- Mobile VPN with IKEv2
- Mobile VPN with L2TP
- Mobile VPN with SSL
- Mobile VPN with IPSec
Your Firebox can support all four types of mobile VPNs simultaneously. You can also configure a client computer to use one or more types of mobile VPNs.
Before you decide which type of Mobile VPN to use, consider your current infrastructure, network policy preferences, and these details:
- Security
- Ease of Use
- Portability
- Performance
- VPN Tunnel Capacity
- Authentication Support
- Other Considerations
- Protocol Details
The Mobile VPN with PPTP feature is not available in Fireware v12.0 and higher. If your Firebox has Fireware v11.12.4 or lower, Mobile VPNwith PPTP is automatically removed from your configuration when you upgrade to Fireware v12.0 or higher. We recommend that you migrate to a different mobile VPN solution before you upgrade. For more information, see How do I migrate from PPTP to L2TP before I upgrade to Fireware v12.0? in the WatchGuard Knowledge Base. For documentation for Mobile VPN with PPTP, see Fireware Help v11.12.x.
Security
Each type of Mobile VPN has different security traits.
IKEv2
Mobile VPN with IKEv2 offers the highest level of security. Mobile VPN with IKEv2 includes multi-layer security, but it is limited to local Firebox authentication and RADIUS. Certificate-based client authentication is supported instead of a pre-shared key. For authentication, Mobile VPN with IKEv2 uses EAP and MS-CHAPv2.
In Fireware v12.2 or higher, the Firebox supports AES-GCM encryption.
In Fireware v12.5 or higher, the Firebox supports ECDSA(EC) certificates for Mobile VPN with IKEv2. Your IKEv2 VPN client must also support EC certificates. Support varies by operating system. For more information, see About Elliptic Curve Digital Signature Algorithm (ECDSA) certificates.
Mobile VPN with IKEv2 supports multi-factor authentication for MFA solutions that support MS-CHAPv2.
AuthPoint is the WatchGuard MFA solution. To use AuthPoint for Mobile VPNwith IKEv2, see:
- Firebox Mobile VPN with IKEv2 Integration with AuthPoint<![CDATA[ ]]>
- Firebox Cloud Mobile VPN with IKEv2 Integration with AuthPoint for Azure Active Directory Users
- Third-Party IKEv2 VPN Client Integration with AuthPoint
L2TP
Mobile VPN with L2TP offers a high level of security, which includes multi-layer security. However, authentication server options are limited to local Firebox authentication and RADIUS. The client must know the pre-shared key.
Mobile VPN with L2TP also supports certificate-based client authentication in place of the pre-shared key.
Mobile VPN with L2TP supports multi-factor authentication for MFA solutions that support MS-CHAPv2. AuthPoint, the WatchGuard MFA service, supports MS-CHAPv2 RADIUS authentication.
In Fireware v12.5.3 or higher, Mobile VPN with L2TP supports AuthPoint for multi-factor authentication to Active Directory through NPS. AuthPoint is the WatchGuard MFA service. To use AuthPoint with Mobile VPN with L2TP, see:
- Firebox Mobile VPN with L2TP Integration with AuthPoint
- Firebox Mobile VPN with L2TP Integration with AuthPoint for Azure Active Directory Users
SSL
Mobile VPN with SSL is a secure mobile VPNoption, but it is less secure than IPSec-based VPNs because:
- It does not support multi-layer encryption
- An attacker needs to know only the Firebox IP address and client login credentials to connect.
In Fireware v12.2 or higher, Mobile VPN with SSL supports AES-GCM.
If your RADIUS server supports multi-factor or two-factor authentication, you can use multi-factor or two-factor authentication with WatchGuard Mobile VPN with SSL.
AuthPoint is the WatchGuard MFA solution. To use AuthPoint for Mobile VPNwith SSL, see Firebox Mobile VPN with SSL Integration with AuthPoint.
IPSec
Mobile VPN with IPSec supports encryption levels up to 256-bit AES and multi-layer encryption.
You can use any authentication method supported by the Firebox.
