Firebox - VPN Branch Office — WatchGuard Community

VPN Problems with new WG T-Models and Fireware 2025.1.2

PTec — Sat, 08 Nov 2025 13:55:08 +0000

Hello,
we got a lot of trouble with the new T145 and Fireware 2025.1.2.
So far we did a lot of tests and every time we have the same problem with the VPN Upload (BOVPN and MUVPN speed.

What we did and tried so far:
1. Took the configuration file from a functional T55 with Fireware 12.11.4. Changed the Firewall model and the Feature Key and imported the configuration to the T145.
-> Problem: Upload speed over VPN very slow. And when I say slow I mean kb/s or no speed!
2. We took the configuration file then from the T145 and did an Import to a M270 with Fireware 12.11.4.
-> No Problem on the M270. Full VPN Speed in upload and download.
3. We reseted the T145 to Factory default and configured a new configuration.
-> Problem: Upload speed over VPN again very slow.
4. We bought a new T145. Configuerd the box this time with Cloud Management. Configured the BOVPN to a Firebox T45 with Fireware 12.11.4.
-> Problem: Upload speed over VPN again very slow.

And we also followed the best Practise Guide from WatchGuard for BOVPN!

Has somebody else BOVPN Upload Problems with the new devices and Fireware 2025.11.2?

BOVPN issue with T115 & T125

Michele — Fri, 05 Dec 2025 22:16:17 +0000

Hello,
Today i have changed cluster of T55 with a cluster of T125.

After boot, the bovpn to another Watchgard M390 on Datacenter it’s worked fine, but after an hour, a lot of pc cannot connect to server on Datacenter, someome work other no.

The problem seem to a mtu issue,

Anyone have the same problem ?

BoVPN issue - no route

Leonid — Tue, 17 Feb 2026 18:53:05 +0000

Hi
I have a BoVPN tunnel between two fireboxes up and running. Interface 1 on the remote firebox has Ip 192.168.71.100. I am trying to ping it from 192.168.21.199 and do not hear back.
The route is 192.168.21.0 - 192.168.71.0 bidirectional. I also have a BoVPN allow policy from the tunnel to any. Below is what I get from BoVPN debug. Why does it say I do not have a policy?

thanks

A possible problem was detected in the internal security policies for tunnel KZ.A correction to this error was attempted.
Recommendation: Send traffic to a host on the remote network, and run the report again.
Tunnel Name: MM
tunnel route#1(192.168.21.0/24<->192.168.71.0/24) - Established
Incoming traffic was NOT detected for this tunnel after the diagnostic report started.
Outgoing traffic was NOT detected for this tunnel after the diagnostic report started.
The outgoing traffic for tunnel route (192.168.21.0/24<->192.168.71.0/24) is denied by firewall policy (No route).
Recommendation: Check your firewall policy configuration.
The incoming traffic for tunnel route (192.168.71.0/24<->192.168.21.0/24) is denied by firewall policy (Inconclusive).
Recommendation: Check your firewall policy configuration.

Watchguard to OPNsense Firewall VPN IPSEC IKE2

Marco_R — Wed, 04 Feb 2026 17:48:17 +0000

Hello everyone in the forum,

I am currently trying to establish an IPsec IKEv2 connection between an OPNsense firewall and a Fritzbox. However, the connection setup is not working and I get the error message "no proposal sent".

Does anyone perhaps have a guide or instructions on what I need to configure in the OPNsense firewall so that the connection works?

Thank you very much and best regards,
Marco

need help accessing secondary network on a an interface from bovpn

chris_new_old_it_guy — Mon, 02 Feb 2026 03:15:01 +0000

Ok I know I'm done bashing my head I need to access a secondary net work on an interface from a bovpn I know it need a policy and probably something else any help between my wife being in and out of the hospital and and me inheriting a real bad network that has been patched worked together and no time to tear it down I'm losing my mind

BOVPN error after upgrade: "No response for IKE_SA_INIT request message"

Chris456 — Sat, 10 Jan 2026 10:56:01 +0000

Hello,

We got this error after upgrading our M270 cluster to the latest firmware 12.11.6 (from 12.11.4).

We then switched from M270 to M295 fireboxes. They were running fine on 2025.1.2 firmware. But when we upgraded them to v2025.1.4 we got the same error ("No response for IKE_SA_INIT request message") and the Branch Office VPN could not be established. So we downgraded them again.

