Watchguard SOHO User manual

WatchGuard® SOHO Remote Management User Guide 1
WatchGuard®SOHO
Remote Management
User Guide
The WatchGuard®SOHOTM and SOHO|tcTM both come equipped with
the SOHO Remote ManagementTM feature. This feature uses Internet
Protocol Security (IPSec) to establish a secure connection over the
Internet to a SOHO device.
This user guide applies to both the SOHO and the SOHO|tc–the
name SOHO is used to refer to both devices throughout.
Configure the SOHO for SOHO Remote Management
Flow these steps to configure your SOHO:
1 With your Web browser, go to the SOHO System Status page using
the Trusted IP address of the SOHO.
For example, if using the default IP address, go to: http://192.168.111.1
2 From the navigation bar on the right side, select Administration =>
System Security.
The System Security page appears.

2 WatchGuard® SOHO Remote Management User Guide
3 Enable the checkbox labeled System Security.
4 Enter the System Administrator Name in the appropriate field.
This name will be used as the E-mail Address when setting up the Remote
Management (MUVPN) client. In our example, Grinellster.
5 Enter the System Passphrase in the appropriate field.
This passphrase will be used as the Pre-Shared Key when setting up the
Remote Management (MUVPN) client.
6 Enter the System Passphrase again to confirm it in the appropriate
field.
7 Enable the checkbox labeled Enable SOHO Remote Management.
8 Enter the Virtual IP address which will be used by the remote
management computer when connecting to the SOHO in the
appropriate field.
In our example, 192.168.111.4.
9 Select the Authentication Algorithm.
In our example, SHA1-HMAC.

Prepare the Client Computers
WatchGuard® SOHO Remote Management User Guide 3
10 Select the Encryption Algorithm.
In our example, 3DECS-CBC.
11 Click the Submit button.
Prepare the Client Computers
A computer used as a SOHO Remote Management host must have the
following system requirements as well as each platform variation
setup properly.
System Requirements
• PC-compatible computer with Pentium processor or equivalent
• Compatible operating systems and minimum RAM:
- Microsoft Windows 98: 32 MB
- Microsoft Windows ME: 64 MB
- Microsoft Windows NT 4.0 Workstation: 32 MB
- Microsoft Windows 2000 Professional: 64 MB
• 10 MB hard disk space
• Native Microsoft TCP/IP communications protocol
• Microsoft Internet Explorer 5.0 or later
• Netscape Navigator 4.7 or later
• An Internet Service Provider account
• A Dial-Up or Broadband (DSL or Cable modem) Connection
The SOHO Remote Management MUVPN Adapter, which supports
L2TP, installs only if these network components are already installed
on your computer:
• Windows 98/ME: Dial-Up Networking
• Windows NT: Remote Access Server (RAS)
If these components are not installed, follow these instructions:

4 WatchGuard® SOHO Remote Management User Guide
Installing Remote Access Server on Windows NT
1 Select Start => Settings => Control Panel. Double-click the Network
icon.
2Select the Services tab.
3Click the Add button.
4Select Remote Access Services from the list, then click the OK button.
5Enter the path to the Windows NT install files or insert your system
installation CD, then click the OK button.
The Remote Access Setup dialog box appears.
6Click the Yes button to add a RAS capable device and enable you to
add a modem.
7Click the Add button and complete the Install New Modem wizard
NOTE
If there is no modem installed, you can enable the Don't detect my modem; I
will select it from a list checkbox then add a Standard 28800 modem.
8Select the modem added in the last step in the Add RAS Device dialog
box, then click the OK button.
9Click the Continue button, then click the Close button.
10 Reboot your computer.
Installing Dial-up Networking on Windows 98/ME
From the Windows desktop:
1 Select Start => Settings => Control Panel. Double-click the Add/
Remove Programs icon.
The Add/Remove Properties window appears.
2Click on the Windows Setup tab.
The Windows Setup dialog box appears and searches for installed components.
3Enable the Communications checkbox and click the OK button.
The Copying Files dialog box appears and copies the necessary files.
4The Dial-Up Networking Setup dialog appears and prompts you to
restart the computer. Click the OK button.
The computer reboots.

Prepare the Client Computers
WatchGuard® SOHO Remote Management User Guide 5
Windows 98/ME Platform Setup
From the Windows desktop:
1 Select Start => Settings => Control Panel. Double-click the Network
icon.
The Network window appears.
2Verify that Client for Microsoft Networks is installed.
If Client for Microsoft Networks is not installed, you must install it. For
instructions, please see the following section of this document titled,
“Installing the Client for Microsoft Networks”.
3Click the Identification tab.
4Enter a name for the remote client.
This must be a unique name on the remote network.
5Enter the domain name you are connecting to.
This should be the same as the Logon to Windows NT domain value.
6Enter a description for your computer (optional).
7Click OK. Click OK to close and save changes to the Network control
panel.
Click Cancel if you do not want to save any changes.
8Reboot the machine.
Installing the Client for Microsoft Networks
From the Networks window:
1ClicktheConfiguration tab. Click Add.
The Select Network Component Type window appears.
2Select Client. Click Add.
The Select Network Client window appears.
3Select Microsoft from the list on the left. Select Client for Microsoft
Networks from the list on the right. Click OK.
4Select Client for Microsoft Networks.
5Click Properties.
6Enable the Log on to Windows NT domain option.
7In the Windows NT Domain field, type the domain name.
For example, your domains might be sales, office, and warehouse.
8Enable the Logon and Restore Network Connections option.

