![Contents](../../../Resources/Images/red_menu.png)
Related Topics
Enable TDR on Your Firebox
To detect indicators of threats on your network, the Threat Detection and Response subscription service collects and analyzes forensic data from the Firebox and from hosts on your network. For more information, see About Threat Detection and Response.
Before you can enable Threat Detection and Response on your Firebox, your Firebox must run Fireware v11.12 or higher and must have the Threat Detection and Response subscription service enabled in the feature key.
Get your TDR Account UUID
Before you can enable Threat Detection and Response on a Firebox, you must know your Threat Detection and Response Account UUID.
To find your Account UUID:
- Log in to the TDR web UI as a user with Operator credentials.
- Select Devices > Firebox.
The Account UUID appears at the top of the page.
- Copy the Account UUID.
Enable Threat Detection and Response
To enable Threat Detection and Response on the Firebox, you must add the Account UUID to your Firebox configuration.
![Closed](../../../../Skins/Default/Stylesheets/Images/transparent.gif)
- Select Subscription Services > Threat Detection.
- Select the Enable Threat Detection & Response check box.
- In the Account UUID and Confirm text boxes, paste your Account UUID.
- Click Save.
- To see the status of the connection from the Firebox to TDR, select Dashboard > Front Panel.
The connection status appears in the Servers list.
![Closed](../../../../Skins/Default/Stylesheets/Images/transparent.gif)
- Select Subscription Services > Threat Detection.
- Select the Enable Threat Detection & Response check box.
- In the Account UUID and Confirm text boxes, paste your Account UUID.
- Click OK.
- Save the configuration to the Firebox.
- To see the status of the connection from the Firebox to TDR, open Firebox System Manager and select the Status Report tab.
For information about how to see the status of the Firebox connection in your TDR account, see See Firebox Status in TDR.
FQDNs for TDR Connections from the Firebox
The Firebox uses one of these FQDNs to connect to TDR:
- For the Europe account region: tdr-eu-fbla.watchguard.com
- For the Americas account region: tdr-na-fbla.watchguard.com
If your Firebox is behind another Firewall, make sure the firewall allows connections from the Firebox to the FQDN for your TDR region on TCP port 4115.
Configure Firewall Policies on Your Firebox
When you enable Threat Detection and Response in Fireware v11.12.1 and higher, the WatchGuard Threat Detection and Response policy is automatically added to the configuration. This WG-TDR-Host-Sensor packet filter policy enables Host Sensors on the trusted network to connect to your TDR account.
If your Firebox runs Fireware v11.12 or lower, when you enable TDR from Policy Manager or Fireware Web UI, you must manually add this policy. For information about how to create this policy, see Configure a Firewall Policy for TDR Traffic.
After you enable Threat Detection and Response, make sure you that you configure the firewall policies on your Firebox to inspect network traffic, generate log messages, and allow connections from Host Sensors. For more information, see Configure Proxy Policies for TDR.