Mobile VPN with SSL. The WatchGuard Mobile VPN with SSL client is a software application that is installed on a remote computer. The client makes a secure connection from the remote computer to your protected network through an unsecured network, such as the Internet.
The Mobile VPN with SSL software enables users to connect, disconnect, gather more information about the connection, and to exit or quit the client. The Mobile VPN with SSL client adds an icon to the system tray on the Windows operating system, or an icon in the menu bar on macOS. You can use this icon to control the client software.
To use Mobile VPN with SSL, you must:
The WatchGuard Mobile VPN with SSL client v11.10.4 or higher is a 64-bit application.
If you are unable to connect to the Firebox, or cannot download the installer from the Firebox, you can Manually Distribute and Install the Mobile VPN with SSL Client Software and Configuration File.
Download the Client Software. Connect to this address with a web browser: or Enter your user name and password to authenticate to the Firebox or XTM device. The SSL VPN client download page appears. The latest version of WatchGuard Mobile VPN with SSL is 11.3 on Mac Informer. It is a perfect match for the General category. The app is developed by com.watchguard.
Client Computer Requirements
For information about which operating systems are compatible with your Mobile VPN with SSL Client, see the Operating System Compatibility list in the Fireware Release Notes.
In Fireware v12.5.4 or higher, the Firebox requires the SSL VPN client to support TLS 1.2 or higher. In Fireware v12.4.1 or lower, the Firebox requires the SSL VPN client to support TLS 1.1 or higher.
Windows Requirements
To upgrade the Mobile VPN with SSL Windows client, you must have administrator privileges.
In Fireware v12.5.3 or higher, if the client automatically detects that an upgrade is available, but you do not have administrator privileges, a message appears that tells you to contact your system administrator for assistance. If a minor version update is available, you can select the Don't show this message again check box. This check box does not appear if a major version update is available.
In Fireware v12.5.2 or lower, if the client automatically detects that an upgrade is available, a message appears that asks you to upgrade. However, if you do not have administrator privileges, you cannot upgrade the client.
macOS Requirements
To install the Mobile VPN with SSL client on macOS, you must have administrator privileges.
In macOS 10.15 (Catalina) or higher, you must install v12.5.2 or higher of the WatchGuard Mobile VPN with SSL client. For more compatibility information, see the Fireware Release Notes.
Download the Client Software
You can download the client from the WatchGuard Software Downloads page or from the Firebox.
In Fireware v12.5.5 or higher, your web browser must support TLS 1.2 or higher to download the client from the Firebox. In Fireware v12.4.1 or lower, your web browser must support TLS 1.1 or higher to download the client from the Firebox.
To download the client from the Software Downloads page:
Over port 443 https://<Firebox interface IP address>/sslvpn.html
https://<Firebox host name>/sslvpn.html
Over a custom port number https://<Firebox interface IP address>:<custom port number>/sslvpn.html https://<Firebox host name>:<custom port number>/sslvpn.html
The authentication web page appears.
From this page, you can also download the Mobile VPN with SSL client profile for connections from any SSL VPN client that supports .OVPN configuration files. For more information about the Mobile VPN with SSL client profile, see Use Mobile VPN with SSL with an OpenVPN Client.
In Fireware v12.5.4 or higher, you can disable the software downloads page hosted by the Firebox. If you disable this page, users cannot download the Mobile VPN with SSL client from the Firebox. Users can download the client from the WatchGuard website, or you can manually distribute the client to your users. For more information, see Plan Your Mobile VPN with SSL Configuration.
Install the Client SoftwareTo install the client in Windows:
After you download and install the client software, the Mobile VPN client software automatically connects to the Firebox. Each time you connect to the Firebox, the client software verifies whether any configuration updates are available.
Connect to Your Private NetworkTo start the Mobile VPN with SSL client in Windows, do one of the following:
Specify the Client Connection Settings
After you start the Mobile VPN with SSL Client, to start the VPN connection, you must specify the authentication server and user account credentials. Mobile VPN with SSL does not support Single Sign-On (SSO).
