Use Mobile VPN with SSL with an OpenVPN Client
In Fireware v11.7.4 and higher, the Firebox creates a Mobile VPN with SSL client profile that users can import to an OpenVPN client to create a profile for connections to the Firebox. This enables you to configure an OpenVPN client, such as the OpenVPN Connect app for Android and iOS, to make an SSL VPN connection to the Firebox.
Fireware XTM v11.7.3 also supports connections from OpenVPN Connect, but does not generate the .ovpn file. For information about how to create this file manually for connections to a device that uses Fireware XTM v11.7.3, see the article Create an SSL VPN Profile for OpenVPN Connect for Android/iOS in the WatchGuard Knowledge Base.
OpenVPN Connect is available from www.openvpn.net, the Google Play app store, or the Apple app store.
Before you download the Mobile VPN with SSL client profile, make sure your Firebox configuration meets these requirements:
- The Firebox must use Fireware OS v11.7.4 or higher.
- The Firebox must be configured to route VPN traffic. Make sure that Routed VPN traffic is selected in the Mobile VPN with SSL configuration. For more information, see Configure the Firebox for Mobile VPN with SSL.
- The certificates for Mobile VPN with SSL must be created with Fireware v11.7.3 or higher. If you upgraded from an earlier version, your certificates may not be compatible with the OpenVPN client.
To generate new SSLVPN certificates, you must delete the SSLVPN certificates from the Firebox and reboot the Firebox. When the Firebox restarts, it creates new SSLVPN certificates.
To generate new SSLVPN certificates, from Firebox System Manager:
- Select View > Certificates.
The Certificates dialog box appears.
- In the list of certificates, find and delete the three SSLVPN certificates.
The three SSLVPN certificates have these common name (cn) attributes:
- cn=Fireware SSLVPN Server
- cn=Fireware SSLVPN Client
- cn=Fireware SSLVPN (SN...) CA
- Reboot the Firebox to automatically generate new certificates.
You must use Firebox System Manager (FSM) to delete certificates. You cannot do this from Fireware Web UI.
After the Firebox generates new SSLVPN certificates, existing WatchGuard Mobile VPN with SSL clients automatically download the new certificates the next time your users connect. The WatchGuard Mobile VPN with SSL client prompts the user to accept the new certificate if the user does not have the CA certificate for the Firebox.
Download the Mobile VPN with SSL Client Profile
After Mobile VPN with SSL is configured, you can download the client.ovpn file from the Firebox, and send it to the device where the OpenVPN client is installed.
Because the web browser on some mobile devices do not support file downloads, this procedure describes how to download the file to another device, and then email it to the mobile device as a file attachment.
To download the .ovpn profile from the Firebox:
- Connect to this address with a web browser:
https://<IP address of a Firebox interface>/sslvpn.html
https://<Host name of the Firebox>/sslvpn.html
- Type your user name and password to authenticate to the Firebox.
The Mobile VPN with SSL download page appears.
- Click the Download button for the Mobile VPN with SSL client profile. The file you download is called client.ovpn.
- Save the file to a location on your computer.
- Send the file as an email file attachment to the mobile user.
Import the Client Profile
To import a client profile to an Android or iOS device:
- Install the OpenVPN Connect app.
- Open the email message that contains the .ovpn email attachment.
- Tap the attachment to open the file in the OpenVPN Connect app.
- Import the .ovpn file to the VPN client to create a new connection profile.
- In the profile, type the Username and Password you use to authenticate to the Firebox.
- To start the VPN tunnel, select or turn on the VPN profile in OpenVPN Connect.
See the documentation for your OpenVPN client for more information about how to import a .ovpn file.