To enable the VPN with SSL, you need to access your Firewall settings through the WatchGuard System Manager application and then go to the Policy Manager. Once opened, follow these steps:
Connection Settings
- Select VPN > Mobile VPN > SSL.
- The Mobile VPN with SSL Configuration dialog box appears.
- Check the box Enable Mobile VPN with SSL.
- In the Primary text box, enter or select a public IP address or domain name.
- This is the IP address or domain name that Mobile VPN with SSL clients connect to by default. It can be an external IP address, a secondary external IP address, or an external VLAN. For a device in direct mode, use the IP address assigned to all interfaces.
IP Address and Network Settings
- In the IP Address and Network Group section, from the dropdown list, select the method the Firebox uses to send traffic through the VPN tunnel.
- Select Bridge VPN traffic to bridge SSL VPN traffic to a network you specify. When you select this option, you cannot filter traffic between SSL VPN users and the network to which SSL VPN traffic connects.
- Select Routed VPN traffic to route VPN traffic to specified networks and resources. This is the default option for all WatchGuard Firebox devices.
- Check or uncheck the box Force all client traffic through the tunnel.
- To route all VPN client traffic to your private network and to the Internet through the tunnel, select Force all client traffic through the tunnel.
- This option sends all external traffic through the Firebox policies you create and provides consistent security for mobile users. However, because it requires more processing power on the Firebox, access to Internet resources may be very slow for the mobile user.
- To route only traffic from the VPN client to your private networks through the tunnel, uncheck the box Force all client traffic through the tunnel.
- This option sends all external traffic through the Firebox policies you create and provides consistent security for mobile users. However, because it requires more processing power on the Firebox, access to Internet resources may be very slow for the mobile user.
- To allow access to all internal networks, select Allow access to all Trusted, Optional, and Custom networks.
- To restrict Mobile VPN with SSL client access only to specified devices on your private network, select Specify allowed resources. To specify an allowed resource, enter the network resource's IP address in CIDR notation and click Add.
- This option sends all external traffic through the Firebox policies you create and provides consistent security for mobile users. However, because it requires more processing power on the Firebox, access to Internet resources may be very slow for the mobile user.
- To route all VPN client traffic to your private network and to the Internet through the tunnel, select Force all client traffic through the tunnel.
- Configure the IP addresses that the Firebox assigns to Mobile VPN with SSL client connections. If FireCluster is enabled, the virtual IP address pool cannot be on the same subnet as a primary cluster IP address.
Routed VPN Traffic
For the virtual IP address pool, keep the default setting of 192.168.113.0/24 or enter a different range.
- To avoid potential IP address conflicts, it is recommended to assign virtual IP addresses that are not part of a network protected by the Firebox, a network accessed through a route or BOVPN, assigned by DHCP to a device behind the Firebox, or used for Mobile VPN with IPSec or Mobile VPN with SSL address pools. If FireCluster is enabled, the virtual IP address pool cannot be on the same subnet as a primary cluster IP address.
Configure the Authentication Settings
From the Mobile VPN with SSL Configuration dialog box:
- Select the Authentication tab.
- A list of configured authentication servers appears.
- Check the box for each authentication server you want to use for Mobile VPN with SSL user authentication. You can select any enabled authentication server: the internal Firebox database (Firebox-DB) or a RADIUS, VACMAN Middleware, SecurID, LDAP, or Active Directory server domain.
- Only enabled authentication methods and server domains are listed.
- If you selected more than one server for authentication, select the server you want to set as the default server. Click Set as Default to move that server to the top of the list.
- If a user does not specify the authentication server in the Username text box when using the Mobile VPN with SSL client for authentication, Mobile VPN with SSL uses the default authentication server.
- Check the box Automatic reconnection after connection loss if you want the Mobile VPN with SSL client to be able to reconnect automatically. If you enable this option, the mobile user can check a box in the Mobile VPN with SSL client to control whether the client reconnects automatically. You should also enable this option if you want the client to automatically use backup IP addresses when it cannot connect to the primary IP address.
- To require users to authenticate after disconnecting a Mobile VPN with SSL connection, check the box Force users to authenticate after a connection is lost. WatchGuard recommends that you check this box if you use a two-factor authentication method with a one-time password, such as RADIUS, SecurID, or VASCO. If you do not require users to authenticate after losing the connection, the automatic reconnection attempt may fail because the Mobile VPN with SSL client tries to use the originally entered one-time password, which is no longer valid, to reconnect automatically after the connection is lost.
- Check the box Allow the Mobile VPN with SSL client to remember the password if you want the Mobile VPN with SSL client to be able to remember the password. If you enable this option, the mobile user can check a box in the Mobile VPN with SSL client to control whether the client remembers the password.
Configure Connection Port
On the Advanced tab, you can change the default port 443 if it is already being used for another service.
Use Other Groups or Users in a Mobile VPN with SSL Policy
- Select Configuration > Authentication > Authentication Servers.
- Add users as needed. If they are Firebox-DB users, simply add the user (with the main information, which is the username and password) and additionally make the user a member of the SSLVPN_Users group.
The final step is to save the changes made.
