To monitor the status and activity on your Firebox from Fireware Web UI, you can use the Dashboard and System Status pages.
The Dashboard
From the Dashboard, you can see real-time information about your Firebox on these pages:
The Front Panel page shows basic information about your device, connected servers, your network, and network traffic.
The System, Servers, WatchGuard Cloud, 4G LTE, External Bandwidth, IPSec VPN, CPU, and Memory widgets refresh at the interval you specify to show you the historical information about your device.
From the Top Panels, you can see real-time data about the currently active connections through your device. Top Panels include: Top Clients, Top Destinations, Top Policies, and Destination Port.
The Subscription Services page shows:
- Scanned, infected, and skipped traffic that is monitored by Gateway AntiVirus
- Scanned, suspect, and infected traffic that is identified by IntelligentAV
- Scanned, detected, and prevented traffic that is monitored by Intrusion Prevention Service
- Signature version and update information for Gateway AntiVirus and Intrusion Prevention Service
- Good, bad, and inconclusive reputation score statistics for URLs checked by Reputation Enabled Defense
The web reputation authority service provided by Reputation Enabled Defense (RED) is deprecated. For more information, go to this Partner Blog post.
- HTTP requests and traffic that is denied by WebBlocker
- Clean and spam mail that is identified by spamBlocker. In Fireware v12.5.3 and lower you will also see confirmed, bulk, and suspect mail that is identified by spamBlocker.
- Scanned, blocked, and quarantined content that is identified by Data Loss Prevention
- Files allowed and dropped by the File Exceptions list
- Scanned, blocked, and quarantined content that is identified by APT Blocker
- Scanned and blocked content that is identified by Botnet Detection
- Scanned and blocked traffic identified by Geolocation
- Scanned, detected, and blocked applications that are identified by Application Control
- Signature version and update information for the default Microsoft 365 alias
For more information about manual signature updates, see Subscription Services Status and Manual Signatures Updates.
On the FireWatch page, you can see real-time, aggregate information about the traffic through your Firebox. Some of the information you can see includes:
- Top Users
- Top Domains
- Application Usage
- Bandwidth Usage
- Firewall Traffic
- Security Service Activity
- Device State
On the Interfaces page, you can see current bandwidth and detailed information for the active interfaces on your device. This includes wireless interfaces configured for your AP devices. You can also release or renew the DHCP lease on an IP address for any external interface with DHCP enabled.
On the Traffic Monitor page, you can see log messages from your Firebox as they occur. This can help you troubleshoot network performance. For example, you can see which policies are used most, or whether external interfaces are constantly used to their maximum capacity.
On the Gateway Wireless Controller page, you can monitor the connection status and activity on your WatchGuard AP devices. You can also monitor and manage the client connections to your WatchGuard AP devices.
On the Geolocation page, you can monitor the activity of network traffic by geographic location as identified by the Geolocation feature.
On the Mobile Security page, you can monitor the mobile devices that are connected to your network.
On the Network Discovery page, you can see a tree map view of all the devices on your network that are connected to the interfaces on your Firebox, and see detailed information for each connected device.
System Status Pages
The System Status pages include a list of monitoring categories. On these pages, you can monitor all the components of your Firebox.
From the System Status section, you can see real-time information on these pages:
- ARP Table
- Authentication List
- Blocked Sites
- Components List
- DHCP Leases
- Diagnostics
- Dynamic DNS
- Hotspot Clients
- Processes
- Routes
- Multicast Routes
- Server Connection
- SSO Agents
- Traffic Management
- Users and Roles
- Quotas
- VM Information
- VPN Statistics
- SD-WAN Status
- 4G LTE Modem or 5G Modem
- Rogue AP Detection
- Wireless Statistics
The System Status pages are set to refresh automatically every 30 seconds. You can change the refresh interval to refresh more or less frequently. You can also pause or restart the page refresh.
- To change the refresh interval, from the drop-down list at the top right of the page, select another interval:
- 5 seconds
- 10 seconds
- 30 seconds
- 60 seconds
- 2 minutes
- 5 minutes
- To force an immediate refresh, click
.
Or, on some System Status pages, click
and then click 
.
On some of the System Status pages, you must use Device Administrator credentials to complete some of the administrative actions available on the page. For example, on the Authentication List page, you must be connected with Device Administrator credentials to log off users who have authenticated to the device.
If you are connected to a FireCluster with the cluster backup master IP address, and have logged in to the device with Device Administrator credentials, the options to complete these administrative actions are not available. You must connect to the FireCluster with the cluster master IP address, and log in with Device Administrator credentials, to make such changes to the FireCluster.
See Authenticated Users in Fireware Web UI
Interface Information and SD-WAN Monitoring
Enable Active Directory SSO on the Firebox
VM Information (Firebox Cloud)