Rambling through different tech topics and some step-by-step guides while figuring out Cloudflare security.
WG Firebox device supports IKEv2 Always On VPN — partly. With the built‑in Windows IKEv2 client, the Firebox firewall supports Microsoft Always On VPN user tunnels using MS‑CHAPv2 authentication (username and password). This tunnel starts automatically after Windows login. However, Firebox does not support certificate authentication, which is required for Microsoft Always On VPN device…
If you cannot use Microsoft Windows NPS for RADIUS authentication with Firebox IKEv2 and on‑prem Active Directory users, you can use FreeRADIUS on Linux instead. In this guide, you install Ubuntu, join it to Active Directory, and install the latest FreeRADIUS. FreeRADIUS will authenticate AD users with MS‑CHAPv2. Environment example: If you need help installing…
LDAP is the preferred method for authenticating SSLVPN users against an on‑premises Active Directory server. However, it is also possible to use a Windows NPS RADIUS server to authenticate AD users. The configuration is almost the same as when you set up IKEv2 Mobile VPN to authenticate on‑prem AD users. The only differences are: Install…
When the Windows IKEv2 VPN client uses automatic logon, it sends credentials as DOMAIN\username. The Firebox matches the DOMAIN part with the RADIUS server name. If the names don’t match (for example, lowercase or different spelling), authentication fails. Windows VPN Client Configuration Firebox Configuration
IKEv2 with MS‑CHAPv2 cannot authenticate directly against LDAP, so a RADIUS server is required. The simplest option is Microsoft NPS, which is included with Windows Server. (FreeRADIUS works too, but this guide focuses on NPS.) Install NPS on a Windows Server You can install NPS on any Windows Server, including a Domain Controller. Server ManagerManage…