Download
Share
Print this page
  1. Manuals
  2. Brands
  3. Watchguard Manuals
  4. Software
  5. Firebox Vclass V100
  6. Administration manual

Watchguard V10.0 Administration Manual

Mobile vpn with ipsec
Hide thumbs Also See for V10.0:

Advertisement

Quick Links

Download this manual See also: User Manual, Installation Manual
WatchGuard®Mobile VPN with
IPSec Administrator Guide
WatchGuard Mobile VPN v10.0
Revised: November 28, 2007

Advertisement

loading

Related Manuals for Watchguard V10.0

Summary of Contents for Watchguard V10.0

  • Page 1 WatchGuard®Mobile VPN with IPSec Administrator Guide WatchGuard Mobile VPN v10.0 Revised: November 28, 2007...
  • Page 2 No part of this guide may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the express written permission of WatchGuard Technologies, Inc. Copyright, Trademark, and Patent Information Copyright©...

  • Page 3: Before You Begin

    Configure the Firebox X Edge to use Mobile VPN with IPSec The WatchGuard® Mobile VPN with IPSec client is a software application that is installed on a remote computer. The client makes a secure connection from the remote computer to your protected network through an unsecured network.
  • Page 4 Enabling Mobile VPN for a Firebox User Account The Firebox X Edge creates a .wgx file for a user when a Firebox user’s account is configured for Mobile VPN, as described in this chapter. If you want to lock the profiles for mobile users by making them read-only, see “Configuring Global Mobile VPN Client Settings”...
  • Page 5 Set MUVPN key expiration in kilobytes and/or hours. The default values are 8192 KB and 24 hours. To remove a size and/or time expiration, set the value to zero (0). Make sure the VPN Client Type drop-down list is set to Mobile User. This is true whether you use a Windows desktop, laptop, or handheld PC.
  • Page 6 Distributing the Software and Profiles You can choose to make the .wgx file read-only so that the user cannot change the security policy file. To do this, select the Make the MUVPN client security policy read-only check box. Mobile VPN clients use shared Windows Internet Naming Service (WINS) and Domain Name System (DNS) server addresses.
  • Page 7 The end-user profile • This file contains the user name, shared key, and settings that enable a remote computer to connect securely over the Internet to a protected, private computer network. For information on how to get the profile from the Edge, see “Get the user’s .wgx file” on page 3. User documentation •...
  • Page 8 Distributing the Software and Profiles Mobile User VPN...
  • Page 9 Using Fireware Policy Manager to Configure Mobile VPN with IPSec The WatchGuard® Mobile VPN with IPSec client is a software application that is installed on a remote computer. The client makes a secure connection from the remote computer to your protected network through an unsecured network.
  • Page 10 About Mobile VPN Client Configuration Files About Mobile VPN Client Configuration Files With Mobile VPN with IPSec, the network security administrator controls end-user profiles. Policy Man- ager is used to set the name of the end user and create a client configuration file, or profile, with the file extension .wgx.
  • Page 11 Use the instructions provided here to go through each screen of the wizard. Click Next after each step. Select a user authentication server Select an authentication server from the Authentication Server drop-down list. You can authenticate users with the internal Firebox database (Firebox-DB) or with a RADIUS, SecurID, LDAP, or Active Directory server.
  • Page 12 Configuring the Firebox for Mobile VPN Direct the flow of Internet traffic: Select an option for Internet traffic. You can allow all Internet traffic between the Mobile VPN client and the Internet to use the ISP of the client, or you can make all Internet traffic use the VPN tunnel.
