Skip to content
IT // Adventures

Watchguard VPN Authentication via Microsoft NPS

VPN authentication on Watchguard firewalls is easy to pass through to a Windows NPS (Network Policy Server).

1 min read
Contents

Preparing Active Directory

  1. Create an AD group “PPTP-Users”. (The group must have exactly this name!)
  2. Add the users who should get VPN access to the new group and allow remote access on their “Dial-In” tab.

Configuring the NPS

  1. Under Template Management > Shared Secrets, generate a “Shared Secret” and document it(!).
  2. Under RADIUS Clients and Servers > RADIUS Clients, add the Watchguard firewall and enter the “Shared Secret” generated in the previous step.
  3. Under Policies > Connection Request Policies, create a new policy with the following settings:
    • Type of network access server: “Remote Access Server (VPN-Dial up)”
    • Conditions: NAS Port Type = Virtual (VPN)
    • Authentication Provider: Local Computer
  4. Under Policies > Network Policies, create a new policy with the following settings:
    • Type of network access server: “Remote Access Server (VPN-Dial up)”
    • Grant access if the connection request matches this policy.
    • Conditions: NAS Port Type = Virtual (VPN) AND Windows Groups = DOMAIN\PPTP-Users
    • Constraints: Set Authentication Methods as required.
    • Settings: Framed-Protocol = PPP and Service-Type = Framed
    • Settings: Set Encryption as required. (“No encryption” should of course not be selected!)

Configuring the firewall

  1. Start Policy Manager.
  2. Open the menu Setup > Authentication.
  3. On the RADIUS tab, configure the following:
    • Enable “Enable RADIUS Server”
    • Enter the IP address and port of the NPS
    • Enter the Shared Secret generated in step 2
  4. In the menu VPN > Mobile VPN > PPTP, enable the option “Use RADIUS Authentication”.