Watchguard SOHO User manual

WatchGuard® SOHO Remote Management User Guide 1
WatchGuard®SOHO
Remote Management
User Guide
The WatchGuard®SOHOTM and SOHO|tcTM both come equipped with
the SOHO Remote ManagementTM feature. This feature uses Internet
Protocol Security (IPSec) to establish a secure connection over the
Internet to a SOHO device.
This user guide applies to both the SOHO and the SOHO|tc–the
name SOHO is used to refer to both devices throughout.
Configure the SOHO for SOHO Remote Management
Flow these steps to configure your SOHO:
1 With your Web browser, go to the SOHO System Status page using
the Trusted IP address of the SOHO.
For example, if using the default IP address, go to: http://192.168.111.1
2 From the navigation bar on the right side, select Administration =>
System Security.
The System Security page appears.

2 WatchGuard® SOHO Remote Management User Guide
3 Enable the checkbox labeled System Security.
4 Enter the System Administrator Name in the appropriate field.
This name will be used as the E-mail Address when setting up the Remote
Management (MUVPN) client. In our example, Grinellster.
5 Enter the System Passphrase in the appropriate field.
This passphrase will be used as the Pre-Shared Key when setting up the
Remote Management (MUVPN) client.
6 Enter the System Passphrase again to confirm it in the appropriate
field.
7 Enable the checkbox labeled Enable SOHO Remote Management.
8 Enter the Virtual IP address which will be used by the remote
management computer when connecting to the SOHO in the
appropriate field.
In our example, 192.168.111.4.
9 Select the Authentication Algorithm.
In our example, SHA1-HMAC.

Prepare the Client Computers
WatchGuard® SOHO Remote Management User Guide 3
10 Select the Encryption Algorithm.
In our example, 3DECS-CBC.
11 Click the Submit button.
Prepare the Client Computers
A computer used as a SOHO Remote Management host must have the
following system requirements as well as each platform variation
setup properly.
System Requirements
• PC-compatible computer with Pentium processor or equivalent
• Compatible operating systems and minimum RAM:
- Microsoft Windows 98: 32 MB
- Microsoft Windows ME: 64 MB
- Microsoft Windows NT 4.0 Workstation: 32 MB
- Microsoft Windows 2000 Professional: 64 MB
• 10 MB hard disk space
• Native Microsoft TCP/IP communications protocol
• Microsoft Internet Explorer 5.0 or later
• Netscape Navigator 4.7 or later
• An Internet Service Provider account
• A Dial-Up or Broadband (DSL or Cable modem) Connection
The SOHO Remote Management MUVPN Adapter, which supports
L2TP, installs only if these network components are already installed
on your computer:
• Windows 98/ME: Dial-Up Networking
• Windows NT: Remote Access Server (RAS)
If these components are not installed, follow these instructions:

4 WatchGuard® SOHO Remote Management User Guide
Installing Remote Access Server on Windows NT
1 Select Start => Settings => Control Panel. Double-click the Network
icon.
2Select the Services tab.
3Click the Add button.
4Select Remote Access Services from the list, then click the OK button.
5Enter the path to the Windows NT install files or insert your system
installation CD, then click the OK button.
The Remote Access Setup dialog box appears.
6Click the Yes button to add a RAS capable device and enable you to
add a modem.
7Click the Add button and complete the Install New Modem wizard
NOTE
If there is no modem installed, you can enable the Don't detect my modem; I
will select it from a list checkbox then add a Standard 28800 modem.
8Select the modem added in the last step in the Add RAS Device dialog
box, then click the OK button.
9Click the Continue button, then click the Close button.
10 Reboot your computer.
Installing Dial-up Networking on Windows 98/ME
From the Windows desktop:
1 Select Start => Settings => Control Panel. Double-click the Add/
Remove Programs icon.
The Add/Remove Properties window appears.
2Click on the Windows Setup tab.
The Windows Setup dialog box appears and searches for installed components.
3Enable the Communications checkbox and click the OK button.
The Copying Files dialog box appears and copies the necessary files.
4The Dial-Up Networking Setup dialog appears and prompts you to
restart the computer. Click the OK button.
The computer reboots.