  • Page 13 Create the virtual IP address pool: Click Add to add one IP address or an IP address range. Repeat this step to add more virtual IP addresses. Mobile VPN users will be assigned one of these IP addresses when they connect to your network. The number of IP addresses should be the same as the number of Mobile VPN users.
  • Page 14 Modifying an Existing Mobile VPN Profile Adding Users to a Firebox Mobile VPN Group To create an Mobile VPN tunnel with the Firebox, remote users type their user name and password to authenticate. WatchGuard® System Manager software uses this information to authenticate the user to the Firebox®.
  • Page 15 Click Edit. The Edit MUVPN Extended Authentication Group dialog box appears. Use the following fields to edit the group profile: Authentication Server Select the authentication server to use for this Mobile VPN group. To configure your authentication server, select Setup > Authentication > Authentication Servers from the menu bar in Policy Manager. Passphrase Type a passphrase to encrypt the Mobile VPN profile (.wgx file) that you distribute to users in this group.
  • Page 16 Modifying an Existing Mobile VPN Profile timeouts for the Mobile VPN group are always ignored because you set timeouts in the individual Firebox user accounts. The session and idle timeouts cannot be longer than the value in the SA Life field. To set this field, from the IPSec Tunnel tab of the Edit MUVPN Extended Authentication Group dialog box, click Advanced.
  • Page 17 Phase2 Settings Select the proposal and key expiration settings for the Mobile VPN tunnel. You can also enable Perfect Forward Secrecy (PFS) or set the Diffie-Hellman group. To change other proposal settings, click the Proposal button, and see the procedure described in “Defining advanced Phase 2 settings”...
  • Page 18 Modifying an Existing Mobile VPN Profile Defining advanced Phase 1 settings To define advanced Phase 1 settings for an Mobile VPN user profile: From the IPSec Tunnel tab of the Edit MUVPN Extended Authentication Group dialog box, select Advanced. The Phase1 Advanced Settings dialog box appears. To change the SA (security association) lifetime, type a number in the SA Life field, and select Hour or Minute from the drop-down list From the Key Group drop-down list, select the Diffie-Hellman group you want.
  • Page 19 From the Type drop-down list, select ESP or AH as the proposal method. Only ESP is supported at this time. From the Authentication drop-down list, select SHA1 or MD5 for the authentication method. From the Encryption drop-down list, select the encryption method. The options are None, DES, 3DES, and AES 128, 192, or 256 bit, which appear in the list from the most simple and least secure to most complex and most secure.
  • Page 20 Locking Down an End-User Profile Locking Down an End-User Profile You can use the advanced settings to lock down the end-user profile so that users can see some set- tings but not change them, and hide other settings so that users cannot change them. We recommend that you lock down all profiles so that users cannot make changes to their profile.
  • Page 21 Configuring Policies to Filter Mobile VPN Traffic In a default configuration, Mobile VPN with IPSec users have full access privileges through a Firebox®, with the Any policy. To put limits on Mobile VPN users, you must add policies to the MUVPN tab in Policy Manager.
  • Page 22 Re-creating End-User Profiles Under MUVPN Group, Policy Manager displays the authentication server, in parentheses, for the Mobile VPN group. Using the Any Policy The Any policy is added to all Mobile VPN user groups by default. The Any policy allows traffic on all ports and protocols between the Mobile VPN user and the Remote Networks available through the Mobile VPN tunnel.
  • Page 23 Distributing the Software and Profiles WatchGuard® recommends distributing end-user profiles by encrypted email or with some other secure method. Each client computer must have: Software installation package • The packages are located on the WatchGuard LiveSecurity® Service web site at: http://www.watchguard.com/support Log in to the site using your LiveSecurity Service user name and password.

