For more information refer: UTM - FAQ: What are the basics of SSLVPN setup on Gen5 UTM appliances running SonicOS Enhanced 5.2?

Size: px

Start display at page:

Download "For more information refer: UTM - FAQ: What are the basics of SSLVPN setup on Gen5 UTM appliances running SonicOS Enhanced 5.2?"

Irma Cannon
8 years ago
Views:

1 TM SSL-VPN: How to setup SSL-VPN feature (NetExtender Access)... of 6 1/12/ :46 PM Question/Title UTM SSL-VPN: How to setup SSL-VPN feature (NetExtender Access) on SonicOS Enhanced (SonicOS 5.6 and above) Answer/Article Article Applies To: Gen5: NSA E8510, E8500, E7500, NSA E6500, NSA E5500, NSA 5000, NSA 4500, NSA 3500, NSA 2400, NSA 2400MX, NSA 220, NSA 220W, NSA 240, NSA 250M, NSA 250MW TZ series: TZ 100, TZ 100 Wireless, TZ 200, TZ 200W, TZ 210, TZ 210 W. TZ 215, TZ 215 W, TZ 105, TZ 105W, TZ 205, TZ 205W Firmware versions: Gen5 devices with SonicOS Enhanced 5.2.x.x or higher. Services: SSL-VPN configuration embedded in SonicOS Enhanced, NetExtender configuration. Overview / Scenario: This article provides information on how to configure the SSL VPN features on the SonicWALL security appliance. SonicWALL s SSL VPN features provide secure remote access to the network using the NetExtender client. NetExtender is an SSL VPN client for Windows, Mac, or Linux users that is downloaded transparently and that allows you to run any application securely on the company s network. It uses Point-to-Point Protocol (PPP). NetExtender allows remote clients seamless access to resources on your local network. Users can access NetExtender two ways: Logging in to the Virtual Office web portal provided by the SonicWALL security appliance and clicking on the NetExtender button. Launching the standalone NetExtender client. The NetExtender standalone client is installed the first time you launch NetExtender. Thereafter, it can be accessed directly from the Start menu on Windows systems, from the Application folder or dock on MacOS systems, or by the path name or from the shortcut bar on Linux systems. For more information refer: UTM - FAQ: What are the basics of SSLVPN setup on Gen5 UTM appliances running SonicOS Enhanced 5.2? Procedure: Step 1. Login to the SonicWALL UTM appliance, go to SSL-VPN > Server Settings page allows the administrator to enable SSL VPN access on zones, from SonicOS Enhanced 5.6.x.x onwards the SSL-VPN feature on UTM devices uses port Please Note: In older firmware versions the SSL-VPN Zones settings are available under SSL-VPN > Client Settings page. SSL-VPN can only be connected using interface IP addresses. By default SSL-VPN is enabled on the WAN zone and users can connect to it using the WAN interface IP address. Likewise for other zones and, if enabled, can only be connected using the interface IP address. The SSL VPN > Portal Settings page is used to configure the appearance and functionality of the SSL VPN Virtual Office web portal. The Virtual Office portal is the website that uses log in to launch NetExtender.

250MW TZ series: TZ 100, TZ 100 Wireless, TZ 200, TZ 200W, TZ 210, TZ 210 W. TZ 215, TZ 215 W, TZ 105, TZ 105W, TZ 205, TZ 205W Firmware versions: Gen5 devices with SonicOS Enhanced 5.2.x.x or higher.

2 TM SSL-VPN: How to setup SSL-VPN feature (NetExtender Access)... of 6 1/12/ :46 PM Step 2. Configure the SSL VPN > Client Settings. The SSL VPN > Client Settings page allows the administrator to configure the client address range information and NetExtender client settings. The most important being where the SSL-VPN will terminate (eg on the LAN in this case) and which IPs will be given to connecting clients. Finally, select from where users should be able to login (probably, this will be the WAN, so just click on the WAN entry): Note (New for SonicOS Enhanced 5.5 and above): NetExtender cannot be terminated on an interface that is paired to another interface using L2 Bridge Mode. This includes interfaces bridged with a WLAN interface. Interfaces that are configured with L2 Bridge Mode are not listed in the "SSLVPN Client Address Range" Interface drop-down menu. For NetExtender termination, an interface should be configured with as a LAN, DMZ, WLAN, or a custom Trusted, Public, or Wireless zone, and also configured with the IP Assignment of "Static". Screenshot from SonicOS Enhanced 5.5 Screenshot from SonicOS Enhanced 5.6 Configuring NetExtender Client Settings: Enable the option Create Client Connection Profile - The NetExtender client will create a connection profile recording the SSL VPN Server name, the Domain name and optionally the username and password.

The most important being where the SSL-VPN will terminate (eg on the LAN in this case) and which IPs will be given to connecting clients.

