Internet Access Through a Mobile VPN with IKEv2 Tunnel

For Mobile VPN with IKEv2, we support default-route VPN only. Split tunnel VPN is not supported.

Default-route VPN is the most secure option because it requires all remote user Internet traffic to be routed through the VPN tunnel to the Firebox. Then, the traffic is sent back out to the Internet. With this configuration, the Firebox is able to examine all traffic and provide increased security, although it uses more processing power and bandwidth.

Firebox Configuration

Your Firebox must be configured with dynamic NAT to receive the traffic from an IKEv2 user. Any policy that manages traffic going out to the Internet from behind the Firebox must be configured to allow the IKEv2 user traffic.

When you configure your default-route VPN:

  • Make sure that the IP addresses you have added to the IKEv2 address pool are included in your dynamic NAT configuration on the Firebox. This allows remote users to browse the Internet when they send all traffic to the Firebox.
    From Policy Manager, select Network > NAT.
  • Edit your policy configuration to allow connections from the IKEv2 -Users group through the external interface.
    For example, if you use WebBlocker to control web access, add the IKEv2 -Users group to the proxy policy that is configured with WebBlocker enabled.

Client Configuration

For compatibility with the Firebox, make sure that your IKEv2 client is configured for default-route (full tunnel) VPN:

  • In Windows 10, change the default setting from split tunnel to default route in the adapter settings for the IKEv2 connection.
  • In Windows 8.1 or macOS, keep the default setting, which is default-route.

You cannot configure this setting on mobile operating systems.

WatchGuard provides interoperability instructions to help our customers configure WatchGuard products to work with products created by other organizations. If you need more information or technical support about configuring a non-WatchGuard product, see the documentation and support resources for that product.

Enable Default-Route (Full Tunnel) in Windows

See Also

Add Network Dynamic NAT Rules

Mobile VPN with IKEv2

Edit the Mobile VPN with IKEv2 Configuration

Give Us Feedback  ●   Get Support  ●   All Product Documentation  ●   Technical Search