WatchGuard

This guide covers WatchGuard Firebox appliances running Fireware OS.

Create a backup account

Fireware ships with two built-in accounts: admin (read-write) and status (read-only). The read-only role is sufficient for QUARK — it can display the device configuration, and QUARK never writes changes.

Prefer a dedicated account: in Fireware Web UI under System > Users and Roles, add a user named netwatch-backup and assign it the Device Monitor (read-only) role. If your Fireware release does not support additional users, use the built-in status account instead.

Enable management access

Fireware's CLI runs over SSH on TCP port 4118, not the standard port 22 — set the port to 4118 when adding the device in QUARK.

Management access is controlled by the built-in WatchGuard policy. Make sure that policy permits connections from the Netwatch collector's IP on the interface the collector reaches, and narrow the policy's source list to the collector (and your management hosts) rather than leaving it open to whole networks.

Platform notes

• Using a read-only account has a side benefit: Fireware allows only one read-write management session at a time, so QUARK never competes with an administrator for the write lock.
• In a FireCluster, back up the cluster's management address; the configuration is shared between members.

Enable backup in Netwatch

Once the device is prepared, open its host in Netwatch (Data collection > Hosts) and add the Config Backup macros — the supported status flag, the model code for this platform, and the credentials you created. See Getting started for the full macro list and values.