Wanting to deploy a Watchguard, wel...
Where should I begin to tell you something about WatchGuard.
Currently i managing 148 all different kind of Watchguard devices. It's been my work for the last 3 1/2 years (some would say, i am living in a hell, but atleast i get paid for it).
Next ot Watchguard I managing also Sonicwalls and Checkpoints FW1.
The mayor problems:
- lock-up/freeze (the couse, viruses like blaster, most of the time you can’t tell what coused the lock-up)
- changes to the config (it’s never constant and always asks a reboot when never did before)
- locked-up MUVPN slots (IPSEC VPN users) (I believe recently resolved with WSM7.3, I am using MSS7.2)
- I don’t want to think hard about, it’s Friday and I want to go home, there a re much more points.
Remedy: restart
There are for sure things to consider when you want to deploy a WG, but there is just to much of them to tell them.
Here I have some point what I think what should be at least implemented before considering a WG.
Here are my points (addressed to WG):
=================
++ = higly demanded
+ = demanded
- = would be nice feature
=================
++ Remove that automated 'ANY' rule when creating VPN tunnels by VPN manager!!!
Mentioned before, this is a PAIN in the *ss
Connecting offices with VPN tunnels doesn't mean that those offices are trusted. It's more
the otherway around! For sure now it is with the viruses, you want to minimialize any problems and security threads.
To my opinions, this automated feature is one of the big minors in the VPN manager setup. I believe that this is really easy to disable in
your software or please let me specify for what i want.
++ Ping AND Traceroute (with specifying your own IP address!) (?)
For now i use the FBSH util (UNIX) to do all of this and a Windows version will not come (your marketing doesn’t approve). What we need is that we can initiate a any given IP address to PING or TRACE (with given source) from the GUI. The existing GUI implementation demands that you initiate a PING or TRACE from a
IP address what passes the logging, you can't work with this implementation for troubleshooting.
So, it would be really great to initiate a PING/TRACE from GUI (not that PING from selecting a IP from logging output) and ofcourse specify
the source address (actually the Interface). You have to specify the Source, due the different networks what you have to deal with.
++ Adminstrative value to your policy rule, in other words, to overrule the service the ANY rule when needed!! (?)
In some situations, one given rule is more important then any other rule. In some cases i create a 'ANY' rule tothe Optional interface, but
while the 'ANY' rule overrules the 'Service' (like SMB, But the FTP (HTTP?) PROXY service overrules again the 'ANY'), i have situations that
i really would that i could overrule a 'Services' the 'ANY" rule.
Although one of my own workaround is to create my own service with the complete port range (1-65536), but also this doesn't give me a
satisfied solution, especially when you want to pass the IP protocol instead of the TCP/UDP port numbers.
+ Removing locked authenticated MUVPN users (SOLVED WITH WSM 7.3?)
This is a known problem, atleast when i was using MSS6.2. Maybe i missed the note that this problem is been resolved in the new
releases? . When you create 'Extended Authentication Groups' MUVPN users, the session on the firebox will stay up when a user abruptly
disconnect from his VPN session. The session on the firebox doesn't timeout and the only way to free-up the sessions is to reboot! Not
acceptable.
+ Create a new service and using the IP protocol nr (6,17) (?)
?, exactly. You can create your own New Service when choose the 'IP' Protocol, but it won't work. Like when i create a New Service with the
'IP' 6 (tcp) & 17 (udp) protocol numbers. Like this i wanted to create my own 'ANY' service (see my previous story). Because instead of
creating a range of port numbers, i would like to specify the protocol number. Well, it's not only 6 & 17.
++ specifying your own FTP proxy port numbers
I experienced situations that i wish that could change the default port (21) number into something else. I have created different
workarounds because i couldn't change that freaky port number
I don't know what is the exactly reason and where the difficulties are
laying, but i am not interested to replace every time my Firebox for a Pix firewall only because my customers want to initiate a Passive
connections at a different port number.
+ Individual User Bandwidth usage meter (by ip, authenticated user? please explain)
Both
, most of the times, our customer have a limited bandwidth. What we really need, is that we can read/tell for how much bandwidth a IP
is using (how much traffic does it generates). This implementation is really welcome. But I gueass I have to wait when SNMP will be implemented….(MSS 8.0?)
+ Service Session time out (define per service..?)
Yep, A session timeout for what you can specify in a Service policy (and any new created services). For now you can't do nothing with it and
in my opinions you should. I want that the FB close a session what becomes idle especially Telnet/SSH sessions. But there where also other
moments that i wish that i could close a idle session by time out.
+ Blocked Sites, add a site to block by hand, or doing this from hostwatch
It would be great if i can block a site instantly. Now you have to configure the 'Auto-Block Sites that....'. I would that i could do this
by hand. Ofcourse you can deploy a IDS and integrate this together with you firebox, but this is a overkill. Add a IP to block (with the default blocking period)
+ Block Host from trusted/optional >> WAN interface, when it makes more x connections/seccond. To prevent that the Firebox to freeze (Blaster Virus).
Now the other way around! First (my thoughts), It looks like that the marketing/Product Management created a weak point in the system of
the Firebox firewall by _software_ limiting the firebox capabilities. I can't imagine no other reason for the unexplainable free/lockups of my firebox firewall the old III series and also the new X series. It seems only to happen when the box have to handle to much connections in a very short moment. I think that the engine freeze and stops working.
Well, those are my thoughts. Now for what i would like to see is that the firewall also could do the same thing as what is does for the External interface, blocking IP when it makes to much connections from the trusted/Optional interface (or from interface 3,4 and 5).
The external interface is a the un-trusted zone, but the un-trusted zone could also be behind interface 4 or 5. If it is like that, i want to have then the same possibilities of blocking users.
So this means, i have to be able to specify for which interface i have to apply the 'Auto-block sites that attempt to connect via...', for now this is default only the External interface.
+ Allow more then 50 concurrent pptp-vpn with the new X series.
I think that the Firebox X with his PIII 1.3 Ghz can handle more then 50 concurrent
Just let us pay for this and activate this with a certificate or something.
Our customer prefer PPTP-VPN with Tokens above IPSEC MUVPN.
+ Record or save all the 'Host Watch' connections, i mentioned this also in ticket xxxxx, after my X1000 froze. Very likely from a PC infected a virus. That box is doing only routing with public IP addresses (no NAT no Proxy).
This would be great for instant trouble shooting. Recording (save) the Host watch connections and AUTO reconnect when it loose his connection.
- DNS proxy, add your own host record (can be very handy) (in the context of.?)
When a public accessible
resides behind the Trusted with a private IP range, the Firebox can't create a NAT table when the
customer is browsing his own server. Only applicable for when a customer don't have their own DSN server. Like small schools.
- Change the JAVA applet 4100 port number into.... and change that logo into my company logo.
- Let pass-through the RADIUS attributes to the Firebox PPTP users. I want to assign by our RADIUS the DNS, IP.
There is MUCH more to improve....
But let's first start with the beginning.
All of this is only to make our live easier... from here, the product is ok. Escpially the GUI is very nice done job!
For ISP, WG is just not the product, you are better of with Sonicwall, especially with the power of the SGMS system... a _REAL_ great system. And also, this product also have his own flaws, but now we are talking about WG.
DYGobel
