Phase 2 Settings - Watchguard Firebox X15 User Manual

Configuring Virtual Private Networks
Speak with the NAT device's manufacturer for information on open-
ing these ports and protocols on the NAT device.
If your Edge's external interface has a private IP address, you cannot
use an IP Address as the local ID type in the Phase 1 settings.
Because private IP addresses cannot get through the Internet, the
other device cannot find your Edge's private external IP address
through the Internet.
• If the NAT device to which the Edge is connected has a dynamic
public IP address:
- You must first set the device to Bridge Mode. In Bridge Mode,
the Edge will get the public IP address on its external interface.
Refer to the manufacturer of your NAT device for more
information.
- Then, set up Dynamic DNS on the Edge. For information, see
"Registering with the Dynamic DNS Service" on page 81. In the
Phase 1 settings of the Manual VPN, set the local ID type to
Domain Name. Enter the DynDNS domain name as the Local
ID. The remote device must identify your Edge by domain
name and it must use your Edge's DynDNS domain name in its
Phase 1 setup.
• If the NAT device to which the Edge is connected has a static
public IP address:
- In the Phase 1 settings of the Manual VPN, set the local ID
type drop-down list to Domain Name. Enter the public IP
address assigned to the NAT device's external interface as the
local ID. The remote device must identify your Edge by domain
name, and it must use this same public IP address as the
domain name in its Phase 1 setup.

Phase 2 settings

Phase 2 negotiates the data management security association for
the tunnel. The tunnel uses this phase to create IPSec tunnels and
put data packets together.
You can use the default Phase 2 settings to make configuration eas-
ier.
Make sure that the Phase 2 configuration is the same on the two
devices.
184
N N
OTE OTE
WatchGuard Firebox X Edge