Watchguard Firebox Ssl Mac Download

| 14-05-2021
[RAND-1-100] Comments

Get the Configuration File from the Firebox. The Mobile VPN with SSL configuration file is in the support.tgz file you can download from your Firebox. To get the Mobile VPN with SSL configuration file, from Firebox System Manager: Select the Status Report tab and click Support. Choose a location to save the support.tgz file and click Retrieve. OS: 11.12.2 Trying to download the openVPN files/SSLVPN client.

Your users can make an SSL VPN connection to the Firebox with an OpenVPN client. For example, users can install OpenVPN Connect for Android or iOS, which is available from openvpn.net, the Google Play app store, or the Apple app store.

To configure the OpenVPN app, users can download a Mobile VPN with SSL client profile from the Firebox. Users can then import the profile into the OpenVPN app.

In Fireware v12.3 or higher, Mobile VPN with SSL supports two-factor, challenge-response authentication for native OpenVPN clients.

Requirements

Before you download the Mobile VPN with SSL client profile, make sure your Firebox configuration meets these requirements:

  • The Firebox must use Fireware v11.7.4 or higher.
  • The Firebox must be configured to route VPN traffic. Make sure that Routed VPN traffic is selected in the Mobile VPN with SSL configuration. For more information, see Manually Configure the Firebox for Mobile VPN with SSL.
  • The certificates for Mobile VPN with SSL must be created with Fireware v11.7.3 or higher. If you upgraded from an earlier version, your certificates may not be compatible with the OpenVPN client.

To generate new SSLVPN certificates, you must delete the SSLVPN certificates from the Firebox and reboot the Firebox. When the Firebox restarts, it creates new SSLVPN certificates.

To generate new SSLVPN certificates for a Firebox, from Firebox System Manager:

  1. Select View > Certificates.
    The Certificates dialog box appears.
  2. In the list of certificates, find and delete the three SSLVPN certificates.

The three SSLVPN certificates have these common name (cn) attributes:

  • cn=Fireware SSLVPN Server
  • cn=Fireware SSLVPN Client
  • cn=Fireware SSLVPN (SN...) CA
  1. Reboot the Firebox to automatically generate new certificates.
    You must use Firebox System Manager (FSM) to delete certificates. You cannot delete the certificate from Fireware Web UI.

After the Firebox generates new SSLVPN certificates, existing WatchGuard Mobile VPN with SSL clients automatically download the new certificates the next time your users connect. The WatchGuard Mobile VPN with SSL client prompts the user to accept the new certificate if the user does not have the CA certificate for the Firebox.

To generate new SSLVPN certificates for Fireboxes that are FireCluster members, you must turn off the backup master and then reboot the master. The master will create the new certificates. After the master is back online, turn on the backup master. The backup master uses the new certificates that the master generated.

Download the Mobile VPN with SSL Client Profile

After you configure Mobile VPN with SSL on the Firebox, you users can download the client.ovpn file from the Firebox and send it to the device where the OpenVPN client is installed.

Because web browsers on some mobile devices do not support file downloads, this procedure describes how to download the file to another device and email it to the mobile device as a file attachment.

To download the .ovpn profile from the Firebox:

  1. Connect to the Firebox with a web browser over port 443, unless you configured a custom port number:

https://<IP address of a Firebox interface or host name>/sslvpn.html

or

https://<IP address of a Firebox interface or host name>:<custom port number>/sslvpn.html

  1. Type your user name and password to authenticate to the Firebox.
    The Mobile VPN with SSL download page appears.
  1. Click the Download button for the Mobile VPN with SSL client profile. The file you download is called client.ovpn.
  2. Save the file to a location on your computer.
  3. Send the file as an email file attachment to the mobile user.

Import the Client Profile

To import a client profile to an Android or iOS device:

  1. Install the OpenVPN Connect app.
  2. Open the email message that contains the .ovpn email attachment.
  3. Tap the attachment to open the file in the OpenVPN Connect app.
  4. Import the .ovpn file to the VPN client to create a new connection profile.
  5. In the profile, type the Username and Password you use to authenticate to the Firebox.
  6. To start the VPN tunnel, select or turn on the VPN profile in OpenVPN Connect.

See the documentation for your OpenVPN client for more information about how to import a .ovpn file.

See Also

The Mobile VPN with SSL software enables users to connect, disconnect, gather more information about the connection, and to exit or quit the client. The Mobile VPN with SSL client adds an icon to the system tray on the Windows operating system, or an icon in the menu bar on macOS. You can use this icon to control the client software.

To use Mobile VPN with SSL, you must:

The WatchGuard Mobile VPN with SSL client v11.10.4 or higher is a 64-bit application.

If you are unable to connect to the Firebox, or cannot download the installer from the Firebox, you can Manually Distribute and Install the Mobile VPN with SSL Client Software and Configuration File.

Client Computer Requirements

For information about which operating systems are compatible with your Mobile VPN with SSL Client, see the Operating System Compatibility list in the Fireware Release Notes.

