vfilby's questions

I have a lot of legitimate outbound traffic intermittently being denied by WatchGuard's "Internal Policy." Today I tried to go to Splunk's homepage and my traffic was denied by my watchguard XTM 22 with Pro upgrade.

What is the "Internal Policy" and what can I do to control it?

Example of Traffic being blocked

Type    Date            Action      Source IP   Port    Interface       Destination IP  Port    Policy  
Traffic 2011-09-21T18:24:43 Deny    10.0.0.90   49627   3-Primary LAN   64.127.105.40   80  Firebox Internal Policy http/tcp

Top three firewall policies:

I have one external static IP that is nat'ed by the XTM to a local network, I would to be able to configure port forwarding on it (say external:80 -> 10.0.1.43:80 and external:2340 -> 10.0.1.48:2340).

How can I do this on the Watchguard XTM 2?

I have quotes for an autoloader + extended warranty and I am baffled by the high cost of the warranty uplift.

• HP LTO-2 Bundle $3000, 3yr extended service agreement $1280
• Quantum LTO-3 $2912, 3yr extended server $1408

Why is the warranty cost high? Does it signal that autoloaders are a flawed solution?

I have an HP MSM410 wireless access point and when I first configured it I couldn't access any other devices on the network, but I could access the internet fine. I figured out that this was because the wireless security mode was restricting traffic to only the default gateway for the router. I do have WPA encryption in place.

For now I have turned off wireless security because I need wireless users to be able to access shares and printers. I have the network protected by WPA encryption. It seems ok to me to turn off the wireless security here but I am interested in here what other professionals have to say.

I want to protect my network best as possible with out inconveniencing the users.

I have a Watchguard XTM 2 that is currently acting as a firewall and a router for my business network, I currently have the WG setup in mixed-routing mode and am happy with the current configuration. The reason I am curious about drop-in mode is because I would like to use all the interfaces on the back of the watchguard for the same subnet.

My understanding is that drop-in mode will put them all on the same subnet, but it is unclear from the manual that the routing/firewall/vpn will still work as expected.

This WG is right behind a DSL modem that is setup in bridge mode, so the WG is handling all PPPoE auth and routing for the network.