Prepare the Client Computers
WatchGuard® SOHO Remote Management User Guide 5
Windows 98/ME Platform Setup
From the Windows desktop:
1 Select Start => Settings => Control Panel. Double-click the Network
icon.
The Network window appears.
2Verify that Client for Microsoft Networks is installed.
If Client for Microsoft Networks is not installed, you must install it. For
instructions, please see the following section of this document titled,
“Installing the Client for Microsoft Networks”.
3Click the Identification tab.
4Enter a name for the remote client.
This must be a unique name on the remote network.
5Enter the domain name you are connecting to.
This should be the same as the Logon to Windows NT domain value.
6Enter a description for your computer (optional).
7Click OK. Click OK to close and save changes to the Network control
panel.
Click Cancel if you do not want to save any changes.
8Reboot the machine.
Installing the Client for Microsoft Networks
From the Networks window:
1ClicktheConfiguration tab. Click Add.
The Select Network Component Type window appears.
2Select Client. Click Add.
The Select Network Client window appears.
3Select Microsoft from the list on the left. Select Client for Microsoft
Networks from the list on the right. Click OK.
4Select Client for Microsoft Networks.
5Click Properties.
6Enable the Log on to Windows NT domain option.
7In the Windows NT Domain field, type the domain name.
For example, your domains might be sales, office, and warehouse.
8Enable the Logon and Restore Network Connections option.

6 WatchGuard® SOHO Remote Management User Guide
Windows NT Platform Setup
Adding a Domain Name to a Windows NT Workstation
Often remote clients need to connect to a domain behind the firewall.
To do this, the remote client must be able to recognize the domains to
which they belong. Adding a domain requires the installation of the
Computer Browser Network Service.
Installing the Computer Browser
From the Windows desktop:
1 Select Start => Settings => Control Panel. Double-click the Network
icon.
The Network dialog box appears.
2Click the Services tab.
3Click Add.
4Select Computer Browser.
5Browse to locate the installation directory. Click OK.
6Reboot the workstation.
Adding a New Domain
From the Windows desktop:
1 Select Start => Settings => Control Panel. Double-click the Network
icon.
The Network dialog box appears.
2Click the Protocols tab.
3Select Computer Browser. Click Properties.
4Add the remote network domain name.
You can add multiple domain names during the same configuration session.
5Click OK.
6Reboot the workstation.

Prepare the Client Computers
WatchGuard® SOHO Remote Management User Guide 7
Windows 2000 Platform Setup
From the Windows desktop:
1 Select Start => Settings => Network and Dial-up Connections, then
select the Dial-up connection you use to access the Internet.
The connection window appears.
2Click on the Properties button.
3Select the Networking tab.
4Verify that the following components are present and enabled:
- Internet Protocol (TCP/IP)
- File and Printer Sharing for Microsoft Networks
- Client for Microsoft Networks
If these components are not present they will need to be installed.
Installing the Internet Protocol (TCP/IP) Network Component
From the Windows desktop:
1 Select Start => Settings => Network and Dial-up Connections, then
select the Dial-up connection you use to access the Internet.
The connection window appears.
2Click on the Properties button.
3Select the Networking tab and then click the Install button.
The Select Network Component Type window appears.
4Double click the Protocol network component.
The Select Network Protocol window appears.
5Select the Internet Protocol (TCP/IP) Network Protocol and then click
the OK button.
Installing the File and Printer Sharing for Microsoft Networks
From the Windows desktop:
1 Select Start => Settings => Network and Dial-up Connections, then
select the Dial-up connection you use to access the Internet.
The connection window appears.
2Click on the Properties button.
3Select the Networking tab and then click the Install button.
The Select Network Component Type window appears.

8 WatchGuard® SOHO Remote Management User Guide
4Double click the Services network component.
The Select Network Service window appears.
5Select the File and Printer Sharing for Microsoft Networks Network
Service and then click the OK button.
Installing the Client for Microsoft Networks Network Client
From the Windows desktop:
1 Select Start => Settings => Network and Dial-up Connections, then
select the Dial-up connection you use to access the Internet.
The connection window appears.
2Click on the Properties button.
3Select the Networking tab and then click the Install button.
The Select Network Component Type window appears.
4Double click the Client network component.
The Select Network Protocol window appears.
5Select the Client for Microsoft Networks Network Client and then
click the OK button.
6Click the Cancel button to close the Select Network Component Type
window.
7Click the OK button to preserve the installed components.
8Click the Cancel button to close the Dial-up connection window.
Install the SOHO Remote Management Client
Install the SOHO Remote Management client (which is labeled as a
Mobile User VPN, or MUVPN client) software on each remote
management computer. The software installation packages are
available from the LiveSecurity Service Web site:
http://www.watchguard.com/support
The installation process consists of two steps: installing the software
and setting up the client.

