BETA — built and unit-tested, switched off until proven on a real WatchGuard Cloud account. One read-only Access ID gives SmartTile every Firebox's model, serial, Fireware version, cloud status, restarts and licence expiry — and, for cloud-managed Fireboxes, BOVPN configuration, the policy base with a change history and deployment history.
WatchGuard Cloud already knows every Firebox an account owns. SmartTile connects to it once per account — or once for a whole WatchGuard Service Provider, with each managed account mapped to its own SmartTile company — and only reads: the only requests it posts are sign-in token requests. WatchGuard Cloud's “offline” means the Firebox lost its cloud connection, so up/down stays with SmartTile's own ping and SNMP checks. Beta: every switch ships off.
Model, serial, Fireware version and MAC written to the linked SmartTile device through the shared identity writer — blanks filled, a manual value never overwritten.
Each Firebox links to the device in the same company with the same serial (else the same public IP), only when exactly one matches. A person can link or unlink; an unlink is respected.
Online, offline (and since when) or no longer listed in the account. An uptime counter going backwards is recorded as a restart.
The Firebox licence expiry date, read hourly. Expired, or expiring within 30 days, becomes a problem a Workflow can act on.
Cloud-managed Fireboxes: firewall policies read hourly; each added, removed, changed (which fields) or moved policy is logged. The first read is the baseline.
Cloud-managed Fireboxes: Branch Office VPN tunnels with endpoints and networks, as configured. The pre-shared key is dropped before anything is stored.
Cloud-managed Fireboxes: the last 25 configuration deployments with status and author; a failed deployment in the last 7 days is flagged.
“A WatchGuard Firebox reports a problem” fires once when it opens — offline in WatchGuard Cloud, restarted, missing, licence expired or expiring, deployment failed.
WGC-1-… or ACC-…).api.usa…, api.deu…, api.jpn…).| Firebox | What works |
|---|---|
| Cloud-managed (Fireware 12.5.3+) | Everything on this page; BOVPN needs Fireware 12.5.7+. |
| Locally managed, connected to WatchGuard Cloud | Identity, cloud status, restarts and licence — no policies, BOVPN or deployments. |
| Not in WatchGuard Cloud | Nothing over the API — monitor with SmartTile's ping and SNMP. |
| Service Provider | One connection; each managed account mapped to its SmartTile company. Unmapped accounts are listed, never read. |
/oauth/tokensign in with the read-only Access ID (token, 1 h)/rest/platform/authorization/v1/audiencestoken audience for a managed account (Service Provider)/rest/platform/accounts/v2/accounts/{acct} · …/childrenaccount name; managed accounts/rest/firebox/management/v1/info/{acct}/devices?device_type=FBFireboxes: model, serial, version, state, uptime/rest/platform/allocation/v2/{acct}/assets/licenses/fireboxlicence expiry, MAC (hourly)/rest/firebox/management/v1/configuration/{acct}/bovpn/ipsec/tunnelsBOVPN configuration (hourly)/rest/firebox/management/v1/configuration/{acct}/firewall/policiespolicy base → change ledger (hourly)/rest/firebox/management/v1/commands/{acct}/transactions?tx_type=deploymentdeployment history (hourly)The client has no write method; its only POSTs request sign-in tokens. Use the read-only Access ID — SmartTile never deploys, changes or reboots anything.
The read-only password and API Key are sealed with AES-256-GCM on save and never returned — only “set”. Tokens live in memory only; audit rows name fields, never values.
A connection belongs to one company; a managed account is read only once mapped to a company the admin also manages. A Firebox links only to a device in its own company.
Scheduled poll, policy inventory and Workflow events are platform switches; each company has its own switch. All default off, plus a global kill switch.
| Area | Today (beta) | Not available |
|---|---|---|
| Proof | Unit-tested against WatchGuard's published OpenAPI specs. | Proven on a real account — then the switches go on. |
| Up / down | Cloud status shown and offered to Workflows. | Marking a Firebox DOWN — stays with ping / SNMP. |
| VPN | BOVPN tunnel configuration. | Live tunnel state, so no VPNAutomate watching. |
| Backups / firmware | Running Fireware version; deployment history. | Config export (Config Backups); available releases (FirmwareAutomate). |
| Access / health | — | Administrator logins; interfaces, bandwidth, FireCluster HA — use SNMP. |
| Objection | Answer |
|---|---|
| “Will it flood our IT Service Management (ITSM) system?” | This integration opens no ticket and sends no e-mail. A Workflow you build fires once per problem. |
| “We are a WatchGuard Service Provider.” | One connection covers every managed account; map each to its customer's SmartTile company. |