Firebox - Management Software — WatchGuard Community

Is WG-Mgmt-Server actually needed for firewall on same network as WSM?

WBF_Tech — Mon, 09 Mar 2026 22:27:25 +0000

So I had noticed various IP addresses connecting through the WG-Mgmt-Server policy on port 4112/4113. Trying to determine if I even need this policy enabled. That Any-External as the FROM address seems over-broad.

I did open a support ticket w/Support, but they only sent me a KB article(https://www.watchguard.com/help/docs/help-center/en-US/Content/en-US/Fireware/management_server/mgmt_server_about_gateway_wsm.html) that did not really explain IF this is really needed and if so, what IP addresses would I swap out the Any-External.

This is a single, T40 firewall (12.11.4.B) . No external VPN connections elsewhere (although mobile VPN w/SSL is running, but would not be affected by this policy so I am told.).

WSM is on the local network tied to Eth1 network.

I also read Bruce' discussion about this, which seem to infer that it may not be needed (at least Any-External) from this article: https://community.watchguard.com/watchguard-community/discussion/comment/7124#Comment_7124?utm_source=community-search&utm_medium=organic-search&utm_term=WG-Mgmt-Server

So, Do I need this policy and if so, does it have to have the Any-External (or are there IP addressed I could lock it down to)?

Thanks,

James

software upgrade on Firebox M400

MoPNW — Mon, 13 Jan 2025 22:06:56 +0000

Hello. I'd like to push down the latest software to this box but don't see the M400 listed. Would you recommend using the higher model or lower model software?

Thanks!

Policy manager slow to load configuration

Ftrenti — Tue, 23 Mar 2021 11:20:33 +0000

Hi, when I use WSM, Policy Manager and I try to open a configuration, the load is slow, more ore less 6 minutes. If I use https portals, the load is immediately. Some idea ? There is a local cache to empty or some limits ? (I have alias with hundred of ip) Thank you.

WSM in RDP

Francesco — Tue, 16 Dec 2025 15:49:28 +0000

Since I started using 2025.. version of wsm, I am unable to launch it if I am connected via rdp to the pc where it is installed.
The preview on the WIN11 taskbar is all white when launched while in rdp.
Is it a bug or a security feature?
Current version 2025.1.3-B726073

Remote management vis WSM

DBEntrust — Mon, 15 Dec 2025 11:28:02 +0000

Hi,

I have a M390 Firewall. It has one Primary and 2 secondary IP addresses for the single external
interface. I have added my remote external IP address to the WG-Firebox-Mgmt policy.

From external I can manage the Firewall via either of the secondary IP addresses
but not the primary one. Why would this be?

Thanks

Dave

unable to save Expired License

Norman — Sun, 19 Oct 2025 12:23:41 +0000

Hello,
i get „INTERNAL_ERROR: unable to set config Expired License“.

fireware version date and policymanager are within the License end date.
i also get
“Failed to Synchronize Feature Key – The Firebox failed to retrieve its feature key from WatchGuard. Verify that the Firebox has Internet connectivity and DNS is properly configured.” if i try sync from system manager. (internet and dns are available)

diagnostic task
PING servicesprd.westus.cloudapp.azure.com (52.159.232.72) 56(84) bytes of data.
64 bytes from 52.159.232.72: icmp_seq=1 ttl=98 time=171 ms

i also both with a default policy after flash

fireware ist 12.9.4 // Feature: LIVESECURITY@Dec-08-2024
so this version should be covered

mfg
norman

BTW in this state nothing works , no vpn , only one outgoing ip etc.
even if the default services never expire.

Watchguard WebUI is very slow

Benjamin15 — Thu, 02 Oct 2025 07:07:00 +0000

Hello,
we have M390 Cluster and it takes
30 seconds to open authentication - server view
50 seconds to open firebox users
more than 5 minutes to save users, sometimes we also get a timeout.
In the past it was much more faster.
Does anyone else have the same problem or know what's causing it?

Https Exceptions list management

supesupe — Wed, 20 Aug 2025 13:01:54 +0000

Can we get a feature so we can import a https Exceptions list from Management server/cloud to the firebox and also masse deploy a new HTTPS Exceptions list to all firebox Management server/cloud. since it is really not fun to import to a lot of firebox every time a new exceptions is needed for a lot. and add so we can have more lists for groups of customers.

Operation failed

eichenadmin — Thu, 14 Aug 2025 22:13:18 +0000

This is a new one. This occurred when attempting to save to the firebox from Policy Manager

wg admin account

Francesco — Tue, 29 Jul 2025 06:56:45 +0000

More than 10 years ago, when I bought my first company watchguard, the technician created in my active directory a user 'wg_admin' and I really can't remember its purpose now.
I see this user making logon and logoff every 5 seconds on every domain pc, cluttering the event viewer.
Any idea what his purpose might be? Logging? SSO? Dimension?

