Watchguard Firewall Monitoring

fspilotros · August 19, 2026, 2:51pm

What is a one sentence summary of your feature request?

Please describe your idea in detail. What is your problem, why do you feel this idea is the best solution, etc.

Having watchguard firewall between the devices supported in auditor would give a great boost to the products between our customers

How do you currently solve the challenges you have by not having this feature?

not auditing watchguard firewalls

TheCat · August 20, 2026, 9:38am

Hi Francesco Spilotros,

Thanks for submitting this feature request. To help us scope this further, we’d like to gather a bit more detail:

Device models in use – Which WatchGuard Firebox models you are running most commonly (e.g., T-series, M-series, XTM)? Are they on the latest Fireware OS?

Priority use case – Following our standard approach for new device audit coverage, we’d prioritize:

Authentication/logon events (successful and failed local logons)
Configuration changes (admin/config modifications)
VPN activity (tunnel establishment, teardown, auth)
Attack/threat reporting (DDoS, IPS signatures) — if the device is configured to report these

Does this match what you are asking for, or would you weight these differently? And separately — is general Traffic (Allow/Deny) logging something customers need for this request, or is that out of scope for now?

Sample logs – If you can share a small set of representative raw log samples (logon, config change, VPN, and attack/alarm types if possible) from a real or test environment, that would significantly speed up development.

Thanks,
Evgenii

fspilotros · August 20, 2026, 1:57pm

Hi Evgeniy
Thanks for the follow up!

Our customers are using mostly M-Series (for the HQs) or T-Series (for the branches or for the smaller companies). They usually are on the latest releases of firmware.

I think that the standard approach will be a great start! Regarding the detail of the traffic it won’t be necessary as there’s a (free) appliance from Watchguard (dimension) that handles the traffic reporting.

Here are some anonymised example logs:

SSLVPN:
Successful login and logout:
10.210.200.1 Aug 20 14:31:26 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:31:26) admd[2835]: msg_id="1100-0004" Authentication of Firewall user [User1@Firebox-DB] from xxx.xxx.xxx.xxx was accepted
10.210.200.1 Aug 20 14:31:26 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:31:26) sslvpn[2889]: msg_id="2500-0000" Mobile VPN with SSL user User1 logged in. Virtual IP address is . Real IP address is .
10.210.200.1 Aug 20 14:31:26 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:31:26) sessiond[2884]: msg_id="3E00-0002" SSL VPN user User1@Firebox-DB from xxx.xxx.xxx.xxx logged in assigned virtual IP is 10.210.250.2
10.210.200.1 Aug 20 14:31:26 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:31:26) sslvpn[2889]: msg_id="2500-0000" Mobile VPN with SSL user User1 logged in. Virtual IP address is . Real IP address is .
10.210.200.1 Aug 20 14:31:31 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:31:31) sessiond[2884]: msg_id="3E00-0004" SSL VPN user User1@Firebox-DB from xxx.xxx.xxx.xxx logged out assigned virtual IP is 10.210.250.2
10.210.200.1 Aug 20 14:31:31 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:31:31) sslvpn[2889]: msg_id="2500-0001" Mobile VPN with SSL user User1 logged off. Virtual IP address is 10.210.250.2.

Failed login:
10.210.200.1 Aug 20 14:31:37 FIREWALLNAME local2 warning SERIALNUMBER CLUSTERNAME (2026-08-20T12:31:37) admd[2835]: msg_id="1100-0005" Authentication of Firewall user [User1@Firebox-DB] from xxx.xxx.xxx.xxx was rejected, invalid credentials or user doesn't exist

Login, logout:
10.210.200.1 Aug 20 14:44:24 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:44:24) sessiond[2884]: msg_id="3E00-0002" Management user admin@Firebox-DB from 172.24.12.20 logged in
10.210.200.1 Aug 20 14:44:31 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:44:31) sessiond[2884]: msg_id="3E00-0004" Management user admin@Firebox-DB from 172.24.12.20 logged out

