firebox status
the following information is displayed under firebox status, as shown in the following figure:
1 status of the high availability option. when properly configured and operational, the ip address of the standby box appears. if high availability is installed but the secondary firebox is not responding, the display indicates “not responding.”
2 the ip address of each firebox interface, and the configuration mode of the external interface.
3 status of the ca (root) certificate and the ipsec (client) certificate.
if you expand the entries under firebox status, as shown in the following figure, you can view:
1 ip address of the default gateway and netmask
2 mac (media access control) address of each interface
3 number of packets sent and received since the firebox rebooted
4 expiration date and time of root and ipsec certificates
branch office vpn tunnels
beneath firebox status is a section on bovpn tunnels, in which two categories of these types of tunnels appear: ipsec and dvcp.
the figure below shows an expanded entry for a bovpn tunnel. the information displayed, from top to bottom, is:
the name assigned to the tunnel during its creation, along with the ip address of the destination ipsec device (such as another firebox, soho, or soho|tc), and the tunnel type (ipsec or dvcp). if the tunnel is dvcp, the ip address refers to the entire remote network address rather than that of the firebox or equivalent ipsec device.
1?the amount of data sent and received on the tunnel in both bytes and packets.
2?the time at which the key expires and the tunnel is renegotiated.
expiration can be expressed as a time deadline or in bytes passed.
dvcp tunnels that have been configured for both traffic and time deadline expiration thresholds display both; this type of tunnel expires when either event occurs first (time runs out or bytes are passed).
1?authentication and encryption levels set for the tunnel.
2?routing policies for the tunnel.
remote vpn tunnels
following the branch office vpn tunnels is an entry for remote vpn tunnels, which includes mobile user vpn (with ipsec) or ruvpn with pptp tunnels.
if the tunnel is mobile user vpn, the branch displays the same statistics as for the dvcp or ipsec branch office vpn described previously: the tunnel name, followed by the destination ip address, followed by the tunnel type. below are the packet statistics, followed by the key expiration, authentication, and encryption specifications.
if the tunnel is ruvpn with pptp, the display shows only the quantity of sent and received packets. byte count and total byte count are not applicable to pptp tunnel types.
expanding and collapsing the display
to expand a branch of the display, click the plus sign (+) next to the entry, or double-click the name of the entry. to collapse a branch, click the minus sign (—) next to the entry. a lack of either a plus or minus sign indicates that no further information about the entry is available.
red exclamation point
a red exclamation point appearing next to any item indicates that something within its branch is not functioning properly. for example, a red exclamation point next to the firebox entry indicates that a firebox is not communicating with either the watchguard security event processor (wsep) or management station. a red exclamation point next to a tunnel listing indicates a tunnel is down.
when you expand an entry that has a red exclamation point, another exclamation point appears next to the specific device or tunnel with the problem. use this feature to rapidly identify and locate problems in your vpn network.