WatchGuard

This guide explains how to protect the WatchGuard SSL VPN with Ironchip over RADIUS through NPS.

Requirements

• A functional Active Directory.
• A configured and working WatchGuard VPN.
• NPS protected by Ironchip. See Microsoft NPS.
• An MFA application created in the Ironchip admin console.
• The Ironchip app downloaded.

Configure NPS

Create a RADIUS client that points to the IP address you use to connect to your WatchGuard VPN.

1. In the NPS (Network Policy Server) of your Active Directory, create a new RADIUS client.

   

2. Give it an identifying name, the IP you use to connect to the VPN, and a shared secret that you should write down or remember.

   

Configure WatchGuard

RADIUS server

Give WatchGuard the data it needs to connect to RADIUS.

1. Go to Authentication > Servers and select RADIUS.

   

2. Click ADD.

   

3. Fill in the fields:

   1. Domain Name: the name of your Active Directory domain where RADIUS is located.
   2. IP Address: the public IP of your Active Directory domain where RADIUS is located.
   3. Port: the RADIUS port (1812 or 1645).
   4. Shared Secret and Confirm Secret: the RADIUS shared secret you set earlier.
   5. Timeout at 60 seconds and Retries at 1, so the user has time to authorize the connection.
   6. Dead Time, optional: you can change it as you like. 0 means disabled.

4. Save the changes.

   

Users and groups

Create users that refer to the users in your AD.

1. Go to Users and Groups and click ADD.

   

2. Select whether you want to create a group or a user.

3. The name must be exactly the same as the user’s name in your Active Directory.

4. In Authentication Server, select the RADIUS server you just created.

5. Click OK and save the changes.

   

SSL VPN

Change the VPN authentication method.

1. Go to VPN and, under Mobile VPN, open SSL. If this VPN connection method is not configured, configure it before continuing.

   

2. In Authentication Server, add the RADIUS server you created and set it as Default.

3. Check the boxes for the users and groups you want to use.

4. Save the changes.

   

Configure Ironchip

Add the users to the NPS application created in the Ironchip admin console. The usernames must be the same as in WatchGuard.

Verify the integration

Sign in to the WatchGuard SSL VPN with a user added to the application: after you enter your username and password, you are asked to authenticate with Ironchip.

Accessing the WatchGuard VPN with IronchipPlay video