Rambling through different tech topics and some step-by-step guides while figuring out Cloudflare security.
WG Firebox device supports IKEv2 Always On VPN — partly. With the built‑in Windows IKEv2 client, the Firebox firewall supports Microsoft Always On VPN user tunnels using MS‑CHAPv2 authentication (username and password). This tunnel starts automatically after Windows login. However, Firebox does not support certificate authentication, which is required for Microsoft Always On VPN device…
By default, a WatchGuard firewall uses its own self‑signed certificate for IKEv2. Important: WatchGuard does not support user certificates for IKEv2 login! The certificate is used only to encrypt the connection between the IKEv2 client and the firewall, so the username and password can be sent securely — similar to how HTTPS works on websites.…
If you cannot use Microsoft Windows NPS for RADIUS authentication with Firebox IKEv2 and on‑prem Active Directory users, you can use FreeRADIUS on Linux instead. In this guide, you install Ubuntu, join it to Active Directory, and install the latest FreeRADIUS. FreeRADIUS will authenticate AD users with MS‑CHAPv2. Environment example: If you need help installing…
The Logon app adds MFA when users sign in to a computer or server. It also protects RDP and RD Gateway. To use MFA, you must create a Logon app resource in AuthPoint and install the Logon app on every computer or server you want to protect. The Logon app also works for RDP/RDS hosts.…
This guide has three parts. It explains how to install and configure Firebox SSLVPN and IKEv2 with AuthPoint MFA with local users, on prem AD users and Entra ID users. Part 3 – Entra ID User Authentication In this guide, we only configure AuthPoint MFA and Microsoft Entra ID users for Firebox SSLVPN. IKEv2 VPN…
This guide has three parts. It explains how to install and configure Firebox SSLVPN and IKEv2 with AuthPoint MFA with local users, on prem AD users and Entra ID users. Part 2 – on prem Active Directory User Authentication In WatchGuard Cloud, go to Configure > Directories and Domain ServicesClick Add Authentication Domain. Choose WatchGuard…
This guide has three parts. It explains how to install and configure Firebox SSLVPN and IKEv2 with AuthPoint MFA with local users, on prem AD users and Entra ID users. Part 1 – Local User authentication In WatchGuard Cloud, go to Configure > Directories and Domain ServicesClick Add Authentication Domain. Choose WatchGuard Cloud Directory, then…
LDAP is the preferred method for authenticating SSLVPN users against an on‑premises Active Directory server. However, it is also possible to use a Windows NPS RADIUS server to authenticate AD users. The configuration is almost the same as when you set up IKEv2 Mobile VPN to authenticate on‑prem AD users. The only differences are: Install…
When the Windows IKEv2 VPN client uses automatic logon, it sends credentials as DOMAIN\username. The Firebox matches the DOMAIN part with the RADIUS server name. If the names don’t match (for example, lowercase or different spelling), authentication fails. Windows VPN Client Configuration Firebox Configuration
IKEv2 with MS‑CHAPv2 cannot authenticate directly against LDAP, so a RADIUS server is required. The simplest option is Microsoft NPS, which is included with Windows Server. (FreeRADIUS works too, but this guide focuses on NPS.) Install NPS on a Windows Server You can install NPS on any Windows Server, including a Domain Controller. Server ManagerManage…