018 in 11.10.7 and later Fireware versions. We recommend that you have your customers upgrade to our latest software build 12.1 to resolve this issue. If that is not currently an option, please upgrade to at least 11.10.7 to resolve this GAV licensing/scanning issue.

Please note that when upgrading to 12.x software versions, signature updates may take up to 20 minutes to complete. During this time, you may experience scanning issues but these will resolve once the signatures have completed the update process. For more detailed information, see the release notes for 12.0.

To stay up to date on this issue, please subscribe to receive updates from our Product and Support News blog.

Thank you for all that you do as a loyal WatchGuard customer.

Customer Support Access Changes

Kimberly Taylor — Tue, 19 Dec 2017 15:39:01 -0800

As a loyal WatchGuard customer, I’m sure that you’re aware that WatchGuard is growing! To address your future needs, WatchGuard Customer Support is changing the way our technicians connect to your WatchGuard appliance while working on a support case.

New Option to Enable Support Access

Over the years, you have used a list of IP addresses in a WatchGuard policy to grant our technicians access to a Firebox or XTM appliance to troubleshoot issues. For added security and ease of granting WatchGuard Support access, we have added an additional Support Access feature to Fireware v12.0.1.

The Support Access option enables WatchGuard Support to connect to your Firebox with read-only permission. It adds a temporary user account with read-only permission and a temporary hidden policy that allows connections to the Firebox from ts.watchguard.com. You can automatically generate credentials or specify a user name and password to provide to your WatchGuard support representative.

You can also define an expiration for the temporary Support Access account. Options for support access account expiration include:

None (no expiration)
3 months
1 month
1 week
1 day

New Connection IP Network Address

Appliances that run Fireware v12.0 or earlier will continue to use the WatchGuard policy configuration process, which involves adding specific IP addresses and ranges to the WatchGuard policy. WatchGuard Support is migrating to a new public subnet as part of an IT infrastructure change. For instructions on updating or setting up your WatchGuard policy configuration please see the knowledge base article #10426: Allow WatchGuard Support to connect to your Firebox.

As you migrate to Fireware v12.0.1 and higher software versions, please begin using the more secure and easy-to-use Support Access process to provide read-only access to your Firebox when working on support cases. For more detailed information on the Support Access feature, please see the online documentation.

Wishing all our loyal WatchGuard customers a wonderful holiday season.

Wi-Fi Key Reinstallation Attack “KRACK” Update: Protecting Unpatched Devices

Chris Warfield — Fri, 20 Oct 2017 13:58:03 -0700

Summary
On October 16, 2017, security researchers announced several vulnerabilities in the WPA/WPA2 encryption protocol that affect countless Wi-Fi enabled devices worldwide. As a result of KRACK, Wi-Fi data streams, including passwords and personal data, can be intercepted, decrypted, and modified without a user’s knowledge. This security flaw means that, for vulnerable clients and access points, WPA- and WPA2-encrypted Wi-Fi traffic is potentially exposed until certain steps are taken to remediate the issue.

Presently, there are 10 known vulnerabilities that comprise KRACK. WatchGuard is providing patches for all of our affected products. For non-WatchGuard devices, users should refer to their vendor’s website and security advisories to determine if they are affected, and if updates are available. Even though most companies will provide patches, it’s likely that unpatched devices will interact with your network and expose you to risk. WatchGuard offers additional methods to protect unpatched client devices from KRACK.

How to Mitigate KRACK
The steps below describe recommended actions to protect your network from KRACK vulnerabilities in various scenarios, including from unpatched client devices.

Update your access point (AP) firmware
- WatchGuard will provide patches for all supported APs and tabletop appliances with embedded wireless APs.

Enable “Mitigate WPA/WPA2 key reinstallation vulnerability in clients” feature. The AP can compensate for the unpatched clients with this setting enabled. Mitigation is recommended only until all clients are patched.
- AP managed by GWC: Available for the AP120, AP320, AP322, and AP420 with the patch issued on 10/31/17.
- AP managed by Wi-Fi Cloud (link to WatchGuard Knowledge Base article is below).
- Firebox with built-in Wi-Fi: Available on the T-10W, T-10W, and T-50W with TBD firmware update.
- In a small percent of cases, mitigation may exacerbate client connectivity issues in environments already suffering from weak signal coverage or high interference.

Alternatively, enable “AP MAC Spoofing Prevention” setting in Wi-Fi Cloud WIPS policy.
- AP managed by GWC: manage your APs with a Wi-Fi Cloud license and acquire dedicated WIPS sensors for your environment.
- AP managed by Wi-Fi Cloud: enable setting in the management interface.

Additional Information

Learn more about the WatchGuard patch schedule, and the KRACK Common Vulnerability and Exposure (CVE) identifiers in our Product and Support Blog post.
WatchGuard Knowledge Base article: WatchGuard Wi-Fi Cloud and the KRACK WPA/WPA2 wireless vulnerabilities.
See our Knowledge Base article about Gateway Wireless Controller and the KRACK WPA/WPA2 wireless vulnerabilities.

Updates to Customer Support Phone System

Kimberly Taylor — Thu, 14 Sep 2017 13:45:43 -0700

As of Monday 18 September, WatchGuard Customer Support is pleased to announce some upcoming improvements to our phone system. We are integrating our phone system and CRM systems so that we can automatically find your account and contact information when you call in for support. We will use your phone number, either the number you call from or a number manually entered by you when you call, to locate your details within our system. We will use this information to prioritize your call and route your call to the correct support representative. We have also made some minor improvements to our language specific lines.

What to expect

Two new options when you call in to WatchGuard Technical Support:
- You can select the language you want to be supported in (English, Spanish, French, Italian, Japanese, Mandarin)
- You can confirm the best phone number for us to use to find your account information
Introduction of Business Hours for our language-specific phone lines:
- The language-specific phone lines will open and close depending on customer time zone
- During closed hours, customers who call a language-specific line will be given the option to leave a voicemail for the next available language speaker or to be transferred to an English-speaking representative

What you need to do

To prepare for these changes, we recommend that you log in to the WatchGuard website to verify your contact information is correct. We will use the phone numbers in your Profile to find your account when you call in. To review and update your profile information, click here. For more information about how to update your profile, you can also watch this video tutorial.