About WireGuard BOVPN in WatchGuard Cloud

This feature is available only to participants in the WatchGuard Cloud Beta program.

Overview

WireGuard is a lightweight VPN protocol that uses UDP and public key authentication. A WireGuard branch office virtual private network (BOVPN) uses a peer-based configuration. Each endpoint defines the remote peer address, UDP listening port, and the networks allowed through the tunnel. Unlike an IPSec BOVPN, WireGuard does not use Phase 1 or Phase 2 negotiations and does not require proposal selection.

You can configure a WireGuard BOVPN on Fireboxes that run Fireware v2026.4 or higher. In WatchGuard Cloud, WireGuard BOVPNs use a hub-and-spoke topology. You select one Firebox as the hub and one or more Fireboxes as spokes. You can configure a WireGuard BOVPN between cloud-managed Fireboxes in the same WatchGuard Cloud account or you can configure a WireGuard BOVPN with a mixed topology of cloud-managed and locally-managed Fireboxes.

WireGuard BOVPN supports Firebox-to-Firebox tunnels only. Third-party WireGuard endpoints are not supported. FireboxV endpoints are not supported.

When you configure a WireGuard BOVPN, you specify:

Endpoints — One hub Firebox and one or more spoke Fireboxes.
VPN Gateways — External networks, IP addresses or domain names, and UDP ports the endpoints use to connect.
Virtual IP Address — IP address assigned to the WireGuard tunnel interface on each endpoint (required for routing, Software-Defined WAN (SD-WAN), zero-route tunnels, and Firebox-generated traffic).
Network Resources — Private networks that can send and receive traffic through the tunnel.

Hub-and-Spoke Topology

Unlike a route-based IPSec BOVPN between two cloud-managed Fireboxes, a WireGuard BOVPN in WatchGuard Cloud is always a hub-and-spoke configuration:

The Hub section identifies the hub Firebox.
The Spokes section identifies one or more spoke Fireboxes.

A configuration with one hub and one spoke is still a hub-and-spoke topology. WatchGuard Cloud does not offer a separate site-to-site WireGuard connection type.

When you plan a WireGuard hub-and-spoke topology, keep these rules in mind:

A Firebox can be the hub in only one WireGuard BOVPN configuration.
A Firebox can be a spoke in more than one WireGuard BOVPN configuration.
A Firebox can be the hub in one WireGuard BOVPN and a spoke in a different WireGuard BOVPN.
Each Firebox has one WireGuard BOVPN virtual interface. The WireGuard virtual interface settings for a Firebox (external networks, IP address or domain name, UDP port, and virtual IP address) must be the same in every WireGuard BOVPN that includes that Firebox.

If a Firebox is already a spoke in another WireGuard BOVPN, WatchGuard Cloud can prepopulate the UDP port and virtual IP address for that spoke. If you change the UDP port or virtual IP address for a spoke that is used in more than one WireGuard BOVPN, the change applies to all WireGuard BOVPNs that include that Firebox.

BOVPNs and Routing

In the BOVPN configuration, you specify the network resources that are accessible through the BOVPN tunnel. The resources you select for one endpoint become static routes on the peer endpoints that use the BOVPN tunnel interface. On the hub, select the private networks behind each spoke that must communicate with the hub. On each spoke, select the private networks behind the hub that must communicate with that spoke.

If spoke-to-spoke traffic must pass through the hub, add the private networks behind the other spokes as network resources on each spoke, and make sure that the hub traffic settings include the private networks for those spokes.

Virtual IP Addresses

A virtual IP address is the IP address assigned to the WireGuard BOVPN tunnel interface. The Firebox uses this virtual address as the local tunnel interface address for routing through the VPN. A virtual IP address is required for the WireGuard BOVPN tunnel interface.

Virtual IP configurations are required for these scenarios:

SD-WAN

Before you can add a BOVPN to an SD-WAN action, you must configure the BOVPN with /32 virtual IP addresses for the hub and each spoke. When you configure /32 host IP addresses as the virtual IP addresses of the endpoints, WatchGuard Cloud implicitly enables BOVPN link monitoring.

A BOVPN that does not have valid /32 virtual IP addresses for the endpoints is not available to select in an SD-WAN action.

For more information about SD-WAN, go to Configure SD-WAN.

Zero Routing

If you add a zero-route BOVPN network resource (0.0.0.0/0), the Firebox creates a default route that sends all traffic, including traffic to WatchGuard Cloud, through the VPN tunnel. For a cloud-managed Firebox, you must enter virtual IP addresses in the BOVPN configuration so that return traffic uses the VPN tunnel.

Caution: If you add a zero-route BOVPN network resource, and the remote VPN endpoint cannot route traffic from the cloud-managed Firebox to WatchGuard Cloud, you lose the ability to manage or monitor the Firebox.

Firebox-Generated Traffic

The Firebox itself generates traffic through the tunnel. Firebox-generated traffic is also known as self-generated traffic or self-originated traffic.

You must enter a /32 virtual IP address for each endpoint so that replies to Firebox-generated traffic use the VPN tunnel. Use an IP address that is unique on the Firebox. You do not have to use an IP address from one of the tunnel routes. Examples of Firebox-generated traffic include DNS, DHCP, WatchGuard Dimension, syslog, SNMP, NTP, authentication (Active Directory, Lightweight Directory Access Protocol (LDAP), and RADIUS), and other connections from the Firebox to resources through the tunnel.

We recommend that you always configure a unique virtual IP address for the hub and each spoke in a WireGuard BOVPN.

Public Key Exchange

WireGuard authenticates peers with public keys.

For cloud-managed Fireboxes in the same account:

WatchGuard Cloud manages WireGuard public keys automatically.
On the VPN Gateways page, the Public Key for each endpoint appears as a read-only value when it is available.

In a mixed topology with locally-managed Fireboxes:

On the VPN Gateways page, the Public Key for the cloud-managed Firebox appears as a read-only value when the Firebox connects and posts the key. You copy this key when you configure the peer on the locally-managed Firebox.
On the locally-managed Firebox, you copy the WireGuard public key from the Fireware Web UI or Policy Manager. You type that public key in WatchGuard Cloud when you add the locally-managed spoke.
(Optional) You can configure the same pre-shared key on the cloud-managed endpoint and on the locally-managed peer.

If a WireGuard public key is not yet available in WatchGuard Cloud for the cloud-managed Firebox, you can still select the device. WatchGuard Cloud does not complete peer configuration for that endpoint until the public key is available.

BOVPNs and Automatic Deployment

When you add, edit, or remove a BOVPN, WatchGuard Cloud automatically creates a new deployment for the Fireboxes in the tunnel to download. For each Firebox, the automatic deployment contains updated BOVPN settings. To make sure that the automatic deployment contains only BOVPN configuration changes, you cannot save BOVPN changes if any Firebox in the tunnel has other undeployed configuration changes. Before you add, edit, or remove a WireGuard BOVPN, make sure that none of the Fireboxes in the tunnel have undeployed changes.

If a WireGuard public key is not yet available in WatchGuard Cloud for a selected Firebox, you can still select the device. WatchGuard Cloud does not deploy the BOVPN configuration for that peer until the public key is available. After the Firebox connects and posts the public key, WatchGuard Cloud can automatically deploy the updated configuration.