1.2 Initial Configuration & Quick Setup Wizard

1.2 Initial Configuration & Quick Setup Wizard

Quick Answer: In the factory-default state, a Firebox enables Interface 0 as an External interface operating as a DHCP client and Interface 1 as a Trusted interface with static IP 10.0.1.1/24 and an active DHCP server. Remaining interfaces are enabled as Optional interfaces with addresses in the 10.0.x.1/24 pattern and the DHCP server disabled. WatchGuard documents the factory-default credentials as admin / readwrite (full read-write) and status / readonly (read-only). To configure the appliance you connect a workstation to Interface 1 or Interface 32, browse to https://10.0.1.1:8080, accept the self-signed certificate warning, and run the Web Setup Wizard (the browser-based wizard) or the WSM Quick Setup Wizard (the Windows equivalent). Large branch rollouts can instead use RapidDeploy for zero-touch cloud provisioning.

Out-of-the-Box Factory Defaults

To ensure predictable deployment and prevent administrators from being locked out of new hardware, WatchGuard pre-programs all physical Firebox appliances with standardized factory default network parameters.

Default Interface Allocation

[!IMPORTANT] On tabletop T-series models, Interface 0 is typically labeled with a globe icon or the word Internet, while Interface 1 is labeled with an icon or number 1. On rackmount M-series platforms, interfaces are numbered starting at 0 from left to right. WatchGuard documents that after a factory reset you connect to the Firebox on Interface 1 or Interface 32 to run the setup wizard.

Workstation Connection Procedure

To initiate staging:

1. Connect an Ethernet patch cable from the network interface card (NIC) of an administrative laptop or workstation directly into Interface 1 of the Firebox.
2. Ensure the workstation's network adapter is configured for dynamic IP addressing (Obtain an IP address automatically / DHCP).
3. Within seconds of physical link establishment, the Firebox's embedded DHCP server leases an IP address to the workstation in the 10.0.1.0/24 subnet (e.g., 10.0.1.2), assigning 10.0.1.1 as the default gateway and primary DNS server.
4. If dynamic addressing is disabled on the workstation, manually assign a static IP such as 10.0.1.2 with subnet mask 255.255.255.0 and default gateway 10.0.1.1.

---

Connecting to Fireware Web UI & Certificate Handling

Once physical and logical connectivity to Interface 1 is established, administration is conducted through the embedded Fireware Web UI.

Accessing Port 8080

Open a modern web browser and navigate to the default secure administrative URL:

https://10.0.1.1:8080

Fireware hosts its administrative web server over TCP port 8080 using TLS encryption. Attempting to connect via plaintext HTTP (http://10.0.1.1) or standard HTTPS (https://10.0.1.1 on port 443) will result in a connection timeout or connection refused error, as port 443 is reserved for user-facing security portals (such as Mobile VPN with SSL and the Access Portal).

The Self-Signed Certificate Warning

Upon navigating to https://10.0.1.1:8080, the web browser will immediately display a prominent security warning stating that the site's security certificate is not trusted (e.g., Your connection is not private or Potential Security Risk Ahead).

sequenceDiagram
    autonumber
    actor Admin as Administrator Laptop
    participant Browser as Web Browser
    participant Firebox as Firebox (Interface 1)
    Admin->>Firebox: Physical RJ-45 cable to Interface 1
    Firebox-->>Admin: DHCP Lease: 10.0.1.2 / Gateway: 10.0.1.1
    Admin->>Browser: Navigate to https://10.0.1.1:8080
    Browser->>Firebox: TLS Handshake Request
    Firebox-->>Browser: Presents Default Factory Self-Signed X.509 Certificate
    Browser-->>Admin: Displays Untrusted Certificate Authority Alert
    Admin->>Browser: Inspects Fingerprint & Confirms Exception
    Browser->>Firebox: Completes TLS Handshake over TCP 8080
    Firebox-->>Browser: Renders Fireware Quick Setup Wizard Welcome Page

Why This Occurs

When a Firebox is manufactured or reset to factory defaults, Fireware automatically generates an internal self-signed X.509 digital certificate to encrypt administrative HTTPS sessions. Because this cryptographic certificate was generated locally by the Firebox itself—and was not issued by a public, globally recognized Certificate Authority (such as DigiCert, Let's Encrypt, or Sectigo) already embedded in the client operating system's Trusted Root Certification Authorities store—the browser cannot automatically verify the certificate's chain of trust.

