Watchguard Firewall Rules

Logging in and Verifying the Model

1. Obtain the IP address of the device, usually the default gateway for the computer.
    
2. Enter the IP address into the browser using the format https://IP_Address:8080 for example https://10.0.1.1:8080
    
3. Have the customer enter the username and password to log in as an administrator.
   
   
    
4. The default landing page is the dashboard, on the right-hand side you can find the model number.
   
   
    

Checking the WAN IP Address

These steps will walk you through how to check the WAN IP address and to determine if it is a static or dynamic IP address.
 

1. If not already expanded click Dashboard on the left-hand side to expand that section.
    
2. Click Interfaces.
   
   
    
3. The WAN IP address is found in the WAN box.
   
   
    
4. Click Network on the left-hand side to expand the section.
   
   
    
5. Click Interfaces.
   
   
    
6. Notate what is listed under the IPV4 Addresses of the WAN interface.  If it is DHCP, the IP address is dynamically assigned.
   
   
    

Disable SIP ALG

SIP ALG is disabled by default, but we need to check it to ensure it has not been enabled.
 

1. Click on Firewall on the left-hand side to expand the section.
   
   
    
2. Click on Proxy Actions.
   
   
    
3. Scroll down the list until you find SIP-Client.  We do NOT want the Predefined option.
   
   
    
4. Select the non Predefined client and click Edit.
   
   
    
5. Select the Access Control tab.
   
   
    
6. Verify Enable access control for VoIP is NOT checked.  If it is checked, uncheck it and click Save.
   
   
    

Multicast

1. Click Network on the left-hand side to expand the section.
   
   
    
2. Click Multicast Routing.
   
   
    
3. Ensure the Enable Multicast Routing box is checked.  If unchecked, check it and click Save.
   
   
    

Firewall Rules and UDP Timeout

The steps below walk through how to configure both LAN to WAN and WAN to LAN rules to allow traffic to Nextiva.
 

1. Select Firewall on the left-hand side to expand the section.
   
   
    
2. Click Firewall Policies.
   
   
    

LAN to WAN

1. Click Add Policy at the top of the page.
   
   
    
2. Ensure that Packet Filter is selected and choose Any from the drop-down menu.
   
   
    
3. Click Add Policy.
    
4. By default, the policy is set up as an Any - Any policy.  Leaving it like this will allow all traffic to pass to/from their network without being blocked, we only want to create rules that allow traffic to/from Nextiva.
   
   
    
5. Select the Any-Trusted in the from box and click Remove.
   
   
    
6. Below the From box click Add.
    
7. In the pop-up that appears scroll in the box, select LAN, and click OK.
   
   
    
8. In the To box, select the Any-External option and click Remove.
   
   
    
9. Click Add under the TO box.
    
10. In the window that appears, click on the drop-down menu and select either Host Range IPv4 to enter the IP range or Network IPv4 to enter the CIDR.
    
     Nextiva has two ranges that need to be whitelisted with all ports for general voice traffic:
    
      Range 1
    208.73.144.0 - 208.73.151.255
    CIDR: 208.73.144.0/21
    
    
      Range 2
    208.89.108.0 - 208.89.111.255
    CIDR: 208.89.108.0/22
    
    
     
11. Enter either the start and end IP addresses for the Nextiva range, or the CIDR.
    
    
     
12. Click OK.
     
13. Repeat steps 11 through 14 for the second IP range.
     
14. Check the box Specify custom idle timeout and enter 90 in the box to set UDP timeout to 90 seconds.
    
    
     
15. Verify that Any-Trusted and Any-External have been removed from the rule.
     
16. Scroll down and click Save.
     
17. If you chose to only put a single IP range in the rule, repeat these steps for Nextiva's second IP range.
     

WAN to LAN

1. Click Add Policy at the top of the page.
   
   
    
2. Ensure that Packet Filter is selected and choose Any from the drop-down menu.
   
   
    
3. Click Add Policy.
    
4. By default, the policy is set up as an Any - Any policy.  Leaving it like this will allow all traffic to pass to/from their network without being blocked, we only want to create rules that allow traffic to/from Nextiva.
   
