WatchGuard Technologies Mobile VPN with IPSec User Manual
WatchGuard®Mobile VPN with
IPSec Administrator Guide
WatchGuard Mobile VPN v10.0
Revised: November 28, 2007
Notice to Users
Information in this guide is subject to change without notice. Companies, names, and data used in examples herein are
fictitious unless otherwise noted. No part of this guide may be reproduced or transmitted in any form or by any means,
electronic or mechanical, for any purpose, without the express written permission of WatchGuard Technologies, Inc.
Copyright, Trademark, and Patent Information
Copyright© 1998 - 2007 WatchGuard Technologies, Inc. All rights reserved.
Complete copyright, trademark, patent, and licensing
information can be found in the WatchGuard System
Manager User Guide. You can find it online at:
http://www.watchguard.com/help/documentation/
All trademarks or trade names mentioned herein, if any, are the property of their respective owners.
Client Software: Mobile VPN with IPSec v10.0
Management Software: WSM 9.1 and Edge v 8.6.x
Appliance Software: Fireware 9.1 and Edge v8.6.x
ADDRESS:
505 Fifth Avenue South
Suite 500
Seattle, WA 98104
SUPPORT:
www.watchguard.com/support
U.S. and Canada +877.232.3531
All Other Countries +1.206.521.3575
SALES:
U.S. and Canada +1.800.734.9905
All Other Countries +1.206.613.0895
ABOUT WATCHGUARD
WatchGuard is a leading provider of network security solutions for small- to midsized enterprises worldwide, delivering integrated products and services that are
robust as well as easy to buy, deploy and manage. The company’s Firebox X family of
expandable integrated security appliances is designed to be fully upgradeable as an
organization grows and to deliver the industry’s best combination of security,
performance, intuitive interface and value. WatchGuard Intelligent Layered Security
architecture protects against emerging threats effectively and efficiently and provides
the flexibility to integrate additional security functionality and services offered
through WatchGuard. Every WatchGuard product comes with an initial LiveSecurity
Service subscription to help customers stay on top of the security landscape with
vulnerability alerts, software updates, expert security instruction and superior
customer care. For more information, please call (206) 613-6600 or visit
www.watchguard.com
.
ii
Mobile User VPN
1
Configure the Firebox X Edge to use Mobile VPN with IPSec
The WatchGuard® Mobile VPN with IPSec client is a software application that is installed on a remote
computer. The client makes a secure connection from the remote computer to your protected network
through an unsecured network. The Mobile VPN client uses Internet Protocol Security (IPSec) to secure
the connection.
This document gives basic configuration instructions on how to configure a Mobile VPN tunnel
between the WatchGuard Mobile VPN with IPSec client and a Firebox® X Edge device.
Before You Begin
Before you begin, make sure you understand:
• You can install the Mobile VPN with IPSec client software on any computer running Windows
2000 Professional, Windows XP (32-bit) or Windows Vista (32-bit and 64-bit). Before you install
the client software, make sure the remote computer does not have any other IPSec mobile user
VPN client software installed. You must also uninstall any desktop firewall software (other than
Microsoft firewall software) from each remote computer.
• If the Mobile VPN with IPsec client software is installed on a computer with Windows Vista and
the Windows Vista Firewall is in use, you must add a firewall exception (Control Panel > Security >
Windows Firewall > Change Settings > Exceptions) for UDP port 4500. This will enable Mobile
VPN keep-alive packets from the Firebox® to reach your client and keep the VPN tunnel up.
About Mobile VPN Client Configuration Files
With Mobile VPN with IPSec, the Firebox® X Edge administrator controls end-user profiles. You use the
Edge web configuration interface to set the name of the end user and create a client configuration file,
or profile, with the file extension .wgx. The .wgx file contains the shared key, user identification, IP
addresses, and settings that are used to create a secure tunnel between the remote computer and the
Edge. This file is encrypted with a key that is eight characters or greater in length. This key must be
known to the administrator and the remote user. When the remote client imports the .wgx file, this key
is used to decrypt the file for use in the client software.
Administrator Guide 1
Enabling Mobile VPN for a Firebox User Account
The Firebox X Edge creates a .wgx file for a user when a Firebox user’s account is configured for Mobile
VPN, as described in this chapter.
If you want to lock the profiles for mobile users by making them read-only, see “Configuring Global
Mobile VPN Client Settings” on page 3.
Enabling Mobile VPN for a Firebox User Account
1 To connect to the Edge System Status page, type https:// in the browser address bar, and the IP
address of the Firebox® X Edge trusted interface.
The default URL is: https://192.168.111.1
2 To add a new Firebox user, select Firebox Users > New User.
You can also edit the properties of an existing user. Go to the main Firebox User page and find the
name of the user account you want to edit.
3 On the Settings tab, type an Account Name for the user. Type the password for the user. This is
different from the shared secret you type in step 7 below.
