Rambling through different tech topics and some step-by-step guides while figuring out Cloudflare security.
WG Firebox device supports IKEv2 Always On VPN — partly. With the built‑in Windows IKEv2 client, the Firebox firewall supports Microsoft Always On VPN user tunnels using MS‑CHAPv2 authentication (username and password). This tunnel starts automatically after Windows login. However, Firebox does not support certificate authentication, which is required for Microsoft Always On VPN device…
The following IKEv2 IPsec encryption values represent the best‑practice configuration I currently use and recommend: BOVPN Phase 1: BOVPN Phase 2: Why GCM? It is strongly recommended to migrate to GCM‑based algorithms. In most environments, 128‑bit GCM provides more than sufficient security. Compared to CBC, GCM128 offers stronger practical security than CBC256, and it is…
By default, a WatchGuard firewall uses its own self‑signed certificate for IKEv2. Important: WatchGuard does not support user certificates for IKEv2 login! The certificate is used only to encrypt the connection between the IKEv2 client and the firewall, so the username and password can be sent securely — similar to how HTTPS works on websites.…
If you cannot use Microsoft Windows NPS for RADIUS authentication with Firebox IKEv2 and on‑prem Active Directory users, you can use FreeRADIUS on Linux instead. In this guide, you install Ubuntu, join it to Active Directory, and install the latest FreeRADIUS. FreeRADIUS will authenticate AD users with MS‑CHAPv2. Environment example: If you need help installing…
This guide has three parts. It explains how to install and configure Firebox SSLVPN and IKEv2 with AuthPoint MFA with local users, on prem AD users and Entra ID users. Part 2 – on prem Active Directory User Authentication In WatchGuard Cloud, go to Configure > Directories and Domain ServicesClick Add Authentication Domain. Choose WatchGuard…
This guide has three parts. It explains how to install and configure Firebox SSLVPN and IKEv2 with AuthPoint MFA with local users, on prem AD users and Entra ID users. Part 1 – Local User authentication In WatchGuard Cloud, go to Configure > Directories and Domain ServicesClick Add Authentication Domain. Choose WatchGuard Cloud Directory, then…
The Firebox doesn’t control whether the IKEv2 VPN runs in Full or Split tunnel mode. Each Windows workstation decides that locally, and you can even have both modes configured on the same machine. By default, Windows IKEv2 connections use a Full tunnel, but you can switch to Split tunnel manually with PowerShell commands. On the…
When the Windows IKEv2 VPN client uses automatic logon, it sends credentials as DOMAIN\username. The Firebox matches the DOMAIN part with the RADIUS server name. If the names don’t match (for example, lowercase or different spelling), authentication fails. Windows VPN Client Configuration Firebox Configuration
IKEv2 with MS‑CHAPv2 cannot authenticate directly against LDAP, so a RADIUS server is required. The simplest option is Microsoft NPS, which is included with Windows Server. (FreeRADIUS works too, but this guide focuses on NPS.) Install NPS on a Windows Server You can install NPS on any Windows Server, including a Domain Controller. Server ManagerManage…
SSLVPN (OpenVPN) – Easiest & works on most distros. WatchGuard SSLVPN is just OpenVPN under the hood, so Linux support is excellent. Step 1 — Download the SSLVPN .ovpn file from the Firebox Step 2 — Import the client.ovpn file into NetworkManager All other settings come from the .ovpn file and normally require no changes.…