An attacker who has the login credentials also needs detailed setup information to connect to the VPN, which includes the pre-shared key.
Mobile VPN with IPSec also supports certificate-based client authentication instead of the pre-shared key.
If your RADIUS server supports multi-factor authentication, you can use multi-factor authentication with WatchGuard Mobile VPN with IPSec.
AuthPoint is the WatchGuard MFA solution. To use AuthPoint for Mobile VPNwith IPSec, see Firebox Mobile VPN with IPSec Integration with AuthPoint.
We recommend Mobile VPN with IKEv2 as an alternative to Mobile VPN with IPSec. The IKEv1 Aggressive Mode vulnerability described in CVE-2002-1623 affects Mobile VPN with IPSec. This vulnerability does not affect Mobile VPN with IKEv2 or L2TP. If you configure Mobile VPN with IPSec, we recommend that you configure a certificate instead of a pre-shared key if you have a WSM Management Server. If you do not have a Management Server, we recommend that you specify a strong pre-shared key and change it on a regular basis. We also recommend that you specify a strong hashing algorithm such as SHA-256.
Ease of Use
IKEv2
Mobile VPN with IKEv2 supports connections from native IKEv2 VPN clients on iOS, macOS, and Windows mobile devices. Android users can configure an IKEv2 VPNconnection with the third-party strongSwan app.
Administrators can download a .bat configuration script from the Firebox to automatically configure a IKEv2 VPNprofile on supported Windows operating systems. The configuration script also automatically installs the certificate. For operating system support information, see the Operating System Compatibility Matrix in the Fireware Release Notes.
For iOS and macOS, Administrators can download a .mobileconfig profile from the Firebox to automatically configure the native IKEv2 VPN client.
For Android, Firebox administrators can download a .sswan file from the Firebox to automatically configure the strongSwan app.
In Fireware v12.9 or higher, you can configure Mobile VPN with IKEv2 for full tunneling or split tunneling. In Fireware v12.8.1 or lower, Mobile VPN with IKEv2 sends all traffic over the VPN tunnel (full tunneling).
L2TP
You can use Mobile VPN with L2TP with native VPN clients and any L2TPv2 clients that comply with RFC 2661. To connect, the end user must specify a user name and password, which can be saved in some VPN clients. Users must manually configure the L2TP client.
Routing for client traffic over L2TP is controlled by the client configuration. Clients typically have an option to route all client traffic through the tunnel, or to route client traffic through the tunnel only for the same /24 subnet as the virtual IP address.
SSL
For Windows and macOSusers, the client is easy to download and install. To download the VPN client, users connect over HTTPS to the Firebox and log in. After users download the client, they only need to know their login credentials to connect. As an administrator, you can enable or disable the option for the VPNclient to remember the user name and password.
Clients with other operating systems and mobile devices can use OpenVPN clients to connect. To use an OpenVPN client, the user needs the client.ovpn file, which is also easy to download from the Firebox.
IPSec
Windows users can download and install the WatchGuard Mobile VPN client which offers additional features. A paid license is required after a 30-day free trial.
For both clients, you must provide the client with a configuration file. If you use the WatchGuard IPSec Mobile VPN Client, you might also need to provide the pre-shared key. We recommend that you use a secure method, such as encrypted email, to distribute the configuration file.
Tunnel routing for both Windows clients can be as broad or specific as needed, based on the allowed resources you configure.
For macOS devices, you must configure a Mobile VPN profile to match the default settings of the on-device client, and configure the client to connect to the VPN. The client needs a user name and passphrase to connect.
For information about which operating systems are compatible with each mobile VPN type, see the Operating System Compatibility list in the
Portability
Portability refers to the network environments from which the VPN client can connect.
IKEv2
By default, IKEv2 uses IPSec, which requires UDP ports 500 and 4500, and ESP IP Protocol 50. You cannot disable IPSec.
L2TP
By default, L2TP uses IPSec, which requires UDP ports 500 and 4500, and ESP IP Protocol 50.
If you disable IPSec, Mobile VPN with L2TP requires only UDP port 1701. This type of L2TP configuration should be allowed in most environments unless the network is configured to be extremely restrictive. However, this configuration does not provide the security of IPSec.
