WatchGuard Firebox Configuration

WatchGuard Firebox appliances run Fireware OS and are managed through three primary interfaces: Fireware Web UI (browser-based, day-to-day), WatchGuard System Manager (WSM) (Windows desktop application, preferred for initial configuration and template-based deployment), and WatchGuard Cloud (centralized management for multiple devices). This page covers initial setup, network configuration, and firewall policy management based on official WatchGuard documentation.

Factory reset

To reset a Firebox to factory-default settings (needed when passphrases are lost or starting fresh):

1. Power off the Firebox
2. Press and hold the Reset button on the back of the device
3. While holding Reset, power on the Firebox
4. Continue holding until the Attn/Shield LED blinks green, then release

The device reboots with factory-default settings. For FireboxV virtual machines, log in to the CLI as admin and run restore factory-default. ¹

WatchGuard System Manager (WSM)

WSM is the preferred tool for initial configuration because it offers capabilities the Web UI lacks:

• Configuration templates — pull an entire config from one device and push it to another, using an existing firebox as a template
• Offline editing — prepare and validate changes before pushing to the device, reducing the risk of lockout during network reconfiguration
• Multi-device management — manage multiple fireboxes from a single console

In WSM, the status user account is used for read-only operations; authentication as admin is required only when saving changes.

Installation

WSM is a Windows application. Download the latest version from the WatchGuard Software Downloads portal (available through the downloads page for any Firebox model). On Linux, WSM can be run under Wine using a compatibility wrapper such as Bottles. ^{2 3 4 5}

Activation

After initial setup, activate the device in the WatchGuard portal to retrieve the feature key — a license file that enables subscription services (AV, IPS, web filtering, etc.). The feature key is required when cloning a configuration from another device.

In WatchGuard Cloud, navigate to My WatchGuard > Manage Products, select the device serial number, and click Get your feature key on the product details page.

Network setup

VLANs

VLAN configuration requires an interface with its Interface Type set to VLAN. Before creating a VLAN, at least one physical interface must be configured as a VLAN interface.

Key steps in Fireware Web UI:

1. Select Network > Interfaces, edit the interface, set Interface Type to VLAN
2. Select Network > VLAN, click Add, specify VLAN name, ID, security zone (Trusted/Optional/Custom/External), and IP address
3. Assign the VLAN interface and specify whether traffic is tagged or untagged

Caution: Do not change the interface type of the interface you are currently connected through — the type change will drop your connectivity because the interface will no longer have an active network configuration. WSM’s offline editing avoids this problem by letting you configure VLANs before pushing the change.

When configuring a VLAN interface, specify the VLAN ID (normally 1) for untagged traffic. Intra-VLAN traffic inspection is enabled by default on external interfaces; the Firebox applies firewall policies to traffic between hosts on the same VLAN when that traffic passes through the device. ^{6 7 8}

Firewall policies

The Firebox uses two categories of policies to filter network traffic:

Type	What it inspects	Use case
Packet filter	IP and TCP/UDP headers only	Basic port/protocol filtering; lower CPU overhead
Proxy policy / ALG	Both headers and payload content	AV scanning, content inspection, application control

The default configuration uses proxy policies so the Firebox can leverage licensed security services. Proxy policies are identified by *-proxy naming (HTTP-proxy, SMTP-proxy, etc.). Each proxy policy has an associated proxy action that defines the inspection behavior — think of proxy actions as sub-profiles for the proxy.

Default policies apply to both “Trusted” and “Optional” security zones. The “Optional” zone is typically used for DMZs; removing it from default policies makes the configuration more explicit and locked down.

Logging

Traffic logging must be explicitly enabled to record successful policy matches; denied traffic is always logged. For email alerts and centralized logging, a Dimension log server is required. ^{9 10 11}

Sources

• WatchGuard — Reset a Firebox
• WatchGuard — Firebox Reset and Recovery
• WatchGuard — Install WatchGuard System Manager Software
• WatchGuard Software Downloads
• WineHQ — What is Wine?
• Bottles — Run Windows Software on Linux
• WatchGuard — Configure Firebox VLANs
• WatchGuard — Define a New VLAN
• WatchGuard — Configure Two VLANs on the Same Interface
• WatchGuard — About Policies
• WatchGuard — About Proxy Policies and ALGs
• WatchGuard — Firebox Configuration Best Practices

Related: windows-event-logs (log forwarding), windows-reconnaissance-commands (network discovery on the inside), watchguard-access-point-configuration (cloud-managed AP side), vlans (802.1Q background)

Footnotes

1. WatchGuard — Reset a Firebox ↩

2. WatchGuard — Install WatchGuard System Manager Software ↩

3. WatchGuard Software Downloads ↩

4. WineHQ — What is Wine? ↩

5. Bottles — Run Windows Software on Linux ↩

6. WatchGuard — Configure Firebox VLANs ↩

7. WatchGuard — Define a New VLAN ↩

8. WatchGuard — Configure Two VLANs on the Same Interface ↩

9. WatchGuard — About Policies ↩

10. WatchGuard — About Proxy Policies and ALGs ↩

11. WatchGuard — Firebox Configuration Best Practices ↩