{"id":974,"date":"2026-07-17T12:40:09","date_gmt":"2026-07-17T09:40:09","guid":{"rendered":"https:\/\/mangen.kitabara.org\/?p=974"},"modified":"2026-07-17T12:45:13","modified_gmt":"2026-07-17T09:45:13","slug":"watchguard-firebox-ikev2-always-on-vpn","status":"publish","type":"post","link":"https:\/\/mangen.kitabara.org\/index.php\/watchguard-firebox-ikev2-always-on-vpn\/","title":{"rendered":"WatchGuard Firebox IKEv2 Always On VPN."},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">WG Firebox device supports IKEv2 Always On VPN \u2014 <strong>partly<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">With the built\u2011in Windows IKEv2 client, the Firebox firewall supports Microsoft Always On VPN <strong>user tunnels<\/strong> using <strong>MS\u2011CHAPv2 authentication<\/strong> (username and password). This tunnel starts automatically after Windows login.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However, Firebox <strong>does not support certificate authentication<\/strong>, which is required for Microsoft Always On VPN <strong>device tunnels<\/strong>. See: <a href=\"https:\/\/directaccess.richardhicks.com\/2020\/03\/30\/always-on-vpn-device-tunnel-operation-and-best-practices\/\" target=\"_blank\" rel=\"noopener\">Always On VPN Device Tunnel Operation and Best Practices<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">WG also sells the <strong><a href=\"https:\/\/www.watchguard.com\/help\/docs\/help-center\/en-US\/Content\/en-US\/Fireware\/mvpn\/client\/mvpn-ipsec_client_about_c.html\" data-type=\"link\" data-id=\"https:\/\/www.watchguard.com\/help\/docs\/help-center\/en-US\/Content\/en-US\/Fireware\/mvpn\/client\/mvpn-ipsec_client_about_c.html\" target=\"_blank\" rel=\"noopener\">NCP IPSec Mobile VPN Client<\/a><\/strong> software, which supports IKEv2 and includes <strong>Always On \/ Pre\u2011logon<\/strong> options. But it still uses <strong>user tunnels<\/strong> with MS\u2011CHAPv2 (username and password).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Always On VPN (AOVPN) setup is mostly <strong>Windows configuration<\/strong>, not Firebox configuration. If you already have a working Firebox IKEv2 VPN setup, you can configure Windows computers to use IKEv2 AOVPN user tunnels with <strong>PowerShell<\/strong> or <strong>Intune<\/strong>. This guide shows how to do it with PowerShell.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Lab example Environment<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Active Directory domain: kita.local<\/li>\n\n\n\n<li>Local network: 10.0.1.0\/24<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Configure Firebox IKEv2 with Windows NPS and AD<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Make sure your <a href=\"https:\/\/mangen.kitabara.org\/index.php\/configure-microsoft-nps-to-authenticate-on-prem-ad-users-for-firebox-ikev2-mobile-vpn\/\" data-type=\"link\" data-id=\"https:\/\/mangen.kitabara.org\/index.php\/configure-microsoft-nps-to-authenticate-on-prem-ad-users-for-firebox-ikev2-mobile-vpn\/\">Firebox IKEv2 VPN works with a Windows NPS RADIUS server and on\u2011prem Active Directory<\/a> authentication.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I also recommend disabling <a href=\"https:\/\/www.watchguard.com\/help\/docs\/help-center\/en-US\/Content\/en-US\/Fireware\/mvpn\/ikev2\/mvpn_ikev2_mobike.html\" data-type=\"link\" data-id=\"https:\/\/www.watchguard.com\/help\/docs\/help-center\/en-US\/Content\/en-US\/Fireware\/mvpn\/ikev2\/mvpn_ikev2_mobike.html\" target=\"_blank\" rel=\"noopener\">MOBIKE on the Firebox<\/a>. I\u2019ve noticed that if MOBIKE is enabled, the Windows IKEv2 connection becomes too \u201csticky.\u201d This means that when you switch from an external internet connection back to the internal network, the IKEv2 tunnel stays connected and does not disconnect like it should.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Use an SSH client (Putty) to connect to the Firebox IP on port 4118, and log in with admin credentials.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a67402bc4f9e&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a67402bc4f9e\" class=\"aligncenter size-full wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"479\" height=\"205\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/PuttySSHtoFirebox.png\" alt=\"\" class=\"wp-image-998\" srcset=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/PuttySSHtoFirebox.png 479w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/PuttySSHtoFirebox-300x128.png 300w\" sizes=\"auto, (max-width: 479px) 100vw, 479px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\"><strong>Disable Mobike through the CLI:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>diag vpn \"\/ike\/param\/set mobike_support=0\"\ndiag vpn \"\/ike\/restart\"\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Check the MOBIKE status through the CLI.