VPN SSL & IPSEC

Guy

Right now just looking for a quick answer concerning Watchguard VPN's. A while back we were told we could only run one vpn, so since most of the users were field, we setup using SSL. Since then we have replaced that router with a T70, and set it up the same as the old using only the SSL vpn client. We now have the need to make a VPN connection that is required to be IPSec. Can I do both, or would I have to change my field systems to IPSec, drop the SSL and deal with the port blocking problems from hotels and such?
Thanks

Bruce_Briggs

You got the wrong info.
You can set up all 4 client VPN types in XTM, and can have users accessing the firewall using the one that suits them best.
You could potentially have various users accessing the firewall using each of them.
I regularly access my firewall using IPSec, SSLVPN or IKEv2.

Bruce_Briggs

Not that I have seen.

Guy

Thanks for that quick answer! You mention IKEv2, do you know if the current WG firmware supports IKEv3?

james.carson

Hi @Guy

SSL, and L2TP have their own independent user counts. IPSec and IKEv2 share the same count between each other.

This article has a decent licensing overview about halfway through it:

(How can I help my users work remotely during the COVID-19 crisis?)
https://watchguardsupport.secure.force.com/publicKB?type=Article&SFDCID=kA10H000000g61aSAA&lang=en_US

If you're looking for an explanation about what VPN does what, and what to choose, I'd suggest checking this article out:

(Select a Mobile VPN Type)
https://www.watchguard.com/help/docs/help-center/en-US/Content/en-US/Fireware/mvpn/general/mobile_vpn_types_c.html

Glenn

Hi Guys, I always lost internet connection when I'm trying to connect to IPSec VPN and when IPSec is up I cannot access the other side but I can access the WSM. Pls help.

Bruce_Briggs

"lost internet connection" when you are connected too ?
If so, check your Dynamic NAT entries. The default is to have 3 of them, 1 for each of the private supernets.
https://www.arin.net/reference/research/statistics/address_filters/
Also make sure that you have a policy which allow Internet access from IPSec-Users.

WSM is Windows software. What do you mean by this?

Can not access what other side?

We clearly need more info here.