Install the SOHO Remote Management Client
WatchGuard® SOHO Remote Management User Guide 9
CAUTION
In order to perform the installation process successfully, you must be logged
into the remote management computer with local administrator rights.
Installing the SOHO Remote Management (MUVPN)
Client Software
Follow these steps to install the client:
1 Copy the software installation package to the remote management
computer.
2 Locate and run the installation executable.
If at any time during the installation process you inadvertently skip a step,
simply cancel the process and begin again.
3 The installation package welcomes you to the InstallShield Wizard.
Click the Next button.
NOTE
During the Setup Status portion of the install procedure, the InstallShield
may detect ReadOnly Files. If this occurs, click the Ye s button for each event
in order to continue the install.
4 The installation package again welcomes you to the InstallShield
Wizard. Once more, click the Next button.
The Software Licence Agreement appears.
5ClicktheYes button, to accept the terms of the License Agreement
and to continue with the installation.
The Setup Type window appears.
6 Select the type of setup, by default Typical is enabled–this is the
setup recommended by WatchGuard. Click the Next button.
7 If you are installing the client on a Windows 2000 host, the
InstallShield will detect the native Windows 2000 L2TP
component. The client will use this component and not need to
install its own. Click the OK button to continue with the install.
The Select Components window appears.

10 WatchGuard® SOHO Remote Management User Guide
8 Keep the default components, click the Next button.
The Start Copying Files window appears.
9ClicktheNext button to begin copying files.
NOTE
A command prompt window will appear while the dni_vapmp file is
installed—this is normal. When it is complete, the installation will continue.
10 When the InstallShield Wizard is complete, click the Finish button.
11 The InstallShield Wizard then searches for a User Profile file, click
the Next button as this step is not necessary.
An Information dialog box appears.
12 Click the OK button to continue with the installation.
13 The InstallShield Wizard has completed the install of the SOHO
Remote Management (MUVPN) client, verify that the option Yes, I
want to restart my computer now is enabled and click the Finish
button.
The computer reboots.
Setting up the Client
Once you have restarted the machine, the WatchGuard Policy Import
dialog box appears. Click the Cancel button as this step is not
necessary.
From the Windows desktop system tray:
1Right-clickontheMobile User VPN client icon.
The Security Policy Editor window interface appears.
2 Select Edit => Add => Connection.
A New Connection will appear under the My Connections folder within the
Network Security Policy field on the left side of the Editor.

Install the SOHO Remote Management Client
WatchGuard® SOHO Remote Management User Guide 11
3 Under the Connection Security header on the right side of the
Security Policy Editor window, enable the Secure option.
4 Under the Remote Party Identity and Addressing header, select IP
Subnet from the ID Type drop list.
5 Enter the network IP Address of the Trusted Network behind the
SOHO in the field labeled “Subnet”.
In our example, 192.168.111.0.
6 Enter the Subnet Mask of the Trusted Network behind the SOHO
in the field labeled “Mask”.
In our example, 255.255.255.0.
7 From the Protocol drop list, verify that All has been selected.
8 Enable the Connect using checkbox and select Secure Gateway
Tunnel from the drop list.
9 From the ID Type drop list, select IP Address.
10 Enter the External IP Address of the SOHO in the appropriate
field.
In our example, 206.253.208.100.

12 WatchGuard® SOHO Remote Management User Guide
11 From the Network Security Policy on the left, expand New
Connection.
My Identity and Security Policy should appear below New Connection.
12 From the Network Security Policy, select Security Policy.
13 From the Select Phase 1 Negotiation Mode header, enable the
Aggressive Mode option.
14 Select My Identity.
15 Click the Pre-Shared Key button.
The Pre-Shared Key window appears.

Install the SOHO Remote Management Client
WatchGuard® SOHO Remote Management User Guide 13
16 Click the Enter Key button.
17 Enter the same System Passphrase configured on the SOHO in the
appropriate field.
18 From the Select Certificate drop list, verify that None has been
selected.
19 From the ID Type drop list, select E-mail Address.
20 Enter the same System Administrator Name configured on the
SOHO.
In our example, Grinellster.
CAUTION
Both the Pre-Shared Key and the E-mail Address, must exactly match the
System Passphrase and System Administrator Name configured on the SOHO
or the connection will fail.
21 From the Virtual Adapter drop list, verify that Disabled has been
selected.
22 From the Network Security Policy expand Security Policy, then
expand Key Exchange (Phase 2).
My Identity and Security Policy should appear below New Connection.

