Inhaltszusammenfassung zur Seite Nr. 1
WatchGuard®Mobile VPN with
IPSec Administrator Guide
WatchGuard Mobile VPN v10.0
Revised: November 28, 2007
Inhaltszusammenfassung zur Seite Nr. 2
Notice to Users Information in this guide is subject to change without notice. Companies, names, and data used in examples herein are fictitious unless otherwise noted. No part of this guide may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the express written permission of WatchGuard Technologies, Inc. Copyright, Trademark, and Patent Information Copyright© 1998 - 2007 WatchGuard Technologies, Inc. All rights reserved. Complete co
Inhaltszusammenfassung zur Seite Nr. 3
1 Configure the Firebox X Edge to use Mobile VPN with IPSec The WatchGuard® Mobile VPN with IPSec client is a software application that is installed on a remote computer. The client makes a secure connection from the remote computer to your protected network through an unsecured network. The Mobile VPN client uses Internet Protocol Security (IPSec) to secure the connection. This document gives basic configuration instructions on how to configure a Mobile VPN tunnel between the WatchGuard M
Inhaltszusammenfassung zur Seite Nr. 4
Enabling Mobile VPN for a Firebox User Account The Firebox X Edge creates a .wgx file for a user when a Firebox user’s account is configured for Mobile VPN, as described in this chapter. If you want to lock the profiles for mobile users by making them read-only, see “Configuring Global Mobile VPN Client Settings” on page 3. Enabling Mobile VPN for a Firebox User Account 1 To connect to the Edge System Status page, type https:// in the browser address bar, and the IP address of the Firebox® X
Inhaltszusammenfassung zur Seite Nr. 5
Configuring Global Mobile VPN Client Settings 10 Set MUVPN key expiration in kilobytes and/or hours. The default values are 8192 KB and 24 hours. To remove a size and/or time expiration, set the value to zero (0). 11 Make sure the VPN Client Type drop-down list is set to Mobile User. This is true whether you use a Windows desktop, laptop, or handheld PC. 12 Select the All traffic uses tunnel (0.0.0.0/0 IP Subnet) check box if the remote client sends all its traffic (including usual web traff
Inhaltszusammenfassung zur Seite Nr. 6
Distributing the Software and Profiles 1 You can choose to make the .wgx file read-only so that the user cannot change the security policy file. To do this, select the Make the MUVPN client security policy read-only check box. 2 Mobile VPN clients use shared Windows Internet Naming Service (WINS) and Domain Name System (DNS) server addresses. DNS changes host names into IP addresses, while WINS changes NetBIOS names to IP addresses. The trusted interface of the Edge must have access to these
Inhaltszusammenfassung zur Seite Nr. 7
Distributing the Software and Profiles • The end-user profile This file contains the user name, shared key, and settings that enable a remote computer to connect securely over the Internet to a protected, private computer network. For information on how to get the profile from the Edge, see “Get the user’s .wgx file” on page 3. • User documentation Documentation to help the remote user install the Mobile VPN client and import their Mobile VPN configuration file can be found in the “Mobile V
Inhaltszusammenfassung zur Seite Nr. 8
Distributing the Software and Profiles 6 Mobile User VPN
Inhaltszusammenfassung zur Seite Nr. 9
2 Using Fireware Policy Manager to Configure Mobile VPN with IPSec The WatchGuard® Mobile VPN with IPSec client is a software application that is installed on a remote computer. The client makes a secure connection from the remote computer to your protected network through an unsecured network. The Mobile VPN client uses Internet Protocol Security (IPSec) to secure the connection. This document gives basic configuration instructions on how to configure a Mobile VPN tunnel between the Watc
Inhaltszusammenfassung zur Seite Nr. 10
About Mobile VPN Client Configuration Files About Mobile VPN Client Configuration Files With Mobile VPN with IPSec, the network security administrator controls end-user profiles. Policy Man- ager is used to set the name of the end user and create a client configuration file, or profile, with the file extension .wgx. The .wgx file contains the shared key, user identification, IP addresses, and settings that are used to create a secure tunnel between the remote computer and the Firebox®. This fi
Inhaltszusammenfassung zur Seite Nr. 11
Configuring the Firebox for Mobile VPN 3 Use the instructions provided here to go through each screen of the wizard. Click Next after each step. 4 Select a user authentication server Select an authentication server from the Authentication Server drop-down list. You can authenticate users with the internal Firebox database (Firebox-DB) or with a RADIUS, SecurID, LDAP, or Active Directory server. Make sure that this method of authentication is enabled in Policy Manager (select Setup > Authenti
