Configure Mobile VPN with SSL for a Cloud-Managed Firebox

1. In the Mobile VPN with SSL configuration, go to the Firebox Addresses section.
2. In the Primary text box, enter the IP address or domain name.
3. (Optional) If your Firebox has more than one external address, enter a Backup IP address or domain name.

If you enter a backup IP address or domain name, the VPN client automatically tries to connect to that IP address or domain after a failed connection attempt. To use these backup connection settings, you must also select Auto reconnect after a connection is lost on the Advanced tab.

1. In the Mobile VPN with SSL configuration, go to the Authentication Domains section.

2. Click Add Authentication Domains.
   The Add Authentication Domains page opens.

3. Select the authentication domains for user authentication.
   The authentication domains that you select appear at the end of the Authentication Domains list.
4. The first server in the list is the default authentication domain. To change the order, click the move handle and drag the domain up or down.
5. Click Add.

1. In the Mobile VPN with SSL configuration, go to the Users and Groups section.

2. To add a Firebox Database user:
   1. Click Add Users > Add Firebox Database Users.
      The Add Users page opens.
   2. Enter the Name of the user.
   3. (Optional) Enter a Description for the user.
   4. Enter a Password for the user. The password length must be 8 to 32 characters.
   5. Enter the Timeout value, in seconds. The default value is 28880 seconds (8 hours). This is the maximum amount of time a user can remain connected to the VPN.
   6. Enter the Idle Timeout value, in seconds. The default value is 1800 seconds (30 minutes). This is length of time a user can remain connected to the VPN when idle.
3. To add authentication domain users, from the Users and Groups section:
   1. Click Add Users.
   2. Select the check box for each user to add to Mobile VPN with SSL.
   3. Click Add.
      The users that you selected appear in the Users list.
4. To add an authentication domain group, from the Users and Groups section:
   1. Click Add Groups.
   2. Select the check box for each group to add.
   3. To remove a user or group from the mobile VPN configuration, in the row for that user or group, click .

5. Click Add.
   The groups that you selected appear in the groups list.

1. In the Mobile VPN with SSL configuration, go to the Virtual IP Address Pool section.
2. Click the IP address of the pool.
   The Add Virtual IP Address Pool dialog box opens.
   

   

3. Type a different IP address and netmask.
4. Click Update.

1. In the Mobile VPN with SSL configuration, go to the Virtual IP Address Pool section.
2. In the Virtual IP Address Pool section, click .
3. To add IP addresses to the pool, click Add Virtual IP Address Pool. 
   The Add Virtual IP Address Pool dialog box opens.
   

   

4. Type an IP address and netmask.
5. Click Add.

1. In the Networking section, select the method the Firebox uses to send traffic through the VPN tunnel.

   Force all client traffic through the tunnel

   Select this option to route all traffic from the VPN client to your private network and to the Internet through the tunnel. This option sends all external traffic through the Firebox policies you create and offers consistent security for mobile users. This option requires more Firebox processing power, which can affect performance. This is the default setting. This option is also known as full tunneling or default route.

   Allow access to all Internal and Guest networks

   This option routes only traffic to private network resources through the Firebox. Other traffic to the Internet does not go through the tunnel and is not restricted by the policies on your Firebox. This option is also known as split tunneling.

   Specify allowed resources

   Select this option to restrict Mobile VPN with SSL client access to only specified devices on your private network. This option is also known as split tunneling.

If you select this option, click Add Network, select the network, and click Add.

2. In the Reconnection section, select one or more options.

   Auto reconnect after a connection is lost

   If you select this option, users can select a check box on the Mobile VPN with SSL client to control whether the client automatically reconnects. This option is selected by default.

   Force users to authenticate after a connection is lost

   We recommend that you select this option if you use a multi-factor authentication method with a one-time password. After a lost connection, auto reconnect might fail if users do not enter a new one-time password.

   Allow the Mobile VPN with SSL client to remember the password

   If you select this option, users can select a check box in the Mobile VPN with SSL client to control whether the client remembers the password. This option is selected by default.

3. In the Data Channel section, configure the channel settings.

   Data Channel

   Mobile VPN with SSL uses the data channel to send data after the VPN connection establishes. The default protocol and port is TCP 443. If you enter a different port, users must manually type the port in the Mobile VPN with SSL connection dialog box (example: 203.0.113.2:444).

   If you select TCP, the configuration channel automatically uses the same port and protocol. If you select UDP, you can set the configuration channel protocol to TCP or UDP, and you can use a different port than the data channel.

   Configuration Channel

   The Configuration Channel determines how users download the Mobile VPN with SSL client software from the Firebox.

   The default Configuration Channel is TCP 443. If you keep the default setting, users download the Mobile VPN with SSL client software from
   https://[Firebox IP address or FQDN]/sslvpn.html.

   If you change the default Configuration Channel, users must specify the port number in the URL (https://[Firebox IP address or FQDN]:<444>/sslvpn.html).

4. (Optional) In the Tunnel Security section, select Use Custom Settings. You can configure these options:

   Authentication method

   Select the authentication method for the connection. Authentication settings specify the authentication algorithm and hash size. You can select SHA2-256 or SHA2-512. The default setting is SHA2-256.

   Encryption method

   Select an encryption method to encrypt the traffic. Encryption settings specify the encryption algorithm and key length. You can select AES-CBS or AES-GCM algorithms that are 128-, 192-, or 256-bit strength.

   We recommend AES-GCM algorithms, which typically provide the best performance for most Firebox models. GCM includes built-in authentication, which means a separate authentication algorithm does not have to be calculated. The default setting is AES-CBC (256-bit).

   Keep-Alive Interval

   Enter a Keep-Alive Interval value (in seconds). This setting controls how often the Firebox sends traffic through the tunnel to keep the tunnel active when no other tunnel traffic exists. The default value is 10 seconds.

   Enter a Keep-Alive Timeout

   Enter a Keep-Alive Timeout value (in seconds). This setting controls how long the Firebox waits for a response. If no response arrives before the timeout value, the Firebox closes the tunnel, and the VPN client must reconnect. The default value is 60 seconds.

   Renegotiate Data Channel

   Enter a Renegotiate Data Channel value (in minutes). If a Mobile VPN with SSL connection has been active for the amount of time specified in the Renegotiate Data Channel text box, the Mobile VPN with SSL client must create a new tunnel. The default value is 480 minutes (8 hours). The minimum value is 60 minutes.

5. (Optional) To use an internal DNS server, in the DNS section, select an option:

Use Network DNS settings

If you select this option, mobile clients use the internal DNS server that you configured on your cloud-managed Firebox. For information about internal DNS servers, see Configure Firebox DNS Settings.

Assign Network DNS settings

If you select this option, mobile clients use the domain name suffix, DNS servers, and WINS servers that you enter in this section. For example, if you specify example.com as the domain name and 10.0.1.53 as the DNS server, mobile clients use example.com for unqualified domain names and 10.0.1.53 as the DNS server.