6 WatchGuard® SOHO Remote Management User Guide
Windows NT Platform Setup
Adding a Domain Name to a Windows NT Workstation
Often remote clients need to connect to a domain behind the firewall.
To do this, the remote client must be able to recognize the domains to
which they belong. Adding a domain requires the installation of the
Computer Browser Network Service.
Installing the Computer Browser
From the Windows desktop:
1 Select Start => Settings => Control Panel. Double-click the Network
icon.
The Network dialog box appears.
2Click the Services tab.
3Click Add.
4Select Computer Browser.
5Browse to locate the installation directory. Click OK.
6Reboot the workstation.
Adding a New Domain
From the Windows desktop:
1 Select Start => Settings => Control Panel. Double-click the Network
icon.
The Network dialog box appears.
2Click the Protocols tab.
3Select Computer Browser. Click Properties.
4Add the remote network domain name.
You can add multiple domain names during the same configuration session.
5Click OK.
6Reboot the workstation.

Prepare the Client Computers
WatchGuard® SOHO Remote Management User Guide 7
Windows 2000 Platform Setup
From the Windows desktop:
1 Select Start => Settings => Network and Dial-up Connections, then
select the Dial-up connection you use to access the Internet.
The connection window appears.
2Click on the Properties button.
3Select the Networking tab.
4Verify that the following components are present and enabled:
- Internet Protocol (TCP/IP)
- File and Printer Sharing for Microsoft Networks
- Client for Microsoft Networks
If these components are not present they will need to be installed.
Installing the Internet Protocol (TCP/IP) Network Component
From the Windows desktop:
1 Select Start => Settings => Network and Dial-up Connections, then
select the Dial-up connection you use to access the Internet.
The connection window appears.
2Click on the Properties button.
3Select the Networking tab and then click the Install button.
The Select Network Component Type window appears.
4Double click the Protocol network component.
The Select Network Protocol window appears.
5Select the Internet Protocol (TCP/IP) Network Protocol and then click
the OK button.
Installing the File and Printer Sharing for Microsoft Networks
From the Windows desktop:
1 Select Start => Settings => Network and Dial-up Connections, then
select the Dial-up connection you use to access the Internet.
The connection window appears.
2Click on the Properties button.
3Select the Networking tab and then click the Install button.
The Select Network Component Type window appears.

8 WatchGuard® SOHO Remote Management User Guide
4Double click the Services network component.
The Select Network Service window appears.
5Select the File and Printer Sharing for Microsoft Networks Network
Service and then click the OK button.
Installing the Client for Microsoft Networks Network Client
From the Windows desktop:
1 Select Start => Settings => Network and Dial-up Connections, then
select the Dial-up connection you use to access the Internet.
The connection window appears.
2Click on the Properties button.
3Select the Networking tab and then click the Install button.
The Select Network Component Type window appears.
4Double click the Client network component.
The Select Network Protocol window appears.
5Select the Client for Microsoft Networks Network Client and then
click the OK button.
6Click the Cancel button to close the Select Network Component Type
window.
7Click the OK button to preserve the installed components.
8Click the Cancel button to close the Dial-up connection window.
Install the SOHO Remote Management Client
Install the SOHO Remote Management client (which is labeled as a
Mobile User VPN, or MUVPN client) software on each remote
management computer. The software installation packages are
available from the LiveSecurity Service Web site:
http://www.watchguard.com/support
The installation process consists of two steps: installing the software
and setting up the client.

Install the SOHO Remote Management Client
WatchGuard® SOHO Remote Management User Guide 9
CAUTION
In order to perform the installation process successfully, you must be logged
into the remote management computer with local administrator rights.
Installing the SOHO Remote Management (MUVPN)
Client Software
Follow these steps to install the client:
1 Copy the software installation package to the remote management
computer.
2 Locate and run the installation executable.
If at any time during the installation process you inadvertently skip a step,
simply cancel the process and begin again.
3 The installation package welcomes you to the InstallShield Wizard.
Click the Next button.
NOTE
During the Setup Status portion of the install procedure, the InstallShield
may detect ReadOnly Files. If this occurs, click the Ye s button for each event
in order to continue the install.
4 The installation package again welcomes you to the InstallShield
Wizard. Once more, click the Next button.
The Software Licence Agreement appears.
5ClicktheYes button, to accept the terms of the License Agreement
and to continue with the installation.
The Setup Type window appears.
6 Select the type of setup, by default Typical is enabled–this is the
setup recommended by WatchGuard. Click the Next button.
7 If you are installing the client on a Windows 2000 host, the
InstallShield will detect the native Windows 2000 L2TP
component. The client will use this component and not need to
install its own. Click the OK button to continue with the install.
The Select Components window appears.

10 WatchGuard® SOHO Remote Management User Guide
8 Keep the default components, click the Next button.
The Start Copying Files window appears.
9ClicktheNext button to begin copying files.
NOTE
A command prompt window will appear while the dni_vapmp file is
installed—this is normal. When it is complete, the installation will continue.
10 When the InstallShield Wizard is complete, click the Finish button.
11 The InstallShield Wizard then searches for a User Profile file, click
the Next button as this step is not necessary.
An Information dialog box appears.
12 Click the OK button to continue with the installation.
13 The InstallShield Wizard has completed the install of the SOHO
Remote Management (MUVPN) client, verify that the option Yes, I
want to restart my computer now is enabled and click the Finish
button.
The computer reboots.
Setting up the Client
Once you have restarted the machine, the WatchGuard Policy Import
dialog box appears. Click the Cancel button as this step is not
necessary.
From the Windows desktop system tray:
1Right-clickontheMobile User VPN client icon.
The Security Policy Editor window interface appears.
2 Select Edit => Add => Connection.
A New Connection will appear under the My Connections folder within the
Network Security Policy field on the left side of the Editor.