The Server is the IP address of the primary external interface of a Firebox, or an FQDN that resolves to that IP address. If Mobile VPN with SSL on the Firebox is configured to use a port other than the default port 443, in the Server text box, you must type the IP address or FQDN followed by a colon and the port number. For example, if Mobile VPN with SSL is configured to use port 444, and the primary external IP address is 203.0.113.2, the Server is 203.0.113.2:444.
The User name format depends on which authentication server the user authenticates to. For example, if the Firebox configuration includes multiple authentication servers, you must specify the authentication server in the User name text box. The User name must be formatted in one of these ways:
To use the default authentication server
Type the user name. Example: j_smith
To use another authentication server
Type the authentication server name or domain name, and then type a backlash () followed by the user name. Example: <server.example.com><j_smith>.
Active Directory â ad1_example.comj_smith
Firebox-DB â Firebox-DBj_smith
RADIUS (Fireware v12.5 or higher) â rad1.example.comj_smith or RADIUSj_smith. You must type the domain name specified in the RADIUS settings on Firebox.
RADIUS (Fireware v12.4.1 or lower) â RADIUSj_smith. You must always type RADIUS.
If your configuration includes a RADIUS server, and you upgrade from Fireware v12.4.1 or lower to Fireware v12.5 or higher, the Firebox automatically uses RADIUS as the domain name for that server. To authenticate to that server, you must type RADIUS as the domain name. In this case, if you type a domain name other than RADIUS, authentication fails.
To connect to your private network from the Mobile VPN with SSL client:
If the connection between the SSL client and the Firebox is temporarily lost, the SSL client tries to establish the connection again.
To troubleshoot connection issues, see Troubleshoot Mobile VPN with SSL.
Other Connection Options
Two other connection options are available in the client only if the administrator has enabled them on the device you connect to.
Automatically reconnect
Select the Automatically reconnect check box if you want the Mobile VPN with SSL client to automatically reconnect when the connection is lost.
Remember password
Select the Remember password check box if you want the Mobile VPN with SSL client to remember the password you typed for the next time you connect.
Watchguard Mobile Vpn Client Download MacMobile VPN with SSL Client Controls
When the Mobile VPN with SSL client runs, the WatchGuard Mobile VPN with SSL icon appears in the system tray (Windows) or on the right side of the menu bar (macOS). The type of magnifying glass icon that appears shows the VPN connection status.
Windows:
macOS:
macOS (Dark Mode):
To see the client controls list, right-click the Mobile VPN with SSL icon in the system tray (Windows), or click the Mobile VPN with SSL icon in the menu bar (macOS). You can select from these actions:
Connect/Disconnect
Start or stop the Mobile VPN with SSL connection.
Status
See the status of the Mobile VPN with SSL connection.
View Logs
Open the connection log file.
Properties
Windows â Select Launch program on startup to start the client when Windows starts. Type a number for Log level to change the level of detail included in the logs.
macOS â Shows detailed information about the Mobile VPN with SSL connection. You can also set the log level.
Show Time Connected (macOS only)
Select to show the elapsed connection time on the macOS menu bar.
Show Status While Connecting (macOS only)
Select to show the connection status on the macOS menu bar.
About
The WatchGuard Mobile VPN dialog box opens with information about the client software.
Exit (Windows) or Quit (macOS)
Disconnect from the Firebox and shut down the client.
See Also
Recently, I got a new project assignment that requires to connect permanently to the customer's network through VPN. They are using a so-called SSL VPN. As I am using OpenVPN since more than 5 years within my company's network I was quite curious about their solution and how it would actually be different from OpenVPN. Well, short version: It is a disguised version of OpenVPN.
Unfortunately, the company only offers a client for Windows and Mac OS which shouldn't bother any Linux user after all. OpenVPN is part of every recent distribution and can be activated in a couple of minutes - both client as well as server (if necessary).
