Contents

Related Topics

Define Gateway Endpoints for a BOVPN Gateway

Gateway Endpoints are the local and remote gateways that a BOVPN connects. The gateway endpoints configuration tells your Firebox how to identify and communicate with the remote endpoint device when it negotiates the BOVPN. It also tells the device how to identify itself to the remote endpoint when it negotiates the BOVPN. You must configure at least one gateway endpoint pair when you add a BOVPN gateway.

Any external interface can be a gateway endpoint. If the local or remote endpoint has more than one external interface, you can configure multiple gateway endpoint pairs. This enables the device to failover to a secondary connection if the primary is not available. For more information, see Configure VPN Failover.

Do not use a secondary interface IP address as a gateway endpoint.
If you configure a gateway endpoint with a secondary interface IP address, the BOVPN connection might fail if the local Firebox initiates the BOVPN connection. This is because the Firebox initiates the connection with the primary interface IP address. If the remote endpoint initiates the BOVPN connection and specifies the secondary interface IP address, the connection succeeds.

If you configure more than one gateway endpoint pair, make sure that the gateway endpoints are listed in the same order on both endpoint devices.

Local Gateway

In the Local Gateway section, you configure the gateway ID and the external interface the BOVPN connects to on your Firebox.

For the gateway ID, if you have a static IP address you can select By IP Address. If you have a domain that resolves to the IP address the BOVPN connects to on your Firebox, select By Domain Information.

To configure the local gateway, from Fireware Web UI:Closed
  1. Create or edit a branch office VPN Gateway. For more information, see Configure Manual BOVPN Gateways.
  2. From the Gateway page, in the Gateway Endpoint section, click Add.
    The New Gateway Endpoints Settings dialog box appears.

Screen shot of the Gateway Endpoint Settings dialog box, Local Gateway tab

  1. From the External Interface drop-down list, select the interface that has the external (public) IP address of the Site A Firebox. If you configured the wireless client as an external interface, select the interface WG-Wireless-Client.
  2. Select an option and specify the gateway ID:
    • By IP address — Type the primary IP address of the Firebox interface. Do not use a secondary interface IP address as the gateway ID.
    • By Domain Name — Type your domain name.
    • By User ID on Domain — Type the user name and domain with the format UserName@DomainName.
    • By x500 Name — Type the x500 name.
To configure the local gateway, from Policy Manager:Closed
  1. Create or edit a branch office VPN gateway. For more information, see Configure Manual BOVPN Gateways.
  2. From the Add Gateway page, in the Gateway Endpoints section, click Add.
    The New Gateway Endpoints Settings dialog box appears.

Screen shot of New Gateway Endpoints Settings dialog box

  1. From the External Interface drop-down list, select the interface that has the external (public) IP address of the Site A Firebox. If you configured the wireless client as an external interface, select the interface WG-Wireless-Client.
  2. Select an option and specify the gateway ID:
    • By IP address — Type or select the primary IP address of the Firebox interface. All configured interface IP addresses appear in the drop-down list. Do not use a secondary interface IP address as the gateway ID.
    • By Domain Information— Click Configure and select the method of domain configuration. Select By Domain Name or By User ID on Domain.
      • By Domain Name — Type your domain name and click OK.
      • By User ID on Domain — Type the user name and domain with the format UserName@DomainName and click OK.

Remote Gateway

You can configure the gateway IP address and gateway ID for the remote endpoint device that the BOVPN connects to. The gateway IP address can be either a static IP address or a dynamic IP address. The gateway ID can be By Domain Name, By User ID on Domain, or By x500 Name. The administrator of the remote gateway device selects which gateway ID type to use.

If the remote VPN endpoint gets an external IP address from DHCP or PPPoE, set the ID type of the remote gateway to Domain Name. Set the peer name to the fully qualified domain name of the remote VPN endpoint. The Firebox uses the IP address and domain name to find the VPN endpoint. Make sure the DNS server the device uses can identify the name.

To configure the remote gateway endpoint, from Fireware Web UI:Closed
  1. In the Gateway Endpoint Settings dialog box, select the Remote Gateway tab.

Screen shot of the Gateway Endpoint Settings dialog box, Remote Gateway tab

  1. Select the remote gateway IP address type:
    • Static IP address — Select this option if the remote device has a static IP address. Type or select the IP address.
    • Dynamic IP address — Select this option if the remote device has a dynamic IP address.
  2. Select an option and specify the remote gateway ID:
    • By IP address — Type the IP address.
    • By Domain Name — Type the domain name.
    • By User ID on Domain — Type the user ID and domain.
    • By x500 Name — Type the x500 name.
    • If the domain name of the remote endpoint can be resolved, select the Attempt to resolve domain check box.
      When this option is selected, the device automatically does a DNS query to find the IP address associated with the domain name for the remote endpoint. Connections do not proceed until the domain name can be resolved. Select this check box for configurations that depend on a dynamic DNS server to maintain a mapping between a dynamic IP address and a domain name.
  3. Click OK.
    The gateway pair you defined appears in the list of gateway endpoints.
  4. To configure Phase 1 settings for this gateway, follow the steps in Configure IPSec VPN Phase 1 Settings.
To configure the remote gateway endpoint, from Policy Manager:Closed
  1. Select the remote gateway IP address type:
    • Static IP address — Select this option if the remote device has a static IP address. Type or select the IP address.
    • Dynamic IP address — Select this option if the remote device has a dynamic IP address.
  2. Select an option and specify the gateway ID:
    • By IP address — Type the IP address or select it from the drop-down list.
    • By Domain Information
      1. Click Configure and select the method of domain configuration: Domain Name, User ID @ Domain, or X500 Name .
      2. Type the name, user ID and domain, or x500 name.
      3. If the domain name of the remote endpoint can be resolved, select the Attempt to resolve check box.
        When this option is selected, the device automatically does a DNS query to find the IP address associated with the domain name for the remote endpoint. Connections do not proceed until the domain name can be resolved. Select this check box for configurations that depend on a dynamic DNS server to maintain a mapping between a dynamic IP address and a domain name.
      4. Click OK.

Screen shot of Configure Domain for Gateway ID dialog box

  1. Click OK to close the New Gateway Endpoints Settings dialog box.
    The gateway pair you defined appears in the list of gateway endpoints.
  2. To use Phase 1 settings other than the default values, follow the steps in Configure IPSec VPN Phase 1 Settings. Otherwise, click OK.

See Also

Configure Manual BOVPN Gateways

Configure Manual BOVPN Tunnels

Give Us Feedback  •   Get Support  •   All Product Documentation  •   Technical Search

© 2018 WatchGuard Technologies, Inc. All rights reserved. WatchGuard, the WatchGuard logo, WatchGuard Dimension, Firebox, Core, Fireware, and LiveSecurity are registered trademarks or trademarks of WatchGuard Technologies in the United States and/or other countries.