WATCHGUARD VPN FOR APPLE MAC HOW TO
WATCHGUARD VPN FOR APPLE MAC MAC OS
WATCHGUARD VPN FOR APPLE MAC SOFTWARE

Select the new interface, and enter the following settings: Service Name: This can be anything you want. Use the following settings in the drop-down window: Open System Preferences, select Network. Click on the + button to add a new interface. Make sure Authenticaion is SHA1, Encryption is AES (256-bit), change Force Key Expiration time to 1 hour, and disable Force Key Expiration by Traffic. Change Key Group to Diffie-Hellman Group2. Under IPsec Tunnel tab, change Encryption to AES (256-bit).Select the configuration we just created, and click Edit….Make sure this pool of IP addresses don’t overlap with your DHCP or any static IP device on the network.

click Next.Īssign a range of IP addresses used by the VPN service. If you do change it, make sure you allow the external port, otherwise your VPN user will lose Internet access after connecting to VPN. Leave it to default if you want them to have access to everything. Here you can define what your VPN users have access to. Select Yse, force all Internet traffic to flow through the tunnel. This is the shared secret you’ll need when configuring a client machine. Select Use this passphrase and type in a secure password. Select LDAP for Authenticaion Server, and for Group Name use the short name of the service group you created earlier in Open Directory. Click Add to add a new configuration, then click Next.

In Fireware XTM Policy Manager, select VPN -> Mobile VPN -> IPSec. Configure WatchGuard Mobile VPN with IPSec.

An example of DN of Searching User would be: uid=firewall_admin,cn=users,dc=server,dc=example,dc=comģ.

Group String can remain memberOf, since it doesn’t apply to Apple Open Directory.

An example of Search Base would be: dc=server,dc=example,dc=com.

Enter the IP of your Open Directory server.

Select the LDAP tap, and fill out the information according to your Open Directory server setup: In Fireware XTM Policy Manager, select Setup -> Authentication -> Authenticaion Servers. Once you have the group created, move all user accounts who need VPN access into the group. You’ll later need to match it to the Group Name of your IPSec rule. Be mindful to the short name of the group. We’ll then need to create a service group on the Open Directory server. You can use the default diradmin account, but I prefer to have a separate account for the firewall. We’ll first need to create an directory administrator account for the firewall. For consistency’s sake, I’ll only include screen shots for WatchGuard System Management.

WATCHGUARD VPN FOR APPLE MAC SOFTWARE

Most of the configurations can be done in both the web interface and the WatchGuard System Management software (Windows only), except the last part. Overcome the lack of memberOf property in Apple Open Directory.

Configure WathcGuard Mobile VPN with IPSec.ĥ. Bind WatchGuard to Open Directory Server.ģ. Create service user and group on the Open Directory server.Ģ.

WATCHGUARD VPN FOR APPLE MAC MAC OS

This allows us to use Mac OS X’s built-in Cisco IPSec profile when setting up VPN instead of having to use a 3rd-party VPN app, and some of the instructions below are extracted from it.īinding a WatchGuard to Apple’s Open Directory is pretty straight forward in itself, however WatchGuard’s LDAP binding relies on the property memberOf to determine membership of an user account (which doesn’t exist in Apple Open Directory), we’ll need to perform a workaround to circumvent this.ġ. WatchGuard has an excellent article here with detailed instructions on configuring a WatchGuard to mimic the behavior of Cisco IPSec.

WATCHGUARD VPN FOR APPLE MAC HOW TO

In this article I’ll show you how to configure a Watchguard firewall for Mac OS X and iOS, and how to bind a WatchGuard firewall to Apple Open Directory for VPN authentication.

Watchguard vpn for apple mac