MUVPN with
extended authentication allows users to authenticate to a Windows NT or
RADIUS authentication server instead of to the Firebox. For more information
on extended authentication, see MUVPN with
extended authentication.
If you want
to use a third-party server for authentication, you must define an extended
authentication group on the Firebox. The actual usernames and passwords
for MUVPN users are stored on the authentication server itself and are
not maintained by the Firebox.
From Policy Manager:
Select Network => Remote User.
Click the Mobile User VPN tab.
The Mobile User VPN Wizard - Extended Authentication
Group appears.
Specify a name for the extended
authentication group. Specify the passphrase used to encrypt the .wgx file for this group. Click Next.
Select an authentication server for this group from
the drop list. Click Next.
The authentication server must already be
set up using the Authentication Servers dialog box. For information on
how to do this, see the WatchGuard Firebox System User Guide.
Select whether this group will use
a shared key or a certificate for authentication. Click Next.
If you specified certificates, enter the configuration
passphrase of your certificate authority, which is either the Firebox
or a third-party CA device. Click Next.
Specify the network resources to which this group
will be allowed access. To add a new resource, click Add.
The Advanced Mobile User VPN Policy Configuration
dialog box appears.
Use the Allow Access to drop
list to select Network or Host. Type the IP address. Use
the Dst Port, Protocol, and Src Port options to restrict
access.
If you plan to use a virtual adapter
and route all of the remote users' Internet traffic through the IPSec
tunnel, enable the checkbox marked Use default gateway on remote network.
Click Next.
Specify the virtual IP address pool
(these can be virtual IP addresses on a false network, as described in
IP Addressing). To add addresses, click
Add and enter an address or address range. Click Next.
Select an authentication method and encryption method
for this group's connections. Enter a key expiration time in kilobytes,
hours, or both.
If you specify both, the key expires at
whichever time arrives earliest.
Authentication
MD5-HMAC (128-bit algorithm) or SHA1-HMAC (160-bit
algorithm)
Encryption
None (no encryption), DES-CBC (56-bit), or 3DES-CBC
(168-bit)
Click Next. Click Finish.
The wizard closes and the group name appears on
the Mobile User VPN tab. If you expand the plus signs (+) next to the
entries, you can view the information .
Configuring the external authentication
server
Define a group on the server that has the same name
as the extended authentication remote gateway. All MUVPN users that authenticate
to the server must belong to this group.
