WatchGuard Firebox System 4.6 User Guide

Configuring the Firebox for Mobile User VPN3 Use the Choose Type drop list to select either a host or network.You can configure up to 50 addresses. If you select a network address, Remote User PPTP willuse the first 50 addresses in the subnet.4 In the Value field, enter the host or network address in slash notation. Click OK.Enter unused IP addresses that the Firebox can dynamically assign to clients during Remote UserPPTP sessions. Selected addresses must not appear in the Blocked Sites list. The IP addressappears in the list of addresses available to remote clients.5 Repeat the add process until you have configured all addresses for use withRemote User PPTP.Rules for valid Remote User PPTP addresses• Addresses that have host routes are invalid• Traffic routed through the default gateway does not receive proxy ARP treatment• Addresses whose packets would be routed through the External interface (but notthrough the default gateway) are invalid• Addresses in networks to which you have routes are invalid (except those that arerouted through default route)• Any other packets are allowed and handled by proxy ARPConfiguring the Firebox for Mobile User VPNMobile User VPN requires careful configuration of both the Firebox and the remoteclient computers. However, unlike Remote User PPTP, the Firebox administratorretains more control over the client configuration through an end-user configurationfile. Configuring the Firebox for Mobile User VPN requires the following steps:• Obtain a license key from WatchGuard• Add user names to the built-in Firebox group ipsec_users• Enter the IPSec license key into the Firebox configuration file• Verify WINS and DNS server settings• Use Policy Manager to simultaneously configure the Firebox and create end-userconfiguration files• Configure service properties using ipsec_users• Distribute the end-user configuration files along with the RUVPN client softwareand documentationPurchasing a Mobile User VPN licenseWatchGuard Mobile User VPN is an optional feature of the WatchGuard FireboxSystem. Although the administrative tools to configure Mobile User VPN areautomatically included in the Policy Manager software, to activate the feature alicense for each installation of the client software must be purchased. To purchaseIPSec license keys, contact your local reseller or visit:http://www.watchguard.com/salesUser Guide 137