Could it be that we have BOVPN settings that conflicts with the new firmware versions? Or what else could be the issue?

Thanks, Chris

Secure Access to Branch Office VPNs that Use IPSec and IKEv2

Norman — Thu, 08 Jan 2026 09:19:46 +0000

https://techsearch.watchguard.com/KB?type=Article&SFDCID=kA1Vr000000DMXNKA4&lang=en_US

what about , skipping step 1
and add ddns names to step 2 or 3

this would still allow Dynamic Peer BOVPN

mfg
norman

BOVPN to Fortigate

Andy_TCT — Wed, 01 Oct 2025 22:47:42 +0000

I'm trying to setup a BOVPN with a couple of Fortigate Firewalls. Two seperate jobs not related. I've worked through the WatchGuard guide and tried numerous other combinations without success. Does anyone have a known working set of parameters please and has anyone ever got one working?

Thanks

Andy.

One way BOVPN

Maarten — Fri, 05 Dec 2025 12:58:30 +0000

I have successfully configured a BOVPN between the office Watchguard and the datacenter Watchguard. I am able to reach all servers in the DC from my laptop in the office and can copy files from and to my laptop. I have recently added a NAS at the Office building, to have a second location NAS. I don't seem to be able to reach the Office NAS from the Datacenter Backup Server.
I have configured the tunnels with all subLAN's on both fireboxes. When looking at the traffic monitor, it seems the ping-command is able to get out, but no response is given, not even a denied.

Where else can I look for this issue?

zero route breaks BOVPN

Leonid — Thu, 30 Oct 2025 20:24:17 +0000

Hello,

I have a properly working IPsec tunnel between Site A and Site B with the current configuration:
192.168.89.0/24 ⇔ 192.168.70.0/24

I now want to convert this to a zero-tunnel route to send all traffic from Site A to the internet via Site B and apply traffic rules at Site B.

I modified the tunnel configuration as follows:

Site A: ANY ⇔ 192.168.70.0/24
Site B: 192.168.70.0/24 ⇔ ANY
After this change, the tunnel went down. Side B's traffic monitor shows:
Reason=Received unacceptable traffic selector in CREATE_CHILD_SA request.

NAT on both sides is configured with 192.168.0.0/16 to any External.

Any thoughts on why this is failing and how to resolve it?

Many thanks.

Create BOVPN tunnel between locally managed firebox with DDNS and cloud-managed FB

Leonid — Sun, 12 Oct 2025 18:39:25 +0000

Hello,

I'm having trouble creating a BOVPN tunnel between a locally-managed Firebox (FB) and a cloud-managed device.

On the locally-managed side, I'm using afraid.org DDNS. I created an A record: myname.chickenkiller.com.

Here comes the first confusion. Afraid.org states on their router setup page:

Select 'freedns.afraid.org' in the drop-down menu, then enter:

Username: guest
Password: guest
Hostname: dns_name,update_key
However, in the WatchGuard documentation, it says: "Type the Password you used to set up your dynamic DNS account."

So, I tried both ways without any change.

The cloud-managed Firebox's BOVPN Endpoint B is set to myname.chickenkiller.com. This hostname correctly resolves to my external IP.

Currently, I am getting the following error in the logs:
2025-10-12 21:23:31 iked (192.168.8.68<->XX.XX.XX.XX) IKEv2 IKE_AUTH exchange from 192.168.8.68:4500 to XX.XX.XX.XX:4500 failed. Tunnel='tunnel.1'. Reason=Received N(AUTHENTICATION_FAILED) message.

I get the same message even if I put a wrong endpoint name (like mname.chickenkiller.com) in the cloud-managed FB. This leads me to believe something is wrong with the DDNS configuration.

I have the option "Allow the dynamic DNS provider to determine the IP address" enabled on both sides.

Have anybody had any luck with afraid.org?

Many thanks

Quick (hopefully) VPN question T40 & gateways & tunnels

beastwez — Tue, 30 Sep 2025 12:09:43 +0000

Hi clever people.

Quick one we've a head office (site 1) with a T40.
We've got site number 2 with a draytek, connected via "gateway.1" and "tunnel.1", and IKEv1.
We've now got site number 3 with another draytek and I need to do the same as site number 2.

