high-powerbrown

You install WatchGuard System Manager (WSM) software on a computer that you designate as the management computer. You can use the WSM tools on the management computer to manage your XTM device and get access to information such as connection and tunnel status, statistics on traffic, and log messages.

1. Watchguard Policy Manager

How to uninstall WatchGuard System Manager 11.8.1 Version 11.8.1 by WatchGuard Technologies, Inc.? Learn how to remove WatchGuard System Manager 11.8.1 Version 11.8.1 from your computer. WatchGuard System Manager 11.8.1 WatchGuard Technologies, Inc. The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from cdn.watchguard.com.

Select one Windows-based computer on your network as the management computer and install the WSM management software. To install the WatchGuard System Manager software, you must have administrative privileges on the management computer. After installation, you can use the WSM client application and tools with Windows Power User privileges, but you must have administrative privileges to use WatchGuard Server Center and manage your WatchGuard servers.

For more information about WatchGuard servers, see About WatchGuard Servers.

You can install more than one version of WatchGuard System Manager on the same management computer, as long as the versions of WSM are not in the same major release version. For example, you can install both WSM v10.2 and WSM v11.9.4, but not WSM v11.8 and WSM v11.9.4. You can install only one version of server software on a computer at a time. For example, you cannot have two Management Servers on the same computer.

If you install WatchGuard System Manager behind your firewall, to use WatchGuard WebCenter, you must have the WG-LogViewer-ReportMgr packet filter policy in your XTM device configuration to open the correct ports.

For more information about how to add a policy to your configuration, see Add Policies to Your Configuration.

Back up Your Previous Configuration

If you have a previous version of WatchGuard System Manager, make a backup of your security policy configuration file before you install a new version. For instructions to make a backup of your configuration file, see Make a Backup of the XTM Device Image.

Watchguard Policy Manager

Download WatchGuard System Manager

You can download the most current WatchGuard System Manager software at any time from the WatchGuard Portal. If you are a new user, before you can download the WSM software, you must create a user profile and activate your product at the WatchGuard Portal.

If you install one of the WatchGuard servers on a computer with a personal firewall other than the Microsoft Windows firewall, you must open the ports for the servers to connect through the firewall. To allow connections to the WebBlocker Server, open UDP port 5003. It is not necessary to change your configuration if you use the Microsoft Windows firewall. For more information, see Install WatchGuard Servers on Computers with Desktop Firewalls.

Before you begin, make sure you have the correct license keys for the software components you want to install.

To install the WatchGuard System Manager and WatchGuard servers:

1. On the management computer, download the latest version of WatchGuard System Manager (WSM) software.
2. Run the WatchGuard System Manager Installer and follow the instructions on each page of the installer.
3. On the Select Components page, select the software components or upgrades to install.
   Make sure you select the check boxes for only the components you want to install.
   To install the localized versions of WSM, select the check box for each language you want to install.

4. Complete the installer.

After your Management Server is installed, you can use it to manage your Firebox or XTM devices. Before you add devices to your Management Server, make sure they are set up and configured correctly. To set up each device, you must run the Quick Setup Wizard either from the web or as a Windows application.

• For instructions to run the wizard from the web, see Run the Web Setup Wizard.
• For instructions to run the wizard as a Windows application, see Run the WSM Quick Setup Wizard.

See Also

Give Us Feedback • Get Support • All Product Documentation • Knowledge Base

© 2014 WatchGuard Technologies, Inc. All rights reserved. WatchGuard, the WatchGuard logo, WatchGuard Dimension, Firebox, Core, Fireware, and LiveSecurity are registered trademarks or trademarks of WatchGuard Technologies in the United States and/or other countries.

