Contents

Related Topics

Edit the Mobile VPN with IKEv2 Configuration

We recommend that you use the WatchGuard IKEv2 Setup Wizard to set up Mobile VPN with IKEv2 for the first time. For more information, see Use the WatchGuard IKEv2 Setup Wizard.

To edit the Mobile VPN with IKEv2 configuration, from Fireware Web UI:Closed
  1. Select VPN > Mobile VPN with IKEv2.
  2. Click Configure.

Screen shot of the Mobile VPN with IKEv2 configuration page

  1. Select the Activate Mobile VPN with IKEv2 check box if Mobile VPN with IKEv2 is not already activated.
  2. Use the information in the next sections to configure the Mobile VPN with IKEv2 settings.
To edit the Mobile VPN with IKEv2 configuration, from Policy Manager:Closed
  1. Select VPN > Mobile VPN > IKEv2 > Configure.
    The Mobile VPN with IKEv2 Configuration dialog box appears.

Screen shot of the Mobile VPN with IKEv2 configuration page

  1. Select the Activate Mobile VPN with IKEv2 check box if Mobile VPN with IKEv2 is not already activated.
  2. Use the information in the next sections to configure the Mobile VPN with IKEv2 settings.

Edit Network Settings

On the Networking tab, in the Firebox Addresses section, specify an IP address or domain name for connections from Mobile VPN with IKEv2 users. If your Firebox is behind a NAT device, you must specify the public IP address or domain name of the NAT device.

Edit the Virtual IP Address Pool

On the Networking tab, the Virtual IP Address Pool shows the internal IP addresses that are used by Mobile VPN with IKEv2 users over the tunnel. The virtual IP address pool must contain at least two IP addresses. By default, the Firebox assigns addresses in the 192.168.114.0/24 range to Mobile VPN with IKEv2 clients.

For more information about virtual IP addresses, see Virtual IP Addresses and Mobile VPNs.

To add to the virtual IP address pool:

  1. Click Add.
    The Add Address Pool dialog box appears.
  2. From the Choose Type drop-down list, select Network IPv4 or Host IPv4.
  3. In the adjacent text box, type an IP address or network IP address.

Edit Authentication Settings

On the Authentication tab you can configure authentication servers and the authorized users and groups.

Configure Authentication Servers

  1. Select the Authentication tab.
  2. In the Authentication Servers section, select Firebox-DB, RADIUS, or both.
  3. If you select both Firebox-DB and RADIUS, you can select Set as default server to make RADIUS the default authentication server.

Configure Users and Groups

If you use Firebox-DB for authentication, you must use the IKEv2-Users group that is created by default. You can add the names of other groups and users that use Mobile VPN with IKEv2. For each group or user you add, you can select the authentication server where the group exists or select Any if that group exists on more than one authentication server. The group or user name you add must exist on the authentication server. The group and user names are case sensitive and must exactly match the name on your authentication server.

For more information about user authentication, see About Mobile VPN with IKEv2 User Authentication.

From Fireware Web UI:Closed
  1. In the Users and Groups section, select users and groups for Mobile VPN with IKEv2.
  2. To add a new Firebox-DB user or group, select Firebox-DB from the drop-down list.
  3. To add a new RADIUS user or group, select RADIUS from the drop-down list.
  4. To add a new user or group for both Firebox-DB and RADIUS, select Any from the drop-down list.
  5. From the adjacent drop-down list, select User or Group.
  6. Click Add.
    The Firebox User, Firebox Group, or Add User or Group dialog box appears.
  7. Specify the settings for the user or group.

For more information about how to add Firebox-DB users, see Define a New User for Firebox Authentication.

For more information about how to add Firebox-DB groups, see Define a New Group for Firebox Authentication.

For more information about how to add RADIUS users and groups, see Use Users and Groups in Policies.

