WatchGuard Firebox System 4.6 User Guide

Configuring the Firebox for Remote User PPTPConfiguring the Firebox for Remote User PPTPConfiguring the Firebox for Remote User PPTP requires that you perform thefollowing:• Enter IP addresses and networks used for clients• Add usernames to the built-in Firebox User group pptp_users• Activate the Remote User PPTP feature• Configure service properties using pptp_users• Verify WINS and DNS server settingsActivating Remote User PPTPIf you want to set up RUVPN for users behind a Firebox (connecting toanother Firebox), they must be on a public subnet, and the wg_pptp serviceicon must be added in the Services Arena. Or, create a BOVPN tunnel.The first step to configuring Remote User PPTP is to activate the feature. ActivatingRemote User PPTP adds the wg_pptp service icon to the Services Arena. The icon isvisible only in the Advanced view of Policy Manager. The wg_pptp icon rarelyrequires modification. WatchGuard recommends leaving wg_pptp in its defaultsettings. From Policy Manager:1 Select Network => Remote User. Click the PPTP tab.2 Enable the Activate Remote User checkbox.3 If necessary, enable the Enable Drop from 128-bit to 40-bit checkbox.In general, the encryption drop control is used only by international customers.Entering IP addresses for Remote User sessionsRemote User PPTP supports only 50 concurrent sessions, but you can configure avirtually unlimited number of client computers. The Firebox dynamically assigns anopen IP address to each incoming RUVPN session from a pool of available addressesuntil this number is reached. After the user closes a session, the address reverts to theavailable pool and can be assigned to the next user who attempts to log on.Use Policy Manager to assign individual addresses or a single network to theavailable pool. The safest method is to fabricate a Secondary Network address (see“Adding a secondary network” on page 38) and choose the IP addresses from thatnetwork range. That way, you draw from a range of addresses already declared toPolicy Manager, but which cannot clash with real host addresses in use behind theFirebox. Using this method, you must also configure the client machine to use thedefault gateway on the remote host (see “Configuring the remote host for RUVPNwith PPTP” on page 145).From the Remote User Setup dialog box:1 Click the PPTP tab.2 Click Add.136