Failed login:
10.210.200.1 Aug 20 14:44:36 FIREWALLNAME local2 warning SERIALNUMBER CLUSTERNAME (2026-08-20T12:44:36) admd[2835]: msg_id="1100-0005" Authentication of Admin user [admin@Firebox-DB] from 172.24.12.20 was rejected, invalid credentials or user doesn't exist

Config modify:
10.210.200.1 Aug 20 14:49:54 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:49:54) configd[2416]: msg_id="0101-0001" Management user admin@Firebox-DB from 172.24.12.20 modified Alias
10.210.200.1 Aug 20 14:49:54 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:49:54) configd[2416]: msg_id="0101-0001" Management user admin@Firebox-DB from 172.24.12.20 modified Alias EXAMPLE_NET
10.210.200.1 Aug 20 14:49:55 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:49:55) configd[2416]: msg_id="0101-0001" Management user admin@Firebox-DB from 172.24.12.20 added Address group list EXAMPLE_NET.2.alm
10.210.200.1 Aug 20 14:53:24 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:53:24) configd[2416]: msg_id="0101-0001" Management user admin@Firebox-DB from 172.24.12.20 deleted Address group list EXAMPLE_NET.2.alm
10.210.200.1 Aug 20 14:53:24 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:53:24) configd[2416]: msg_id="0101-0001" Management user admin@Firebox-DB from 172.24.12.20 modified Alias
10.210.200.1 Aug 20 14:53:24 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:53:24) configd[2416]: msg_id="0101-0001" Management user admin@Firebox-DB from 172.24.12.20 modified Alias EXAMPLE_NET
10.210.200.1 Aug 20 14:53:31 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:53:31) configd[2416]: msg_id="0101-0001" Management user admin@Firebox-DB from 172.24.12.20 deleted Address group list EXAMPLE_NET.1.alm
10.210.200.1 Aug 20 14:53:31 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:53:31) configd[2416]: msg_id="0101-0001" Management user admin@Firebox-DB from 172.24.12.20 modified Alias
10.210.200.1 Aug 20 14:53:31 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:53:31) configd[2416]: msg_id="0101-0001" Management user admin@Firebox-DB from 172.24.12.20 deleted Alias EXAMPLE_NET

BOTNET:
10.210.200.1 Aug 20 14:30:10 FIREWALLNAME local1 warning SERIALNUMBER CLUSTERNAME (2026-08-20T12:30:10) firewall: msg_id="3000-0173" Deny External Firebox 60 tcp 20 56 66.132.186.239 xxx.xxx.xxx.xxx 30581 2405 offset 10 S 493526701 win 25765 geo_src="USA" geo_dst="ITA" msg="blocked sites" flags="SR" duration="0" sent_pkts="1" rcvd_pkts="0" sent_bytes="60" rcvd_bytes="0" botnet="source" (Unhandled External Packet-00)