Administrative Remediation

During initial unboxing and staging, this behavior is completely expected and normal. The administrator should verify that the destination IP address matches 10.0.1.1, expand the advanced browser warning dialog, and proceed past the warning (e.g., clicking Advanced -> Proceed to 10.0.1.1 (unsafe)). Once the Firebox is deployed into production, administrators can replace this temporary self-signed certificate with a signed certificate issued by the organization's enterprise Active Directory Certificate Services (AD CS) Public Key Infrastructure (PKI) or a public CA to eliminate browser warnings permanently across management stations.

---

The Quick Setup Wizard Sequence

Upon bypassing the certificate warning, the Firebox presents the browser-based Web Setup Wizard (its Windows counterpart in WatchGuard System Manager is the Quick Setup Wizard). Either wizard guides the engineer through the foundational security and routing parameters required to bring the firewall into an operational state. Both also configure the default security policies and enable the licensed security services with WatchGuard's recommended settings.

+-----------------------------------------------------------------------+
|               FIREWARE WEB SETUP WIZARD / WSM QUICK SETUP             |
+-----------------------------------------------------------------------+
|                                                                       |
|  1. Configuration Method Selection (Web UI vs WSM)                    |
|  2. External Interface Configuration (DHCP / Static IP / PPPoE)       |
|  3. Trusted Interface Configuration (IP: 10.0.1.1/24 & DHCP Scope)    |
|  4. Device Passphrases Setup (Status vs Admin Passphrase)              |
|  5. Device Identification & System Time (Firebox Name & NTP Sync)     |
|  6. Feature Key Activation (WatchGuard Portal Login vs Manual Paste)  |
|  7. Configuration Commit & Service Restart                            |
|                                                                       |
+-----------------------------------------------------------------------+

Step 1: Configuration Mode Selection

Administrators can run the wizard directly in a web browser (the Fireware Web Setup Wizard) or launch the Windows-based WatchGuard System Manager (WSM) Quick Setup Wizard. Both tools execute identical backend provisioning logic and produce the same default policy set.

Step 2: External Interface Configuration

The wizard prompts for the WAN connection topology:

• DHCP Client (Default): Used when the upstream ISP modem or router automatically hands out public IP addressing.
• Static IPv4: Required for enterprise DIA (Dedicated Internet Access) circuits. The administrator manually inputs the public IP address, subnet mask, default gateway IP, and primary/secondary DNS server IPs.
• PPPoE: Used for telecommunication DSL/fiber connections requiring username and password encapsulation authentication.

Step 3: Trusted Interface Configuration

The administrator can retain the default 10.0.1.1/24 addressing or assign a new private IP subnet matching corporate addressing standards (e.g., 172.16.10.1/24 or 192.168.1.1/24). The wizard allows customization of the DHCP server scope or disabling the DHCP daemon entirely if an existing Windows Server or dedicated DHCP cluster services the LAN.

Step 4: Setting Administrative Passphrases

The wizard mandates the creation of two separate, non-identical passwords that govern device security:

1. Status Passphrase: Replaces the factory-default readonly passphrase for the read-only status account. This account permits personnel to monitor traffic, view real-time logs, and inspect performance gauges without granting authority to alter security policies or system settings.
2. Admin Passphrase: Replaces the factory-default readwrite passphrase for the read/write admin account. This account possesses full administrative control over all routing, firewall policies, user databases, subscription security services, and firmware upgrades.

[!IMPORTANT] Fireware enforces strict password complexity. The admin and status passphrases cannot match each other, must be at least 8 characters in length (12+ recommended), and should combine uppercase letters, lowercase letters, numbers, and symbols.

Step 5: Device Identification & Time Zone

The administrator specifies a unique Firebox Name (e.g., HQ-M590-FW01 or BOS-T45-FW01) to distinguish the unit in logs and management consoles, sets the local time zone, and configures Network Time Protocol (NTP) synchronization servers. Accurate system time is vital for digital certificate validation, scheduled firewall policies, and correlated log timestamps.