Borrowing some files from a Windows client installation
Initially, I didn't know about the product, so therefore I went through the installation on Windows 8. No obstacles (and no restart despite installation of TAP device drivers!) here and the secured VPN channel was up and running in less than 2 minutes or so. Much appreciated from both parties - customer and me. Of course, this whole client package and my long year approved and stable installation ignited my interest to have a closer look at the WatchGuard client. Compared to the original OpenVPN client (okay, I have to admit this is years ago) this commercial product is smarter in terms of file locations during installation. You'll be able to access the configuration and key files below your roaming application data folder. To get there, simply enter
in your Windows/File Explorer and confirm with Enter/Return. This will display the following files:
Application folder below user profile with configuration and certificate files
From there we are going to borrow four files, namely:
![]()
and transfer them to the Linux system.
You might also be able to isolate those four files from a Mac OS client. Frankly, I'm just too lazy to run the WatchGuard client installation on a Mac mini only to find the folder location, and I'm going to describe why a little bit further down this article. I know that you can do that! Feedback in the comment section is appreciated.
Update #1:
One of the reader (zer0Sum) provided the path information to retrieve the necessary files on a Mac OS system:
Thanks!
Update #2:
Retrieve the information directly from the WatchGuard Firebox as described in the next paragraph.
Get the client configuration file from the WatchGuard Firebox
Due to a replacement unit at my customer, I had to update all the certificates here on the client side, too. And as I already changed my main machine I wouldn't like to install the Windows Client software on this computer. Actually, it is not necessary because the certificates can be downloaded from the appliance directly. In order to do this, open your web browser and enter the following URL:
Note: I changed the IP address of the remote directive above (which should be obvious, right?).
This will give you a login dialog like so:
Login into the WatchGuard Firebox to get the Mobile VPN with SSL Client information
Enter your credentials given by your network administrator and you will be able to download various client information.
This is the regular 'Mobile VPN with SSL client' area:
Download the Mobile VPN with SSL Client Profile directly from the WatchGuard appliance
We simply ignore the software for Windows and Mac and choose to download the client profile. Save the provided file 'client.ovpn' to a location on your computer.
Now, you can open it with a text editor like Notepad++. Interestingly, the different certificates are stored inside the OpenVPN client configuration file. So, either you leave it as-is or you might consider to cut the certificates from the file and store them as individual files. Both approaches will work.
Source: WatchGuard System Manager Help - Use Mobile VPN with SSL with an OpenVPN Client
Configuration of OpenVPN (console)
Depending on your distribution the following steps might be a little different but in general you should be able to get the important information from it. I'm going to describe the steps in Ubuntu 13.04 (Raring Ringtail). As usual, there are two possibilities to achieve your goal: console and UI. Let's what it is necessary to be done.
First of all, you should ensure that you have OpenVPN installed on your system. Open your favourite terminal application and run the following statement:
Just to be on the safe side. The four above mentioned files from your Windows machine could be copied anywhere but either you place them below your own user directory or you put them (as root) below the default directory:
At this stage you would be able to do a test run already. Just in case, run the following command and check the output (it's the similar information you would get from the 'View Logs...' context menu entry in Windows:
Pay attention to the correct path to your configuration and certificate files. OpenVPN will ask you to enter your Auth Username and Auth Password in order to establish the VPN connection, same as the Windows client.
Remote server and user authentication to establish the VPN
Please complete the test run and see whether all went well. You can disconnect pressing Ctrl+C.
Simplify your life - use an authentication file
In my case, I actually set up the OpenVPN client on my gateway/router. This establishes a VPN channel between my network and my client's network and allows me to switch machines easily without having the necessity to install the WatchGuard client on each and every machine. That's also very handy for my various virtualised Windows machines. Anyway, as the client configuration, key and certificate files are located on a headless system somewhere under the roof, it is mandatory to have an automatic connection to the remote site.
For that you should first change the file extension '.ovpn' to '.conf' which is the default extension on Linux systems for OpenVPN, and then open the client configuration file in order to extend an existing line.
You should have a similar content to this one here:
Note: I changed the IP address of the remote directive above (which should be obvious, right?).
Anyway, the required change is marked in red and we have to create a new authentication file 'auth.txt'. You can give the directive 'auth-user-pass' any file name you'd like to.