IPSEC VPN:
10.210.200.1 Aug 20 14:56:56 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:56:56) iked[2860]: msg_id="0207-0001" (xxx.xxx.xxx.226<->xxx.xxx.xxx.92)'tunnel.1' BOVPN IPSec tunnel is established. local:10.210.206.1 remote:10.38.100.0/24 in-SA:0x714e4ec2 out-SA:0x14477ea4 role:initiator
10.210.200.1 Aug 20 14:56:56 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:56:56) iked[2860]: msg_id="0207-0001" (xxx.xxx.xxx.226<->xxx.xxx.xxx.150)'VPN1' BOVPN IPSec tunnel is re-keyed. local:0 remote:0 in-SA:0x413aa04d out-SA:0x3229d091 role:initiator
10.210.200.1 Aug 20 14:56:56 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:56:56) iked[2860]: msg_id="0207-0001" (xxx.xxx.xxx.226<->xxx.xxx.xxx.170)'VPN2' BOVPN IPSec tunnel is re-keyed. local:10.2.1.0/24 remote:10.2.3.0/24 in-SA:0x0457ce01 out-SA:0x69878fff role:initiator
10.210.200.1 Aug 20 14:56:56 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:56:56) iked[2860]: msg_id="0207-0001" (xxx.xxx.xxx.226<->xxx.xxx.xxx.170)'VPN2' BOVPN IPSec tunnel is established. local:10.2.1.0/24 remote:10.2.222.0/24 in-SA:0x929b7720 out-SA:0x69879000 role:initiator
10.210.200.1 Aug 20 14:56:56 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:56:56) iked[2860]: msg_id="0207-0001" (xxx.xxx.xxx.226<->xxx.xxx.xxx.170)'VPN2' BOVPN IPSec tunnel is established. local:10.2.1.0/24 remote:10.2.4.0/24 in-SA:0x7ece017a out-SA:0x69879001 role:initiator
10.210.200.1 Aug 20 14:56:56 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:56:56) iked[2860]: msg_id="0207-0001" (xxx.xxx.xxx.226<->xxx.xxx.xxx.170)'VPN2' BOVPN IPSec tunnel is established. local:10.2.1.0/24 remote:10.2.5.0/24 in-SA:0x27f5c7a6 out-SA:0x69879002 role:initiator
10.210.200.1 Aug 20 14:56:56 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:56:56) iked[2860]: msg_id="0207-0001" (xxx.xxx.xxx.226<->xxx.xxx.xxx.170)'VPN2' BOVPN IPSec tunnel is established. local:10.33.100.0/24 remote:10.2.3.0/24 in-SA:0x44221f0c out-SA:0x69879003 role:initiator
10.210.200.1 Aug 20 14:56:56 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:56:56) iked[2860]: msg_id="0207-0001" (xxx.xxx.xxx.226<->xxx.xxx.xxx.170)'VPN2' BOVPN IPSec tunnel is established. local:10.33.100.0/24 remote:10.2.222.0/24 in-SA:0x93eb5b60 out-SA:0x69879004 role:initiator
10.210.200.1 Aug 20 14:56:56 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:56:56) iked[2860]: msg_id="0207-0001" (xxx.xxx.xxx.226<->xxx.xxx.xxx.170)'VPN2' BOVPN IPSec tunnel is established. local:10.33.100.0/24 remote:10.2.4.0/24 in-SA:0x15e008d7 out-SA:0x69879005 role:initiator
10.210.200.1 Aug 20 14:56:56 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:56:56) iked[2860]: msg_id="0207-0001" (xxx.xxx.xxx.226<->xxx.xxx.xxx.170)'VPN2' BOVPN IPSec tunnel is established. local:10.33.100.0/24 remote:10.2.5.0/24 in-SA:0x851b3aa5 out-SA:0x69879006 role:initiator
10.210.200.1 Aug 20 14:56:56 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:56:56) iked[2860]: msg_id="0207-0001" (xxx.xxx.xxx.226<->xxx.xxx.xxx.170)'VPN2' BOVPN IPSec tunnel is re-keyed. local:10.110.221.0/24 remote:10.2.3.0/24 in-SA:0xa860a27f out-SA:0x69879007 role:initiator
10.210.200.1 Aug 20 14:56:56 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:56:56) iked[2860]: msg_id="0207-0001" (xxx.xxx.xxx.226<->xxx.xxx.xxx.170)'VPN2' BOVPN IPSec tunnel is established. local:10.110.221.0/24 remote:10.2.222.0/24 in-SA:0x80d9dbcd out-SA:0x69879008 role:initiator
10.210.200.1 Aug 20 14:56:56 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:56:56) iked[2860]: msg_id="0207-0001" (xxx.xxx.xxx.226<->xxx.xxx.xxx.170)'VPN2' BOVPN IPSec tunnel is established. local:10.110.221.0/24 remote:10.2.4.0/24 in-SA:0xa189e14b out-SA:0x69879009 role:initiator
10.210.200.1 Aug 20 14:56:56 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:56:56) iked[2860]: msg_id="0207-0001" (xxx.xxx.xxx.226<->xxx.xxx.xxx.170)'VPN2' BOVPN IPSec tunnel is established. local:10.110.221.0/24 remote:10.2.5.0/24 in-SA:0xb53f7235 out-SA:0x6987900a role:initiator
