SonicWALL SMA 100 Series Guía de referencia rápida

Secure Mobile Access 10.2

Deployment Guide

for the SMA 100 Series

Contents

Deployment Scenarios Overview 3

Selecting a Deployment Scenario 3

SMA 210/410 Deployment Scenarios 4

Overview of Scenario A: SMA on a New DMZ 4

Overview of Scenario B: SMA on an Existing DMZ 4

Overview of Scenario C: SMA on the LAN 4

Connecting the SMA on a New DMZ 5

Connecting the SMA to the Gateway 5

Allowing a WAN to SMA Connection 5

Allowing an SMA to LAN Connection 7

Connecting the SMA on an Existing DMZ 9

Connecting the SMA to the Gateway 9

Allowing WAN to DMZ Connection 9

Allowing DMZ to LAN Connection 10

Deploying SMA on the LAN 13

Connecting the SMA to the Gateway 13

Configuring SMA to LAN Connectivity 13

Additional Configuration 16

Configuring the X0 IP Address 16

Configuring a Default Route 17

Adding a NetExtender Client Route 17

Setting Your NetExtender Address Range 19

Adding a New SMA Custom Zone 20

Testing and Troubleshooting Your Remote Connection 22

Verifying a User Connection from the Internet 22

Policy > Access Rules Matrix View 23

SonicWall Support 24

About This Document 25

SMA 10.2 Deployment Guide for the SMA 100 Series

Contents

Deployment Scenarios Overview

Welcome to the SonicWall SMA Deployment Guide. SonicWall® Secure Mobile Access 210/410 provides a

unified secure gateway to access all network and cloud resources. This guide contains configuration

guidelines for deployment scenarios involving new DMZ, existing DMZ, and LAN deployments, along with

basic configuration settings for those scenarios.

Topics:

lSelecting a Deployment Scenario

lSMA 210/410 Deployment Scenarios

Selecting a Deployment Scenario

The deployment scenarios described in this guide are based on actual customer deployments and are

SonicWall-recommended deployment best practices for SMA appliances.

An SMA appliance is commonly deployed in one-arm mode over the DMZ interface on an accompanying

gateway appliance, such as a SonicWall NSa 3600. This method of deployment offers additional layers of

security control, plus the ability to use SonicWall’s security services, including Gateway Anti-Virus, Anti-

Spyware, Content Filtering, Intrusion Prevention Service, and Comprehensive Anti-Spam Service, to scan all

incoming and outgoing traffic.

The primary interface (X0) on the SonicWall SMA connects to an available segment on the gateway device.

The encrypted user session is passed through the gateway to the SMA appliance. The SonicWall SMA

appliance decrypts the session and determines the requested resource.

The session traffic then traverses the gateway appliance to reach the internal network resources. The

gateway appliance applies security services as data traverses the gateway. The internal network resource

then returns the requested content to the SonicWall SMA appliance through the gateway, where it is

encrypted and sent to the client.

SMA 10.2 Deployment Guide for the SMA 100 Series

Deployment Scenarios Overview

SMA 210/410 Deployment Scenarios

Gateway Appliance Deployment Scenario Requirements on Gateway Appliance

SonicOS/X 7 or higher:

lTZ Series

lNSa Series

lNSsp Series

lNSv Series

SMA on new DMZ lAn unused interface

lNEW DMZ configured for NAT or Transparent

Mode

SMA on existing DMZ lOne dedicated interface in use as an existing

DMZ

SMA on LAN lNone

For a full list of the supported SonicWall firewall and firmware versions, see

https://www.sonicwall.com/support/product-lifecycle-tables/

The following illustrations provide an overview of each deployment scenario:

lOverview of Scenario A: SMA on a New DMZ

lOverview of Scenario B: SMA on an Existing DMZ

lOverview of Scenario C: SMA on the LAN

Overview of Scenario A: SMA on a New DMZ

Overview of Scenario B: SMA on an Existing DMZ

Overview of Scenario C: SMA on the LAN

SMA 10.2 Deployment Guide for the SMA 100 Series

Deployment Scenarios Overview

Connecting the SMA on a New DMZ

The following procedures explain how to configure your gateway appliance on a new DMZ:

lConnecting the SMA to the Gateway

lAllowing a WAN to SMA Connection

lAllowing an SMA to LAN Connection

Connecting the SMA to the Gateway

To connect the SMA 210/410 using Scenario A:

1. Connect one end of an Ethernet cable to an unused port on your SonicWall gateway appliance.

2. Connect the other end of the Ethernet cable to the X0 port on the front of your SonicWall Secure

Mobile Access 210/410. The X0 Port LED lights up indicating an active connection.