   
    
5. Select the Any-Trusted in the from box and click Remove.
   
   
    
6. Below the From box click Add.
    
7. In the window that appears, click on the drop-down menu and select either Host Range IPv4 to enter the IP range or Network IPv4 to enter the CIDR.
   
    Nextiva has two ranges that need to be whitelisted with all ports for general voice traffic:
   
   Range 1
   208.73.144.0 - 208.73.151.255
   CIDR: 208.73.144.0/21
   
   
   Range 2
   208.89.108.0 - 208.89.111.255
   CIDR: 208.89.108.0/22
   
   
   
   
    
8. Enter either the start and end IP addresses for the Nextiva range, or the CIDR.
   
   
    
9. Click OK.
    
10. Repeat steps 6 through 9 for the second IP range.
     
11. In the To box, select the Any-External option and click Remove.
    
    
     
12. Click Add under the TO box.
     
13. In the pop-up that appears scroll in the box, select LAN, and click OK.
    
    
     
14. Check the box Specify custom idle timeout and enter 90 in the box to set UDP timeout to 90 seconds.
    
    
     
15. Verify that Any-Trusted and Any-External have been removed from the rule.
     
16. Scroll down and click Save.
     
17. If you chose to only put a single IP range in the rule, repeat these steps for Nextiva's second IP range.
     

Re-Ordering Rules

By default, new rules are created at the lowest priority, if the customer has any deny rules in place, the Nextiva rules will need to be moved above of the deny rules.
 

1. Check the box to the left of a single rule to move.
    
2. Click the Move Up button until the rule sits above any existing deny rules.
   
   
    
3. Repeat these steps for each Nextiva rule created.
    
4. Click Save Policy Order.
   
   
    

Load Balancing

Load balancing can cause device registration issues, dropped calls, and one-way audio.  If more than one ISP is present, the customer can setup their network in fail-over mode.
 

1. Select Network on the left-hand side to expand the section.
   
   
    
2. Click Multi-WAN.
   
   
    
3. Confirm the drop-down option at the top of the page is set to Failover and not Interface Overflow, Round-robin, or Routing table. 
   
   
    

Intrusion Prevention System (IPS)

If the customer is paying for IPS, we will need to ensure that it is disabled for traffic to/from Nextiva.  To check to see if IPS is enabled:
 

1. Select Subscription Services on the left-hand side of the page.
   
   
    
2. Select Intrusion Prevention Service.
   
   
    
3. If the customer is NOT paying for this service the page will show Your Feature Key does not have this feature enabled.
   
   
    
4. If IPS is enabled, please follow the instructions on Watchguard's help site to disable IPS for Nextiva.
    

QoS Configuration

1. From the main page click Firewall on the left-hand side of the page.
    
2. Select Traffic Management.
   
   
    
3. If unchecked, check the box to enable traffic management and click Save.
   
   
    
4. Click Add to add a new policy.
   
   
    
5. In the screen that appears enter the following information
    
   • Name: Nextiva
      
   • Description: Enter a description for the rule.
      
   • Type: Per Policy
      
   • Maximum Bandwidth: Nextiva recommends 2-3 times the guaranteed bandwidth
      
   • Guaranteed Bandwidth: 100 Kbps per phone (i.e. if you have 5 phones it should be 500 Kbps)
      

1. Click Save.
    
2. Click Firewall Policies on the left-hand side of the page.
   
   
    
3. For each Nextiva rule (WAN to LAN and LAN to WAN) apply the traffic management rule.
    
   1. Click the check icon next to the rule
       
   2. Select the Traffic Management option.
       
   3. Set the Forward Action (From >To) and the Reverse Action (To > From) to be the Nextiva rule created above.
      
      
       
   4. Click Save.
       

DSCP/CoS Marking

1. Select Firewall on the left-hand side to expand the section.
   
   
    
2. Click Firewall Policies.
   
   
   
    
3. For each Nextiva rule do the following:
    
   1. Edit the rule
       
   2. Select the Advanced tab.
       
   3. In the QoS section check the box for Override per-interface settings.
       
   4. Set the Marking Type to DSCP.
       
   5. Set the Marking method to Assign.
       
   6. Set the first Value field to 46 (EF).
       
   7. Set Prioritize traffic based on to Custom Value.
       
   8. Set the second Value field to 6.
      
      
       
   9. Click Save.