From Policy Manager:Closed
  1. In the Users and Groups section, select users and groups for Mobile VPN with IKEv2.
  2. To add a new Firebox-DB user or group, click New.
  3. Select Firebox-DB User/Group or External User/Group.
    The Authentication Servers dialog box appears.
  4. To add a user, in the Users section, click Add.
    The Setup Firebox User dialog box appears.
  5. Specify the user name, password, timeout settings, and login limit settings for the user. For more information about how to add users, see Define a New User for Firebox Authentication.
  6. To add a group, in the Group section, click Add.
    The Setup Firebox Group dialog box appears.
  7. Specify the user name, password, timeout settings, and login limit settings for the user. For more information about how to add users, see Define a New Group for Firebox Authentication.

Configure a Certificate for Authentication

You can select a Firebox certificate or a third-party certificate for Mobile VPN with IKEv2 authentication. Firebox and third-party certificates have these requirements:

  • Extended Key Usage (EKU) flags "serverAuth" and "IP Security IKE Intermediate” (OID 1.3.6.1.5.5.8.2.2)
  • IP address or DNS name as a Subject Alternative Name value

To select a certificate for authentication:

  1. Click the Security tab.
  2. To specify a certificate for authentication, click Edit.
    The Firebox Address and Certificate Settings dialog box appears.
  3. In the Type drop-down list, select Firebox-Generated Certificate or Third-Party Certificate.

Configure the Phase 1 and 2 Settings

To configure the Phase 1 settings, select VPN > IKEv2 Shared Settings. For more information about IKEv2 Shared Settings, see Configure IKEv2 Shared Settings.

The IPSec Phase 2 proposals used for Mobile VPN with IKEv2 are the same proposals you configure to use with a branch office VPN. If you want to configure a new Phase 2 proposal to use with Mobile VPN with IKEv2, you must add it in the Phase 2 Proposals page. Then you can add it to the Mobile VPN with IKEv2 configuration.

To configure the Phase 2 settings, from the Web UI:Closed
  1. Select VPN > Mobile VPN > IKEv2 > Configure.
  2. Select Security > Phase 2.
  3. Select the Phase 2 Settings tab.
  4. Select Enabled Perfect Forward Secrecy to enable Perfect Forward Secrecy (PFS).
  5. From the adjacent drop-down list, select a Diffie-Hellman Group.
  6. In the IPSec Proposals section, select an existing proposal from the drop-down list.
  7. Click Add.
  8. To add a new proposal, select VPN > Phase 2 Proposals. For more information about Phase 2 Proposals, see Add a Phase 2 Proposal.
  9. Click Save.
To configure the Phase 2 settings, from Policy Manager:Closed
  1. Select VPN > Mobile VPN > IKEv2 > Configure.
  2. Select Security > Phase 2.
  3. Select the Phase 2 Settings tab.
  4. Select the PFS check box to enable Perfect Forward Secrecy (PFS).
  5. From the adjacent drop-down list, select a Diffie-Hellman Group.
  6. In the IPSec Proposals section, select an existing proposal from the drop-down list.
  7. Click Add.
  8. To add a new proposal, select VPN > Phase 2 Proposals. For more information about Phase 2 Proposals,see Add a Phase 2 Proposal.
  9. Click OK.

See Also

Use the WatchGuard IKEv2 Setup Wizard

Mobile VPN with IKEv2

Configure iOS and macOS Devices for Mobile VPN with IKEv2

Configure Windows Devices for Mobile VPN with IKEv2

Configure Android Devices for Mobile VPN with IKEv2

Configure Client Devices for Mobile VPN with IKEv2

Internet Access Through a Mobile VPN with IKEv2 Tunnel

Certificates for Mobile VPN with IKEv2 Tunnel Authentication

Give Us Feedback  •   Get Support  •   All Product Documentation  •   Technical Search

© 2018 WatchGuard Technologies, Inc. All rights reserved. WatchGuard, the WatchGuard logo, WatchGuard Dimension, Firebox, Core, Fireware, and LiveSecurity are registered trademarks or trademarks of WatchGuard Technologies in the United States and/or other countries.