Do I just clone tunnel and change the IP address in the settings of the new tunnel?
Or do I need to set up another gateway also etc?

Thanks in advance

Custom Modem Interface

AschildmeyerSTR — Wed, 17 Sep 2025 15:49:13 +0000

I all I have two different fiber connections at our location, and everything works wonderfully. We recently had our demarcation room flood causing all carrier equipment to get wiped out. To work around this, we are getting T-Mobile business internet. They are sending this device https://inseego.com/products/5g-indoor-routers/fx4100/#product-specifications

My plan is to put it into bridge mode and add it as an extra interface on my M290. However, for the VPN's I don't want to leverage those as on the Azure side there is no way to change BGP priority, so everything is ECMP always. I noticed a modem interface can be used to come online for a bovpn interface. However, that looks like a USB device...

Is there a way to create a custom modem interface that only brings up a site to site tunnel on this third external interface that is driven by this 5G modem over ethernet only when the first two connections are offline? Or is my only option to bring the interface up manually if an issue arises?

Active-Active BOVPN with Azure Virtual WAN using BGP?

GPARRA — Sun, 14 Sep 2025 01:09:40 +0000

Hi All,

We are migrating a customer's BOVPN that connects with a single Azure VPN Gateway to an Azure Virtual WAN VPN Gateway with 2 instances in Active-Acitve configuration.

I created two BOVPN Virtual Interfaces in the WatchGuard using IKEv2 and BGP for both, the VPN connections are established without errors and azure shows both BGP sessions are connected (one to each Azure VPN Gateway).

The problem is that the WatcGuard is only adding the routes to one of the BOVPN Virtual Interfaces, seems like whichever connects last, the other Virtual Interface shows no routes. Communication from local networks to azure works fine but from azure to local networks is dependent on which VPN connection is used by Azure to send packets, anything sent using the BOVPN with the routes works fine, anything send on the one without does not, so the communication from azure to local is a ht and miss...

If I disable one of the Virtual Interfaces (does not matter which one, both do the same) then the other one gets the routes and as Azure stops sending packets through the one that is down then everything works fine but it defeats the purpose of having an expensive Active-Active setup in Azure if you are only using one and have to do manual failover on the WatchGuard side, plus, half the potential bandwidth...

Shouldn't the WatchGuard add the routes advertised through BGP to both Virtual Interfaces and use ECMP to balance both connections?

BGP configuration is pretty simple:

!
! The local BGP ASN is 10001
!
router bgp 10001

!
! Azure Virtual WAN VPN (Instance0)
neighbor 10.10.10.13 remote-as 65515
neighbor 10.10.10.13 activate
neighbor 10.10.10.13 ebgp-multihop
!
! Azure Virtual WAN VPN (Instance1)
neighbor 10.10.10.12 remote-as 65515
neighbor 10.10.10.12 activate
neighbor 10.10.10.12 ebgp-multihop

!
! Local networks to Advertise
network 172.20.0.0/24

Has anyone been able to get an Active-Active BOVPN with Azure working properly?

BOVPN Randomly Dropping

kwhood67 — Wed, 04 Jan 2023 17:59:45 +0000

I have a client that has two locations. The main location has a M290 and Spectrum Business and the secondary location has a T35 and Spectrum Business. The BOVPN will randomly drop, and I have to reboot the M290 for the tunnel to connect again. Rebooting the T35 does not restore the tunnel. I contacted WG support, and they said to reboot the Spectrum modem and not the firewall when the BOVPN goes down again. When the tunnel went down last week, I rebooted the Spectrum modem at the main location, and the BOVPN came back up. I called Spectrum support, and they said nothing was wrong with their modem and router. However, Spectrum is going to replace the modem and router today. The Internet works fine at both locations when the BOVPN goes down. Spectrum has a router between the modem and M290 that serves at the gateway. Both locations have a static IP Address on the WAN side of the firewalls. Has anybody run into this issue before?

Speed Problem

Lacin — Mon, 18 Aug 2025 14:00:47 +0000

Hello everyone, I'm trying to set up a BOVPN between branches. I can install it without any problems, but the speed is extremely slow, even at the byte level. Even though the connection (tunnel) appears, I can't communicate. How can I resolve this? I'm using an M290, M390, and T45.