UTM SSL-VPN: How to setup SSL-VPN feature (NetExtender Access)... 3 of 6 1/12/2013 11:46 PM Step 3.

The NetExtender client routes are passed to all NetExtender clients and are used to govern which private networks and resources remote user can access via the SSL VPN connection.

3 UTM SSL-VPN: How to setup SSL-VPN feature (NetExtender Access)... 3 of 6 1/12/ :46 PM Step 3. The SSL VPN > Client Routes page allows the administrator to control the network access allowed for SSL VPN users. The NetExtender client routes are passed to all NetExtender clients and are used to govern which private networks and resources remote user can access via the SSL VPN connection. Note: All clients can see these routes. Also, here you may enable/disable Tunnel All Mode (this is the equivalent of This gateway only option while configuring GroupVPN). Step 4. Under Users > Local users, ensure that the relevant user or user group is a member of the SSLVPN Services group: Groups Tab: To setup membership for individual users Members Tab: To setup membership for local or LDAP user group, edit the SSLVPN Services user group and add the user group under the Members tab

4 TM SSL-VPN: How to setup SSL-VPN feature (NetExtender Access)... of 6 1/12/ :46 PM VPN Access Tab: On the VPN Access Tab allows users to access networks using a VPN tunnel, select one or more networks from the Networks list and click the arrow button -> to move them to the Access List. To remove the user s access to a network, select the network from the Access List, and click the left arrow button <-. Step 5. Under Firewall > Access Rules, note the new SSLVPN zone: Step 6. Firewall access rules are auto-created from and to SSLVPN zone from other zones. Optionally you could modify the auto-created SSLVPN to LAN rule to allow access only to those users that are configured (recommended to use single rule with groups rather than multiple rules with individual users). Ignore any warning that login needs to be enabled from SSLVPN zone. Please note: Prior to SonicOS Enhanced 5.6, the VPN access list that we normally use for GVC VPNs has no effect. You can control access using the firewall rules: Step 7: Goto WAN interface and ensure HTTPS user login is enabled:

to move them to the Access List. To remove the user s access to a network, select the network from the Access List, and click the left arrow button <-. Step 5.

5 UTM SSL-VPN: How to setup SSL-VPN feature (NetExtender Access)... 5 of 6 1/12/ :46 PM How to Test this Scenario: 1. Users can now go to the public IP of the sonicwall. Notice the new click here for SSL login hyper link: 2. Users can then login and start netextender: NetExtender provides remote users with full access to your protected internal network. The experience is virtually identical to that of using a traditional IPSec VPN client, but NetExtender does not require any manual client installation. Instead, the NetExtender Windows client is automatically installed on a remote user s PC by an ActiveX control when using the Internet Explorer browser, or with the XPCOM plugin when using Firefox. On MacOS systems, supported browsers use Java controls to automatically install NetExtender from the Virtual Office portal. Linux systems can also install and use the NetExtender client. After installation, NetExtender automatically launches and connects a virtual adapter for secure SSL-VPN point-to-point access to permitted hosts and subnets on the internal network.

The experience is virtually identical to that of using a traditional IPSec VPN client, but NetExtender does not require any manual client installation.

6 UTM SSL-VPN: How to setup SSL-VPN feature (NetExtender Access)... 6 of 6 1/12/ :46 PM See Also: SSL-VPN: Installing NetExtender using Mozilla Firefox browser SSL-VPN: Installing NetExtender using the Internet Explorer (IE) browser SSL-VPN: Installing NetExtender on MacOS (Macintosh Computers) SSL-VPN: Installing and Using NetExtender on Linux Related Items UTM - FAQ: What are the basics of SSLVPN setup on Gen5 UTM appliances running SonicOS Enhanced 5.2? UTM SSL-VPN: How to create a profile for SSL-VPN clients and connect from the NetExtender Client automatically UTM SSL-VPN: Unable to save username and password on UTM SSL VPN Netextender client UTM and SMB SSL-VPN: How To Configure SSLVPN Enforcement UTM SSL-VPN: Error "Server is busy, please try it later!" when downloading NetExtender KBID 6461 Date Modified 5/9/2012 Date Created 3/23/2009 Use Alerts to be notified when new information is added or changed in an individual answer or topic of information you care about. All Alert notifications sent in a single once each day. Notify me if this item has activity Notify me if content in this topic has activity or you can subscribe to our RSS feed for this topic by clicking the link below Subscribe

NetExtender on MacOS (Macintosh Computers) SSL-VPN: Installing and Using NetExtender on Linux Related Items UTM - FAQ: What are the basics of SSLVPN setup on Gen5 UTM appliances running SonicOS

Using SonicWALL NetExtender to Access FTP Servers

SSL-VPN Using SonicWALL NetExtender to Access FTP Servers Problem: Using NetExtender to access an FTP Server on the LAN segment of a SonicWALL PRO 4060. Solution: Perform the following setup steps. Step