10.210.200.1 Aug 20 14:56:56 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:56:56) iked[2860]: msg_id="0207-0001" (xxx.xxx.xxx.226<->xxx.xxx.xxx.170)'VPN2' BOVPN IPSec tunnel is re-keyed. local:10.213.213.0/24 remote:10.2.3.0/24 in-SA:0xa3b427f3 out-SA:0x6987900b role:initiator
10.210.200.1 Aug 20 14:56:56 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:56:56) iked[2860]: msg_id="0207-0001" (xxx.xxx.xxx.226<->xxx.xxx.xxx.170)'VPN2' BOVPN IPSec tunnel is established. local:10.213.213.0/24 remote:10.2.4.0/24 in-SA:0x63d9f36b out-SA:0x6987900c role:initiator
10.210.200.1 Aug 20 14:56:56 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:56:56) iked[2860]: msg_id="0207-0001" (xxx.xxx.xxx.226<->xxx.xxx.xxx.170)'VPN2' BOVPN IPSec tunnel is established. local:10.213.213.0/24 remote:10.2.5.0/24 in-SA:0x12f32767 out-SA:0x6987900d role:initiator
10.210.200.1 Aug 20 14:56:56 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:56:56) iked[2860]: msg_id="0207-0001" (xxx.xxx.xxx.226<->xxx.xxx.xxx.170)'VPN2' BOVPN IPSec tunnel is established. local:10.213.213.0/24 remote:10.2.222.0/24 in-SA:0x6fc96bb3 out-SA:0x6987900e role:initiator
10.210.200.1 Aug 20 14:56:56 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:56:56) iked[2860]: msg_id="0207-0001" (xxx.xxx.xxx.226<->xxx.xxx.xxx.42)'VPN3' BOVPN IPSec tunnel is re-keyed. local:0 remote:0 in-SA:0xcc299788 out-SA:0xaf054eec role:initiator
10.210.200.1 Aug 20 14:56:56 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:56:56) iked[2860]: msg_id="0207-0001" (xxx.xxx.xxx.226<->xxx.xxx.xxx.170)'VPN2' BOVPN IPSec tunnel is established. local:10.2.7.0/24 remote:10.2.3.0/24 in-SA:0x0cb9721f out-SA:0x6987900f role:initiator
10.210.200.1 Aug 20 14:56:56 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:56:56) iked[2860]: msg_id="0207-0001" (xxx.xxx.xxx.226<->xxx.xxx.xxx.170)'VPN2' BOVPN IPSec tunnel is re-keyed. local:10.2.8.0/24 remote:10.2.3.0/24 in-SA:0x78c50f19 out-SA:0x69879010 role:initiator
10.210.200.1 Aug 20 14:56:56 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:56:56) iked[2860]: msg_id="0207-0001" (xxx.xxx.xxx.226<->xxx.xxx.xxx.170)'VPN2' BOVPN IPSec tunnel is re-keyed. local:10.2.9.0/24 remote:10.2.3.0/24 in-SA:0xb36de299 out-SA:0x69879011 role:initiator
10.210.200.1 Aug 20 14:56:56 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:56:56) iked[2860]: msg_id="0207-0001" (xxx.xxx.xxx.226<->xxx.xxx.xxx.170)'VPN2' BOVPN IPSec tunnel is re-keyed. local:10.210.200.248 remote:10.2.3.0/24 in-SA:0xaaf9eac5 out-SA:0x69879012 role:initiator
10.210.200.1 Aug 20 14:56:56 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:56:56) iked[2860]: msg_id="0207-0001" (xxx.xxx.xxx.226<->xxx.xxx.xxx.130)'VPN4' BOVPN IPSec tunnel is re-keyed. local:10.110.220.0/24 remote:10.111.3.0/24 in-SA:0xf099f3d2 out-SA:0x4b5821a5 role:initiator
10.210.200.1 Aug 20 14:56:56 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:56:56) iked[2860]: msg_id="0207-0001" (xxx.xxx.xxx.226<->xxx.xxx.xxx.130)'VPN4' BOVPN IPSec tunnel is established. local:10.110.227.32/28 remote:10.111.3.0/24 in-SA:0x228d9f83 out-SA:0x4b5821a6 role:initiator
10.210.200.1 Aug 20 14:56:56 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:56:56) iked[2860]: msg_id="0207-0001" (xxx.xxx.xxx.226<->xxx.xxx.xxx.82)'VPN5' BOVPN IPSec tunnel is re-keyed. local:10.110.219.0/24 remote:192.168.100.0/24 in-SA:0x42f829bc out-SA:0x86bec2ca role:initiator
10.210.200.1 Aug 20 14:56:56 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:56:56) iked[2860]: msg_id="0207-0001" (xxx.xxx.xxx.226<->xxx.xxx.xxx.82)'VPN5' BOVPN IPSec tunnel is re-keyed. local:10.110.219.0/24 remote:192.168.170.0/24 in-SA:0x6c5e3046 out-SA:0x86bec2cb role:initiator
