/
Setting up ATR for WatchGuard Firebox

Setting up ATR for WatchGuard Firebox

These instructions outline the configuration required in WatchGuard Cloud so Barracuda XDR can perform ATR actions, including blocking and unblocking IPs and FQDN.

To allow ATR to take action, perform the following steps:

  • Have each Firebox added to WatchGuard Cloud and running a supported Fireware version.

  • Enable API Access in WatchGuard Cloud and record the Access ID, password, and API Key issued on the Managed Access page.

  • Note the account-specific Base API URL (this varies by region).

  • Identify the Account ID and the Device ID of each Firebox that ATR should manage.

  • Provide the credentials in the XDR Dashboard.

How ATR for WatchGuard Firebox works

ATR for WatchGuard Firebox creates blocked sites exceptions through the Firebox Management API.

When an ATR Block action runs, Barracuda XDR uses the Firebox Management API to add a blocked site exception against the configured device. The exception can be an IPv4 host, an IPv6 host, or an FQDN.

Locally-managed Fireboxes

For locally-managed devices, blocked sites and exceptions you configure with the Firebox Management API do not appear in Fireware Web UI or Policy Manager. WatchGuard Cloud stores the exceptions and applies them, but they are not visible in the local management UI. Cloud-managed Fireboxes display the exceptions normally in the WatchGuard Cloud UI.

Setting up ATR for WatchGuard Firebox

Part 1: Confirm Firebox Prerequisites

The Firebox Management API can only manage Fireboxes that are in your WatchGuard Cloud account and running a supported Fireware version.

  1. Confirm each Firebox you want ATR to manage is added to WatchGuard Cloud (either locally-managed or cloud-managed).

  2. Confirm the Firebox runs Fireware v12.5.3 or higher. This is the minimum version supported by the Firebox Management API.

  3. If a Firebox is not yet in WatchGuard Cloud, add it following WatchGuard's procedure for one of the following:

Part 2: Enable API Access in WatchGuard Cloud

To enable API access, you must have the Owner or Administrator operator role in WatchGuard Cloud.

API access is enabled once per account, not per Firebox.

  1. Log in to WatchGuard Cloud (https://cloud.watchguard.com).

  2. If you are a Service Provider managing this customer, from Account Manager, select the managed account so that API access is enabled on the correct subscriber account.

  3. Select Administration > Managed Access.

  4. Select Enable API Access.

  5. Specify the read-write and read-only passwords. Both must:

    • Be at least 12 characters long.

    • Include a lowercase letter, an uppercase letter, a number, and a symbol.

    • Not contain <, >, emojis, or spaces.

    • Be different from each other.

  6. Select Save.

  7. After saving, the Managed Access page displays the following values. Copy and save them in a safe place to use in Part 5: Enable ATR in the XDR Dashboard.

    • Access ID (Read-write)

    • Read-write password

    • API Key

    • API URL (base) (e.g. https://api.usa.cloud.watchguard.com)

The read-write password must be rotated before any internal expiry policy is reached. To rotate, click Change Passwords on the same Managed Access page.

Part 3: Record the Account ID

The Account ID is required in every Firebox Management API request path.

  1. In WatchGuard Cloud, navigate to Administration > My Account.

  2. Copy and save the Account ID in a safe place to use in Part 5: Enable ATR in the XDR Dashboard.
    Examples: WGC-1-abc123def456 or ACC-1234567, depending on account type.

Part 4: Record the Device ID for the Firebox

The Device ID identifies which Firebox the ATR action should be applied to. If multiple Fireboxes should be managed by ATR, repeat this part for each.

  1. In WatchGuard Cloud, navigate to Configure > Devices (or Monitor > Devices).

  2. Select the Firebox that ATR should manage.

  3. On the Device Summary page, copy and save the Device ID in a safe place to use in Part 5: Enable ATR in the XDR Dashboard.
    Example: WGC-1-123abc456.

If you have multiple Fireboxes, record the Device ID of each.

Part 5: Enable ATR in the XDR Dashboard

In this procedure, you need the credentials you saved in Part 2: Enable API Access in WatchGuard Cloud:

  • Access ID (Read-write)

  • Read-write password

  • API Key

  • API URL (base) (e.g. https://api.usa.cloud.watchguard.com)

You also need the Account ID you saved in Part 3: Record the Account ID and the Device ID you saved in Part 4: Record the Device ID for the Firebox.

Best Practice
Use the Test Connection button to verify that XDR can authenticate against the Authentication API and reach the target device before any real ATR event fires. A successful test confirms three things at once: the credentials are valid, the API Key matches the account, and the Device ID is reachable in that account.

  1. Log in to the XDR Dashboard.

  2. Navigate to Network Security > Firewall ATR.

  3. In the Firewall table, click the WatchGuard Firebox row.

  4. Click Edit Config.

  5. Save the following credentials:

    • API Base URL

    • Access ID

    • Password

    • API Key

    • Account ID

    • Device ID — the Firebox that this configuration entry will manage.

  6. Select the Auto Remediation Enabled checkbox.

  7. Click Save.

To onboard additional Fireboxes, repeat steps 4–7 for each device. Each Firebox has its own configuration entry but reuses the same Access ID, password, API Key, and Account ID.

References

We value your feedback.
If you have questions, suggestions, or feedback on our documentation, contact the Campus Product Documentation team.
For general product inquiries or technical support, please contact the global Barracuda Support team.