3. Configure the SMA X0 IP address. Refer to Configuring the X0 IP Address.

Allowing a WAN to SMA Connection

NOTE: Before continuing, you must add a new SMA custom zone. Refer to Adding a New SMA Custom

Zone for more information.

To allow a WAN to SMA connection:

1. Using SonicOS, click the Wizards icon in the top right corner of the gateway appliance management

interface.

2. On the Configuration Guide page, select the Public Server Guide, and then click Next.

SMA 10.2 Deployment Guide for the SMA 100 Series

Connecting the SMA on a New DMZ

3. On the Public Server Guide, select these options:

Service Type Other

Services Create new group

4. In the Service Group dialog box, create a service group for HTTP and HTTPS:

lEnter a Name for the service.

lSelect both HTTP and HTTPS and click the arrow button to move them to the right column.

lClick Save.

5. On the Server Private Network Configuration page, enter the following server and SMA

information, and then click Next:

Server Name Specify the name for the SMA appliance

Server Private IP Address SMA appliance X0 IP address

Server Comment Brief description of the server

6. On the Server Public Information page, accept the default IP address, or enter an IP address in

your allowed public IP range. Click Next.

NOTE: The default IP address is the WAN IP address of your SonicWall security appliance. If

you accept this default, all HTTP and HTTPS traffic to this IP address will be routed to your SMA

appliance.

SMA 10.2 Deployment Guide for the SMA 100 Series

Connecting the SMA on a New DMZ

7. The Public Server Configuration Summary page displays all the configuration actions that are

performed. Click Apply to create the configuration and allow access from the WAN to the SMA on

the DMZ.

Allowing an SMA to LAN Connection

When users have connected to the SMA, they need to be able to connect to resources on the LAN.

To allow an SMA to LAN connection:

1. Using SonicOS, navigate to the OBJECT | Match Objects > Addresses page on the gateway

appliance.

2. In the Address Objects tab, click +Add.

3. In the Address Object Settings dialog box, create an address object for the X0 interface IP address

of your SMA appliance:

Name Name of the SMA appliance

Zone Assignment SMA

Type Host

IP Address SMA appliance X0 IP address (default 192.168.200.1)

4. Click Save to create the object. Once done, click Close.

5. Click Add again to create an address object for the NetExtender range.

6. In the Add Address Object dialog box, create an address object for the NetExtender range:

Name Name for NetExtender range

Zone Assignment SMA

Type Range

Starting IP Address Start of the NetExtender IP address range (default 192.168.200.100)

Ending IP Address End of the NetExtender IP address range (default 192.168.200.200)

7. Click Save to create the object. Once added, click Close.

8. On the OBJECT | Match Objects > Addresses page, click the Address Groups tab.

SMA 10.2 Deployment Guide for the SMA 100 Series

Connecting the SMA on a New DMZ

9. Click +Add.

10. In the Add Address Groups dialog box, create a group for the X0 interface IP address of your SMA

appliance and the NetExtender IP range:

lEnter a name for the group.

lIn the left column, select the address objects you created and click the right arrow button.

lClick Save to create the group when both objects are in the right column.

11. Navigate to the POLICY | Rules and Policies > Access Rules page, and select the Matrix view

style.

12. Click the SMA > LAN icon.

13. On the page that displays for SMA to LAN, click +Add.

14. In the Add Rule window, create a rule to allow access to the LAN for the address group you just

created:

Source Zone/Interface SMA

Source Destination LAN

Source Port Any

Service Any

Source The address group you just created, such as SMA and

NetExtender.

Destination Any

Users Allowed All

Users Excluded None

Schedule Always on

Select the following check box

(es)

lEnable Logging

lAllow Fragmented Packets

15. Click OK to create the rule.

This completes Scenario A.

NOTE: Some gateway appliances have a default zone named SSLVPN. Do not select this zone when

configuring for the SMA appliance. The SSLVPN zone is intended for use with the more limited SSLVPN

features that are included in the firewall products.

Continue to Additional Configuration and Testing and Troubleshooting Your Remote Connection.

SMA 10.2 Deployment Guide for the SMA 100 Series

Connecting the SMA on a New DMZ

Connecting the SMA on an Existing DMZ

The following procedures explain how to configure your gateway on an existing DMZ:

lConnecting the SMA to the Gateway

lAllowing WAN to DMZ Connection

lAllowing DMZ to LAN Connection

Connecting the SMA to the Gateway

To connect the SMA using Scenario B:

1. Connect one end of an Ethernet cable to your DMZ, either directly to the corresponding port on your

existing SonicWall gateway appliance, to a hub, or to a switch on your DMZ.