The Full Name and Description fields are optional.
4 Select the Allow access to VPN check box.
5 Click the MUVPN tab.
6 Select the Enable MUVPN for this account check box.
7 Type a shared key in the related field.
The .wgx file is encrypted with this shared key. Do not give the shared key to any user that is not
authorized to use this Firebox user account.
8 Type the virtual IP address in the related field.
The virtual IP address must be an address on the Firebox X Edge trusted or optional network that
is not used and is not included within any range of DHCP addresses assigned by the Edge. This
address is used by the remote computer to connect to the Firebox X Edge.
9 Change the Authentication Algorithm or Encryption Algorithm settings if want to. You can
find more information about these settings in the Firebox X Edge User Guide.
2
Mobile User VPN
Configuring Global Mobile VPN Client Settings
10 Set MUVPN key expiration in kilobytes and/or hours. The default values are 8192 KB and 24
hours.
To remove a size and/or time expiration, set the value to zero (0).
11 Make sure the VPN Client Type drop-down list is set to Mobile User. This is true whether you use
a Windows desktop, laptop, or handheld PC.
12 Select the All traffic uses tunnel (0.0.0.0/0 IP Subnet) check box if the remote client sends all
its traffic (including usual web traffic) through the VPN tunnel to the Firebox X Edge. This can also
let the Mobile VPN client connect with other networks that the Edge connects to.
If you do not select this check box, the remote user can connect with the Firebox X Edge trusted
network only. You must select this check box for the remote user to be able to connect to:
- Networks on the other side of a Branch Office VPN tunnel that the Edge has connected.
- Computers on the Edge’s optional network.
- Networks that are behind a static route on the trusted or optional interface.
13 Click Submit.
Get the user’s .wgx file
The Firebox X Edge makes an encrypted Mobile VPN with IPSec client configuration (.wgx) file for every
Firebox User that you give access to. To download a user’s .wgx file:
1 To connect to the System Status page, type https:// in the browser address bar, and the IP
address of the Firebox X Edge trusted interface.
The default URL is: https://192.168.111.1
2 From the navigation bar, select Firebox Users.
3 Below Secure MUVPN Client Configuration Files, select the .wgx file to download by clicking
on the link
4 At the prompt, save the .wgx file to your computer.
username.wgx
where username is the Firebox user’s name.
Configuring Global Mobile VPN Client Settings
Some MUVPN client settings apply to all Firebox® X Edge Mobile VPN connections. Select
VPN > Mobile User to set these options.
Administrator Guide 3
Distributing the Software and Profiles
1 You can choose to make the .wgx file read-only so that the user cannot change the security
policy file. To do this, select the Make the MUVPN client security policy read-only check box.
2 Mobile VPN clients use shared Windows Internet Naming Service (WINS) and Domain Name
System (DNS) server addresses. DNS changes host names into IP addresses, while WINS changes
NetBIOS names to IP addresses. The trusted interface of the Edge must have access to these
servers. Type a DNS server and WINS server IP address in the text boxes near the bottom of the
Mobile User page.
Because the Mobile VPN client always uses a virtual adapter, you should not change the virtual adapter
settings on this dialog box.This setting applies only to Mobile User VPN versions prior to 10.0. For version
10.0 and later, it does not matter what you use for this setting because the Mobile VPN with IPSec software
version 10.0 and later always uses a virtual adapter. See the Mobile User VPN Administrator's Guide for information
about how this setting affects earlier versions of the Mobile User software.
Distributing the Software and Profiles
WatchGuard® recommends distributing end-user profiles by encrypted email or with some other
secure method. Each client computer must have:
• Software installation package
The packages are located on the WatchGuard LiveSecurity® Service web site at:
http://www.watchguard.com/support
Log in to the site using your LiveSecurity Service user name and password. Click the Latest
Software link, click Add-ons/Upgrades on the left side, and then click the link for Mobile VPN
with IPSec.
4
Mobile User VPN
Distributing the Software and Profiles
• The end-user profile
This file contains the user name, shared key, and settings that enable a remote computer to
connect securely over the Internet to a protected, private computer network. For information on
how to get the profile from the Edge, see “Get the user’s .wgx file” on page 3.
• User documentation
Documentation to help the remote user install the Mobile VPN client and import their Mobile
VPN configuration file can be found in the “Mobile VPN Client Installation and Connection”
chapter in this user guide.
• Shared key
To import the end-user profile, the user is requested to type a shared key. This key decrypts the
file and imports the security policy into the Mobile VPN client. The key is set when you enable the
Firebox User account to use Mobile VPN with IPSec.
The shared key, user name, and password are highly sensitive information. For security reasons, we
recommend that you do not provide this information by email message. Because email is not
secure, an unauthorized user can get the information and gain access to your internal network.
Give the user the information by telling it to the user, or by some other method that does not allow an
unauthorized person to intercept it.