10.210.200.1 Aug 20 14:56:56 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:56:56) iked[2860]: msg_id="0207-0001" (xxx.xxx.xxx.226<->xxx.xxx.xxx.82)'VPN5' BOVPN IPSec tunnel is re-keyed. local:10.110.219.0/24 remote:192.168.150.0/24 in-SA:0xa0cc7966 out-SA:0x86bec2cc role:initiator
10.210.200.1 Aug 20 14:56:56 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:56:56) iked[2860]: msg_id="0207-0001" (xxx.xxx.xxx.226<->xxx.xxx.xxx.82)'VPN5' BOVPN IPSec tunnel is re-keyed. local:10.110.219.0/24 remote:172.16.201.0/24 in-SA:0x6b0096a2 out-SA:0x86bec2cd role:initiator
10.210.200.1 Aug 20 14:56:56 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:56:56) iked[2860]: msg_id="0207-0001" (xxx.xxx.xxx.226<->xxx.xxx.xxx.82)'VPN5' BOVPN IPSec tunnel is re-keyed. local:10.110.219.0/24 remote:172.16.4.0/24 in-SA:0xc65d6983 out-SA:0x86bec2ce role:initiator
10.210.200.1 Aug 20 14:56:56 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:56:56) iked[2860]: msg_id="0207-0001" (xxx.xxx.xxx.226<->xxx.xxx.xxx.92)'VPN6' BOVPN IPSec tunnel is established. local:10.210.206.1 remote:10.138.100.23 in-SA:0x4dee5dc0 out-SA:0x14477ea5 role:initiator
10.210.200.1 Aug 20 14:56:56 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:56:56) iked[2860]: msg_id="0207-0001" (xxx.xxx.xxx.226<->xxx.xxx.xxx.146)'VPN7' BOVPN IPSec tunnel is re-keyed. local:0 remote:0 in-SA:0x01332fc8 out-SA:0xafd1660e role:initiator
10.210.200.1 Aug 20 14:56:56 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:56:56) iked[2860]: msg_id="0207-0001" (xxx.xxx.xxx.226<->xxx.xxx.xxx.149)'VPN8' BOVPN IPSec tunnel is re-keyed. local:xxx.xxx.xxx.226 remote:xxx.xxx.xxx.149 in-SA:0xfc277171 out-SA:0x1b979e5a role:initiator
10.210.200.1 Aug 20 14:56:56 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:56:56) iked[2860]: msg_id="0207-0001" (xxx.xxx.xxx.226<->xxx.xxx.xxx.58)'VPN9' BOVPN IPSec tunnel is established. local:10.2.1.0/24 remote:10.2.7.0/24 in-SA:0x8f47538c out-SA:0x4a1ea924 role:initiator
10.210.200.1 Aug 20 14:56:56 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:56:56) iked[2860]: msg_id="0207-0001" (xxx.xxx.xxx.226<->xxx.xxx.xxx.26)'VPN10' BOVPN IPSec tunnel is re-keyed. local:10.246.246.1 remote:10.246.246.2 in-SA:0x153c5d50 out-SA:0xac767707 role:initiator
10.210.200.1 Aug 20 14:56:56 FIREWALLNAME local3 err SERIALNUMBER CLUSTERNAME (2026-08-20T12:56:56) iked[2860]: msg_id="021A-0016" (xxx.xxx.xxx.227<->xxx.xxx.xxx.130)IKEv2 CREATE_CHILD_SA exchange from xxx.xxx.xxx.130:500 to xxx.xxx.xxx.227:500 failed. Tunnel='GDDCMI'. Reason=Received N(NO_PROPOSAL_CHOSEN) message.
10.210.200.1 Aug 20 14:56:56 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:56:56) iked[2860]: msg_id="0207-0001" (xxx.xxx.xxx.226<->xxx.xxx.xxx.146)'VPN11' BOVPN IPSec tunnel is re-keyed. local:xxx.xxx.xxx.226 remote:xxx.xxx.xxx.146 in-SA:0x837fb58e out-SA:0x59c06007 role:initiator
10.210.200.1 Aug 20 14:56:56 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:56:56) iked[2860]: msg_id="0207-0001" (xxx.xxx.xxx.226<->xxx.xxx.xxx.19)'VPN12' BOVPN IPSec tunnel is re-keyed. local:xxx.xxx.xxx.226 remote:xxx.xxx.xxx.19 in-SA:0x3895eaa2 out-SA:0xa2ef7b4c role:initiator
10.210.200.1 Aug 20 14:56:56 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:56:56) iked[2860]: msg_id="0207-0001" (xxx.xxx.xxx.228<->xxx.xxx.xxx.170)'VPN13' BOVPN IPSec tunnel is re-keyed. local:10.210.1.0/28 remote:192.168.3.0/24 in-SA:0xaa0a69c1 out-SA:0x8270a73d role:initiator
10.210.200.1 Aug 20 14:56:56 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:56:56) iked[2860]: msg_id="0207-0001" (xxx.xxx.xxx.226<->xxx.xxx.xxx.30)'VPN14' BOVPN IPSec tunnel is re-keyed. local:10.110.227.0/28 remote:192.168.0.0/24 in-SA:0x91f0ec0d out-SA:0x26587471 role:initiator
10.210.200.1 Aug 20 14:56:56 FIREWALLNAME local2 info SERIALNUMBER CLUSTERNAME (2026-08-20T12:56:56) iked[2860]: msg_id="0207-0001" (xxx.xxx.xxx.226<->xxx.xxx.xxx.58)'VPN9' BOVPN IPSec tunnel is established. local:10.2.1.0/24 remote:10.2.8.0/24 in-SA:0x66a38ab1 out-SA:0x4a1ea925 role:initiator