<\/strong> <\/p>\n\n\n\n<pre class=\"wp-block-code\"><code><code>diag vpn \"\/ike\/param\/dump\"<\/code><\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"> If the output shows <strong>mobike_support=0<\/strong>, then MOBIKE is configured as <strong>disabled<\/strong>.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a67402bc552d&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a67402bc552d\" class=\"aligncenter size-full wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"647\" height=\"306\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Disable_mobike_Firebox.png\" alt=\"\" class=\"wp-image-999\" srcset=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Disable_mobike_Firebox.png 647w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Disable_mobike_Firebox-300x142.png 300w\" sizes=\"auto, (max-width: 647px) 100vw, 647px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\"><strong>Enable Mobike through the CLI:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>diag vpn \"\/ike\/param\/set mobike_support=1\"\ndiag vpn \"\/ike\/restart\"\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">On a Windows 11 test machine that already connects successfully to Firebox via IKEv2 and NPS:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Install PowerShell v7<\/strong> <a href=\"https:\/\/learn.microsoft.com\/en-us\/powershell\/scripting\/install\/install-powershell-on-windows?view=powershell-7.6\" target=\"_blank\" rel=\"noopener\">Microsoft guide<\/a><\/p>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li><\/li>\n<\/ol>\n\n\n<div class=\"wp-block-image\">\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a67402bc5b03&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a67402bc5b03\" class=\"aligncenter size-full wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"853\" height=\"309\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/PowerShellv7_install-2.png\" alt=\"\" class=\"wp-image-1000\" srcset=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/PowerShellv7_install-2.png 853w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/PowerShellv7_install-2-300x109.png 300w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/PowerShellv7_install-2-768x278.png 768w\" sizes=\"auto, (max-width: 853px) 100vw, 853px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\"><strong>Open PowerShell (Admin)<\/strong> and install AOVPNTools from <a href=\"https:\/\/github.com\/richardhicks\" data-type=\"link\" data-id=\"https:\/\/github.com\/richardhicks\" target=\"_blank\" rel=\"noopener\">Richard Hicks Github<\/a><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Install-Module -Name AOVPNTools -Scope CurrentUser<\/code><\/pre>\n\n\n<div class=\"wp-block-image\">\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a67402bc5fa6&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a67402bc5fa6\" class=\"aligncenter size-large wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"221\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/AOVPNTools_install-5-1024x221.png\" alt=\"\" class=\"wp-image-1001\" srcset=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/AOVPNTools_install-5-1024x221.png 1024w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/AOVPNTools_install-5-300x65.png 300w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/AOVPNTools_install-5-768x166.png 768w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/AOVPNTools_install-5-980x212.png 980w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/AOVPNTools_install-5.png 1110w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">Create a new file<strong> <\/strong>called <strong>ProfileXML_User.xml<\/strong> and copy the following template into it using Notepad.