Inhaltszusammenfassung zur Seite Nr. 12
Configuring the Firebox for Mobile VPN 6 Direct the flow of Internet traffic: Select an option for Internet traffic. You can allow all Internet traffic between the Mobile VPN client and the Internet to use the ISP of the client, or you can make all Internet traffic use the VPN tunnel. If you choose to force all Internet traffic to go through the tunnel, more processing power and bandwidth on the Firebox is used. However, the configuration is more secure. 7 Identify the resources accessible t
Inhaltszusammenfassung zur Seite Nr. 13
Configuring the Firebox for Mobile VPN 8 Create the virtual IP address pool: Click Add to add one IP address or an IP address range. Repeat this step to add more virtual IP addresses. Mobile VPN users will be assigned one of these IP addresses when they connect to your network. The number of IP addresses should be the same as the number of Mobile VPN users. If High Availability is configured, you must add two virtual IP addresses for each Mobile VPN user. The IP addresses cannot be used for
Inhaltszusammenfassung zur Seite Nr. 14
Modifying an Existing Mobile VPN Profile Adding Users to a Firebox Mobile VPN Group To create an Mobile VPN tunnel with the Firebox, remote users type their user name and password to authenticate. WatchGuard® System Manager software uses this information to authenticate the user to the Firebox®. To authenticate, users must be part of the group entered in the Add Mobile User VPN Wizard. If you use Firebox authentication, use the instructions below. If you use a third-party authentication ser
Inhaltszusammenfassung zur Seite Nr. 15
Modifying an Existing Mobile VPN Profile 3 Click Edit. The Edit MUVPN Extended Authentication Group dialog box appears. Use the following fields to edit the group profile: Authentication Server Select the authentication server to use for this Mobile VPN group. To configure your authentication server, select Setup > Authentication > Authentication Servers from the menu bar in Policy Manager. Passphrase Type a passphrase to encrypt the Mobile VPN profile (.wgx file) that you distribute to users
Inhaltszusammenfassung zur Seite Nr. 16
Modifying an Existing Mobile VPN Profile timeouts for the Mobile VPN group are always ignored because you set timeouts in the individual Firebox user accounts. The session and idle timeouts cannot be longer than the value in the SA Life field. To set this field, from the IPSec Tunnel tab of the Edit MUVPN Extended Authentication Group dialog box, click Advanced. The default value is 8 hours. 4 Click the IPSec Tunnel tab. 5 Use the following fields to edit the IPSec settings: Use the passphr
Inhaltszusammenfassung zur Seite Nr. 17
Modifying an Existing Mobile VPN Profile Phase2 Settings Select the proposal and key expiration settings for the Mobile VPN tunnel. You can also enable Perfect Forward Secrecy (PFS) or set the Diffie-Hellman group. To change other proposal settings, click the Proposal button, and see the procedure described in “Defining advanced Phase 2 settings” on page 16. 6 Click the Resources tab. 7 Use the following fields to add and remove allowed network resources and virtual IP addresses: Force All Tr
Inhaltszusammenfassung zur Seite Nr. 18
Modifying an Existing Mobile VPN Profile Defining advanced Phase 1 settings To define advanced Phase 1 settings for an Mobile VPN user profile: 1 From the IPSec Tunnel tab of the Edit MUVPN Extended Authentication Group dialog box, select Advanced. The Phase1 Advanced Settings dialog box appears. 2 To change the SA (security association) lifetime, type a number in the SA Life field, and select Hour or Minute from the drop-down list 3 From the Key Group drop-down list, select the Diffie-Hell
Inhaltszusammenfassung zur Seite Nr. 19
Configuring WINS and DNS Servers 2 From the Type drop-down list, select ESP or AH as the proposal method. Only ESP is supported at this time. 3 From the Authentication drop-down list, select SHA1 or MD5 for the authentication method. 4 From the Encryption drop-down list, select the encryption method. The options are None, DES, 3DES, and AES 128, 192, or 256 bit, which appear in the list from the most simple and least secure to most complex and most secure. 5 To make the gateway endpoints g
Inhaltszusammenfassung zur Seite Nr. 20
Locking Down an End-User Profile Locking Down an End-User Profile You can use the advanced settings to lock down the end-user profile so that users can see some set- tings but not change them, and hide other settings so that users cannot change them. We recommend that you lock down all profiles so that users cannot make changes to their profile. 1 On the Mobile User VPN tab, click Advanced. The Advanced Export File Preferences dialog box appears. 2 To give mobile users only read-only access to
