# WatchGuard

> Protect the WatchGuard SSL VPN with Ironchip over RADIUS and NPS: RADIUS client, authentication server, users and groups, and Ironchip setup.

URL: https://docs.ironchip.com/en/identidad/integraciones/red/watchguard/

This guide explains how to protect the **WatchGuard** SSL VPN with Ironchip over [RADIUS](https://docs.ironchip.com/en/identidad/protocolos/radius/) through [NPS](https://docs.ironchip.com/en/identidad/integraciones/red/nps/).

## Requirements

- A functional Active Directory.
- A configured and working WatchGuard VPN.
- NPS protected by Ironchip. See [Microsoft NPS](https://docs.ironchip.com/en/identidad/integraciones/red/nps/).
- An MFA application created in the Ironchip admin console.
- The Ironchip app downloaded.

## Configure NPS

Create a RADIUS client that points to the IP address you use to connect to your WatchGuard VPN.

1. In the NPS (Network Policy Server) of your Active Directory, create a new RADIUS client.

   [Image: Creating a RADIUS client in NPS]

2. Give it an identifying name, the IP you use to connect to the VPN, and a shared secret that you should write down or remember.

   [Image: RADIUS client details: name, IP, and shared secret]

## Configure WatchGuard

### RADIUS server

Give WatchGuard the data it needs to connect to RADIUS.

1. Go to **Authentication > Servers** and select **RADIUS**.

   [Image: Authentication > Servers section with the RADIUS option]

2. Click **ADD**.

   [Image: ADD button to add the RADIUS server]

3. Fill in the fields:

   1. **Domain Name**: the name of your Active Directory domain where RADIUS is located.
   2. **IP Address**: the public IP of your Active Directory domain where RADIUS is located.
   3. **Port**: the RADIUS port (`1812` or `1645`).
   4. **Shared Secret** and **Confirm Secret**: the RADIUS shared secret you set earlier.
   5. **Timeout** at `60` seconds and **Retries** at `1`, so the user has time to authorize the connection.
   6. **Dead Time**, optional: you can change it as you like. `0` means disabled.

4. Save the changes.

   [Image: RADIUS server form in WatchGuard]

### Users and groups

Create users that refer to the users in your AD.

1. Go to **Users and Groups** and click **ADD**.

   [Image: Users and Groups section]

2. Select whether you want to create a group or a user.
3. The name must be exactly the same as the user's name in your Active Directory.
4. In **Authentication Server**, select the RADIUS server you just created.
5. Click **OK** and save the changes.

   [Image: User form with the RADIUS authentication server]

### SSL VPN

Change the VPN authentication method.

1. Go to **VPN** and, under **Mobile VPN**, open **SSL**. If this VPN connection method is not configured, configure it before continuing.

   [Image: VPN > Mobile VPN > SSL section]

2. In **Authentication Server**, add the RADIUS server you created and set it as **Default**.
3. Check the boxes for the users and groups you want to use.
4. Save the changes.

   [Image: RADIUS server as Default in the SSL VPN configuration]

## Configure Ironchip

Add the users to the NPS application created in the Ironchip admin console. The usernames must be the same as in WatchGuard.

[Image: Users added to the NPS application in the Ironchip admin console]

## Verify the integration

Sign in to the WatchGuard SSL VPN with a user added to the application: after you enter your username and password, you are asked to authenticate with Ironchip.

Video: [Accessing the WatchGuard VPN with Ironchip](https://play.hubspotvideo.com/v/7745202/id/134922034954)