Protect a Web Server

You can configure the proxy policies and subscription services in your Firebox Cloud configuration file to protect a web server on the virtual network connected to your Firebox Cloud instance.

For more information about Firebox Cloud features, see:

• Introduction to Firebox Cloud
• Firebox Cloud Feature Differences

Step 1 — Launch an Instance of Firebox Cloud

To protect a web server with Firebox Cloud, you must launch an instance of Firebox Cloud instance in the same VPC as the web server you want to protect. You must assign an Elastic IP (EIP) address to eth0 of the instance of Firebox Cloud. This is the public IP address of Firebox Cloud. The web server to protect must be on the private subnet of the VPC where you deploy the instance of Firebox Cloud.

For detailed steps to launch and configure the instance on AWS or Azure, see:

• Deploy Firebox Cloud on AWS
• Deploy Firebox Cloud on Microsoft Azure

After you deploy the instance of Firebox Cloud, connect to it with Fireware Web UI at the public IP address of the Firebox external interface:

https://<eth0_public_IP>:8080

After you have connected to Fireware Web UI for your instance of Firebox Cloud, you can configure your Firebox Cloud.

Step 2 — Add A Static NAT Action

Add a static NAT action for traffic from the external interface to the internal IP address of the web server. You can then use the static NAT action in policies that allow traffic to your web server.

To add a static NAT action, from Fireware Web UI:

1. Select Firewall > SNAT.
2. Add a static NAT action that allows traffic from the external interface to the private IP address of the web server.

3. Click Save.

Step 3 — Add HTTP and HTTPS Proxy Policies

After you add the static NAT action, to allow HTTP and HTTPS traffic to the web server, you can add proxy policies that use the new static NAT action. You also clone the predefined proxy actions for each policy and create user-defined proxy actions that you can edit.

Add an HTTP-Proxy Policy

To allow HTTP traffic through Firebox Cloud to the web server over port 80, you must add an HTTP-proxy policy to the Firebox Cloud configuration.

To add the HTTP-Proxy policy, from Fireware Web UI:

1. Select Firewall > Firewall Policies.
2. Click Add Policy.
3. Select Proxies.
4. Select the HTTP-proxy and the HTTP-Server.Standard proxy action.
5. Click Add Policy.
   By default, the policy allows traffic from Any-External to Any-Trusted.
6. From the policy To list, remove Any-Trusted. Click Add.
7. From the Member type drop-down list, select Static NAT and select the static NAT action you added. Click OK.
   The static NAT action is added to the policy.

To select a user-defined proxy action for HTTP traffic:

1. Select the Proxy Action tab.
2. From the Proxy Action drop-down list, select Clone the current proxy action.
   A user-defined proxy action based on the predefined proxy action is created and assigned to the policy. The cloned proxy action has a number appended to the name. For example, HTTP-Server.Standard.1.
3. Click Save.

Add an HTTPS-Proxy Policy

To allow secure web traffic (HTTPS) to your web server, you must also add an HTTPS-proxy policy that allows HTTPS connections to the server over port 443. In the proxy configuration, you clone the predefined HTTPS proxy action and enable inspection of HTTPS content.

To add the HTTPS-proxy policy, from Fireware Web UI:

1. Select Firewall > Firewall Policies.
2. Click Add Policy.
3. Select Proxies.
4. Select the HTTPS-proxy and the HTTPS-Server.Standard proxy action.
5. Click Add Policy.
   By default, the policy allows traffic from Any-External to Any-Trusted.
6. From the To list, remove Any-Trusted. Click Add.
7. From the Member type drop-down list, select Static NAT and select the static NAT action you added. Click OK.
   The static NAT action is added to the policy.

To select a user-defined proxy action and enable inspection of HTTPS content:

1. Select the Proxy Action tab.
2. From the Proxy Action drop-down list, select Clone the current proxy action.
   A user-defined proxy action based on the predefined proxy action is created and assigned to the policy. The cloned proxy action has a number appended to the name. For example, HTTPS-Server.Standard.1.

3. In the HTTPS Proxy Action Settings section, select the Content Inspection tab.
4. Select the Enable Content Inspection check box.
5. From the Proxy Action drop-down list, select the user-defined HTTP proxy action you created when you cloned the HTTP proxy action in the HTTP-Proxy policy.
   For example, select HTTP-Server.Standard.1.
6. Click Save.

Import a Proxy Server Certificate

If you enable inspection of HTTPS content, the HTTPS proxy intercepts the HTTPS request, and starts a new connection to the destination HTTPS server on behalf of the client. The HTTPS proxy in your Firebox Cloud configuration sends a self-signed certificate to the client that originated the connection. To avoid certificate errors in the web browser for users that connect to the server with HTTPS, you must get the proxy server certificate and key pair from the web server and import it to Firebox Cloud as a proxy server certificate.

To import the certificate, from Fireware Web UI:

1. Select System > Certificates.
2. Select Import Certificate/CL.
3. For the Certificate Function, select Proxy Server.
4. Import the certificate file from your web server.
5. Save the configuration.