If you disable IPsec in the Mobile VPN with L2TPconfiguration, you must also disable IPSec on the client devices. On some devices, this procedure might be more difficult. For information about IPSec settings on a device, see the device manufacturer’s documentation.
SSL
You can configure Mobile VPN with SSL to use any TCP or UDP port, or use the default setting, TCP 443. If you use a UDP port, you must still specify a TCP port for the initial authentication request. This makes Mobile VPN with SSL portable to almost any environment that allows outbound HTTPS and does not decrypt the traffic.
Although Mobile VPN with SSL usually works on most networks, it can fail because of firewall restrictions:
- Content inspection — If a network device decrypts HTTPS traffic to inspect it for malicious content, Mobile VPN with SSL fails.
- Protocol enforcement — If you enable the Allow only TLS-compliant traffic option on your Firebox, Mobile VPN with SSL might fail.
- Application control — If an application control service blocks the open-source OpenVPN software, Mobile VPN with SSL fails.
You can configure the HTTPS proxy on a Firebox to allow non-compliant HTTPS requests. To learn more about the HTTPS proxy, see HTTPS-Proxy: General Settings.
IPSec
Mobile VPN with IPSec requires the client to access the Firebox on UDP ports 500 and 4500, and ESP IP Protocol 50. This often requires a specific configuration on the client's internet gateway, so clients might not be able to connect from hotspots or with mobile Internet connections.
You can configure a Firebox to allow outbound IPSec requests. To learn more about outbound IPSec pass-through, see About Global VPN Settings.
Performance
IKEv2
Mobile VPN with IKEv2 performs better than Mobile VPN with L2TP and Mobile VPN with SSL.
L2TP
Mobile VPN with L2TP is faster than Mobile VPN with SSL, but slower than Mobile VPN with IKEv2.
SSL
Mobile VPN with SSL is slower than other mobile VPN types. It is not the best option for latency-sensitive traffic such as VoIP or high-bandwidth file transfers. However, you can improve Mobile VPN with SSL performance if you select UDP for the data channel and AES-GCM ciphers.
VPN Tunnel Capacity
When you select a type of VPN, make sure to consider the number of tunnels your device supports.
The maximum number of IKEv2, L2TP, SSL, and IPSec mobile VPN tunnels depends on the Firebox model.
You can see the maximum number of each type of VPN tunnel your Firebox supports in the Firebox feature key. For more information, see VPNTunnel Capacity and Licensing.
Authentication Support
Make sure the Mobile VPN solution you choose supports the type of authentication server you use.
| Mobile VPN Type | AuthPoint | Active Directory | LDAP | RADIUS | SecurID | Firebox (Firebox-DB)Local Authentication |
|---|---|---|---|---|---|---|
| Mobile VPN with IKEv2 | Yes | Yes* | No | Yes | No | Yes |
| Mobile VPN with L2TP | Yes | Yes* | No | Yes | No | Yes |
| Mobile VPN with SSL | Yes | Yes | Yes | Yes | Yes | Yes |
| Mobile VPN with IPSec for iOS, Windows, and macOS | Yes | Yes | Yes | Yes | Yes | Yes |
| Mobile VPN with IPSec for Android (native client) | Yes | Yes | Yes | Yes | No | Yes |
* Active Directory authentication for IKEv2 and L2TP is supported only through a RADIUSserver.
The RADIUS server must return the Filter-Id attribute (RADIUS attribute #11) in its Access-Accept response. The value of the Filter-Id attribute must match the name of the correct group (SSLVPN-Users, or the name of the group you define in the Mobile VPNwith SSL or Mobile VPN with IPSec configuration).
Other Considerations
- Mobile VPN with IKEv2 offers the highest level of security, best performance, and easiest deployment. This VPN type has certificate-based client authentication instead of a pre-shared key.
- Mobile VPN with IKEv2, L2TP, and IPSec work only when the required ports and protocols are allowed on the remote networks. This means these mobile VPN types might not work on all remote networks.