  • Page 24: Global Vpn Settings

    Additional Mobile VPN Topics Terminating IPSec connections To fully stop VPN connections, the Firebox must be restarted. Removing the IPSec policy does not stop current connections. Global VPN settings Global VPN settings on your Firebox apply to all manual BOVPN tunnels, managed tunnels, and Mobile VPN tunnels.
  • Page 25 Mobile VPN Client Installation and Connection The WatchGuard® Mobile VPN with IPSec client is installed on an employee computer, whether the employee travels or works from home. The employee uses a standard Internet connection and acti- vates the Mobile VPN client. The Mobile VPN client then creates an encrypted tunnel to your trusted and optional networks, which are protected by a WatchGuard Firebox®.
  • Page 26 Installing the Mobile VPN with IPSec Client > Windows Firewall > Change Settings > Exceptions) for UDP port 4500. This will enable Mobile VPN keep-alive packets from the Firebox® to reach your client and keep the VPN tunnel We recommend that you check to make sure all available service packs are installed before you •...
  • Page 27 Importing the end-user profile When the computer restarts, the WatchGuard Mobile VPN Connection Monitor dialog box opens. When the software starts for the first time after you install it, you get this message: There is no profile for the VPN dial-up! Do you want to use the Configuration Assistant for generating a profile now? Click No.
  • Page 28 Connecting the Mobile VPN Client If the password you use is your password on an Active Directory or LDAP server and you choose to store it, the password becomes invalid when it changes on the authentication server. Click Finish. The computer is now ready to use Mobile VPN with IPSec. Selecting a certificate and entering the PIN If you are use certificates for authentication, you must select the correct certificate for the connection.
  • Page 29 Start your connection to the Internet through a Dial-Up Networking connection or LAN connection. Then, use the instructions below or select your profile, connect, and disconnect by right-clicking the Mobile VPN icon on your Windows toolbar. From your Windows desktop, select Start >...

  • Page 30: Mobile User Vpn Client Icon

    Seeing Mobile VPN Log Messages Use the Connection Mode drop-down list to set the connection behavior you want for this profile. - Manual - When you select manual connection mode, the client does not try to restart the VPN tunnel automatically if the VPN tunnel goes down. To restart the VPN tunnel, you must click the Connect button in Connection Monitor or right-click the Mobile VPN icon on your Windows desktop toolbar and click Connect.
  • Page 31 Securing Your Computer with the Mobile VPN Firewall The WatchGuard® Mobile VPN with IPSec client includes two firewall components: Link firewall The link firewall is not enabled by default. When the link firewall is enabled, your computer will discard any packets received from other computers. You can choose to enable the link firewall only when a Mobile VPN tunnel is active, or enable it all the time.

  • Page 32: About The Desktop Firewall

    Securing Your Computer with the Mobile VPN Firewall From the Stateful Inspection drop-down list, select when connected or always. If you select when connected, the link firewall operates only when the VPN tunnel is active for this profile. If you select always, the link firewall is always active, whether the VPN tunnel is active or not. Click OK.
  • Page 33 Define friendly networks and create firewall rules as described in the subsequent sections. Defining friendly networks Use the Friendly Networks tab to define specific known networks for which you want to generate a firewall rule set. For example, if you want to use the Mobile VPN client on a local network where you do not want your computer firewalled from other computers, you can add the network address of that LAN as a friendly network to differentiate the firewall rules for that LAN from the firewall rules you cre- ate for connections to the Internet and to remote VPN networks.

  • Page 34: General Tab

    Securing Your Computer with the Mobile VPN Firewall To create a rule, click New. Use the four tabs in the Firewall Rule Entry dialog box to define the traffic you want to control. Each tab is described below. General tab On the General tab, you define the basic properties of your rule.

  • Page 35: Local Tab

    Securing Your Computer with the Mobile VPN Firewall Local tab Use the Local tab to define the local IP address and ports that are controlled by this rule, if any. We rec- ommend that, in any rule, you configure the Local IP Addresses setting to enable the Any IP address radio button.

  • Page 36: Remote Tab

    Securing Your Computer with the Mobile VPN Firewall Remote tab Use the Remote tab to define the remote IP address or addresses and ports that are controlled by this rule, if any. For example, if your firewall is set to deny all traffic and you want to create a rule to allow outgoing POP3 connections, you would add the IP address of your POP3 server as an Explicit IP Address in the Remote IP Addresses section.
  • Page 37 Securing Your Computer with the Mobile VPN Firewall Administrator Guide...
  • Page 38 Securing Your Computer with the Mobile VPN Firewall Mobile User VPN...