Use a Wizard to Configure the Firebox for Mobile VPN with SSL

1. Select VPN > Mobile VPN.
   The Mobile VPN selection page opens.
2. In the Mobile VPN with SSL section, click Launch Wizard.
   The first page of the wizard opens.

3. Click Next.
   The server settings show.
4. In the Primary text box, type a public IP address or domain name.
   This is the IP address or domain name that Mobile VPN with SSL clients connect to by default. This can be an external IP address, secondary external IP address, or external VLAN. For a device in drop-in mode, use the IP address assigned to all interfaces.
5. (Optional) If your Firebox has more than one external address, in the Backup text box, type a different public IP address.
   This is the IP address that the Mobile VPN with SSL client connects to if it is unable to establish a connection with the primary IP address. If you add a secondary IP address, make sure it is an IP address assigned to a Firebox external interface or VLAN. If you want the Mobile VPN with SSL client to use a secondary IP address, you must also select the Auto reconnect after a connection is lost check box in the Authentication settings, as described in the next section.

6. Click Next.
   The authentication settings show.
7. To add an authentication server, select a server from the drop-down list and click Add.
   In Fireware v12.7 or higher, you can select AuthPoint as an authentication server. AuthPoint is the cloud-based multi-factor authentication solution from WatchGuard. For more information, go to Plan Your Mobile VPN with SSL Configuration.
8. To remove an authentication server, select the server and click Remove.
9. To change the order of servers, select a server and click Up or Down.

10. Click Next.
    The settings for users and groups open.
11. Select one or more groups or users to add to the SSLVPN-Users group.
12. (Optional) To apply enforcement settings to Mobile VPN with SSL groups:
    1.  Select the check box for a group.
    2. In Fireware v12.9 or higher, in the Network Access Enforcement column, select Yes.
13. To disable enforcement for a group, select the check box for that group and select No.

14. Click Next.
    The Define the virtual IP Address pool page opens.
15. Specify a virtual IP address pool subnet to use for client connections. For best practices that can help you to avoid IP address conflicts, go to Manually Configure the Firebox for Mobile VPN with SSL.

16. Click Next.
    The final page of the wizard opens.

17. Click Finish.
    The Mobile VPN with SSL Configuration page opens.

18. To edit the configuration, go to Manually Configure the Firebox for Mobile VPN with SSL.

If you configure Mobile VPN with SSL to use more than one authentication server, users who do not use the default authentication server must specify the authentication server or domain as part of the user name. For more information and examples, go to Download, Install, and Connect the Mobile VPN with SSL Client.

1. Select VPN > Mobile VPN > Get Started.
   The Configure Mobile VPN dialog box opens.

2. In the SSL section, click Launch Wizard.
   The first page of the wizard opens.

3. Click Next.
   The server settings appear.
4. In the Primary text box, type a public IP address or domain name.
   This is the IP address or domain name that Mobile VPN with SSL clients connect to by default. This can be an external IP address, secondary external IP address, or external VLAN. For a device in drop-in mode, use the IP address assigned to all interfaces.
5. (Optional) If your Firebox has more than one external address, in the Backup text box, type a different public IP address.
   This is the IP address that the Mobile VPN with SSL client connects to if it is unable to establish a connection with the primary IP address. If you add a secondary IP address, make sure it is an IP address assigned to a Firebox external interface or VLAN. If you want the Mobile VPN with SSL client to use a secondary IP address, you must also select the Auto reconnect after a connection is lost check box in the Authentication settings, as described in the next section.

6. Click Next.
   The authentication settings show.
7. To add an authentication server, select a server from the drop-down list and click Add.
   In Fireware v12.7 or higher, you can select AuthPoint as an authentication server. AuthPoint is the cloud-based multi-factor authentication solution from WatchGuard. For more information, go to Plan Your Mobile VPN with SSL Configuration.
8. To remove an authentication server, select the server and click Remove.
9. To change the order of servers, select a server and click Up or Down.

10. Click Next.
    The settings for users and groups show.
11. Select one or more groups or users to add to the SSLVPN-Users group.
12. (Optional) To apply enforcement settings to Mobile VPN with SSL groups:
    1. Select the check box for a group.
    2. Select Network Access Enforcement check box.
13. To disable enforcement for a group, select the check box for that group and select No.

14. Click Next.
    The Define a virtual IP address pool page opens.
15. Specify a virtual IP address pool subnet to use for client connections. For best practices that can help you to avoid IP address conflicts, go to Manually Configure the Firebox for Mobile VPN with SSL.

16. Click Next.
    The final page of the wizard opens.
17. To view or edit the configuration after you exit the wizard, select Open the mobile SSL configuration dialog.

18. Click Finish.
    If you selected to open the configuration, the Mobile VPN with SSL Configuration page opens.

19. To edit the configuration, go to Manually Configure the Firebox for Mobile VPN with SSL.

If you configure Mobile VPN with SSL to use more than one authentication server, users who do not use the default authentication server must specify the authentication server or domain as part of the user name. For more information and examples, go to Download, Install, and Connect the Mobile VPN with SSL Client.