14 WatchGuard® SOHO Remote Management User Guide
23 Select Proposal 1.
My Identity and Security Policy should appear below New Connection.
24 Verify that the Encapsulation Protocol (ESP) check box is enabled.
25 Set the Encrypt Alg and Hash Alg drop lists to the same values
configured on the SOHO.
The “Hash Alg” setting refers to the “Authentication Algorithm” and the
“Encrypt Alg” setting refers to the “Encryption Algorithm” settings on the
SOHO. In our example, Triple DES and MD5.
CAUTION
These two setting must exactly match those on the SOHO or the connection
will fail.
26 Select File => Save Changes.
Connect Using the SOHO Remote Management Client
The SOHO Remote Management (MUVPN) client enables a computer
to establish a secure, encrypted connection to a SOHO over the
Internet. To do this, you must first connect to the Internet and then use
the SOHO Remote Management (MUVPN) client to connect to the
SOHO.

Connect Using the SOHO Remote Management Client
WatchGuard® SOHO Remote Management User Guide 15
From the Windows desktop:
1 First establish an Internet connection through either Dial-Up
Networking or directly through a local area network (LAN) or
wide area network (WAN).
Then, from the Windows desktop system tray:
2 Verify the SOHO Remote Management (MUVPN) client status–it
must be activated. If it is not, right-click on the icon and select
Activate Security Policy.
For information on how to determine the status of the SOHO Remote
Management (MUVPN) icon, please see the following section of this document
titled, “The SOHO Remote Management (MUVPN) Client Icon”.
The SOHO Remote Management (MUVPN) Client Icon
The SOHO Remote Management (MUVPN) client icon exists in the
Windows desktop system tray and displays several different status
images. The following lists these images and provides a brief
description of each.
Deactivated
The SOHO Remote Management Security Policy has been
deactivated or the Windows operating system did not start a
necessary SOHO Remote Management (MUVPN) service
properly and the remote management computer must be
restarted (if this continues you may need to reinstall the SOHO
Remote Management (MUVPN) client).
Activated
The SOHO Remote Management (MUVPN) client is ready to
establish a secure, IPSec connection.

16 WatchGuard® SOHO Remote Management User Guide
Activated and Transmitting Unsecured Data
The SOHO Remote Management (MUVPN) client is ready to
establish a secure, IPSec connection and the red bar on the right
of the icon indicates that the client has begun transmitting
unsecured data.
Activated and Connected
The SOHO Remote Management (MUVPN) client has
established at least one secure, IPSec connection but is not
transmitting data.
Activated, Connected and Transmitting Unsecured Data
The SOHO Remote Management (MUVPN) client has
established at least one secure, IPSec connection and the red
bar on the right of the icon indicates that the client is
transmitting only unsecured data.
Activated, Connected and Transmitting Secured Data
The SOHO Remote Management (MUVPN) client has
established at least one secure, IPSec connection and the green
bar on the right of the icon indicates that the client is
transmitting only secured data.
Activated, Connected and Transmitting both Secure and
Unsecured Data
The SOHO Remote Management (MUVPN) client has
established at least one secure, IPSec connection and the red

Monitor the SOHO Remote Management connection
WatchGuard® SOHO Remote Management User Guide 17
and green bars on the right of the icon indicate that the client is
transmitting both secured and unsecured data.
Disconnecting the SOHO Remote Management
(MUVPN) client
The SOHO Remote Management (MUVPN) connection is independent
of the Internet connection. Close the SOHO Remote Management
(MUVPN) connection when the remote computer encounters either of
the following events.
- Loses the Internet connection
- No longer needs the SOHO Remote Management (MUVPN)
connection
From the Windows desktop system tray:
1Right-clickontheMobile User VPN client icon.
2 Select Disconnect All.
The SOHO Remote Management (MUVPN) client closes all IPSec
connections. This process does not affect your connection to the Internet. You
must disconnect from the Internet separately.
3Right-clickontheMobile User VPN client icon and select
Deactivate Security Policy.
The SOHO Remote Management (MUVPN) icon will display a red slash to
indicate that the Security Policy has been deactivated.
Monitor the SOHO Remote Management connection
There are two tools that accompany the SOHO Remote Management
(MUVPN) client which can be used to monitor your connection and
diagnose problems that may occur: the Log Viewer and the
Connection Monitor.

