Rambling through different tech topics and some step-by-step guides while figuring out Cloudflare security.
WG Firebox device supports IKEv2 Always On VPN — partly. With the built‑in Windows IKEv2 client, the Firebox firewall supports Microsoft Always On VPN user tunnels using MS‑CHAPv2 authentication (username and password). This tunnel starts automatically after Windows login. However, Firebox does not support certificate authentication, which is required for Microsoft Always On VPN device…
The following IKEv2 IPsec encryption values represent the best‑practice configuration I currently use and recommend: BOVPN Phase 1: BOVPN Phase 2: Why GCM? It is strongly recommended to migrate to GCM‑based algorithms. In most environments, 128‑bit GCM provides more than sufficient security. Compared to CBC, GCM128 offers stronger practical security than CBC256, and it is…
By default, a WatchGuard firewall uses its own self‑signed certificate for IKEv2. Important: WatchGuard does not support user certificates for IKEv2 login! The certificate is used only to encrypt the connection between the IKEv2 client and the firewall, so the username and password can be sent securely — similar to how HTTPS works on websites.…
If you cannot use Microsoft Windows NPS for RADIUS authentication with Firebox IKEv2 and on‑prem Active Directory users, you can use FreeRADIUS on Linux instead. In this guide, you install Ubuntu, join it to Active Directory, and install the latest FreeRADIUS. FreeRADIUS will authenticate AD users with MS‑CHAPv2. Environment example: If you need help installing…
This guide has three parts. It explains how to install and configure Firebox SSLVPN and IKEv2 with AuthPoint MFA with local users, on prem AD users and Entra ID users. Part 3 – Entra ID User Authentication In this guide, we only configure AuthPoint MFA and Microsoft Entra ID users for Firebox SSLVPN. IKEv2 VPN…
This guide has three parts. It explains how to install and configure Firebox SSLVPN and IKEv2 with AuthPoint MFA with local users, on prem AD users and Entra ID users. Part 2 – on prem Active Directory User Authentication In WatchGuard Cloud, go to Configure > Directories and Domain ServicesClick Add Authentication Domain. Choose WatchGuard…
This guide has three parts. It explains how to install and configure Firebox SSLVPN and IKEv2 with AuthPoint MFA with local users, on prem AD users and Entra ID users. Part 1 – Local User authentication In WatchGuard Cloud, go to Configure > Directories and Domain ServicesClick Add Authentication Domain. Choose WatchGuard Cloud Directory, then…
LDAP is the preferred method for authenticating SSLVPN users against an on‑premises Active Directory server. However, it is also possible to use a Windows NPS RADIUS server to authenticate AD users. The configuration is almost the same as when you set up IKEv2 Mobile VPN to authenticate on‑prem AD users. The only differences are: Install…
The problem with the WatchGuard SSLVPN client is that it always downloads a fresh SSLVPN configuration file from the Firebox every time it connects. So if you change the SSLVPN settings on the Firebox — for example, from Full Tunnel to Split Tunnel — the next time the SSLVPN client connects, it will automatically download…
The Firebox doesn’t control whether the IKEv2 VPN runs in Full or Split tunnel mode. Each Windows workstation decides that locally, and you can even have both modes configured on the same machine. By default, Windows IKEv2 connections use a Full tunnel, but you can switch to Split tunnel manually with PowerShell commands. On the…