Firebox Migration to Cloud Management Guide

There are two ways you can manage a Firebox in WatchGuard Cloud:

• Firebox Management in WatchGuard Cloud (Cloud Management) — When a Firebox is cloud-managed, you fully manage the configuration and monitor for visibility and reporting in WatchGuard Cloud. You no longer manage the device configuration with Fireware Web UI or WatchGuard System Manager.
• Firebox Visibility and Reporting in WatchGuard Cloud (Local Management) — When you add a locally-managed Firebox to WatchGuard Cloud, you continue to configure the device locally from Fireware Web UI or WatchGuard System Manager, but you can monitor live status, view log messages and reports, and perform firmware upgrades from WatchGuard Cloud.

To more easily change Fireboxes from local management to cloud management, we recommend you first add your locally-managed Fireboxes to WatchGuard Cloud for visibility and reporting. With this method, it is easier to change a Firebox to cloud management because the device is already available in WatchGuard Cloud, and you can gradually change your devices. For more information, go to Add a Locally-Managed Firebox to WatchGuard Cloud.

Use the steps in the Migrate Fireboxes to WatchGuard Cloud — Checklist to plan your change to cloud management.

1. Plan the Change to Cloud Management — Review your current locally-managed Firebox configurations and plan how to change to cloud management.
2. Set Up WatchGuard Cloud — Before you change to cloud management, set up your WatchGuard Cloud account, operators, and managed accounts.
3. Plan and Set Up Templates and Configuration Settings — After you add your Fireboxes to WatchGuard Cloud, set up templates and configuration settings for the devices.
4. Change Locally-Managed Fireboxes from Visibility to Cloud-Managed — After you build the Firebox configuration in WatchGuard Cloud, change your Firebox to cloud management.
5. Test the Firebox After Change to Cloud Management — Test the device to make sure that your Firebox works as expected.

We recommend you select a locally-managed Firebox as an initial test device to change to cloud management. Create a cloud configuration with a base configuration that includes common settings for your Fireboxes, and then use Firebox templates to configure additional policies and services, as required. When you change other Fireboxes to cloud management, you can copy the configuration settings from this initial cloud-managed Firebox.

These are the steps to change a locally-managed Firebox to cloud management:

In this example, we change a locally-managed Firebox that has already been added to WatchGuard Cloud for visibility and reporting to cloud management, and copy the configuration from another existing cloud-managed Firebox.

To change a locally-managed Firebox to cloud management and copy the configuration from another cloud-managed Firebox:

1. In Fireware Web UI or WSM, log in to your locally-managed Firebox and download the most recent configuration file as a backup.

2. Log in to your WatchGuard Cloud account.
   For Service Provider accounts, from Account Manager, select My Account.
3. Select Configure > Devices.
4. Select the Firebox you want to change to cloud management.
   The Device Settings page opens.
5. Make sure the Firebox runs the latest version of Fireware. You can click the Upgrade Firmware link to upgrade the Firebox.

6. In the Cloud Management section, click Change to Cloud Management.

7. Confirm that you want to change to cloud management.

Caution: When you advance to the next step and the Add Device wizard starts, you can no longer make configuration changes to the Firebox configuration with Fireware Web UI or WatchGuard System Manager.

8. Select the Copy a configuration from another cloud-managed Firebox option, then click Next.
   

9. Select the cloud-managed Firebox you want to copy the configuration from, then click Next.

Make sure you review the list of settings that are not copied and require manual configuration in WatchGuard Cloud, such as VPN settings and device certificates.

10. Enter the Device Name, select a Time Zone, and select the folder location for the device in WatchGuard Cloud. Click Next.

11. If you have a wireless-capable Firebox, configure the wireless SSID network names and passphrases, then click Next.

12. Set the Status and Admin passwords for Fireware Web UI access, then click Next.

Caution: If you have to back out of the chance to cloud management and revert the device to local management, you must use these new credentials to log in to the device with Fireware Web UI or WatchGuard System Manager.

13. Click Next.

14. Review the device configuration and make changes as necessary:

• The current local configuration remains active until you deploy the cloud-managed configuration. The configuration to deploy appears in the Deployment History page with the description Initial Deployment and a status of Staged.
• Make sure you review the external and internal network interfaces, network settings, wireless settings, and VPN settings, if applicable, in the cloud-managed configuration before you deploy. If you require more than one external interface or the external interface is physically connected to another port, manually configure the interface before you schedule the deployment.
• Review your Firebox template subscriptions.
• Add any policies that you require on the device.

15. To deploy the configuration, click Schedule Deployment.

For more information, go to Manage Device Configuration Deployment.
WatchGuard Cloud automatically creates a deployment history of all scheduled deployments. The new cloud-managed configuration replaces the locally-managed configuration on the Firebox.