18 WatchGuard® SOHO Remote Management User Guide
The Log Viewer
The Log Viewer displays the communications log, a diagnostic tool
that lists the negotiations that occur during the SOHO Remote
Management (MUVPN) client connection.
From the Windows desktop system tray:
1Right-clickontheMobile User VPN client icon.
2 Select Log Viewer.
The Log Viewer window appears.
The Connection Monitor
The Connection Monitor displays statistical and diagnostic
information for each active connection in the security policy. This
module shows the actual security policy settings and the security
association (SA) information established during Phase 1 IKE
negotiations and Phase 2 IPSec negotiations.
From the Windows desktop system tray:
1Right-clickontheMobile User VPN client icon.
2 Select Connection Monitor.
The Connection Monitor window appears.
An icon displays to the left of the connection name:
• SA indicates that the connection has only a Phase 1 IKE SA. This
occurs when connecting to a secure gateway or when a Phase 2
IPSec SA fails to establish or has not been established yet.
• A key indicates that the connection has a Phase 2 IPSec SA, or
both a Phase 1 and Phase 2 SA.
• A key with a black line moving below it indicates that the client
is processing secure IP traffic for that connection.
• When there is a single Phase 1 SA to a gateway that is protecting
multiple Phase 2 SAs, there will be a single Phase 1 connection
with the SA icon and individual Phase 2 connections with the
key icon displayed above that entry.

Uninstall the SOHO Remote Management Client
WatchGuard® SOHO Remote Management User Guide 19
Uninstall the SOHO Remote Management Client
At some point, it may become necessary to completely uninstall the
SOHO Remote Management (MUVPN) client. WatchGuard
recommends using the Windows Add/Remove Programs tool.
From the Windows desktop:
1 Select Start => Settings => Control Panel.
The Control Panel window appears.
2 Double click on the Add/Remove Programs icon.
The Add/Remove Programs window appears.
3 Select Mobile User VPN and click on the Change/Remove button.
The InstallShield Wizard window appears.
4 Select Remove and click the Next button.
The Confirm File Deletion dialog box appears.
5ClicktheOK button to completely remove all of the components.
The Uninstall Security Policy dialog box appears.
NOTE
A command prompt window will appear while the dni_vapmp file is
uninstalled—this is normal. When it is complete the process will continue.
6ClicktheYes button to delete the Security Policy Personal
Certificates and Private/Public Keys.
The InstallShield Wizard window appears.
7 Verify that the option Yes, I want to restart my computer now is
enabled and click Finish.
The computer will reboot.
8 When the computer has restarted, select Start => Programs.
9Right-clickonMobile User VPN and select Delete to remove this
selection from your Start Menu.
You have completed the uninstall process.

20 WatchGuard® SOHO Remote Management User Guide
Troubleshoot SOHO Remote Management
WatchGuard maintains a knowledge base on our Web site, including
an In-Depth FAQ section on configuring and using the SOHO Remote
Management (MUVPN) client. This is available at:
www.watchguard.com/support
A few of the most common issues found in installing, configuring, and
using the SOHO Remote Management (MUVPN) client are described
below.
Why is my computer hung up just after installing the
SOHO Remote Management (MUVPN) client?
This is most likely because the SOHO Remote Management (MUVPN)
client is active and is unsuccessfully attempting to create an IPSec
connection.
When the SOHO Remote Management (MUVPN) client is not in use,
the client should be disconnected and deactivated.
1 First, reboot your computer.
From the Windows desktop system tray:
2Right-clickontheMobile User VPN client icon.
3 Select Disconnect All.
The SOHO Remote Management (MUVPN) client closes all IPSec
connections.
4Right-clickontheMobile User VPN client icon and select
Deactivate Security Policy.
The SOHO Remote Management (MUVPN) icon will display a red slash to
indicate that the Security Policy has been deactivated.
How can I tell if the SOHO Remote Management
(MUVPN) tunnel is working?
The SOHO Remote Management (MUVPN) client icon, which appears
in the Windows desktop system tray once it has been launched,
displays a key once the client has connected.