WatchGuard Configuration

This guide explains how to configure WatchGuard wireless products to work with IronWifi for RADIUS authentication and captive portal.

Supported Platforms

• WatchGuard Wi-Fi Cloud - Cloud-managed access points (AP120, AP125, AP225W, AP320, AP322, AP325, AP327X, AP420)
• WatchGuard Wi-Fi 6 in WatchGuard Cloud - AP130, AP230W, AP330, AP430CR, AP432
• WatchGuard Firebox - With wireless capabilities
• WatchGuard AP - Standalone access points

---

Prerequisites

In IronWifi Console (complete these first):

1. Log in to IronWifi Management Console
2. Navigate to Networks
3. Click Create Network or select existing
4. Note RADIUS details:
   • RADIUS Server IP
   • Authentication Port: 1812
   • Accounting Port: 1813
   • Shared Secret
5. Navigate to Captive Portals
6. Click Create Captive Portal
7. Configure:
   • Network: Select your network
   • Vendor: WatchGuard or Generic
8. Note the Splash Page URL
9. Copy the Walled Garden domains

In WatchGuard:

• WatchGuard Wi-Fi Cloud or WatchGuard Cloud account
• Compatible WatchGuard access points or Firebox device
• Administrative access to management portal
• Network connectivity to IronWifi RADIUS servers

---

Wi-Fi Cloud Configuration

Access Wi-Fi Cloud

1. Log in to WatchGuard Wi-Fi Cloud portal
2. Navigate to your organization and site
3. Select Configure > WiFi

Configure RADIUS Settings

1. Go to Configure > WiFi > RADIUS

2. Click Add RADIUS Server

3. Configure Authentication Server:

   • Name: IronWifi-Auth
   • IP Address: Your IronWifi RADIUS IP
   • Port: 1812
   • Shared Secret: Your RADIUS secret
   • Confirm Secret: Re-enter secret

4. Configure Accounting Server:

   • Name: IronWifi-Acct
   • IP Address: Same as authentication
   • Port: 1813
   • Shared Secret: Same secret

5. Click Save

Create SSID with External Captive Portal

1. Go to Configure > WiFi > SSIDs

2. Click Add SSID

3. Configure Basic Settings:

   • SSID Name: Guest WiFi
   • Security Mode: Open
   • VLAN: Configure as needed

4. Configure Captive Portal:

   • Splash Page Type: Third-Party Hosted with RADIUS
   • Portal URL: Your IronWifi Splash Page URL
   • Portal Shared Secret: Portal secret from IronWifi
   • RADIUS Server: IronWifi-Auth
   • Accounting Server: IronWifi-Acct
   • Accounting Interval: 5 minutes

5. Configure Redirect Settings:

   • Success Redirect: Original URL or custom page
   • Session Timeout: As configured in IronWifi

6. Click Save

Configure Walled Garden

1. In SSID settings, find Walled Garden section
2. Add IronWifi domains:

Required for IronWifi:

107.178.250.42
*.ironwifi.com
*.ironwifi.net
splash.ironwifi.com

Authentication Provider Domains:

If using social login providers, add the following domains to your walled garden:

Provider	Required Entries
Google	*.google.com, *.googleapis.com, *.gstatic.com, accounts.google.com
Facebook	*.facebook.com, *.fbcdn.net, connect.facebook.net, facebook.com
Twitter	*.twitter.com, *.twimg.com, twitter.com
LinkedIn	*.linkedin.com, *.licdn.com
Microsoft	*.microsoft.com, *.microsoftonline.com, *.live.com, login.live.com

3. Click Save

Create WPA2-Enterprise SSID

1. Go to Configure > WiFi > SSIDs

2. Click Add SSID

3. Configure:

   • SSID Name: Secure WiFi
   • Security Mode: WPA2-Enterprise
   • RADIUS Server: IronWifi-Auth
   • Accounting Server: IronWifi-Acct

4. Click Save

---

WatchGuard Cloud (Wi-Fi 6) Configuration

For Wi-Fi 6 access points managed through WatchGuard Cloud:

Configure Authentication

1. Log in to WatchGuard Cloud
2. Navigate to Configure > Devices > Access Points
3. Select your site
4. Go to Authentication > RADIUS Servers

Add RADIUS Server

1. Click Add

2. Configure:

   • Name: IronWifi
   • Server Address: IronWifi RADIUS IP
   • Authentication Port: 1812
   • Accounting Port: 1813
   • Shared Secret: Your secret