Step 6: Feature Key Activation

The Feature Key is a digitally signed cryptographic license text file issued by WatchGuard. It binds directly to the appliance's unique hardware serial number.

• What it Controls: Unlocks licensed network interfaces, maximum authenticated user limits, concurrent Mobile VPN tunnels, and subscription security services (such as Gateway AntiVirus, Intrusion Prevention Service, WebBlocker, Application Control, and spamBlocker).
• Activation Methods:
  • Automatic Download: If Interface 0 has active Internet connectivity, the administrator enters their WatchGuard Support Portal account credentials (username and password). The Firebox connects directly to WatchGuard licensing servers, retrieves the Feature Key, and installs it automatically.
  • Manual Import: If the appliance is staged in an isolated offline lab without WAN access, the administrator logs into www.watchguard.com from an alternate computer, downloads the plaintext Feature Key file, and pastes the entire text block into the wizard dialog.

Step 7: Finalizing & Restart

The wizard compiles the parameters into an active Fireware configuration, saves the settings to non-volatile flash memory, and restarts the Firebox network daemons. The administrator is redirected to the standard Fireware Web UI login screen.

---

RapidDeploy: Zero-Touch Cloud Provisioning

For large distributed enterprises deploying dozens or hundreds of branch office firewalls, manually cabling a laptop and running the Quick Setup Wizard at each individual site is cost-prohibitive. WatchGuard provides RapidDeploy, a zero-touch cloud provisioning mechanism.

RapidDeploy Architecture & Workflow

RapidDeploy automates initial provisioning by allowing engineers to build and store configurations in the cloud before physical hardware ever reaches the deployment site.

flowchart TD
    subgraph CLOUD["WatchGuard Cloud Provisioning Infrastructure"]
        WGC["WatchGuard Cloud / Portal"] -->|"1. Associate Serial Number<br/>& Upload Target Config .xml"| RDS["RapidDeploy Deployment Server"]
    end
    subgraph REMOTE_SITE["Remote Branch Store / Clinic"]
        UNBOX["2. Non-Technical Staff Unboxes Firebox"] --> CABLING["3. Cable Interface 0 to Internet Modem<br/>& Power On Chassis"]
        CABLING --> BOOT["4. Firebox Boots in Factory Default State<br/>Interface 0 Obtains DHCP IP"]
        BOOT --> PHONE_HOME["5. Firebox Phones Home over HTTPS (Port 443)<br/>to RapidDeploy Cloud Server"]
    end
    RDS -->|"6. Authenticates Serial & Pushes Down<br/>Feature Key + Full XML Configuration"| PHONE_HOME
    PHONE_HOME --> APPLY["7. Firebox Applies Configuration,<br/>Binds Interfaces & Enters Live Production"]

RapidDeploy Execution Phases

1. Pre-Configuration in WatchGuard Cloud: The network engineer registers the new Firebox serial number within the organization's WatchGuard Cloud management portal. The engineer either associates a pre-built centralized cloud management template or uploads a custom Fireware .xml configuration file containing the branch's pre-defined policies, VPN definitions, and local subnets.
2. Physical Deployment: The factory-sealed appliance is shipped directly from the distributor to the remote branch location. No on-site IT technician is required.
3. Cabling & Power On: A local employee connects an Ethernet cable from the upstream broadband modem (or ISP handoff providing DHCP) into Interface 0 and powers on the appliance.
4. Automated Phone-Home: Upon booting, the factory-default Fireware OS detects an active link and DHCP lease on Interface 0. It initiates an outbound secure TLS session over TCP port 443 to WatchGuard’s central deployment servers (rapiddeploy.watchguard.com).
5. Authentication & Provisioning: The Firebox presents its serial number and factory cryptographic signature. The RapidDeploy server matches the serial number, retrieves the pre-staged Feature Key and configuration file, and pushes them securely down to the appliance.
6. Live State: The Firebox writes the new configuration to flash, updates its interfaces, establishes Branch Office VPN (BOVPN) tunnels back to corporate headquarters, and enters full production without a single local console command ever being typed.

Provisioning Methods Comparison