Watchguard Firebox FireboxTM System 4.6, User Manual

Page: 109 / 170

User Guide 99
HostWatch
The HostWatch display uses the logging settings configured for your Firebox using
the Policy Manager. For instance, to see all denied attempts at incoming Telnet in
HostWatch, configure the Firebox to log incoming denied Telnet attempts.
The line connecting the source host and destination host is color-coded to display the
type of connection being made. These colors can be changed. The defaults are:
• Red – The connection is being denied.
• Blue – The connection is being proxied.
• Green – The connection is using network address translation (NAT).
• Black – The connection falls into none of the first three categories.
Representative icons appear next to the server entries for HTTP, Telnet, SMTP, and
FTP.
Name resolution might not occur immediately when you first start HostWatch. As
names are resolved, HostWatch replaces IP addresses with host or usernames,
depending on the display settings. Some machines might never resolve, and the IP
addresses remain in the HostWatch window.
To start HostWatch, click the HostWatch icon (shown at left) on the
Control Center
QuickGuide .
HostWatch display
The upper pane is split into two sides, Inside and Outside. Double-click an item on
either side to produce a pop-up window displaying detailed information about
current connections for the item. The
Connects For window displays the IP
addresses, port number, connection type, direction, and other detailed information
about these connections.
The lower pane displays detailed information for connections directly related to the
Firebox. Double-click a connection to view details regarding a specific host.
Connecting to a Firebox
From HostWatch:
1 Select File => Connect .
You can also click the Firebox icon.
2 Use the Firebox drop list to select a Firebox.
You can also type the Firebox name or IP address.
3 Enter the Firebox read-only password. Click OK .
HostWatch connects to the Firebox and begins the real-time display.
Replaying a log file
You can replay a log file in HostWatch in order to troubleshoot and retrace a
suspected break-in. From HostWatch:
1 Select File => Open .
You can also click the Folder icon. The Open dialog box appears.