WSM User Guide - WatchGuard Technologies

Configuring Policy PropertiesRepeat CountThis counts how frequently an event occurs. When this gets to the selected value, a specialrepeat notifier starts. This notifier makes a repeat log entry about that specified notification.Notification starts again after this number of events.Here is an example of how to use these two values. The values are configured as:• Launch interval = 5 minutes• Repeat count = 4A port space probe starts at 10:00 a.m. and continues each minute. This starts the logging and notificationmechanisms. These are the times and the actions that occur:1 10:00—Initial port space probe (first event)2 10:01—First notification starts (one event)3 10:06—Second notification starts (reports five events)4 10:11—Third notification starts (reports five events)5 10:16—Fourth notification starts (reports five events)The launch interval controls the time intervals between the events 1, 2, 3, 4, and 5. This was set to 5 minutes.Multiply the repeat count by the launch interval. This is the time interval an event must continue tostart the repeat notifier.If the policy you configured is a proxy, a Proxy drop-down list appears with the View/Edit Proxy andClone Proxy icons. For information on how to use these options, see the “Configuring Proxied Policies”chapter in this guide.NoteOne policy manages either allowed or denied traffic, but not both. If you want the Firebox to send logmessages for both allowed and denied traffic, you must use different policies for each.Configuring static NATStatic NAT is also known as port forwarding. Static NAT is a port-to-host NAT. A host sends a packet fromthe external network to a specified public address and port. Static NAT changes this address to anaddress and port behind the firewall. For more information on NAT, see the “Working with Firewall NAT”chapter in this guide.Because of how static NAT operates, it is available only for policies that use a specified port, whichincludes TCP and UDP. A policy that uses a different protocol cannot use incoming static NAT. The NATbutton in the Properties dialog box of that policy does not operate. You also cannot use static NAT withthe Any policy.To help fight spam, many servers that receive e-mail do a reverse lookup of the source IP address themail comes from. The receiving server does this to make sure that the sending server (the server sendingthe e-mail) is an authorized mail server for that domain. Because of this, we recommend that youuse the external IP address of your Firebox as the MX record for your domain. An MX, or Mail exchange,record is a type of DNS record that sets how e-mail is routed through the Internet. MX records show theservers to send an e-mail to, and which server to send an e-mail to first, by priority.Usually, connections that start from a trusted or optional network and go to the Internet show the externalIP address of the Firebox as the source IP address of the packets. If the Firebox external IP address isnot your domain’s MX record IP address, some remote servers reject e-mail that you send. They do thisbecause the SMTP session does not show your MX DNS record as the source IP address for the connection.If your Firebox does not use your MX record IP address as the external interface IP address, you can154 WatchGuard System Manager