Administrator Guide 5
Distributing the Software and Profiles
6
Mobile User VPN
2
Using Fireware Policy Manager to Configure Mobile VPN with IPSec
The WatchGuard® Mobile VPN with IPSec client is a software application that is installed on a remote
computer. The client makes a secure connection from the remote computer to your protected network
through an unsecured network. The Mobile VPN client uses Internet Protocol Security (IPSec) to secure
the connection.
This document gives basic configuration instructions on how to configure a Mobile VPN tunnel
between the WatchGuard Mobile VPN with IPSec client and a Firebox® X Core or Peak device running
Fireware®.
Before You Begin
Before you begin, make sure you understand:
• Because strict export restrictions are put on exported high encryption software, WatchGuard®
System Manager is available with two encryption levels. You must make sure you download and
use WatchGuard System Manager with strong encryption when you use Mobile VPN with IPSec,
because the IPSec standard requires 56-bit (medium) encryption at a minimum.
• You can install the Mobile VPN with IPSec client software on any computer running Windows
2000 Professional, Windows XP (32-bit) or Windows Vista (32-bit and 64-bit). Before you install
the client software, make sure the remote computer does not have any other IPSec mobile user
VPN client software installed. You must also uninstall any desktop firewall software (other than
Microsoft firewall software) from each remote computer.
• If the Mobile VPN with IPsec client software is installed on a computer with Windows Vista and
the Windows Vista Firewall is in use, you must add a firewall exception
(Control Panel > Security > Windows Firewall > Change Settings > Exceptions) for UDP port
4500. This will allow Mobile VPN keep-alive packets from the Firebox® to reach your client and
keep the VPN tunnel up.
Administrator Guide 7
About Mobile VPN Client Configuration Files
About Mobile VPN Client Configuration Files
With Mobile VPN with IPSec, the network security administrator controls end-user profiles. Policy Manager is used to set the name of the end user and create a client configuration file, or profile, with the file
extension .wgx. The .wgx file contains the shared key, user identification, IP addresses, and settings that
are used to create a secure tunnel between the remote computer and the Firebox®. This file is
encrypted with a key that is eight characters or greater in length. This key must be known to the
administrator and the remote user. When the .wgx file is imported on the remote client, this key is used
to decrypt the file for the client software to use.
After you use the Add Mobile User VPN wizard, you can create or re-create a .wgx file at any time.
If you want to lock the profiles for mobile users by making them read-only, see “Locking Down an EndUser Profile” on page 18.
Configuring the Firebox for Mobile VPN
Use this procedure to enable Mobile VPN for an existing group of users or a new group you want to create. The users that are part of the group can authenticate to the local Firebox® authentication server, or
to a third-party authentication server configured in your Firebox configuration. If you use Firebox
authentication, use the instructions in “Adding Users to a Firebox Mobile VPN Group” on page 12 to
add users to your group. If you use a third-party authentication server, use the instructions provided in
that vendor’s documentation.
1 From Policy Manager, select VPN > Remote Users.
The Remote User VPN configuration dialog box appears.
2 Click Add.
The Add Mobile User VPN Wizard appears.
8
Mobile User VPN
Configuring the Firebox for Mobile VPN
3 Use the instructions provided here to go through each screen of the wizard. Click Next after each
step.
4 Select a user authentication server
Select an authentication server from the Authentication Server drop-down list. You can
authenticate users with the internal Firebox database (Firebox-DB) or with a RADIUS, SecurID,
LDAP, or Active Directory server. Make sure that this method of authentication is enabled in
Policy Manager (select Setup > Authentication > Authentication Servers).
Type a group name in the Group Name field. You can type the name of an existing Mobile VPN
group, or enter a group name for a new Mobile VPN group. Make sure the name is unique among
VPN group names as well as all interface and tunnel names.
See the Authentication chapter in the WatchGuard® System Manager User Guide for more
information.
5 Select a tunnel authentication method: Select Use this passphrase. Type and confirm a
passphrase.
When your remote users import their Mobile VPN connection profile, they will need this
passphrase. In the Mobile VPN Configuration Assistant, this passphrase is known as the “preshared key” or “shared secret.”
Administrator Guide 9
Configuring the Firebox for Mobile VPN
6 Direct the flow of Internet traffic: Select an option for Internet traffic. You can allow all Internet
traffic between the Mobile VPN client and the Internet to use the ISP of the client, or you can
make all Internet traffic use the VPN tunnel. If you choose to force all Internet traffic to go
through the tunnel, more processing power and bandwidth on the Firebox is used. However, the
configuration is more secure.
10
7 Identify the resources accessible through the tunnel: Enter the IP addresses that the Mobile
VPN users need access to. Click Add to add a host IP address or a network IP address. Type an
address and click OK in the Add Address dialog box. Do this step again to add more resources.
Mobile User VPN
Loading...