BOVPN VIF from cloud managed to locally managed firebox

Leonid — Sat, 02 Aug 2025 22:35:12 +0000

Hello,
I am struggling to establish a connection between cloud-based firebox and locally managed one. my logs are%

25-08-03 01:00:11 iked (XXX.XXX.XXX.94<->XXX.XXX.XXX.86)******** RECV an IKE packet at XXX.XXX.XXX.94:500(socket=14 ifIndex=4) from Peer XXX.XXX.XXX.86:500 ********
2025-08-03 01:00:11 iked (XXX.XXX.XXX.94<->XXX.XXX.XXX.86)Received IKEv2 "CREATE_CHILD_SA response" message with message-ID:11 length:480 SPI[i=003f59e5ac1aa8e7 r=721e0c1074f400c6]
2025-08-03 01:00:11 iked (XXX.XXX.XXX.94<->XXX.XXX.XXX.86)"CREATE_CHILD_SA response" message has 1 payloads [ ENCR(sz=452)]
2025-08-03 01:00:11 iked (XXX.XXX.XXX.94<->XXX.XXX.XXX.86)Got IKE policy 'BovpnVif.1' from ikeSA(0x21d7f278)
2025-08-03 01:00:11 iked (XXX.XXX.XXX.94<->XXX.XXX.XXX.86)"CREATE_CHILD_SA response" message has 5 payloads [ SA(sz=52) NONCE(sz=36) KE(sz=264) TSi(sz=24) TSr(sz=24)]
2025-08-03 01:00:11 iked (XXX.XXX.XXX.94<->XXX.XXX.XXX.86)IKEv2 "CREATE_CHILD_SA response"'s decrypted message contains 5 payloads [ SA(sz=52) NONCE(sz=36) KE(sz=264) TSi(sz=24) TSr(sz=24)]
2025-08-03 01:00:11 iked (XXX.XXX.XXX.94<->XXX.XXX.XXX.86)dispatch the received CREATE_CHILD_SA response message - IkeSA(0x21d7f278)'s state=MATURE
2025-08-03 01:00:11 iked (XXX.XXX.XXX.94<->XXX.XXX.XXX.86)Peer proposed selector[1/1]: from[0-255.255.255.255/0-65535] <-> to[0-255.255.255.255/0-65535], proto=47
2025-08-03 01:00:11 iked (XXX.XXX.XXX.94<->XXX.XXX.XXX.86)BVPN-VIF: bvpn interface enabled. use IP(XXX.XXX.XXX.94) as local to match IP in received selector (0)
2025-08-03 01:00:11 iked (XXX.XXX.XXX.94<->XXX.XXX.XXX.86)IKEv2 CREATE_CHILD_SA exchange from XXX.XXX.XXX.86:500 to XXX.XXX.XXX.94:500 failed. Gateway-Endpoint='BovpnVif.1'. Reason=Received unacceptable traffic selector in CREATE_CHILD_SA response.
2025-08-03 01:00:11 iked (XXX.XXX.XXX.94<->XXX.XXX.XXX.86)delete childState(0x21d82988) and free SPI nodes
2025-08-03 01:00:11 iked (XXX.XXX.XXX.94<->XXX.XXX.XXX.86)childState(0x21d82988) state change: EXCHANGING ==> DEL, reason: "Free the Child State"
2025-08-03 01:00:11 iked (XXX.XXX.XXX.94<->XXX.XXX.XXX.86)stop the retry object(0x21d59b88) for the previous request message(name=CREATE_CHILD_SA request, msgId=11)
2025-08-03 01:00:21 iked (XXX.XXX.XXX.94<->XXX.XXX.XXX.86)******** RECV an IKE packet at XXX.XXX.XXX.94:500(socket=14 ifIndex=4) from Peer XXX.XXX.XXX.86:500 ********
2025-08-03 01:00:21 iked (XXX.XXX.XXX.94<->XXX.XXX.XXX.86)Received IKEv2 "INFO request" message with message-ID:13 length:80 SPI[i=003f59e5ac1aa8e7 r=721e0c1074f400c6]

