It seems like your browser didn't download the required fonts. Please revise your security settings and try again.
Barracuda CloudGen Firewall

This Firmware Version Is End-Of-Support

Documentation for this product is no longer updated. Please see End-of-Support for CloudGen Firewall Firmware for further information on our EoS policy.

How to Configure the SSL VPN Service

  • Last updated on

The SSL VPN service is part of the VPN service on the NextGen Firewall. Configure a listener for the SSL VPN on a public IP address and authenticate the users via a local or external authentication scheme. It is recommended to use signed SSL certificates to avoid SSL error messages when users access the SSL VPN portal. SSL VPN is supported for NextGen Firewall F18 and larger, as well as all NextGen Firewall F-Series Vx models except VF10. 

Before You Begin

  • An Advanced Remote Access subscription is required.
  • Verify that the IP address you want the SSL VPN to listen on is configured as a virtual server and VPN service IP address. For more information, see Virtual Servers and Services
  • Configure an external authentication server or NGF local authentication. For more information, see Authentication.

Step 1. Disable Port 443 for Site-to-Site and Client-to-Site VPN 

  1. Go to CONFIGURATION > Configuration Tree > Box > Virtual Servers > your virtual server > Assigned Services > VPN > VPN Settings.
  2. Click Lock.
  3. Click Click here for Server Settings link. The Server Settings window opens.
  4. Set Use Port 443 to No.
  5. Click OK.
  6. Click Send Changes and Activate.

Step 2. Configure SSL VPN General Service Settings

Enable the SSL VPN service and add the listening IP addresses.

  1. Go to CONFIGURATION > Configuration Tree > Box > Virtual Servers > your virtual server > Assigned Services > VPN-Service > SSL-VPN.
  2. Click Lock.
  3. Set Enable SSL VPN to Yes.

  4. Click + to add a Listen IP.

  5. (recommended) Enable Restrict to Strong Ciphers Only.

  6. Select the Identification Type:
    • Generated-Certificate – The certificate and the private key is automatically created by the firewall.
    • Self-Signed-Certificate – Click New to create a Self-Signed Private Key and then Edit to create the Self-Signed Certificate.
    • External-Certificate – Click Ex/Import to import the CA-signed External Certificate and the External-Signed Private Key.
  7. Click Send Changes and Activate.

Step 3. Configure Login

  1. Go to CONFIGURATION > Configuration Tree > Box > Virtual Servers > your virtual server > Assigned Services > VPN-Service > SSL-VPN.
  2. In the left menu, click Login.
  3. Click Lock.
  4. In the Login section, set the Identity Scheme to your preferred authentication method, e.g., MS-Active Directory.
  5. Click + to add your access control policy to the list of Access Control Policies.
  6. (optional) Configure the following settings as needed:  
    • Use Max Concurrent Users – Enable to limit the number of simultaneous users using the SSL VPN service.
    • Max Concurrent Users – Enter the maximum number of users that can be simultaneously connected to the SSL VPN service.
    • Cookie Timeout (Min) – Enter the session timeout in minutes.
    • Authentication Request Timeout (sec) – Enter a value up to 20 seconds if you are using multi-factor authentication.            
    • Deny Remember Me – Set to yes to remove the Remember me check box on the login page.
  7. Customize the login messages and logos:   
    • (optional) Import a 200 x 66-pixel PNG or JPG image to customize the Logo.

    • (optional) Enter a plain text Login Message. E.g, Welcome to the Barracuda NextGen Firewall SSL VPN.
    • (optional) Enter a HTML Help Text.
  8. Click Send Changes and Activate.

Step 4. (optional) Use Custom Cipher String

Configure a custom cipher string to be used by the SSL VPN service.

  1. Go to CONFIGURATION > Configuration Tree > Box > Virtual Servers > your virtual server > Assigned Services > VPN-Service > SSL-VPN.
  2. In the left menu, click Basic Setup.
  3. Click Lock.
  4. In the left menu, expand Configuration Mode and click on Switch to Advanced View.
  5. Disable Allow SSLv3.

  6. Enable Restrict to Strong Ciphers Only.

  7. Enter your custom SSL Cipher Spec string. 

  8. Set Strict SSL Security to yes.

    This setting might break access for some older client SSL implementation. Disable if you experience problems when using older browsers.

  9. Click Send Changes and Activate.


  • If the sslvpn log contains the following line: http_listener: failed to listen on <IP address>@443 verify that no other service on the firewall is running on that port and that no DNAT access rules are forwarding TCP port 443 (HTTPS) traffic.
  • Restart the SSL VPN service after updating or changing certificates:
    1.  Set Enable SSL VPN to no.
    2.  Click Send Changes and Activate.
    3.  Set Enable SSL VPN to yes.
    4.  Click Send Changes and Activate.

When using RADIUS authentication, the service assumes that one-time passwords can be used. This in turn disables the single sign-on functionality for at least the native app RDP. The result is that the system asks for the password again when connecting to the resource.

  • Use a different authentication scheme (possibly in conjunction with RADIUS), or
  • Set up a user attribute that is used for logging into the RDP, and have the user configure that once logged into the portal. For more information, see How to Configure RADIUS Authentication.

The downside of the latter is that it will necessitate the user adjusting the password here as well whenever it changes.

Last updated on