How can I turn off allowed HTTP/HTTPS proxy logging?

BobbyJones — Tue, 03 Jun 2025 18:37:59 +0000

My logs are flooded with allowed logging messages from HTTPS Proxy. I've checked the rules associated with the HTTPS proxy rule, and I do not have allowed packets selected for logging.

Is this possibly turned on elsewhere? I can't seem to find a reasonable logging option that would turn this off.

comparison method violates its general contract

Gaming_RB — Fri, 25 Apr 2025 18:25:26 +0000

Hello,

I currently have a problem with my WatchGuard System Manager. I was making configurations on Fireboxes and when I want to save the configuration on the box, it gives me the message ‘comparison method violates its general contract’. I have uninstalled WSM by deleting the registry keys, the files in the %appdata% and program files folders, etc.

Do you have a solution?

Management Servet NAT gateway

Adbaldur — Thu, 10 Apr 2025 19:19:06 +0000

So , long story short we have a M270 and I backed up the config and implemented it into a newer M290 everything works fine except the SSL over TLS tunnels for our other boxes I checked EVERYTHING!! Nothing is working, if I plug the old box it pops right out , the new one is not connecting to the other boxes , what am I doing wrong here ? Thanks in advance .

Does WSM work on ARM?

Paddleboat21 — Wed, 12 Mar 2025 20:53:38 +0000

Hi all, I have a Surface Pro 11 that I'm trying to get WSM 12.9.0 running on. It seems to work fine for most aspects, but the policy manager fails with a "failed to read servers response. Received fatal alert: handshake_failure." I've connected to the same Firebox with WSM on an x64 server OS and it works fine. I got the Mobile SSL VPN working on ARM, hopefully the WSM will work too!

WSM Server Large Log file and High CPU

phanaaekIT — Wed, 29 Jan 2025 22:39:04 +0000

I've had to delete the log every couple weeks and the CPU often stays at 40-60% until a reboot. Running 12.11 on Server 2022. Any idea what causes this?

Error 110 connection time out

Kelvin_PTY — Tue, 21 Jan 2025 16:32:04 +0000

Hello, for a few days I have not been able to enter the portal of my m370 through the web portal, I enter the username and password and I get error 110. But through the watchguard system manager application I do enter without problem

Error connecting to Policy Manager on T30-W device

ENT_Support — Tue, 03 Oct 2023 18:17:15 +0000

Device has been placed in recovery mode with OS version 12.0.2
Using WSM 12.9.4
When trying to access Policy Manager on the device, getting an error:
"An error occurred while checking dvcp managed flag of the Firebox 10.0.1.1. XML-RPC command not found"
Trying to access the Web UI times out
CLI via putty fails
Quick Setup wizard fails when trying to load a new firmware (tested with multiple fireware versions, including 12.5.9 U2)

Are we screwed on this device or is there a way to get beyond this error?

Disable Dimension via template

p1mikec — Mon, 06 Jan 2025 20:40:18 +0000

Hello everyone! Has anyone had luck using a template to disable "Send log messages to these Dimension or WSM Log Servers"? I am able to use a template to deploy those settings without issue but I am running in to some trouble trying to use a template to untick the box.

Can I import an XML config into a centrally-managed firebox?

Streamline_Corey — Mon, 28 Oct 2024 16:54:40 +0000

I have a firebox fully managed by WSM Server and want to load a config file. However, that option (Open>Configuration File) doesn't appear as an available option in the File menu in Policy Manager. Am I going about this the wrong way? Feedback appreciated. Thanks!

Bought an old M200, can I get the software?

JerryDM — Mon, 30 Sep 2024 14:14:50 +0000

So I purchased an old M200 Firebox for a bit of self-education (coming from a Cisco background).

I tried to reset to factory default to start from a known state and when I run the quick setup wizard from WSM 12.10.4 it tells me I need 11.9.6 or higher (but not too high, obviously!).

I can't seem to find V11 anywhere, is it possible to get a copy here? Ideally I'd like to get it up to V12, but just getting a working system would be a start.

Any help would be appreciated.

WSM_12_10_4.exe install error - Runtime Error (at -1:0):

Landy — Wed, 25 Sep 2024 16:30:52 +0000

I just downloaded WSM_12_10_4.exe and when installing on Windows Server Standard 2019, I get an install error popup:
Runtime Error (at -1:0):
Cannot Import dil:C:)Users\atkinson\AppData\LocalTemp\is-RTK5C.tmp\ssProc.dil.
How can I resolve this?

