WatchGuard Firebox System 4.6 User Guide

Configuring WatchGuard VPNConfiguring WatchGuard VPNUse WatchGuard VPN to implement branch office VPN between two Fireboxes.WatchGuard VPN uses udp port 4104.WatchGuard VPN offers 40-bit encryption. WatchGuard VPN with 128-bitencryption can be used when both ends of the tunnel are licensed for enhancedencryption. Other encryption standards are available (128-bit DES and 3-DES).WatchGuard VPN configuration modelsThere are two models for configuring WatchGuard VPN:Two-box configurationConnect two networks over the Internet using two Fireboxes.Multiple box configurationConnect one central Firebox to multiple remote networks over the Internet.- Add multiple VPN configurations to the central Firebox, and configure remoteFireboxes accordingly.- Make sure that passphrases are unique to a single VPN connection.- On the central Firebox, use the same IP address for multiple remote Fireboxes.However, the address can not be used for another purpose on either the centralor remote networks.Setting up WatchGuard VPNFrom Policy Manager:1 Select Network => Branch Office VPN => WatchGuard VPN.2 To set up a branch office, click Add.3 In the Remote Firebox IP field, enter the IP address of the External interface of theremote Firebox.4 In the Local Firebox IP field, enter an IP address from a reserved network not inuse on the local or remote networks.More information on reserved networks can be found in RFC 1918. You canuse the same local VPN IP address for multiple VPN connections whenspecifying more than one—for example, when there are several branch officesconnecting to a central office.5 In the text box to the left of the Add button, enter the IP address in slash notationof any remote network to which access should be granted from the local Firebox .Click Add.The remote Firebox must reciprocate by adding the local networks in its Remote Networks box.Because WatchGuard VPN is a peer-to-peer situation, each Firebox must have the other’snetwork listed.6 Click the Encryption tab.7 Under Encryption, select the number of bits used to encrypt the tunnel.The greater the number of bits, the stronger the encryption.130