Step 1: Upgrade Gateway Server and Server-Side SSTP Tunnel

Before you proceed, make sure the MOVEit Transfer server is installed and running.

To upgrade Ipswitch Gateway 2017 SP1 to 2017 Plus:

1. Reboot the Ipswitch Gateway machine.
2. After reboot, sign in with administrator credentials.
3. Go to the Customer Portal and download the installer for Ipswitch Gateway 2017 Plus for MOVEit Transfer.
4. Open the Ipswitch Gateway installer.
5. Welcome: Select Step 1: Install a Gateway server (outside firewall) and a server side SSTP tunnel. Click Next. The installer looks for prerequisite software.
6. System Check: The installer verifies the following:
   • Operating System Version: The machine must be running the Windows Server 2012R2 or Server 2016 operating system.
   • Routing and Remote Access Service: A Windows server is required to properly configure the the Routing and Remote Access (RRAS) service. Workstations are not supported.
   • Routing and Remote Access - IIS: If IIS is installed and enabled, the IIS service will be disabled to avoid configuration conflicts with the Remote Access service and VPN. If not, the necessary components of Microsoft Internet Information Services (IIS) will be installed.
   • Administrator privileges

   Click Next.

7. Options: Gateway Configuration Interface. Designate a certificate to use as the identity of the Gateway Configuration interface. This certificate will be presented to Gateway administrators accessing the administrative user interface via a browser.
   • X.509 (*.pfx or *.p12) certificate from your computer (recommended): Browse to locate the SSL *.pfx or *.p12 file. Since in many cases the hostname of the Gateway server will be the hostname previously assigned to a MOVEit Transfer server, you may wish to use the certificate already installed on your MOVEit Transfer server. If you need to create a *.pfx or *.p12 file from your MOVEit Transfer server, see Create a *.pfx or *.p12 File. Enter the Certificate password in the space provided.
   • System-generated self-signed certificate: By default, the installer populates the Certificate Name field with Ipswitch Gateway (Demo). In most cases, you will simply accept the proposed value and continue. The Certificate Name value is used to populate the CN parameter in the *.pfx or *.p12 file.
   • No changes - keep current certificate configuration. (default)

   Choose the network interface and port to listen on:

   • Network Interface: Select a network interface (IP address) from the drop-down list. In most cases, you will want the Gateway to listen on All Interfaces.
   • Port: Enter the TCP port to which Gateway administrators will connect with a browser, to administer Ipswitch Gateway. It is recommended that you accept the default of 9443. When configuring the TCP port for the administrative interface, do not choose a port number that is likely to already be in use by the system, such as 10043. The default, 9443, is a good choice for most systems.

   Click Next.

8. Options: Service Logon Account: Designate which account Ipswitch Gateway should use to run the Gateway service process:
   • Local System account
   • Different account: Enter the username and password of the different account.

   Click Next.

9. Options: SSTP Tunnel Certificate: Designate a certificate to use for the Secure Socket Tunnel Protocol (SSTP) connection:
   • A new system-generated self-signed certificate: For Certificate Name, enter the IP address or hostname that will be used to connect to this machine from the MOVEit Transfer server.
   • Existing certificate from the certificate manager: Select an existing certificate from the drop-down list. Public keys will not be shown here. Optionally click View Details to see detailed information about that certificate, in case you need to distinguish between certificates with the same name.
   • No changes - keep current certificate configuration. (default)

   Click Next.

10. Upgrade: Verify the upgrade options, and then click Upgrade.

    After a few moments, the setup program finishes updating Ipswitch Gateway.

11. Click Finish.

    Note: When you see the Enable Windows Firewall message, ignore it for now.

    Note: Your web browser may attempt to open the Gateway Configuration Interface at this point. Proceed with the following steps before using the Gateway Configuration Interface.

12. On the Gateway server, open Network Policy Server.
13. Expand Policies and select Connection Request Policies.
14. Right-click on Microsoft Routing and Remote Access Server Policy and select Properties.
15. Go to the Settings tab.
16. Select Authentication Methods.
17. Select Override network policy authentication settings (if not selected).
18. Make sure that Microsoft: Secured password (EAP-MSCHAP v2) is enabled under EAP Types.

Proceed to Step 2.