In Fireware v12.5.4 or higher, the Firebox requires the SSL VPN client to support TLS 1.2 or higher. In Fireware v12.4.1 or lower, the Firebox requires the SSL VPN client to support TLS 1.1 or higher.

Windows Requirements

To upgrade the Mobile VPN with SSL Windows client, you must have administrator privileges.

  • If a minor version update is available, but you cannot update the client version, you can still connect to the VPN tunnel.
  • If a major version update is available, but you cannot update the client version, you cannot connect to the VPN tunnel.

In Fireware v12.5.3 or higher, if the client automatically detects that an upgrade is available, but you do not have administrator privileges, a message appears that tells you to contact your system administrator for assistance. If a minor version update is available, you can select the Don't show this message again check box. This check box does not appear if a major version update is available.

In Fireware v12.5.2 or lower, if the client automatically detects that an upgrade is available, a message appears that asks you to upgrade. However, if you do not have administrator privileges, you cannot upgrade the client.

macOS Requirements

To install the Mobile VPN with SSL client on macOS, you must have administrator privileges.

In macOS 10.15 (Catalina) or higher, you must install v12.5.2 or higher of the WatchGuard Mobile VPN with SSL client. For more compatibility information, see the Fireware Release Notes.

Download the Client Software

You can download the client from the WatchGuard Software Downloads page or from the Firebox.

In Fireware v12.5.5 or higher, your web browser must support TLS 1.2 or higher to download the client from the Firebox. In Fireware v12.4.1 or lower, your web browser must support TLS 1.1 or higher to download the client from the Firebox.

To download the client from the Software Downloads page:
  1. Go to the Software Downloads page.
  2. Do one of the following:
    1. From the Select a device drop-down list, select the hardware model of the Firebox.
    2. In the text box, type the first four digits of the Firebox serial number.
  3. In the WatchGuard Mobile VPN with SSL Software section, click the Mobile VPN with SSL for Windows link or the Mobile VPN with SSL for macOS link.
    The installation file downloads to your computer.
To download the client from the Firebox:
  1. Authenticate to the Firebox with an HTTPS connection over the port specified by the administrator. The default port is 443.

Over port 443

https://<Firebox interface IP address>/sslvpn.html

https://<Firebox host name>/sslvpn.html

Over a custom port number

https://<Firebox interface IP address>:<custom port number>/sslvpn.html

https://<Firebox host name>:<custom port number>/sslvpn.html

The authentication web page appears.

  1. Type your Username and Password.
  2. If Mobile VPN with SSL is configured to use more than one authentication method, select the authentication server from the Domain drop-down list.
    The Mobile VPN with SSL download page appears.
  1. Click the Download button for the correct installer for your operating system: Windows (WG-MVPN-SSL.exe) or macOS (WG-MVPN-SSL.dmg).
  2. Save the file to your computer.

From this page, you can also download the Mobile VPN with SSL client profile for connections from any SSL VPN client that supports .OVPN configuration files. For more information about the Mobile VPN with SSL client profile, see Use Mobile VPN with SSL with an OpenVPN Client.

In Fireware v12.5.4 or higher, you can disable the software downloads page hosted by the Firebox. If you disable this page, users cannot download the Mobile VPN with SSL client from the Firebox. Users can download the client from the WatchGuard website, or you can manually distribute the client to your users. For more information, see Plan Your Mobile VPN with SSL Configuration.

Install the Client Software

To install the client in Windows:
  1. Double-click WG-MVPN-SSL.exe.
    The Mobile VPN with SSL client Setup Wizard starts.
  2. Accept the default settings on each screen of the wizard.
  3. (Optional) To add a desktop icon or a Quick Launch icon, select the check box in the wizard that matches the option.
  4. Finish and exit the wizard.
To install the client in macOS:

Firebox Ssl Download Free

Firebox
  1. Make sure that the System Preferences > Security and Privacy settings on your Mac allow apps downloaded from Mac App Store and identified developers. This is the default setting.
  2. Double-click WG-MVPN-SSL.dmg.
    A volume named WatchGuard Mobile VPN is created on your desktop.
  3. In the WatchGuard Mobile VPN volume, double-click WatchGuard Mobile VPN with SSL Installer <version>.mpkg.
    The client installer starts.
  4. Accept the default settings on each screen of the installer.
  5. Finish and exit the installer.

After you download and install the client software, the Mobile VPN client software automatically connects to the Firebox. Each time you connect to the Firebox, the client software verifies whether any configuration updates are available.

Connect to Your Private Network

To start the Mobile VPN with SSL client in Windows, do one of the following:
  • From the Start Menu, select All Programs > WatchGuard > Mobile VPN with SSL client > Mobile VPN with SSL client.
  • Double-click the Mobile VPN with SSL shortcut on your desktop.
  • Click the Mobile VPN with SSL icon in the Quick Launch toolbar.
To start the Mobile VPN with SSL client on macOS:
  1. Open a Finder window.
  2. Select Applications > WatchGuard.
  3. Double-click the WatchGuard Mobile VPN with SSL application.