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;VPNProfile&gt;\n   &lt;AlwaysOn&gt;true&lt;\/AlwaysOn&gt;\n   &lt;RememberCredentials&gt;true&lt;\/RememberCredentials&gt;\n   &lt;DnsSuffix&gt;kita.local&lt;\/DnsSuffix&gt;\n   &lt;TrustedNetworkDetection&gt;kita.local&lt;\/TrustedNetworkDetection&gt;\n   &lt;NativeProfile&gt;\n      &lt;Servers&gt;vpn.uchilab.org&lt;\/Servers&gt;\n      &lt;RoutingPolicyType&gt;SplitTunnel&lt;\/RoutingPolicyType&gt;\n      &lt;NativeProtocolType&gt;IKEv2&lt;\/NativeProtocolType&gt;\n      &lt;DisableClassBasedDefaultRoute&gt;true&lt;\/DisableClassBasedDefaultRoute&gt;\n      &lt;CryptographySuite&gt;\n         &lt;AuthenticationTransformConstants&gt;GCMAES128&lt;\/AuthenticationTransformConstants&gt;\n         &lt;CipherTransformConstants&gt;GCMAES128&lt;\/CipherTransformConstants&gt;\n         &lt;PfsGroup&gt;PFS2048&lt;\/PfsGroup&gt;\n         &lt;DHGroup&gt;Group14&lt;\/DHGroup&gt;\n         &lt;IntegrityCheckMethod&gt;SHA256&lt;\/IntegrityCheckMethod&gt;\n         &lt;EncryptionMethod&gt;AES256&lt;\/EncryptionMethod&gt;\n      &lt;\/CryptographySuite&gt;\n      &lt;Authentication&gt;\n         &lt;UserMethod&gt;EAP&lt;\/UserMethod&gt;\n         &lt;Eap&gt;\n            &lt;Configuration&gt;\n&lt;EapHostConfig xmlns=http:\/\/www.microsoft.com\/provisioning\/EapHostConfig&gt;\n   &lt;EapMethod&gt;\n      &lt;Type xmlns=http:\/\/www.microsoft.com\/provisioning\/EapCommon&gt;26&lt;\/Type&gt;\n      &lt;VendorId xmlns=http:\/\/www.microsoft.com\/provisioning\/EapCommon&gt;0&lt;\/VendorId&gt;\n      &lt;VendorType xmlns=http:\/\/www.microsoft.com\/provisioning\/EapCommon&gt;0&lt;\/VendorType&gt;\n      &lt;AuthorId xmlns=http:\/\/www.microsoft.com\/provisioning\/EapCommon&gt;0&lt;\/AuthorId&gt;\n   &lt;\/EapMethod&gt;\n   &lt;Config xmlns=http:\/\/www.microsoft.com\/provisioning\/EapHostConfig&gt;\n      &lt;Eap xmlns=http:\/\/www.microsoft.com\/provisioning\/BaseEapConnectionPropertiesV1&gt;\n         &lt;Type&gt;26&lt;\/Type&gt;\n         &lt;EapType xmlns=http:\/\/www.microsoft.com\/provisioning\/MsChapV2ConnectionPropertiesV1&gt;\n            &lt;UseWinLogonCredentials&gt;true&lt;\/UseWinLogonCredentials&gt;\n         &lt;\/EapType&gt;\n      &lt;\/Eap&gt;\n   &lt;\/Config&gt;\n&lt;\/EapHostConfig&gt;               \n            &lt;\/Configuration&gt;\n         &lt;\/Eap&gt;\n      &lt;\/Authentication&gt;\n   &lt;\/NativeProfile&gt;\n   &lt;Route&gt;\n      &lt;Address&gt;10.0.1.0&lt;\/Address&gt;\n      &lt;PrefixSize&gt;24&lt;\/PrefixSize&gt;\n   &lt;\/Route&gt;\n&lt;RegisterDNS&gt;true&lt;\/RegisterDNS&gt;\n&lt;DisableAdvancedOptionsEditButton&gt;true&lt;\/DisableAdvancedOptionsEditButton&gt; \n&lt;DisableDisconnectButton&gt;true&lt;\/DisableDisconnectButton&gt;\t\t\n&lt;DisableIKEv2Fragmentation&gt;false&lt;\/DisableIKEv2Fragmentation&gt;\t\n&lt;IPv4InterfaceMetric&gt;3&lt;\/IPv4InterfaceMetric&gt;\t\t\t\n&lt;NetworkOutageTime&gt;0&lt;\/NetworkOutageTime&gt;\t\t\t\n&lt;UseRasCredentials&gt;false&lt;\/UseRasCredentials&gt;\t\t\t\n&lt;PrivateNetwork&gt;true&lt;\/PrivateNetwork&gt;\t\t\t\t\n&lt;\/VPNProfile&gt;\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">You need to edit the following settings with your data:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>&lt;DnsSuffix&gt;<strong>kita.local<\/strong>&lt;\/DnsSuffix&gt;<\/li>\n\n\n\n<li>&lt;TrustedNetworkDetection&gt;<strong>kita.local<\/strong>&lt;\/TrustedNetworkDetection&gt;<\/li>\n\n\n\n<li>&lt;Servers&gt;<strong>vpn.uchilab.org<\/strong>&lt;\/Servers&gt;<\/li>\n\n\n\n<li>&lt;Address&gt;<strong>10.0.1.0&lt;\/<\/strong>Address&gt;<\/li>\n\n\n\n<li>&lt;PrefixSize&gt;<strong>24&lt;\/<\/strong>PrefixSize&gt;<br><br><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">If you have configured IKEv2 to use the <strong><a href=\"https:\/\/mangen.kitabara.org\/index.php\/how-to-configure-windows-ikev2-vpn-client-automatically-use-your-windows-logon-credentials-with-a-watchguard-firebox-and-radius\/\" data-type=\"link\" data-id=\"https:\/\/mangen.kitabara.org\/index.php\/how-to-configure-windows-ikev2-vpn-client-automatically-use-your-windows-logon-credentials-with-a-watchguard-firebox-and-radius\/\">Automatically use my Windows log-on name and password<\/a>&nbsp;<\/strong>setting:<br>&lt;UseWinLogonCredentials&gt;<strong>true<\/strong>&lt;\/UseWinLogonCredentials&gt;<br>otherwise:<br>&lt;UseWinLogonCredentials&gt;<strong>false<\/strong>&lt;\/UseWinLogonCredentials&gt;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Open the <a href=\"https:\/\/mangen.kitabara.org\/index.php\/recommended-ikev2-ipsec-encryption-settings-best-practice\/\" data-type=\"link\" data-id=\"https:\/\/mangen.kitabara.org\/index.php\/recommended-ikev2-ipsec-encryption-settings-best-practice\/\">Firebox AddVPN.ps1 file with Notepad and check its CryptographySuite