Contents
Introduction: The Case for Securing Availability and the DDoS Threat
Categorization of DDoS Attacks and Problems Caused
DDoS Attack General Categories
Volume-Based DDoS Attacks
Application DDoS Flood Attacks
Low-Rate DoS Attacks
Detailed Examples of DDoS Attacks and Tools
Internet Control Message Protocol Floods
Smurf Attacks
SYN Flood Attacks
UDP Flood Attacks
Teardrop Attacks
DNS Amplification Attacks
SIP INVITE Flood Attacks
Encrypted SSL DDoS Attacks
Slowloris
Low Orbit Ion Cannon and High Orbit Ion Canon
Zero-Day DDoS Attacks
The DDoS Lifecycle
Reconnaissance
Exploitation and Expansion
Command and Control
Testing
Sustained Attack
Network Identification Technologies
User/Customer Call
Anomaly Detection
Cisco IOS NetFlow
Packet Capture
ACLs and Firewall Rules
DNS
Sinkholes
Intrusion Prevention/Detection System Alarms
ASA Threat Detection
Modern Tendencies in Defending Against DDoS Attacks
Challenges in Defending DDoS Attacks
Stateful Devices
Route Filtering Techniques
Unicast Reverse Path Forwarding
Geographic Dispersion (Global Resources Anycast)
Tightening Connection Limits and Timeouts
Reputation-Based Blocking
Access Control Lists
DDoS Run Books
Manual Responses to DDoS Attacks
Traffic Scrubbing and Diversion
Conclusion
References
NetFlow
Reputation Management Tools
DDoS Run Book Case Study and Template

Denial of service (DoS) and distributed denial of service (DDoS) attacks have been quite the topic of discussion over the past year since the widely publicized and very effective DDoS attacks on the financial services industry that came to light in September and October 2012 and resurfaced in March 2013.

The purpose of this white paper is to provide a number of tools, some or all of which may apply to a customer's environment, that can be part of an overall toolkit to help identify and mitigate potential DDoS attacks on customer networks.

The following quotes and excerpts are from several high-profile individuals and organizations that are focused on defending networks from these types of attacks:

'...recent campaigns against a number of high-profile companies—including U.S. financial institutions—serve as a reminder that any cyber security threat has the potential to create significant disruption, and even irreparable damage, if an organization is not prepared for it.'

'Cybercrime is no longer an annoyance or another cost of doing business. We are approaching a tipping point where the economic losses generated
by cybercrime are threatening to overwhelm the economic benefits created by information technology. Clearly, we need new thinking and approaches to reducing the damage that cybercrime inflicts on the well-being of the world.'

The preceding quotes from John Stewart, Cisco Senior Vice President and Chief Security Officer are eye opening considering that the miscreants are using the network infrastructure to financially impact organizations and diminish the purpose of this infrastructure.

'The bottom line is that unfortunately, no organization is immune to a data breach in this day and age...'

'We have the tools today to combat cybercrime, but it's really all about selecting the right ones and using them in the right way.'
'In other words, understand your adversary -- know their motives and methods, and prepare your defenses accordingly and always keep your guard up...'

These quotes from the Verizon 2013 Data Breach Investigations Report (PDF) speak to the point that organizations are befuddled with the number of technologies, features, and processes available to help defend their networks. There is no one-size-fits-all approach. Each entity must determine which solutions meet its requirements and which help mitigate the threats that concern it.

'The number of DDoS attacks in Q1 2013 increased by 21.75 percent over the same period of last year.'

'Attacks targeting the infrastructure layer represented more than a third of all attacks observed during the first three months of 2013.'

'What defined this quarter (Q1 2013) was an increase in the targeting of Internet Service Provider (ISP) and carrier router infrastructures...'

While the preceding statements from Prolexic are certainly keeping service providers' (SP) network security experts awake at night, it is a legitimate fear that everyone should possess. If the core of the Internet is impacted by a malicious attack or inadvertent outage, we will all suffer because the Internet has become our lifeblood in terms of how we work, live, play, and learn.

While the actual DDoS attacks garner the headlines, it is imperative that organizations also fully understand the impact of inadvertent, unmalicious outages. Two recent examples of unintentional events are the GoDaddy DNS Infastructure outage that took place in September 2012 and the CloudFlare outage that occurred in March 2013. Although the details of each event differ, the key message is that each outage occurred on a production network, adversely impacted resources that thousands—if not millions—of people used, and was initially reported in the press as an 'attack.'

At the heart of many customers' concerns is the ability to protect against DDoS attacks. The focus may revolve around customers' own networks and data, network and data services that customers provide to their own customers, or a combination.

While the network landscape and the nature of the assets that require protection will vary among customers and verticals, the general approach to mitigating DDoS attacks should be relatively similar across every environment. This approach should consist of, at a minimum, developing and deploying a solid security foundation that incorporates general best practices to detect the presence of outages and attacks and obtain details about them.

At Cisco we have been espousing the following six-phase methodology to customers and at training conferences, Cisco Live, Black Hat, CanSecWest, and other venues.

Figure 1. Six-Phase Methodology