ATM I’m not able to send you IPS logs… I’ll send some as soon as I get some (I’ve activated syslog logging to send you samples) since we normally log only on dimension.

Best regards
Francesco

TheCat · August 21, 2026, 11:46am

Hi Francesco,

Thanks so much for the details and the samples. The models, priority order, and log samples give us a solid basis to scope this properly.

If you’re able to send over some IPS/attack log samples once you have them, that would round things out nicely, but it’s not blocking anything.

I don’t have a timeline to share yet, but I’ll take this internally and advocate for it with our product team.

Thanks again

Best regards,
Evgenii

Topic		Replies	Views
Entra ID monitoring plan - more details in log Ideas auditor , new , ideas	0	19	August 19, 2026
Request for Customized Content-Aware Report with Excel Export and Advanced Filtering Ideas endpoint-protector , ideas , reports , planned-long-term	6	95	May 14, 2026
Combine open ports for network devices into the same command baseline report to maintain a unified baseline that tracks open ports, executed commands, and other relevant events Ideas new , ideas	0	38	May 28, 2025
Netwrix Endpoint Protector Server 2608.0.1.0 News endpoint-protector , release-major	0	512	September 1, 2026
AI Tools prompt Content Monitoring Ideas already-exists , ideas , epp-server	8	147	July 23, 2026

Watchguard Firewall Monitoring

What is a one sentence summary of your feature request?

Please describe your idea in detail. What is your problem, why do you feel this idea is the best solution, etc.

How do you currently solve the challenges you have by not having this feature?

Related topics