WG Cloud Adoption

Red_Leader — Wed, 11 Sep 2024 12:29:40 +0000

I am a long-time user of WSM and manage 150+ fireboxes in the management server. Recently I have been exploring Cloud Managed Firebox and have not been pleased with its inability to import an existing configuration from WSM and the fact that if you want to Cloud manage it has to be done from scratch.
Curious if other WSM fans have been able embrace cloud managed fireboxes.

Jitter and Latency on Internet connections

Wingmantech — Sat, 31 Aug 2024 16:03:12 +0000

Hello,
From time to time our Internet provider has issues with jitter and latency which causes issues with our VOIP system. The connection does not fail so it never goes to our secondary Internet connection. However, the call quality and other Internet related functions suffer until the ISP resolves the issue. Is there a way to view the external interfaces connection quality? Or can the WatchGuard show the jitter and latency on a connection? If the WatchGuard management software cannot accomplish this are their recommendations for another monitoring solution?
Thanks,

WSM server -> generate configuration rapport

Robert_Vilhelmsen — Sun, 18 Aug 2024 17:57:06 +0000

WSM 12.10.4

When i try to generate a Configuration Rapport from WSM server on a non fully managed device, it says "The selected device is not a fully managed device".

This has worked before. It this a bug?

/Robert

Device Properties dynamic external IP

jeang — Fri, 16 Aug 2024 17:33:20 +0000

I have untick the checkbox "Device has dynamic external IP address" to try a fixed IP address, but I'm unable to tick back the checkbox.

It's grayed out.

Someone has a trick to tick it back on ?

Thank you
Jean

12.10.4 Block failed logins is not save in WSM template

Robert_Vilhelmsen — Wed, 03 Jul 2024 05:59:01 +0000

WSM server version 12.10.4
Fireware device version 12.10.4

If i enable Blocked failed logins in a template, it does not save the settings to the template and of cause is not applied to the device.

/Robert

WSM (WatchGuard System Manager) v12.10.3 and Winget

FleuropIT — Thu, 30 May 2024 07:29:27 +0000

WSM 12.10.3 has not correctly set its version number. Regardless of using the downloaded "setup.exe" or installing it through "winget": version number is always "Unknown" (- see screenshot below). Please, fix it.

WSM uninstall woes

HolyGuacamole — Thu, 23 May 2024 19:39:09 +0000

Hello,

I see a few posts about this on older versions, so I thought this would be fully resolved. When I attempt to uninstall the Watchguard Systems Manager from, well, any device I have it installed on (Windows Server, Windows 10, Windows 11, doesn't matter), I get this message:
Runtime Error (at -1:0):
Cannot Import dll:C:\Windows\system32\IssProc.dll.

If I try to reinstall the same version, it gives me the same message about the file, but then points me towards the path of the temporary install directory. What is going on here and how do I fix this? This causes me to not be able to uninstall or update WSM on any device we have it installed on. Since we are currently on 12.8.1 and need to update WSM to 12.10 prior to updating our Fireboxes to 12.10, this is very necessary for me to resolve.

Thanks for any assistance you all can give. I am going to attempt to create a support ticket for this as well.

Firebox SNMP ifIndex mismatch

KGS — Thu, 16 May 2024 15:08:26 +0000

Hi,

I've been querying a Firebox M470 SNMP data to get reachable devices from it and noticed something strange:
According to RFC 4293, for ipNetToPhysicalTable ( ---/get/1.3.6.1.2.1.4.35.1 ), the first part of the index is ipNetToPhysicalIfIndex which should match the ifIndex for that interface - "The interface identified by a particular value of this index is the same interface as identified by the same value of the IF-MIB's ifIndex."
However the entries here do not match the if-indices from the ifTable ( ---/get/1.3.6.1.2.1.2.2.1 ). In particular from ipNetToPhysicalTable, I am getting entries with indices 4 and 5, and in the ifTable, the indices are from 4096 to 4103.
Is there any way to remap the indices I get to the correct ifIndex? The rest of the oid-s from the ip table seem to use the correct ones...

[removed domain name]

FIREBOX's stuck in Pending for Update Status in WSM

SecretSquirrel — Wed, 15 May 2024 17:04:44 +0000

In my organization we manage 121 Watchguard Firebox's and regularly push out templates to update Aliases with new subnets. We are running version 12.10.3 and recently we pushed a template to all Firewalls and ALL of them are stuck in Pending for the Update Status. This means that the Firewalls are not updating and the only work around is to put the devices in Basic Management Mode and edit them directly. Even when this is done, saved and switched back to Fully Managed Mode, the Update Status is stuck in Pending. We have rebooted the VM that the WSM server is on, tried to Expire the Lease ect. but nothing is getting the devices out of Pending. Edit: All the devices also show Heartbeat is Unavailable, but we can still ping and access the Policy Manager and Firebox System Manager. Any advice will be appreciated. Thanks.