I understand that error is initiated by cloud based FB here
2025-08-03 01:00:11 iked (XXX.XXX.XXX.94<->XXX.XXX.XXX.86)Peer proposed selector[1/1]: from[0-255.255.255.255/0-65535] <-> to[0-255.255.255.255/0-65535], proto=47
but I do not understand where to fix this. My networks for VIF are 192.168.21.0/24 ol locally managed and 192.168.61.0/24 on cloud managed FB. I triple checked that phase 2 is identical on both machines.
Any help is highly appreciated !

thanks

BOVPN Watchguard M390 to Draytek

Florian — Mon, 28 Jul 2025 14:12:59 +0000

Hi,
I have a WatchGuard M390 at a branch office and a DrayTek 3910 router at the main site.
I've set up a Branch Office VPN using IKEv2.
Unfortunately, the VPN connection occasionally drops.

Today it ran fine for about 5 hours, but within the past hour, it has disconnected twice.
When I use “Rekey Selected BOVPN Tunnel” in WatchGuard System Manager, the tunnel comes back up and works again—for a while.

I couldn’t find anything helpful in the Traffic Monitor logs.
The firewall was just deployed at this location today.

Is there anything I might need to adjust or fine-tune?

IPSec Local Gateway Issue

mtavukcuoglu — Sun, 27 Jul 2025 00:55:59 +0000

Merhaba,
Uzak şubemiz ile ipsec bağlantısı kurmaya çalışıyoruz. Bağlantı kurmaya çalıştığımda ipsec bağlantısı kurulamıyor. hatayı incelediğimde external üzerinden değil mpls üzerinden bağlantı kurmaya çalıştığını görüntülüyorum.

Firebox üzerinde network yapılandırmam aşağıdaki gibi.

0 external
1 servers
2 mpls

Phase1 i kurarken local gateway olarak external seçili ve çıkış ip adresim yazılım. konfigürasyonu defalarca kontrol ettim ama başarılı olamadım. aşağıdaki çıktıları inceleyip yol gösterirseniz çok memnun olurum.

*** WG Diagnostic Report for Gateway "Balikesir-sube" ***
Created On: Fri Jul 25 16:43:48 2025

[Conclusion]
Unable to find an established Phase 1 Security Association (SA) for BOVPN Gateway (Balikesir-sube)'s endpoint #1
Recommendation: Review VPN log messages to identify the reason.

[Gateway Summary]
Gateway "Balikesir-sube" contains "1" gateway endpoint(s). IKE Version is IKEv1.
Gateway Endpoint #1 (name "Balikesir-sube") Enabled
Mode: Main
PFS: Disabled AlwaysUp: Disabled
DPD: Enabled Keepalive: Disabled
Local ID<->Remote ID: {IP_ADDR(1.1.1.1) <-> IP_ADDR(2.2.2.2)}
Local GW_IP<->Remote GW_IP: {1.1.1.1 <-> 2.2.2.2}
Outgoing Interface: eth0 (ifIndex=2)
ifMark=0x10000
linkStatus=0 (0:unknown, 1:down, 2:up)

[Tunnel Summary]
"1" tunnel(s) are found using the previous gateway

Name: "balikesirp2" Enabled
PFS: "Enabled" DH-Group: "5"
Number of Proposals: "1"
Proposal "ESP-AES256-SHA256"
ESP:
EncryptAlgo: "AES" KeyLen: "32(bytes)"
AuthAlgo: "SHA2-256"
LifeTime: "28800(seconds)" LifeByte: "0(kbytes)"
Number of Tunnel Routes: "1"
#1
Direction: "BOTH"
"192.168.10.0/24<->192.168.0.0/24"

[Run-time Info (gateway IKE_SA)]

[Run-time Info (tunnel IPSEC_SA)]
"0" IPSEC SA(s) are found under tunnel "balikesirp2"

[Run-time Info (tunnel IPSEC_SP)]
"1" IPSEC SP(s) are found under tunnel "balikesirp2"

1

Tunnel Endpoint: "1.1.1.1->2.2.2.2"
Tunnel Selector: 192.168.10.0/24 -> 192.168.0.0/24 Proto: ANY
Created On: Fri Jul 25 16:39:57 2025
Gateway Name: "Balikesir-sube"
Tunnel Name: "balikesirp2"

[Address Pairs in Firewalld]
Address Pairs for tunnel "balikesirp2"
Direction: BOTH
192.168.10.0/24 <-> 192.168.0.0/24

