Configure a WireGuard BOVPN between Cloud-Managed Fireboxes

Applies To: Cloud-managed Fireboxes

This document applies to BOVPNs that you manage in WatchGuard Cloud. For information that applies to BOVPNs managed in Fireware Web UI or WatchGuard System Manager, go to Configure BOVPN over WireGuard.

Overview

This feature is available only to participants in the WatchGuard Cloud Beta program.

You can configure a WireGuard branch office virtual private network (BOVPN) between cloud-managed Fireboxes in the same WatchGuard Cloud account. In WatchGuard Cloud, WireGuard BOVPNs use a hub-and-spoke topology. You select one Firebox as the hub and one or more Fireboxes as spokes. For more information about WireGuard, topology rules, virtual IP address, routing and other WireGuard BOVPN concepts, go to About WireGuard BOVPN in WatchGuard Cloud.

WireGuard BOVPN supports Firebox-to-Firebox tunnels only. Third-party VPN endpoints are not supported. FireboxV endpoints are not supported.

Before You Begin

Before you add a WireGuard BOVPN between cloud-managed Fireboxes:

  • Make sure that the hub and each spoke are cloud-managed Fireboxes in the same WatchGuard Cloud account.
  • Make sure that each Firebox runs Fireware v2026.4 or higher.
  • Make sure that the ISP for each endpoint allows UDP traffic on the configured WireGuard listening port.
  • Make sure that none of the Fireboxes in the tunnel have undeployed configuration changes.
  • Identify which Firebox is the hub and which Fireboxes are spokes.
  • Plan unique virtual IP addresses for the hub and each spoke. For SD-WAN and Firebox-generated traffic, use a /32 host IP address for each endpoint.
  • Identify the external networks and private networks to include in the tunnel.

    WireGuard does not perform network address translation (NAT). If the private networks behind the endpoints use the same IP address range, you cannot route traffic through the tunnel between those networks.

Add a WireGuard BOVPN between Cloud-Managed Fireboxes in the Same WatchGuard Cloud Account

You can add a WireGuard BOVPN on the BOVPN page for a specific Firebox, or you can add it on the VPNs page, which is a shared configuration page. For more information, go to Manage BOVPNs for Cloud-Managed Fireboxes.

Before you add a WireGuard BOVPN, make sure that none of the Fireboxes in the tunnel have undeployed changes. You cannot save BOVPN changes if any Firebox in the tunnel has other undeployed configuration changes.

To add a WireGuard BOVPN, from WatchGuard Cloud:

  1. To open the BOVPN page, use one of these methods:
    • To manage BOVPNs for all Fireboxes in the currently selected account, select Configure > VPNs.
    • To manage BOVPNs for a specific Firebox, on the Device Configuration page, click the Branch Office VPN widget.
      The BOVPN page shows currently configured BOVPNs.

Screenshot of the BOVPN page with no BOVPNs added

  1. Click Add BOVPN.
    The Add BOVPN page opens.

Screenshot of the Add BOVPN page, name and type settings

  1. In the Name text box, type a name for this BOVPN.
  2. From the VPN Connection Type drop-down list, select WireGuard to Cloud-Managed or Locally-Managed Firebox.
    The Define VPN Endpoints section shows lists of cloud-managed Fireboxes for the hub and the spokes. For WireGuard, Address Family is set to IPv4 and cannot be changed.
  3. In the Define VPN Endpoints section, select the hub and spokes:
    • In the Hub section, select the hub Firebox.
    • In the Spokes section, expand the Cloud-Managed Firebox section, and select one or more spoke Fireboxes.

    A Firebox selected for one endpoint is not available for the other endpoint. If you open the BOVPN page from a Device Configuration page, WatchGuard Cloud selects that Firebox as the hub. For a tunnel between two Fireboxes, select one hub and one spoke.

    If a WireGuard public key is not yet available in WatchGuard Cloud for a selected Firebox, you can still select the device. WatchGuard Cloud does not deploy the BOVPN configuration for that peer until the public key is available. After the Firebox connects and posts the public key, WatchGuard Cloud can automatically deploy the updated configuration.

Screenshot of the Define VPN Endpoints settings

  1. Click Next.
    If WatchGuard Cloud does not detect a public key on one or more of the Fireboxes, a dialog box opens. Review the listed Fireboxes, then click Continue. The VPN Gateways page opens.