settings<\/a> and copy the settings to the ProfileXML_User.xml file<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>&lt;AuthenticationTransformConstants&gt; <strong>GCMAES128<\/strong>&lt;\/AuthenticationTransformConstants&gt;<\/li>\n\n\n\n<li>&lt;CipherTransformConstants&gt; <strong>GCMAES128<\/strong>&lt;\/CipherTransformConstants&gt;<\/li>\n\n\n\n<li>&lt;PfsGroup&gt; <strong>PFS2048<\/strong>&lt;\/PfsGroup&gt;<\/li>\n\n\n\n<li>&lt;DHGroup&gt;<strong>Group14<\/strong>&lt;\/DHGroup&gt;<\/li>\n\n\n\n<li>&lt;IntegrityCheckMethod&gt;<strong>SHA256<\/strong>&lt;\/IntegrityCheckMethod&gt;<\/li>\n\n\n\n<li>&lt;EncryptionMethod&gt;<strong>AES256<\/strong>&lt;\/EncryptionMethod&gt;<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">There are many different settings you can configure. For the full explanation of all options, check the documentation and example files from these sources. These resources explain the remaining settings in more detail.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong><a href=\"https:\/\/directaccess.richardhicks.com\/?s=profileXML\" data-type=\"link\" data-id=\"https:\/\/directaccess.richardhicks.com\/?s=profileXML\" target=\"_blank\" rel=\"noopener\">Richard Hicks\u2019 website<\/a><\/strong> and his <a href=\"https:\/\/github.com\/richardhicks\/aovpn\/blob\/master\/ProfileXML_User.xml\" data-type=\"link\" data-id=\"https:\/\/github.com\/richardhicks\/aovpn\/blob\/master\/ProfileXML_User.xml\" target=\"_blank\" rel=\"noopener\"><em>ProfileXML_User.xml<\/em> <\/a>example<\/li>\n\n\n\n<li><strong><a href=\"https:\/\/www.tbone.se\/2023\/11\/28\/always-on-vpn-in-add-remove-programs-with-powershell-update-1-7\/\" data-type=\"link\" data-id=\"https:\/\/www.tbone.se\/2023\/11\/28\/always-on-vpn-in-add-remove-programs-with-powershell-update-1-7\/\" target=\"_blank\" rel=\"noopener\">MR T-Bone\u2019s Always On VPN guide<\/a><\/strong> and his <em><a href=\"https:\/\/github.com\/Mr-Tbone\/AoV\/blob\/main\/AoV-User-Tunnel.ps1\" data-type=\"link\" data-id=\"https:\/\/github.com\/Mr-Tbone\/AoV\/blob\/main\/AoV-User-Tunnel.ps1\" target=\"_blank\" rel=\"noopener\">AoV-User-Tunnel.ps1<\/a><\/em> example<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">In the PowerShell v7 Terminal run the following command to add the Always on VPN profile to Windows.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>New-AovpnConnection ProfileXML_User.xml \u2013 ProfileName \u201cAlways on VPN\u201d<\/code><\/pre>\n\n\n<div class=\"wp-block-image\">\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a67402bc67dd&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a67402bc67dd\" class=\"aligncenter size-full wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"914\" height=\"662\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/New-AovpnConnection-1.png\" alt=\"\" class=\"wp-image-1003\" srcset=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/New-AovpnConnection-1.png 914w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/New-AovpnConnection-1-300x217.png 300w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/New-AovpnConnection-1-768x556.png 768w\" sizes=\"auto, (max-width: 914px) 100vw, 914px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">You should now have a IKEv2 Always on VPN on your Windows. Click connect and sign-in with the Username and Password. Test moving the Windows machine between your local network and an internet connection. The IKEv2 VPN should automatically disconnect when in your local network and automatically connect when outside the office with an internet connection.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a67402bc6c91&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a67402bc6c91\" class=\"aligncenter size-full wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"350\" height=\"187\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/New-AovpnConnection-2.png\" alt=\"\" class=\"wp-image-1005\" srcset=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/New-AovpnConnection-2.png 350w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/New-AovpnConnection-2-300x160.png 300w\" sizes=\"auto, (max-width: 350px) 100vw, 350px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">If the AOVPN profile doesn\u2019t work, you can remove the Always on VPN profile with:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Remove-AovpnConnection ProfileName \u201cAlways on VPN\u201d<\/code><\/pre>\n\n\n<div