Specify the Client Connection Settings

After you start the Mobile VPN with SSL Client, to start the VPN connection, you must specify the authentication server and user account credentials. Mobile VPN with SSL does not support Single Sign-On (SSO).

The Server is the IP address of the primary external interface of a Firebox, or an FQDN that resolves to that IP address. If Mobile VPN with SSL on the Firebox is configured to use a port other than the default port 443, in the Server text box, you must type the IP address or FQDN followed by a colon and the port number. For example, if Mobile VPN with SSL is configured to use port 444, and the primary external IP address is 203.0.113.2, the Server is 203.0.113.2:444.

The User name format depends on which authentication server the user authenticates to. For example, if the Firebox configuration includes multiple authentication servers, you must specify the authentication server in the User name text box. The User name must be formatted in one of these ways:

To use the default authentication server

Type the user name. Example: j_smith

To use another authentication server

Type the authentication server name or domain name, and then type a backlash () followed by the user name. Example: <server.example.com><j_smith>.

Firebox Vpn Download

Active Directory — ad1_example.comj_smith

Firebox-DB — Firebox-DBj_smith

RADIUS (Fireware v12.5 or higher) — rad1.example.comj_smith or RADIUSj_smith. You must type the domain name specified in the RADIUS settings on Firebox.

RADIUS (Fireware v12.4.1 or lower) — RADIUSj_smith. You must always type RADIUS.

If your configuration includes a RADIUS server, and you upgrade from Fireware v12.4.1 or lower to Fireware v12.5 or higher, the Firebox automatically uses RADIUS as the domain name for that server. To authenticate to that server, you must type RADIUS as the domain name. In this case, if you type a domain name other than RADIUS, authentication fails.

To connect to your private network from the Mobile VPN with SSL client:

  1. In the Server text box, type or select the IP address or name of the Firebox to connect to.
    The IP address or name of the server you most recently connected to is selected by default.
  2. In the User name text box, type the user name.
    If Mobile VPN with SSL on the Firebox is configured to use multiple authentication methods, specify the authentication server or domain name before the user name. For example, ad1_example.comj_smith.
  3. In the Password text box, type the password for your user account.
    The client remembers the password if the administrator configured the authentication settings to allow it.
  4. Click Connect.

If the connection between the SSL client and the Firebox is temporarily lost, the SSL client tries to establish the connection again.

To troubleshoot connection issues, see Troubleshoot Mobile VPN with SSL.

Other Connection Options

Two other connection options are available in the client only if the administrator has enabled them on the device you connect to.

Automatically reconnect

Select the Automatically reconnect check box if you want the Mobile VPN with SSL client to automatically reconnect when the connection is lost.

Watchguard Ssl Vpn

Remember password

Select the Remember password check box if you want the Mobile VPN with SSL client to remember the password you typed for the next time you connect.

Mobile VPN with SSL Client Controls

When the Mobile VPN with SSL client runs, the WatchGuard Mobile VPN with SSL icon appears in the system tray (Windows) or on the right side of the menu bar (macOS). The type of magnifying glass icon that appears shows the VPN connection status.

Windows:

  • — The VPN connection is not established.
  • — The VPN connection is established. You can securely connect to resources behind the Firebox.
  • — The client is in the process of connecting or disconnecting. The 'W' letter in the icon pulsates.
  • — The client cannot connect to the server. Verify that the server IP address, user name, and password are correct. To troubleshoot further, check the client logs for Mobile VPN with SSL.

macOS:

  • — The VPN connection is not established.
  • — The VPN connection is established. You can securely connect to resources behind the Firebox.
  • — The client is in the process of connecting or disconnecting. The 'W' letter in the icon pulsates.
  • — The client cannot connect to the server. Verify that the server IP address, user name, and password are correct. To troubleshoot further, check the client logs for Mobile VPN with SSL.

macOS (Dark Mode):

  • — The VPN connection is not established.
  • — The VPN connection is established. You can securely connect to resources behind the Firebox.
  • — The client is in the process of connecting or disconnecting. The 'W' letter in the icon pulsates.
  • — The client cannot connect to the server. Verify that the server IP address, user name, and password are correct. To troubleshoot further, check the client logs for Mobile VPN with SSL.

To see the client controls list, right-click the Mobile VPN with SSL icon in the system tray (Windows), or click the Mobile VPN with SSL icon in the menu bar (macOS). You can select from these actions:

Connect/Disconnect

Firebox Ssl Update

Start or stop the Mobile VPN with SSL connection.

Status

See the status of the Mobile VPN with SSL connection.

View Logs

Open the connection log file.

Properties

Windows — Select Launch program on startup to start the client when Windows starts. Type a number for Log level to change the level of detail included in the logs.

macOS — Shows detailed information about the Mobile VPN with SSL connection. You can also set the log level.

Show Time Connected (macOS only)

Select to show the elapsed connection time on the macOS menu bar.

Show Status While Connecting (macOS only)

Select to show the connection status on the macOS menu bar.

About

The WatchGuard Mobile VPN dialog box opens with information about the client software.

Exit (Windows) or Quit (macOS)

Disconnect from the Firebox and shut down the client.

See Also