1

Problem

We want to use WatchGuard's Geo Location to restrict access to our "Access Portal" and "Mobile VPN" connections, but see no options and the corresponding "Firewall Policies" don't seem to honour the Geo Location configuration.

I'm struggling to find resources on the scenario either via Google or WG documentation. Surely, this should be possible? Does anyone have any success with doing something similar?

What we've tried

  • For the "Access Portal" it generates a Firewall policy called "WatchGuard SSLVPN" (not very meaningful in the context of the Access Portal it is for), but changing the Geo Location for that has no effect and clients can connect to the Access Portal regardless of the connection's geographic origin.

  • For the "Mobile VPN" it generates an "Allow IKEv2-Users" firewall policy but changing the Geo Location for that policy has no effect and clients can establish VPN connections regardless of the connection's geographic origin. In my mind this rule is for when the VPN tunnel has already been established and 'feels' like it is too late in the pipeline and would need to be blocked sooner/upstream

Would really appreciate any insights you might have.

Improve this question
4
  • 1
    IP location and Geo location have nothing to do with each other. You could have many networks in one geolocation, and one network could span the entire world, or it can be in multiple places (anycast). Your question seems to want to equate geolocation with IP location, but that just does not work.
    – Ron Maupin ♦
    Apr 16, 2021 at 10:59
  • @RonMaupin Thanks, I understand your distinction. I'm meaning specifically WatchGuard's "Geo Location" feature where you can allow / block connections where the IP address originates from a specific geographic location, like say "China".
    – Jaans
    Apr 16, 2021 at 13:18
  • That type of geolocation is often quite bad. For example, doing geolocation on my public address shows me in Virginia, where my ISP has its headquarters, but I am in Texas, over 1000 miles away. Also, there are companies that get ARIN (North America) IP assignments, but use those assignments in other parts of the world to bypass the geolocation restrictions like you want.
    – Ron Maupin ♦
    Apr 16, 2021 at 13:23
  • It serves us very well to reduce our attack rate for other firewall policies we have defined, but the accuracy of Geolocation databases isn't really the point here. I'm guessing WatchGuard doesn't support it for Mobile VPN / Access Portal.
    – Jaans
    Apr 18, 2021 at 3:13

1 Answer 1

Reset to default
1

Managed to resolve this.

Turns out, WatchGuard has a built-in policy for IPSec (enabled by default) that creates a "hidden" firewall policy for IPSec (Port 4500 UDP ESP AH and Port 500 UDP). This can be found under VPN -> Global Settings -> IPSec Settings -> Enable built-in IPSec Policy

To enable WatchGuard's Geolocation feature for VPN connections (or any other option like Traffic Management or Scheduling), the build-in IPSec policy needs to be disabled and an equivalent Firewall Policy be created manually. This new manual policy can then be configured like a normal Firewall Policy.

Note: Disabling the IPSec policy will disconnect existing VPN users (which may include yourself) so you may need to plan ahead.

Depending on your configuration you may need to create a manual IPSec firewall policy for each VPN interface. At least that's what I would've expected, but for us that was not needed for Point-to-Point BOVPN interfaces and we only needed a Firewall Policy for the IKEv2 "Mobile VPN".

Improve this answer
1
  • 1
    You should accept your own answer so this doesn't keep popping up. Thanks for sharing!
    – Zac67 ♦
    May 28, 2021 at 7:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.