[Policy checker result]
Tunnel name: balikesirp2
#1 tunnel route 192.168.10.0/24<->192.168.0.0/24
No policy checker results for this tunnel (no P2SA found or some other error)

[Related Logs]

Jul 25 16:43:48 iked: alwaysUpTimerCb trigger autoStart for ikePcy(Balikesir-sube) ipsecPcy(balikesirp2)
Jul 25 16:43:48 iked: AUTOSTART: RECV ipecPcy(balikesirp2), ikePcy(Balikesir-sube), ifIndex(2), tunnel_src=1.1.1.1, tunnel_dst=2.2.2.2
Jul 25 16:43:48 iked: (1.1.1.1<->2.2.2.2) do the ACQUIRE action for the tunnel route [src:192.168.10.0/24 <-> dst:192.168.0.0/24], ike_ver=1, peer_udp_port=0
Jul 25 16:43:48 iked: (1.1.1.1<->2.2.2.2) ikeSAInsertToCookieHashTable: IKE SA event: Added IsakmpSA(0x6d3f50)
Jul 25 16:43:48 iked: MainMode: Start (Ct=71133) pcy [Balikesir-sube]
Jul 25 16:43:48 iked: ikeSendToWithPktInfo: sendmsg failed, ifindex:2 - error: Operation not permitted(1)
Jul 25 16:43:48 iked: StartMainMode: failed to send out 1st msg
Jul 25 16:43:48 iked: StartNegotiation: failed to start phase 1 negotiation
Jul 25 16:43:48 iked: SA Nego Fail: saHandle 0x0x84a0b8 InitMode 1, reason 2

SSLVPN and SNMP

Leo — Fri, 02 Oct 2020 15:03:19 +0000

HI,
is it possible to recive the active SSLVPN connection via SNMP trap?
If yes what is the oid number?

thank

BOVPN Notification

eichenadmin — Tue, 13 May 2025 12:29:27 +0000

Perhaps I am not remembering correctly, but I have it in my head that I used to get a notification message (via dimension) both when a BOVPN went down and when it comes back up. I now only seem to get the 'down' notification. Am I mis-remembering or did something change?

IPSec mobile VPN with Radius

jfaz11 — Tue, 27 May 2025 16:48:13 +0000

I am having issues trying to get Radius working with IPSec VPN client. I am trying to use this so that I can use Microsoft MFA.

This is the error I keep getting
2025-05-27 10:47:00 admd Authentication of MUVPN user [username] from x.x.x.x was rejected, received an Access-Reject response from the (x.x.x.x) server msg_id="1100-0005"

I setup NPS and ran the Azure MFA NPS Extension.The group exists in AD and the user is a member of the group. The VM in Azure I created an NSG rule to allow inbound UDP 1812/1813/1645/1646

Any help would be great. Thanks

BOVPN error "No response for IKE_SA_INIT request message": UPDATE: issue SOLVED

AlessandroD — Wed, 11 Aug 2021 13:19:46 +0000

Hi all,

I've this error after build up a BOVPN between a T20 and T15 Firebox but it's very strange because both Firewalls are reachable over public ip addresses, I can login into both of them and also in both firewalls I've already configured three others BOVPNs that are working properly. I've checked the max number of VPNs in my license and it's ok, I've removed and recreated the BOVPN that isn't working but without success. I've also upgrade OS to the latest possible version but without success.
Any tips?
Thx

UPDATE: issue SOLVED

New Cloud to site manged VPN interface

Jsawyer77 — Mon, 07 Apr 2025 20:08:04 +0000

We have a new M290 Firebox that is cloud managed and are tryint to create a BOVPN to one of our older M270. We have set up a new BOVPN virtual interface and see the gateway come up but the tunnel always stays inactive with the following message even if we are trying to ping from either side.

"Unable to find any active Phase 2 Security Associations (SAs) for BOVPN virtual interface VIF.
Recommendation: Confirm whether either side is currently sending traffic through the tunnel."

TIA _ Josh

Lan to Lan has a strange issue.

