WatchGuard VPN: Mobile VPN IKEv2, SSL and remote work

The short answer: on a WatchGuard Firebox firewall, the remote-worker VPN is called Mobile VPN, and it comes in four variants. WatchGuard recommends Mobile VPN with IKEv2 as the default choice, and Mobile VPN with SSL when the remote network blocks IPsec traffic. Both can run at the same time on the same appliance, which covers almost every situation. The IPSec and L2TP variants remain available for specific needs, but we no longer deploy them for new access. In every case, the connection must be protected by a second factor, ideally AuthPoint.

The general principles of business VPNs, site-to-site access and ZTNA are explained in business VPN for remote work: IPsec, SSL or ZTNA. Here we go into the detail of the Firebox, based on the Fireware documentation published by WatchGuard. We configure this access as a WatchGuard partner in Morocco.

The four Mobile VPN types

Fireware, the Firebox operating system, supports four VPN types for mobile users.

Criterion	IKEv2	SSL	IPSec	L2TP
Client	Native on Windows, macOS and iOS; strongSwan on Android	WatchGuard client on Windows and macOS; OpenVPN elsewhere	WatchGuard client for Windows (paid licence); native client on Android and macOS	Native or compatible L2TPv2 client
Authentication	Firebox local database, RADIUS, AuthPoint	Local database, RADIUS, Active Directory, LDAP, SecurID, AuthPoint, SAML	Every Firebox method with the WatchGuard client	Local database, RADIUS, AuthPoint
Ports	UDP 500 and 4500, ESP	TCP 443 by default, configurable	UDP 500 and 4500, ESP	UDP 1701, plus UDP 500, 4500 and ESP with IPsec
Cloud management	Yes	Yes	Not planned	Not planned
Our use	Default	Fallback and special cases	Legacy to migrate, per-group profiles	Avoid

Source: WatchGuard Fireware documentation, Mobile VPN type selection page. The number of concurrent tunnels depends on the Firebox model; it appears in the appliance’s feature key.

Why IKEv2 is the default choice

WatchGuard presents Mobile VPN with IKEv2 as the option offering the best security, the best performance and the easiest deployment. Three concrete reasons for an SMB:

• No software to deploy on Windows, macOS and iOS: the operating system’s VPN client is enough. The Firebox itself provides the configuration profiles to distribute to users.
• No client licence to buy, unlike WatchGuard’s IPSec client for Windows.
• A modern protocol, not affected by the IKEv1 aggressive mode weakness (CVE-2002-1623) that WatchGuard’s documentation flags for Mobile VPN with IPSec.

Two constraints to know. First, IKEv2 only accepts the Firebox local database, RADIUS or AuthPoint: for Active Directory accounts, WatchGuard recommends going through RADIUS, or through AuthPoint. Second, split tunnelling, which only sends traffic destined for the company through the VPN, has been available for IKEv2 since Fireware v12.9; earlier versions send all traffic through the tunnel. On an older fleet, upgrading Fireware is therefore part of the project.

When to add Mobile VPN with SSL

IKEv2 uses UDP ports 500 and 4500 and the ESP protocol. Some hotel, client or carrier networks block them. Mobile VPN with SSL then uses TCP 443 by default, the web port, which is almost always open.

In return, WatchGuard states that SSL is slower than the other VPN types and is not the best choice for latency-sensitive traffic such as voice over IP, or for large file transfers. Its security is also considered weaker, as it lacks multi-layer encryption. Our practice: IKEv2 for everyone, and an SSL profile enabled for staff who travel often, as a fallback.

SSL has one real advantage: it accepts the widest choice of authentication methods, including direct Active Directory and LDAP, and SAML with recent clients. That is useful when you want the VPN to rely on an existing identity provider.

IPSec and L2TP: the special cases

Mobile VPN with IPSec remains the only type that allows different configuration profiles for different user groups. That is its only real reason to exist today. WatchGuard’s client for Windows, provided by NCP, requires a paid licence. If you have an existing IPSec fleet, we plan its migration to IKEv2, unless per-group profiles are a proven need.

Mobile VPN with L2TP is only useful to carry protocols other than IP. Without IPsec, WatchGuard considers it less secure and does not recommend it; with IPsec, users must configure the client by hand.

WireGuard does not exist on the Firebox: WatchGuard’s documentation says so and points to its FireCloud Total Access service.