- With Mobile VPN with L2TP, you can use L2TP to transport protocols other than IP.
- Mobile VPN with IPSec is the only VPN type that allows you to configure different VPN configuration profiles for different groups of users.
- We recommend Mobile VPN with SSL when IKEv2 IPSec traffic is not allowed on the remote network.
The WatchGuard Mobile VPN app for Android is no longer available in the Google Play store. The WatchGuard Mobile VPN app for iOS is no longer available in the Apple Store. We no longer support these legacy apps.
Protocol Details
Each type of mobile VPNuses different ports, protocols, and encryption algorithms to establish a connection. The required ports and protocols must be open between the mobile device and your Firebox for the mobile VPN to function.
Mobile VPN with IKEv2
- Required ports: ESPand UDP port 500; UDP port 500 and 4500 for NAT-T
- Transport and authentication protocols:
- IKEv2 (Internet Key Exchange Tunneling Protocol v2)
- IPSec (Internet Protocol Security)
- IKE (Internet Key Exchange)
- ESP (Encapsulating Security Payload)
- Authentication: MD5, SHA-1, SHA2-256, SHA2-384, SHA2-512
- Encryption protocols:DES, 3DES, AES. AES-GCM is supported in Fireware v12.2 or higher.
- Encryption strength:
- DES and 3DES:56 bit and 168 bit
- AES:128, 192, or 256 bit
- AES-GCM: 128, 192, or 256 bit (Fireware v12.2 or higher)
Mobile VPN with L2TP, with IPSec enabled
- Required ports: UDP port 1701, UDP 500 and ESPfor IKE, UDP 500 and 4500 for NAT-T
- Transport and authentication protocols:
- L2TP (Layer 2 Tunneling Protocol)
- IPSec (Internet Protocol Security)
- IKE (Internet Key Exchange)
- ESP (Encapsulating Security Payload)
- Authentication: MD5, SHA-1, SHA2-256, SHA2-384, SHA2-512
- Encryption protocols:DES, 3DES, AES
- Encryption strength:
- DES and 3DES:56 bit and 168 bit
- AES:128, 192, or 256 bit
Mobile VPN with SSL
- Required ports:
- TCP 443 (default; recommended)
- UDP 53 (recommended for the data channel if increased performance is a goal)
- Other TCP and UDP ports are less likely to be allowed by remote networks
- Transport and authentication protocols:
- TLS (Transport Layer Security) — In Fireware v12.5.4 or higher, the minimum accepted TLS version for VPN connections is TLS 1.2. In Fireware v12.5.5 or higher, your web browser must support TLS 1.2 or higher to download the WatchGuard SSLVPNclient from the Firebox.
- Authentication: SHA-1, SHA-256, SHA-512 Tip! SHA-256 and SHA-512 are SHA-2 variants.
- Encryption protocols:
- AES
- AES-GCM (Fireware v12.2 or higher)
- 3DES
- Encryption strength:
- AES:128, 192, or 256 bit
- AES-GCM: 128, 192, or 256 bit (Fireware v12.2 or higher)
- 3DES: 168 bit
For Mobile VPN with SSL, you can choose a different port and protocol in some cases. For more information, see Choose the Port and Protocol for Mobile VPN with SSL
Mobile VPN with IPSec
- Required ports:
- UDPport 500 for IKE
- UDPport 4500 for NAT traversal (NAT-T)
- Transport and authentication protocols:
- IPSec (Internet Protocol Security)
- IKE (Internet Key Exchange)
- ESP (Encapsulating Security Payload)
- Authentication: MD5, SHA-1, SHA2-256, SHA2-384, SHA2-512
- Encryption protocols:DES, 3DES, AES
- Encryption strength:
- DES and 3DES:56 bit
- AES:128, 192, or 256 bit
See Also
Mobile VPNwith IKEv2
Mobile VPN with L2TP
About Mobile VPN with SSL
Mobile VPN with IPSec
© 2023 WatchGuard Technologies, Inc. All rights reserved. WatchGuard and the WatchGuard logo are registered trademarks or trademarks of WatchGuard Technologies in the United States and other countries. Various other trademarks are held by their respective owners.