StuartSmithz — Fri, 28 Mar 2025 10:22:15 +0000

Hi - I have a BOVPN - Lan to Lan between a Draytek 2865ax and Watchguard T40. Draytek does the dial out to the Watchguard. I have several other Lan to Lans working fine on this watchguard. I can only get the link to work if in the tunnel I put the external WAN IP of the Drayek in as a HOST IP - where usually and with all other connections I would have Network IPv4 (eg 192.168.50.0/24 ) set with Bi-Directional. The problem with the HOST IP is that from the remote site the connection works to the watchguard, but reverse pings only can see the Draytek Router and nothing inside the network. So when I do change it to the Network IPv4 address it does not connect at all and throws up an error Gateway Statistics Error No matching tunnel route for peer proposed local:192.168.10.0/24 remote:170.39.152.32 (10:13:31 3/28/2025 - so I'm stumped !! Can anyone help me please ?

BovpnVif goes one way

Leonid — Thu, 27 Mar 2025 21:11:01 +0000

Hello,
I have two Fireboxes connected via BovpnVIF. Firebox 1 has network 192.168.21.0/24 with physical interface IP 192.168.21.100, Firebox 2 - 192.168.61.0/24 with 192.168.61.100 accordingly. While everything works fine from behind both Fireboxes I can ping 192.168.21.100 from Firebox2 diagnostic tab, but cannot do the same from Firebox 1. I can see pings on Firebox 2 but they never come back. Can somebody suggest where to look?
thanks

WatchGuard BOVPN GRE tunnel over IPSec with other vendors IPsec solutions

LauriAlo — Thu, 13 Mar 2025 13:20:54 +0000

Hello !

We have working IPsec tunnel between OPNsense and WatchGuard BOVPN (ipv4 subnets). and next want to route both IPv4 and IPv6 traffic securely over the GRE tunnel, which is carried inside the IPsec tunnel.
Is there alternative solutions how to configure BOVPN IPv4 and IPv6 traffic securely ipv4 IPsec tunnel.

Is there guide / examples to configure WatchGuard BOVPN with GRE tunnel. Is there any compatibility issues related to BOVPN ipsec site to site VPN and GRE with other solutions.

I haven found BOVPN Integration Guide that describes how other vendors solutions to configure BOVPN IPv4 and IPv6 traffic securely ipv4 IPsec tunnel.

Lauri-Alo Adamson

BOVPN over CenturyLink fiber

shaazaminator — Thu, 06 Mar 2025 19:36:46 +0000

M470 12.11
T25 12.10

Trying to create a BOVPN over a Century Link home fiber connection from the T25 to the M470 at the main office.

Century Link home fiber requires an interesting solution for a third party product (T25) to replace CL's router.

You need to create a VPN w/ID 201, configure it as an external PPOe interface with dynamic addressing to work.

Created the Gateways, Tunnels, PSK, IKEv2 and identical transform settings and nothing works.
Rekey tunnels, change transform settings, change to IKEv1 and still no luck.

I have another BOVPN from a remote office that uses a Century Link DSL connection that runs fine.
Tried copying those settings and still no luck.

VPN diagnostic report from home office M470:

[Conclusion]
BOVPN Gateway(House to Work)'s endpoint #1 has a dynamic remote IP address. The configured DNS server was unable to resolve the remote ID (xxx.xxx.xxx.xxx) to a valid IP address.
Recommendation: Ask the remote site to initiate the tunnel.

Have tried to ping devices on remote network tunnel to initiate and the ping fails.

VPN diagnostic report from remote T25W:

Conclusion]
Error Messages for Gateway Endpoint #1(name "BOVPNtoWORK")
Mar 06 11:25:20 2025 ERROR 0x02030015 Message retry timeout. Check the connection between local and remote gateway endpoints.

I can ping the remote gateway endpoint on the T25 from the M470 so I know it's good.

Any ideas or suggestions?

Thanks,

Doug

Remove AD domain from Web UI Login page

jfaz11 — Wed, 12 Mar 2025 23:28:24 +0000

Is there a way to remove the option to select the active directory domain from the web UI login page? Our DC is getting hammered with invalid login attempts.

Policy BOVPN

StefanMoore — Tue, 11 Mar 2025 15:01:26 +0000

Have a BOVPN tunnel connected and the option "Add this tunnel to the BOVPN-Allow policies" configured but cannot pass data through. log information indicate, "Found policy: policy Action: Denied Outif: Trusted" while i have no policy with that name.

Is there a built-in policy with that name, anyone know or have that same issue