Firebox Mobile VPN with IPSec Integration with Azure AD Users (2024)

Deployment Overview

WatchGuard provides integration instructions to help our customers configure WatchGuard products to work with products created by other organizations. If you need more information or technical support about how to configure a third-party product, see the documentation and support resources for that product.

This document describes how to set up Active Directory authentication for Mobile VPN with IPSec.

Topology

This topology diagram shows the data flow for Active Directory authentication with a WatchGuard Firebox and Azure AD Domain Services.

Before You Begin

Before you begin these procedures, make sure that:

• You have an Azure Active Directory global administrator account within the Azure Active Directory tenant.
• You have an active Azure subscription.
• You have created and configured Azure Active Directory Domain Services (Azure AD DS).

Additional charges might apply for the use of Microsoft Azure.

Configure Azure

The steps in this section cover how to configure Azure AD.

Configure Secure LDAP

To configure Secure LDAP:

1. Log in to the Azure portal with your Microsoft Azure account credentials.
2. Click Resource groups.
3. Select your Azure AD Domain Services resource group.
4. Click the Azure AD Domain Services.
   

5. Select Settings > Secure LDAP.
6. Enable the Secure LDAP toggle.
7. Enable the Allow secure LDAP access over the internet toggle.
8. Next to the .PFX file with secure LDAP certificate text box, click the folder icon and upload your certificate. For information about how to create and export the certificate, see Configure Secure LDAP in the Microsoft documentation.
9. In the Password to decrypt .PFX file text box, type the password.

10. Click Save.

11. Select Properties.
12. Copy the Secure LDAP external IP addresses value. You need this information when you configure the Firebox.

Configure a Security Rule in Azure

To configure a security rule in Azure:

1. In the Azure portal, click Resource groups.
2. Select your Azure AD Domain Services resource group.
3. Select the network security group.
4. Select Settings > Inbound security rules > Add.
5. From the Source drop-down list, select IP Addresses.
6. In the Source IP addresses/CIDR ranges text box, type the public IP address or range for your environment.
7. From the Destination drop-down list, select Any.
8. From the Service drop-down list, select Custom.
9. In the Destination port ranges text box, type 636.
10. For Protocol, select TCP.
11. In the Priority text box, type a number between 100 and 4096. In our example, we type 311.
12. In the Name text box, type a name.
13. Leave the default value for all other settings.
14. Click Add.

Add an Azure Group and User

To add an Azure group and user:

1. Go back to the Azure home page.
2. Click Azure Active Directory.
3. Select Manage > Groups.
4. Click + New group.
5. From the Group type drop-down list, select Security.
6. In the Group name text box, type a group name.
7. From the Membership type drop-down list, select Assigned.

8. Click Create.
9. To add a user in Azure, select Manage > Users.
10. Click + New user and enter your user information.
    

11. Click Create.

Users must change their passwords before they can use Azure AD DS. The password change process causes the password hashes for Kerberos and NTLM authentication to be generated and stored in Azure AD. The account is not synced from Azure AD to Azure AD DS until the password is changed. It might take a few minutes after the password change before the new password can be used in Azure AD DS.

Configure the Firebox

You must configure the Active Directory authentication settings and enable Mobile VPN with IPSec on your Firebox.

Configure Active Directory Authentication

To configure Active Directory authentication:

1. Log in to Fireware Web UI (https://<your Firebox IP address>:8080).
2. Select Authentication > Servers.
   The Authentication Servers page opens.

3. From the Authentication Servers list, click Active Directory.
   The Active Directory page opens.
4. Click Add.
5. Click Next.
6. In the Domain Name text box, type the domain name. You cannot change the domain name after you save the settings.

7. Click Next.
8. In the Server Address text box, type or paste the secure LDAP external IP address you copied in the previous section.
9. Select the Enable secure SSL connections to your Active Directory server (LDAPS) check box.

10. Click Next.
11. Click Finish.

Configure Mobile VPN with IPSec

To configure Mobile VPNwithIPSec:

1. Select VPN > Mobile VPN.
2. In the IPSec section, click Configure.

3. Click Add to add a new group.
4. In the Name text box, type a group name that matches the name of the Azure Active Directory group your users belong to.
5. From the Authentication Server drop-down list, select your authentication server.
6. In the Passphrase and Confirm text boxes, type a passphrase to encrypt the mobile VPN profile (.wgx file) that you distribute to users in this group. The passphrase can only use standard ASCII characters. If you use a certificate for authentication, this passphrase is also used to encrypt the exported certificate file you send to users.
7. In the Primary text box, type the external IP address of the Firebox that the VPN client connects to.

8. Select the Resources tab.
9. Select the Allow All Traffic Through Tunnel check box.

10. In the Virtual IP Address Pool section, click Add.
11. From the Choose Type drop-down list, select Host Range IPv4.
12. In the From and To text boxes, type a range for your virtual IP addresses. The range should not be in your interface range. The IP addresses in the virtual IP address pool cannot be used for anything else on your network.

13. Click OK.
14. Click Save.
15. In the Groups list, select your group.
16. From the Client drop-down list, select WatchGuard Mobile VPN.
17. Click Generate and save the <group name>.ini file.

Test the Integration

To test the integration of Azure AD Users and the WatchGuard Mobile VPN with IPSec.

1. Open your WatchGuard Mobile VPN with IPSec client.
2. Select Configuration > Profiles and import the <group name>.ini config file. This is the file you generated at the end of the Configure Mobile VPN with IPSec section.
3. Click Add / Import.
4. Select Profile Import. Click Next.
5. Select your file. Click Next to finish.
6. Select your profile as default. Click OK.
7. Select Connection > Connect.
8. Type your Azure AD user name and password.
9. Click OK.
   You are connected successfully.