Screenshot of the Public Key Not Detected dialog box

  1. For the hub and each spoke, select at least one external network that the endpoint uses to connect.

For cloud-managed Fireboxes in the same account, WatchGuard Cloud exchanges public keys automatically.

Screenshot of the VPN Gateways page before gateway settings are complete

  1. For each network you select, in the IP or Domain Name text box, type or select the IP address or domain name that resolves to the Firebox external network IP address.
  2. For the hub and each spoke, in the UDP Port text box, type the UDP listening port for WireGuard, or keep the default value of 442.

    If a Firebox is already a spoke in another WireGuard BOVPN, WatchGuard Cloud can prepopulate the UDP port. If you change the UDP port for a spoke that is used in more than one WireGuard BOVPN, the change applies to all WireGuard BOVPNs that include that Firebox.

  1. If you select more than one network for an endpoint, the Order determines which network is primary. To change the network order, click the move handle for a network and drag it higher or lower in the list.
  2. For the hub and each spoke, in the Virtual IP Address text box, type a unique virtual IP address.

    3. If a Firebox is already a spoke in another WireGuard BOVPN, WatchGuard Cloud can prepopulate the virtual IP address for that spoke. If you change the virtual IP address for a spoke that is used in more than one WireGuard BOVPN, the change applies to all WireGuard BOVPNs that include that Firebox.

Virtual IP addresses are required in some cases:

  • Before you can add this BOVPN to an SD-WAN action, you must specify virtual IP addresses with a /32 netmask.
  • If you configure a zero-route BOVPN, you must enter virtual IP addresses so that return traffic uses the VPN tunnel. If you add a zero route BOVPN network resource, and the remote VPN endpoint cannot route traffic from the cloud-managed Firebox to WatchGuard Cloud, you lose the ability to manage or monitor the Firebox.
  • For Firebox-generated traffic, virtual IP addresses are required so the response traffic uses the VPN tunnel. Examples of Firebox-generated traffic include DNS and DHCP traffic, Dimension, syslog, SNMP, NTP, authentication (Active Directory, LDAP, and RADIUS), and other connections established by the Firebox to resources through the tunnel.

Screenshot of the VPN Gateways settings with virtual IP addresses

  1. (Optional) In the Pre-Shared Key text box, type a WireGuard preshared key. Use the same preshared key on both Fireboxes. The preshared key must be a random 32-byte value. When encoded in Base64, the key must contain exactly 44 ASCII characters.

  2. Click Next.
    The Traffic settings page opens. The page shows the internal and guest networks configured on the hub and each spoke.

Screenshot of the Traffic settings page for a WireGuard BOVPN

  1. For the hub and each spoke, select internal or guest networks that can send and receive traffic through this tunnel.
  2. Specify a network resource other than internal or guest networks:
    1. Click Add Network Resource.
      The Add Network Resource dialog box opens.
      Screenshot of the Add Network Resource dialog box
    2. In the Network Resource text box, type the network IP address and netmask.Tip!
    3. In the Distance text box, type a value from 1 through 254. Routes with lower distance values have higher priority.
    4. Click Add.
      The network resource is added to the Traffic settings for the endpoint.

Screenshot of the Add BOVPN Traffic settings

  1. Click Save.
    WatchGuard Cloud automatically creates a deployment for the hub and each spoke. The deployment shows in the Deployment History for each device.

Edit or Delete a WireGuard BOVPN

You can edit or delete a WireGuard BOVPN on the BOVPN page. You cannot change the VPN Connection Type after you save the BOVPN.

Before you edit or remove a WireGuard BOVPN, make sure that none of the Fireboxes in the tunnel have undeployed changes. You cannot save BOVPN changes if any Firebox in the tunnel has other undeployed configuration changes.

To edit or delete a WireGuard BOVPN, from WatchGuard Cloud:

  1. Open the BOVPN page.
  2. To edit a BOVPN, click the BOVPN name, make your changes, then click Save.
  3. To delete a BOVPN, click the icon next to the BOVPN and select Delete.

For more information, go to Manage BOVPNs for Cloud-Managed Fireboxes.

Related Topics

Manage BOVPNs for Cloud-Managed Fireboxes

Manage Device Configuration Deployment

Configure a BOVPN Between Cloud-Managed Fireboxes

Configure a WireGuard BOVPN to a Locally-Managed Firebox

Configure a BOVPN to a Locally-Managed Firebox or Third-Party VPN Endpoint