class=\"wp-block-image\">\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a67402bc7153&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a67402bc7153\" class=\"aligncenter size-full wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"773\" height=\"94\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Remove-AovpnConnection-1.png\" alt=\"\" class=\"wp-image-1007\" srcset=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Remove-AovpnConnection-1.png 773w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Remove-AovpnConnection-1-300x36.png 300w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/Remove-AovpnConnection-1-768x93.png 768w\" sizes=\"auto, (max-width: 773px) 100vw, 773px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">Check and edit the ProfileXML_User.xml file and try again to add the Alway on VPN profile&#8230;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">When your Always On VPN *.xml profile works correctly, you can start deploying it to the computers in your AD domain.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Install AOVPNTools on each computer<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Use <strong>New-AovpnConnection<\/strong> to add the Always On VPN profile to the user\u2019s machine.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Deploy a PowerShell script with Group Policy<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Use a <strong>GPO startup script<\/strong> to run the PowerShell file and apply the XML configuration. (This method is a bit of a pain.)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Use the free open\u2011source <a href=\"https:\/\/aovpndpc.com\/\" data-type=\"link\" data-id=\"https:\/\/aovpndpc.com\/\" target=\"_blank\" rel=\"noopener\">Always On VPN DPC tool<\/a><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">However, DPC only supports <strong>certificate authentication<\/strong>, not <strong>mschapv2<\/strong>. And as mentioned earlier, Firebox IKEv2 does <strong>not<\/strong> support certificate authentication.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">But you <em>can<\/em> still use DPC to distribute the <strong>ProfileXML_User.xml<\/strong> file.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To use DPC:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Download the DPC client and install it on the user\u2019s computer (for example, using GPO software deployment).<\/li>\n\n\n\n<li>Download the DPC ADMX templates and configure DPC settings through Group Policy.<\/li>\n<\/ul>\n\n\n<div class=\"wp-block-image\">\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a67402bc787f&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a67402bc787f\" class=\"aligncenter size-full wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"818\" height=\"225\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/GPO_DPC_software_install.png\" alt=\"\" class=\"wp-image-1008\" srcset=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/GPO_DPC_software_install.png 818w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/GPO_DPC_software_install-300x83.png 300w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/GPO_DPC_software_install-768x211.png 768w\" sizes=\"auto, (max-width: 818px) 100vw, 818px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n\n<div class=\"wp-block-image\">\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a67402bc7c64&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a67402bc7c64\" class=\"aligncenter size-full wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"1021\" height=\"406\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/GPO_DPC_config-1.png\" alt=\"\" class=\"wp-image-1009\" srcset=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/GPO_DPC_config-1.png 1021w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/GPO_DPC_config-1-300x119.png 300w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/GPO_DPC_config-1-768x305.png 768w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/GPO_DPC_config-1-980x390.png 980w\" sizes=\"auto, (max-width: 1021px) 100vw, 1021px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n\n<div class=\"wp-block-image\">\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a67402bc8074&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a67402bc8074\" class=\"aligncenter size-large wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"498\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/GPO_DPC_config-2-1024x498.png\" alt=\"\" class=\"wp-image-1010\" srcset=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/GPO_DPC_config-2-1024x498.png 