As an expert in network security and VPN technologies, I'll delve into the details of the concepts mentioned in the article about Fireware and its support for various Mobile VPN types. Let's break down the information provided:
Fireware Mobile VPN Support:
Fireware supports four types of Mobile VPNs:
- Mobile VPN with IKEv2
- Mobile VPN with L2TP
- Mobile VPN with SSL
- Mobile VPN with IPSec
Simultaneous Support:
Your Firebox can support all four types of mobile VPNs simultaneously.
Client Configuration:
You can configure a client computer to use one or more types of mobile VPNs.
Considerations Before Choosing a VPN Type:
Before deciding on a Mobile VPN type, consider:
- Security
- Ease of Use
- Portability
- Performance
- VPN Tunnel Capacity
- Authentication Support
- Other Considerations
- Protocol Details
Mobile VPN Types:
Security:
- IKEv2: Highest security level, multi-layer security, supports EAP and MS-CHAPv2.
- L2TP: High security level, multi-layer security, supports MS-CHAPv2.
- SSL: Less secure than IPSec, supports AES-GCM, and multi-factor authentication with AuthPoint.
- IPSec: Supports encryption up to 256-bit AES, multi-layer encryption, and various authentication methods.
Ease of Use:
- IKEv2: Supports native clients on iOS, macOS, and Windows.
- L2TP: Can be used with native VPN clients and L2TPv2 clients.
- SSL: Easy download and install for Windows and macOS users. OpenVPN clients for other operating systems.
- IPSec: WatchGuard Mobile VPN client for Windows.
Portability:
- IKEv2 and L2TP: Use IPSec by default, requiring UDP ports 500 and 4500, and ESP IP Protocol 50.
- SSL: Configurable to use any TCP or UDP port, usually TCP 443.
Performance:
- IKEv2: Better performance than L2TP and SSL.
- L2TP: Faster than SSL but slower than IKEv2.
- SSL: Slower than other types, not ideal for latency-sensitive traffic.
VPN Tunnel Capacity:
Consider the maximum number of tunnels supported by your Firebox for each VPN type.
Authentication Support:
Ensure compatibility with authentication servers such as AuthPoint, Active Directory, LDAP, RADIUS, SecurID, and Firebox (Firebox-DB) Local Authentication for each VPN type.
Other Considerations:
- IKEv2 offers the highest security, best performance, and easy deployment.
- L2TP allows the transport of protocols other than IP.
- IPSec allows different VPN configuration profiles for different user groups.
Protocol Details:
Mobile VPN with IKEv2:
- Required Ports: ESP and UDP port 500; UDP port 500 and 4500 for NAT-T.
- Protocols: IKEv2, IPSec, IKE, ESP.
- Authentication: MD5, SHA-1, SHA2-256, SHA2-384, SHA2-512.
- Encryption: DES, 3DES, AES, AES-GCM.
Mobile VPN with L2TP:
- Required Ports: UDP port 1701, UDP 500, and ESP for IKE; UDP 500 and 4500 for NAT-T.
- Protocols: L2TP, IPSec, IKE, ESP.
- Authentication: MD5, SHA-1, SHA2-256, SHA2-384, SHA2-512.
- Encryption: DES, 3DES, AES.
Mobile VPN with SSL:
- Required Ports: TCP 443 (default), UDP 53 (optional).
- Protocols: TLS.
- Authentication: SHA-1, SHA-256, SHA-512.
- Encryption: AES, AES-GCM, 3DES.
Mobile VPN with IPSec:
- Required Ports: UDP port 500 for IKE, UDP port 4500 for NAT-T.
- Protocols: IPSec, IKE, ESP.
- Authentication: MD5, SHA-1, SHA2-256, SHA2-384, SHA2-512.
- Encryption: DES, 3DES, AES.
Conclusion:
Choosing the right Mobile VPN type depends on your specific security, performance, and deployment requirements. Each type has its strengths and considerations, and it's crucial to align your choice with your network infrastructure and policies.