Update #3:
The OpenVPN directive
tls-remote has been deprecated. In the above listed configuration I simply commented the line. The file client.ovpn doesn't have it at all.
Due to my existing OpenVPN infrastructure my setup differs completely from the above written content but for sake of simplicity I just keep it 'as-is'. Okay, let's create this file 'auth.txt'
and just put two lines of information in it - username on the first, and password on the second line, like so:
Store the file, change permissions, and call openvpn with your configuration file again:
This should now work without being prompted to enter username and password.
In case that you placed your files below the system-wide location /etc/openvpn you can operate your VPNs also via service command like so:
Using Network Manager
For newer Linux users or the ones with 'console-phobia' I'm going to describe now how to use Network Manager to setup the OpenVPN client. For this move your mouse to the systray area and click on Network Connections => VPN Connections => Configure VPNs... which opens your Network Connections dialog. Alternatively, use the HUD and enter 'Network Connections'.
Watchguard Vpn Mac Download FreeNetwork connections overview in Ubuntu
Click on 'Add' button. On the next dialog select 'Import a saved VPN configuration...' from the dropdown list and click on 'Create...'
Choose connection type to import VPN configuration
Now you navigate to your folder where you put the client files from the Windows system and you open the 'client.ovpn' file. Next, on the tab 'VPN' proceed with the following steps (directives from the configuration file are referred):
Then click on the 'Advanced...' button and check the following values:
Finally, you have to confirm and close all dialogs. You should be able to establish your OpenVPN-WatchGuard connection via Network Manager. For that, click on the 'VPN Connections => client' entry on your Network Manager in the systray.
It is advised that you keep an eye on the syslog to see whether there are any problematic issues that would require some additional attention.
Advanced topic: routing
As stated above, I'm running the 'WatchGuard client for Linux' on my head-less server, and since then I'm actually establishing a secure communication channel between two networks. In order to enable your network clients to get access to machines on the remote side there are two possibilities to enable that:
Following, I'm going to describe the second option a little bit more in detail. The Linux system that I'm using is already configured as a gateway to the internet. I won't explain the necessary steps to do that, and will only focus on the additional tweaks I had to do. You can find tons of very good instructions and tutorials on 'How to setup a Linux gateway/router' - just use Google.
OK, back to the actual modifications. First, we need to have some information about the network topology and IP address range used on the 'other' side. We can get this very easily from /var/log/syslog after we established the OpenVPN channel, like so:
Or if your system is quite busy with logging, like so:
The output should contain PUSH received message similar to the following one:
The interesting part for us is the route command which I highlighted already in the sample PUSH_REPLY. Depending on your remote server there might be multiple networks defined (172.16.x.x and/or 10.x.x.x).
Important: The IP address range on both sides of the connection has to be different, otherwise you will have to shuffle IPs or increase your the netmask.
After the VPN connection is established, we have to extend the rules for iptables in order to route and masquerade IP packets properly. I created a shell script to take care of those steps:
I'm using the wildcard interface 'tun+' because I have multiple client configurations for OpenVPN on my server. In your case, it might be sufficient to specify device 'tun0' only.
Simplifying your life - automatic connect on boot
Now, that the client connection works flawless, configuration of routing and iptables is okay, we might consider to add another 'laziness' factor into our setup. Due to kernel updates or other circumstances it might be necessary to reboot your system. Wouldn't it be nice that the VPN connections are established during the boot procedure? Yes, of course it would be. To achieve this, we have to configure OpenVPN to automatically start our VPNs via init script. Let's have a look at the responsible 'default' file and adjust the settings accordingly.
Which should have a similar content to this:
With the OpenVPN client configuration as described above you would either set AUTOSTART to 'all' or to 'client' to enable automatic start of your VPN(s) during boot. You should also take care that your iptables commands are executed after the link has been established, too.
You can easily test this configuration without reboot, like so:
Watchguard Mobile Vpn Client Download
Enjoy stable VPN connections between your Linux system(s) and a WatchGuard Firebox SSL remote server.
Cheers, JoKi
Comments are closed.
|
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |