Contents

Contents ● Fireware Help

Configure iOS and macOS Devices for Mobile VPN with IKEv2

You can configure the native IKEv2 VPN client on iOS and macOS devices for a VPN connection to your Firebox. To add the VPN connection on your device, you can use the WatchGuard automatic configuration script or manually configure the settings.

Mobile VPN with IKEv2 is supported on Fireboxes with Fireware v12.1 and higher.

WatchGuard provides interoperability instructions to help our customers configure WatchGuard products to work with products created by other organizations. If you need more information or technical support about configuring a non-WatchGuard product, see the documentation and support resources for that product.

Automatically Configure VPN Settings

To configure a VPN connection with the WatchGuard automatic configuration script, you must download a compressed .TGZ file from your Firebox. This file contains instructions and configuration scripts for different operating systems. For information about how to download this file, see Configure Client Devices for Mobile VPN with IKEv2.

The automatic configuration script creates a new IKEv2 VPN connection. It also installs the required CA certificate for the VPN connection.

On iOS devices, you must type the user name and password when prompted. If do not specify a user name and password, the VPN profile is created but does not work.

To add a new VPN connection in macOS or iOS with the automatic configuration script:Closed
  1. From the .TGZ file you downloaded from the Firebox, find the WG IKEv2.mobileconfig file.
  2. Send the WG IKEv2.mobileconfig file to your macOS or iOS device.
  3. To import the WG IKEv2.mobileconfig file, click the file.
  4. Follow the instructions that appear during the import process.
  5. Type your user name and password.

Manually Configure VPN Settings

You can manually add a new VPN connection rather than run the configuration script.

On iOS devices, you must type the user name and password when prompted. If do not specify a user name and password, the VPN profile is created but does not work.

To manually add a new VPN connection in macOS:Closed
  1. From the .TGZ file you downloaded from the Firebox, find the rootca.crt or rootca.pem certificate file.
  2. Send the rootca.crt or rootca.pemcertificate file to your macOS device.
  3. To install the certificate, click the rootca.crt or rootca.pem file.
    The Keychain Access application opens.
  4. Add the certificate to the existing list.
  5. Find the certificate in the list and double-click it.
  6. Expand the Trust menu. Change When using this certificate to Always Trust.
  7. Select System Preferences > Network.
  8. To add a new service, click the + symbol.
  9. To configure the VPN, specify these settings:
    • Interface — VPN
    • VPN Type— IKEv2
    • Service Name— VPN connection name (For example, WG IKEv2 VPN)
  10. Click Create.
  11. On the next screen, specify this information:
    • Server Address— Host name or IP address of the server
    • Remote ID— Host name or IP address of the server
  12. Click Authentication Settings and specify the user information:
    • Authentication Settings— User name
    • User Authentication— User name
    • Username — Your Firebox user name
    • Password— Your Firebox password
  13. Click OK and then click Apply.
  14. To start a VPN connection to the Firebox, select the new IKEv2 connection that you added.
To manually add a new VPN connection in iOS:Closed
  1. From the .TGZ file you downloaded from the Firebox, find the rootca.crt or rootca.pem file.
  2. Send the rootca.crt or rootca.pem file to your iOS device.
  3. To install the certificate, click the rootca.crt or rootca.pem file.
  4. Select Settings > General > VPN.
  5. Click Add VPN Configuration.
  6. To configure the VPN, specify these settings:
    • Type— IKEv2
    • Description— VPN connection description
    • Server— Host name or IP address of the server
    • Remote ID— Host name or IP address of the server
    • Username— Your Firebox user name
    • Password— Your Firebox password
  7. Click Done at the top right.
  8. To start a VPN connection to the Firebox, select the new IKEv2 connection that you added.

See Also

About Mobile VPN with IKEv2

Configure Client Devices for Mobile VPN with IKEv2

Configure Android Devices for Mobile VPN with IKEv2

Configure Windows Devices for Mobile VPN with IKEv2

Internet Access Through a Mobile VPN with IKEv2 Tunnel

Give Us Feedback  ●   Get Support  ●   All Product Documentation  ●   Technical Search

© 2019 WatchGuard Technologies, Inc. All rights reserved. WatchGuard, the WatchGuard logo, and Firebox are trademarks or registered trademarks of WatchGuard Technologies, Inc. in the United States and/or other countries. All other tradenames are the property of their respective owners.