The second factor with AuthPoint

All four Mobile VPN types support AuthPoint, WatchGuard’s MFA. On a Firebox registered in WatchGuard Cloud, you declare the appliance as a resource in AuthPoint, then select AuthPoint as the authentication server in the VPN configuration. On a Firebox not connected to the cloud or an older Fireware version, you go through the AuthPoint Gateway over RADIUS, with a Windows NPS server for Active Directory accounts.

Two settings prevent failed connections:

• AuthPoint’s authentication timeout is fixed at 60 seconds and cannot be changed; the IKEv2 VPN timeout must not exceed it.
• With MS-CHAPv2, used for Active Directory accounts over IKEv2, the user approves by push notification: entering an OTP is not supported.

We detail AuthPoint configuration, policies and other uses in WatchGuard AuthPoint: MFA for SMBs, and the general approach in rolling out MFA in an SMB.

Preparing users’ devices

A VPN correctly configured on the Firebox can still fail because of a poorly prepared device. For IKEv2, the Firebox provides a download containing instructions, profiles for macOS and Android, and scripts for Windows. These profiles configure the connection automatically. For manual configuration, you must also install the Firebox certificate on the device: this is the most common omission when a user sets up their own personal computer.

For SSL, the WatchGuard client for Windows and macOS is downloaded from WatchGuard’s software site; on iOS and Android, the user installs an OpenVPN client from the app store. Compatible operating systems are listed in the Fireware release notes, to be checked before deploying a new client version.

Our method is simple: a one-page installation guide per operating system, a first test carried out with the user, from a 4G connection rather than the office network, and a check of access to each expected resource. Company-issued computers are prepared before handover, VPN profile and AuthPoint app included.

Local management or WatchGuard Cloud: what changes for the VPN

A Firebox managed in WatchGuard Cloud supports Mobile VPN with IKEv2 and with SSL, possibly at the same time. IPSec and L2TP are not planned there. The SSL clients for Windows and macOS can be downloaded from WatchGuard’s software site or from WatchGuard Cloud. If your remote access still relies on IPSec, moving to cloud management therefore requires a migration to IKEv2 or SSL: plan it before any change, as we explain in WatchGuard Cloud: managing your Fireboxes remotely.

The settings we apply

• IKEv2 enabled by default, SSL as a fallback for mobile profiles.
• AuthPoint mandatory on every connection, administrators included.
• Separate user groups, with rules that only open the resources each one needs: an accountant does not need to see the cameras.
• Split or full tunnel chosen according to the security policy, knowingly.
• Firebox security services applied to VPN traffic, like everything else.
• Fireware kept up to date, and Firebox administrative access never exposed to the internet.
• Connection logs kept and reviewed, alerts on repeated failures.

Sizing matters too: each tunnel consumes capacity, and a head office hosting many remote workers must be sized accordingly, as we explain in Firebox T125, T145, T185 or M295: which model.

The mistakes we fix

1. A VPN without a second factor, protected only by the user’s Windows password.
2. Mobile VPN with IPSec or L2TP kept out of habit, with paid clients or manual settings on every device.
3. The whole network open to VPN users, instead of only the servers they need.
4. A VPN timeout longer than AuthPoint’s, causing unexplained failures.
5. SSL used for telephony, with dropouts and echo.
6. VPN accounts never disabled after an employee leaves.

Checklist before deploying the VPN

• List of mobile users, their devices and the resources they need.
• VPN type: IKEv2 by default, SSL as a fallback.
• Fireware version checked, especially for IKEv2 split tunnelling.
• Authentication source: AuthPoint, RADIUS or Active Directory.
• Rules per group, with the minimum access required.
• Firebox capacity checked for the number of concurrent tunnels.
• Firebox management mode, local or cloud, compatible with the chosen VPN type.
• Joiner and leaver procedure for users.

How we do it

We start with a free initial audit of your remote access: who connects, from which devices, to which resources. We then configure Mobile VPN with IKEv2 and, where needed, SSL, connect AuthPoint, write rules per group, and prepare an installation guide for users. Cutover from an old VPN is done group by group, without disconnecting people at work. Once in service, the Firebox is monitored 24/7, and a critical incident is handled in under 15 minutes.

The VPN is part of our business cybersecurity in Morocco offering, and can be included in a managed IT services in Morocco contract that also covers remote worker support. To compare with Fortinet’s approach, read FortiGate or WatchGuard for an SMB. Request your free initial audit: we reply within 24 business hours.