For more information, see Manage Device Certificates (Web UI).

Step 4 — Enable Subscription Services

Firebox Cloud includes activated subscription services you can use to control network traffic. Follow the instructions in these procedures to enable subscription services for the HTTP and HTTPS proxy policies.

Enable Gateway AntiVirus

Gateway AntiVirus (Gateway AV) works with the SMTP, POP3, HTTP, FTP, and TCP-UDP proxies. When a new attack is identified, the features that make the virus unique are recorded. These recorded features are known as the signature. Gateway AV uses these signatures to find viruses when content is scanned by the proxy.

To enable Gateway AV in the user-defined HTTP-proxy action assigned to your HTTP-proxy policy, from Fireware Web UI:

1. Select Subscription Services > Gateway AV.
   The Gateway AntiVirus Activation Wizard starts automatically if Gateway AV is not already enabled.
2. Complete the wizard.

Enable Intrusion Prevention Service (IPS)

Intrusion Prevention Service (IPS) provides real-time protection from threats, such as spyware, SQL injections, cross-site scripting, and buffer overflows.

To enable IPS, from Fireware Web UI:

1. Select Subscription Services > IPS.
2. Select the Enable Intrusion Prevention check box.
3. Make sure that IPS is enabled in the HTTP-proxy and HTTPS-proxy policies you added.

Enable Botnet Detection

The Botnet Detection subscription service uses a feed of known botnet site IP addresses gathered by Reputation Enabled Defense (RED). These known botnet sites are added to the Blocked Sites List that enables Firebox Cloud to block these sites at the packet level.

To enable Botnet Detection, from Fireware Web UI:

1. Select Subscription Services > Botnet Detection.
2. Select the Block traffic from suspected botnet sites check box.
3. Click Save.

Enable Data Loss Prevention

The Data Loss Prevention (DLP) service enables you to detect, monitor, and prevent accidental unauthorized transmission of confidential information outside your network or across network boundaries. You can use the built-in PCI Audit or HIPAA Audit sensors, or create your own sensor.

For example, to enable Data Loss Prevention for PCI compliance, from Fireware Web UI:

1. Select Subscription Services > Data Loss Prevention.
2. Select the Enable Data Loss Prevention check box.
3. Select the Policies tab.
4. Configure the HTTP-proxy and HTTPS-proxy to use the PCI Audit Sensor.
5. Click Save.

The default Data Loss Prevention sensors monitor and send log messages when they detect data that matches the rules enabled in the sensor. To change the action for the sensor, you can clone the sensor and then edit the settings in the new sensor.

Configure Threat Detection and Response

Threat Detection and Response (TDR) is a cloud-based service hosted by WatchGuard. Your Threat Detection and Response account in the cloud collects and analyzes forensic data received from Fireboxes and Host Sensors on your network. You log into your TDR account on the WatchGuard Portal to configure account settings, Host Sensor settings, and to monitor and manage security threats.

Before you can enable Threat Detection and Response in your Firebox Cloud configuration, you must log in to Threat Detection and Response and get your TDR Account UUID.

For more information, see Log In to the TDR Web UI.

To find your Account UUID:

1. Log in to the TDR web UI as a user with Operator credentials.
2. Select Devices > Firebox.
   The Account UUID appears at the top of the page.
3. Copy the Account UUID.

To enable Threat Detection and Response, from Fireware Web UI:

1. Select Subscription Services > Threat Detection.
2. Select the Enable Threat Detection & Response check box.
3. In the Account UUID and Confirm text boxes, paste your Account UUID.
4. Click Save.

For more information, see Enable TDR on Your Firebox.

Configure Geolocation

The Geolocation subscription service uses a database of IP addresses and countries to identify the geographic location of connections through the Firebox. Geolocation is enabled by default. You can configure Geolocation to block connections to or from specific regions.

If your internal network configuration includes IP addresses outside the reserved private IP address ranges defined in RFC 1918, RFC 5737, or RFC 3330, make sure to look up the geolocation of the IP addresses in your network before you block a country.

To look up the geolocation of an IP address, from Fireware Web UI:

1. Select Dashboard > Geolocation > Lookup. 
2. Specify the IP address to look up.

To select the countries to block, from Fireware Web UI:

1. Select Subscription Services > Geolocation.
2. Select the Enable Geolocation check box.
3. Select countries to block on a map or from a list.
4. If there are sites you want to allow in the blocked countries, configure exceptions.
5. Save the configuration.

For more information about how to select countries and configure exceptions, see Configure Geolocation in Fireware Help.

For more information about how to select countries and configure exceptions, see Configure Geolocation.

Give Us Feedback  •   Get Support  •   All Product Documentation  •   Technical Search

© 2018 WatchGuard Technologies, Inc. All rights reserved. WatchGuard, the WatchGuard logo, WatchGuard Dimension, Firebox, Core, Fireware, and LiveSecurity are registered trademarks or trademarks of WatchGuard Technologies in the United States and/or other countries.