Rambling through different tech topics and some step-by-step guides while figuring out Cloudflare security.
LDAP is the preferred method for authenticating SSLVPN users against an on‑premises Active Directory server. However, it is also possible to use a Windows NPS RADIUS server to authenticate AD users. The configuration is almost the same as when you set up IKEv2 Mobile VPN to authenticate on‑prem AD users. The only differences are: Install…
The problem with the WatchGuard SSLVPN client is that it always downloads a fresh SSLVPN configuration file from the Firebox every time it connects. So if you change the SSLVPN settings on the Firebox — for example, from Full Tunnel to Split Tunnel — the next time the SSLVPN client connects, it will automatically download…
The Firebox doesn’t control whether the IKEv2 VPN runs in Full or Split tunnel mode. Each Windows workstation decides that locally, and you can even have both modes configured on the same machine. By default, Windows IKEv2 connections use a Full tunnel, but you can switch to Split tunnel manually with PowerShell commands. On the…
When the Windows IKEv2 VPN client uses automatic logon, it sends credentials as DOMAIN\username. The Firebox matches the DOMAIN part with the RADIUS server name. If the names don’t match (for example, lowercase or different spelling), authentication fails. Windows VPN Client Configuration Firebox Configuration
IKEv2 with MS‑CHAPv2 cannot authenticate directly against LDAP, so a RADIUS server is required. The simplest option is Microsoft NPS, which is included with Windows Server. (FreeRADIUS works too, but this guide focuses on NPS.) Install NPS on a Windows Server You can install NPS on any Windows Server, including a Domain Controller. Server ManagerManage…
SSLVPN (OpenVPN) – Easiest & works on most distros. WatchGuard SSLVPN is just OpenVPN under the hood, so Linux support is excellent. Step 1 — Download the SSLVPN .ovpn file from the Firebox Step 2 — Import the client.ovpn file into NetworkManager All other settings come from the .ovpn file and normally require no changes.…
This article explains how to install the WatchGuard Agent and enable the ThreatSync+ NDR Collector Agent on an Ubuntu Linux server. The steps apply to Ubuntu Server 24.04 LTS. Please check also:WatchGuard’s guide how to install NDR collector to a ubuntu Linux server.Ubuntu server 24.04 LTS download link This guide walks you through the full…
Modern firewalls can inspect encrypted HTTPS traffic to provide deeper security, better visibility, and more accurate web filtering. WatchGuard Firebox offers two ways to use the HTTPS Proxy: This guide explains both modes, how they work, when to use them, and how to deploy certificates for HTTPS inspection. Understanding HTTP Proxy vs. HTTPS Proxy HTTP…
You can still update your Firebox device even if the license has expired. Just follow these simple steps. Get your computer ready Open your Firebox settings Connect your computer to the Firebox Start the setup wizard Install the firmware The Firebox will reboot twice: Restore your configuration 8. Finish up Your Firebox is now running…