3. Click Save

Configure SSID

1. Go to SSIDs
2. Create or edit SSID
3. Configure security and captive portal as needed
4. Assign RADIUS server

---

Firebox Wireless Configuration

Access Firebox

1. Log in to Firebox System Manager or Web UI
2. Navigate to wireless settings

Configure RADIUS

1. Go to Setup > Authentication > Servers
2. Click Add
3. Configure:
   • Server Type: RADIUS
   • Name: IronWifi
   • IP Address: IronWifi RADIUS IP
   • Auth Port: 1812
   • Acct Port: 1813
   • Shared Secret: Your secret

Configure Wireless Guest Network

1. Go to Network > Wireless
2. Create or edit wireless network
3. Configure:
   • SSID: Guest WiFi
   • Security: Open with Captive Portal
   • Authentication Server: IronWifi

---

Password Encoding for Captive Portal

WatchGuard uses a specific password encoding process for external captive portals:

1. Convert the challenge parameter from hex to bytes
2. Generate key using MD5 of the portal shared secret
3. XOR the password with the repeated key
4. Convert result to hexadecimal
5. Append encoded password to login URL

IronWifi handles this encoding automatically when configured with WatchGuard vendor.

---

Configuration Summary

RADIUS Settings

Setting	Value
Server IP	IronWifi RADIUS IP
Auth Port	1812
Acct Port	1813
Secret	Your shared secret
Timeout	5 seconds

Captive Portal Settings

Setting	Value
Portal Type	Third-Party Hosted with RADIUS
Portal URL	IronWifi Splash Page URL
Portal Secret	From IronWifi Console

Walled Garden

Domain/IP
107.178.250.42
*.ironwifi.com
*.ironwifi.net

---

Verification

Check AP Status

1. In Wi-Fi Cloud, go to Monitor > Access Points
2. Verify APs are online
3. Check configuration sync status

Check RADIUS Connectivity

1. Go to Monitor > Events
2. Filter for authentication events
3. Look for successful RADIUS responses

Test Guest Portal

1. Connect device to guest SSID
2. Open browser - should redirect to splash page
3. Complete authentication
4. Verify in IronWifi Console logs

---

Troubleshooting

Issue	Possible Cause	Solution
RADIUS timeout	Network connectivity issue	Verify AP can reach IronWifi RADIUS; check firewall rules allow outbound UDP 1812/1813; test connectivity from Wi-Fi Cloud diagnostics
Authentication rejected	Wrong shared secret	Verify shared secret matches exactly (case-sensitive) in both IronWifi Console and WatchGuard configuration
Portal not redirecting	Portal disabled or URL wrong	Verify captive portal is enabled on SSID; check portal URL is correct; ensure DNS is working for clients; verify walled garden includes portal domain
Authentication fails after portal	Portal secret mismatch or encoding issue	Check portal shared secret matches; verify password encoding is correct; review RADIUS response in logs
Social login not working	Missing provider domains	Add all social provider domains to walled garden; verify OAuth is configured in IronWifi
SSL error	Certificate issue	Install valid SSL certificate on AP/controller; add authentication provider domains to walled garden
Encoding error	Wrong portal secret	Verify portal shared secret matches in both systems

Additional Troubleshooting Steps

1. Verify RADIUS Configuration

   • Check server IP address is correct
   • Verify shared secret matches exactly (case-sensitive)
   • Ensure ports 1812/1813 are correct

2. Check Network Connectivity

   • Verify AP can reach IronWifi RADIUS
   • Check firewall rules allow outbound UDP 1812/1813
   • Test connectivity from Wi-Fi Cloud diagnostics

3. Review Logs

   • Check Wi-Fi Cloud event logs
   • Review IronWifi authentication logs
   • Look for timeout or rejection messages

4. SSL Certificate Issues

   • Install a valid SSL certificate on your AP/controller to avoid authentication issues with HTTPS portals

---

Best Practices

1. Use Strong Secrets: Generate complex RADIUS and portal shared secrets
2. Enable Accounting: Track usage and session data
3. Configure Timeouts: Set appropriate session and idle timeouts
4. Monitor Regularly: Check Wi-Fi Cloud dashboard for issues
5. Firmware Updates: Keep APs updated for security and compatibility
6. Test Changes: Verify configuration in lab before production
7. SSL Certificates: Install valid certificates to avoid client warnings

Related Topics

• Captive Portal Configuration
• RADIUS Configuration
• Troubleshooting