Use the WatchGuard IKEv2 Setup Wizard

The WatchGuard IKEv2 Setup Wizard helps you activate and configure Mobile VPN with IKEv2 on the Firebox. The setup wizard is available only when Mobile VPN with IKEv2 is not activated. The wizard prompts you to configure four settings:

  • Firebox domain name or IP address for client connections
  • Authentication server
  • Users and groups
  • Virtual IP address pool

Settings not included in the wizard are set to their default values. After you complete the wizard, you can edit the Mobile VPN with IKEv2 configuration to change settings you specified in the wizard and other settings.

Before You Begin

You must configure an authentication server for IKEv2 user authentication before you enable Mobile VPN with IKEv2. When you configure Mobile VPN with IKEv2, you select an authentication server and specify users and groups. If your users authenticate to network resources with Active Directory, we recommend that you configure RADIUS authentication so the IKEv2 VPN can pass through Active Directory credentials.

For more information about supported user authentication methods for IKEv2, see About Mobile VPN with IKEv2 User Authentication.

Default Settings

IPSec

When you activate Mobile VPN with IKEv2, IPSec is enabled by default with these IPSec settings:

Phase 1 transforms

  • SHA2-256, AES(256), and Diffie-Hellman Group 14
  • SHA-1, AES(256), and Diffie-Hellman Group 5
  • SHA-1, AES(256), and Diffie-Hellman Group 2
  • SHA-1, 3DES, and Diffie-Hellman Group 2

The SA life is 24 hours for all transforms.

Phase 2 proposals

  • ESP-AES-SHA1
  • ESP-AES256-SHA256

PFS is disabled.

Fireware v12.2 or higher supports AES-GCM for Phase 1 transforms and Phase 2 proposals.

If your IKEv2 clients require different settings, you can edit these settings after you run the wizard.

IP Address Pool

By default, the Mobile VPN with IKEv2 address pool is 192.168.114.0/24.

We recommend that you do not use the private network ranges 192.168.0.0/24 or 192.168.1.0/24 on your corporate or guest networks. These ranges are commonly used on home networks. If a mobile VPN user has a home network range that overlaps with your corporate network range, traffic from the user does not go through the VPN tunnel. To resolve this issue, we recommend that you Migrate to a New Local Network Range.

For more information about virtual IP address pools, see Virtual IP Addresses and Mobile VPNs.

Other Settings

After you complete the wizard, you can configure additional Mobile VPN with IKEv2 settings that do not appear in the wizard. For information about other settings, see Edit the Mobile VPN with IKEv2 Configuration.

Use the IKEv2 Setup Wizard

To configure other settings, edit the Mobile VPN with IKEv2 configuration.

See Also

Mobile VPN with IKEv2

Edit the Mobile VPN with IKEv2 Configuration

Internet Access Through a Mobile VPN with IKEv2 Tunnel

Configure Client Devices for Mobile VPN with IKEv2

Configure iOS and macOS Devices for Mobile VPN with IKEv2

Configure Windows Devices for Mobile VPN with IKEv2

Configure Android Devices for Mobile VPN with IKEv2

Troubleshoot Mobile VPN with IKEv2