1024w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/GPO_DPC_config-2-300x146.png 300w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/GPO_DPC_config-2-768x374.png 768w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/GPO_DPC_config-2-980x477.png 980w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/GPO_DPC_config-2.png 1091w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n\n<div class=\"wp-block-image\">\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a67402bc8493&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a67402bc8493\" class=\"aligncenter size-large wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"442\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/GPO_DPC_config-3-1024x442.png\" alt=\"\" class=\"wp-image-1011\" srcset=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/GPO_DPC_config-3-1024x442.png 1024w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/GPO_DPC_config-3-300x130.png 300w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/GPO_DPC_config-3-768x332.png 768w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/GPO_DPC_config-3-980x423.png 980w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/GPO_DPC_config-3.png 1093w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n\n<div class=\"wp-block-image\">\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a67402bc88ab&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a67402bc88ab\" class=\"aligncenter size-full wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"663\" height=\"393\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/GPO_DPC_config-4.png\" alt=\"\" class=\"wp-image-1012\" srcset=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/GPO_DPC_config-4.png 663w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/GPO_DPC_config-4-300x178.png 300w\" sizes=\"auto, (max-width: 663px) 100vw, 663px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">You can speed up how quickly DPC applies its configuration on a user\u2019s computer by running these commands:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>gpupdate \/force\nrestart-service dpcservice<\/code><\/pre>\n\n\n<div class=\"wp-block-image\">\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a67402bc8d15&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a67402bc8d15\" class=\"aligncenter size-full wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"472\" height=\"230\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/DPC_client-update.png\" alt=\"\" class=\"wp-image-1016\" srcset=\"https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/DPC_client-update.png 472w, https:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/07\/DPC_client-update-300x146.png 300w\" sizes=\"auto, (max-width: 472px) 100vw, 472px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">This forces the Group Policy update and restarts the DPC service so the new settings are applied immediately.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>WG Firebox device supports IKEv2 Always On VPN \u2014 partly. With the built\u2011in Windows IKEv2 client, the Firebox firewall supports Microsoft Always On VPN user tunnels using MS\u2011CHAPv2 authentication (username and password). This tunnel starts automatically after Windows login. However, Firebox does not support certificate authentication, which is required for Microsoft Always On VPN device&hellip;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[17,18,13,5,12,4,2],"tags":[],"class_list":["post-974","post","type-post","status-publish","format-standard","hentry","category-always-on-vpn","category-aovpn","category-authentication","category-ikev2","category-radius","category-vpn","category-watchguard"],"_links":{"self":[{"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/posts\/974","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/comments?post=974"}],"version-history":[{"count":30,"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/posts\/974\/revisions"}],"predecessor-version":[{"id":1017,"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/posts\/974\/revisions\/1017"}],"wp:attachment":[{"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/media?parent=974"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/categories?post=974"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/tags?post=974"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}