2. Connect the other end of the Ethernet cable to the X0 port on your SonicWall SMA 210/410. The X0

Port LED lights up indicating an active connection.

3. Configure the SMA X0 with an IP address in the DMZ subnet. Refer to Configuring the X0 IP Address

for more information.

Allowing WAN to DMZ Connection

If you are already forwarding HTTP or HTTPS to an internal server and you only have a single public IP

address, you need to select different (unique) ports of operation for either the existing servers or for the SMA

appliance, because both cannot concurrently use the same IP address and port combinations.

To allow a WAN to DMZ connection:

1. Using SonicOS, log into your gateway appliance as an administrator and click the Wizards icon at

the top right of the interface.

2. On the Configuration Guide page, select the Public Server Guide, and then click Next.

3. On the Public Server Guide page of the Wizard, select:

Server Type Other

Service Create new group

The Service Group dialog box is displayed.

SMA 10.2 Deployment Guide for the SMA 100 Series

Connecting the SMA on an Existing DMZ

4. In the Service Group dialog box, create a service group for HTTP and HTTPS:

lEnter a Name for the service group.

lSelect both HTTP and HTTPS and click the arrow button to move to the right column.

lClick OK.

5. On the Server Private Network Configuration page, enter the following server information and

click Next:

Server Name Name for the SMA appliance

Server Private IP

Address

The X0 IP address of the SMA appliance within your DMZ range, such

as 10.1.1.10/24.

Server Comment Brief description of the server

6. On the Server Public Information page, accept the default IP address or enter a new IP address in

your allowed public IP range. Click Next.

NOTE: The default IP address is the WAN IP address of your SonicWall firewall. If you accept

this default, all HTTP and HTTPS traffic to this IP address is routed to your SMA appliance.

7. The Public Server Configuration Summary page displays all configuration actions that are

performed. Click Apply to create the configuration and allow access from the WAN to the SMA

appliance on the DMZ.

Allowing DMZ to LAN Connection

When users have connected to the SMA, they need to be able to connect to resources on the LAN.

To allow a DMZ to LAN connection:

1. Using SonicOS, navigate to the OBJECT | Match Objects > Addresses page on the gateway

appliance.

2. In the Address Objects tab, click +Add.

3. In the Address Object Settings dialog box, create an address object for the X0 interface IP address

of your SMA appliance:

Name Name of the SMA appliance

Zone

Assignment

DMZ

Type Host

IP Address X0 IP address of the SMA appliance within your DMZ range, such as

10.1.1.10.

4. Click OK to create the object. Once added, click Close.

5. Click +Add again to create an address object for the NetExtender range.

6. In the Add Object dialog box, create an address object for the NetExtender range using the

following options, then click Add:

Name Name for NetExtender

SMA 10.2 Deployment Guide for the SMA 100 Series

Connecting the SMA on an Existing DMZ

Otros manuales para SMA 100 Series

Tabla de contenidos

Otros manuales de Punto de acceso inalámbrico de SonicWALL

SonicWALL

SonicWALL SonicWave 231o Manual del propietario

SonicWALL

SonicWALL SonicWave 432o Manual de usuario

SonicWALL

SonicWALL SonicPoint ACe Manual de usuario

SonicWALL

SonicWALL TZ300P Manual del propietario

SonicWALL

SonicWALL ex9000 Manual de usuario

SonicWALL

SonicWALL SonicWave 641 Manual de usuario

SonicWALL

SonicWALL TZ500 W Manual del propietario

SonicWALL

SonicWALL SonicWave 432o Manual de usuario

SonicWALL

SonicWALL SonicWave 231c Manual de usuario

SonicWALL

SonicWALL SonicWave 200 Series Guía de referencia rápida

SonicWALL

SonicWALL APL13-02C Manual de usuario

SonicWALL

SonicWALL APL62-0F7 Manual del propietario

SonicWALL

SonicWALL SonicWave 200 Series Guía de referencia rápida

SonicWALL

SonicWALL SonicWave 200 Series Guía de referencia rápida

SonicWALL

SonicWALL SonicWave 400 Series Guía de referencia rápida

SonicWALL

SonicWALL E-Class SonicPoint-Ne Manual de usuario

SonicWALL

SonicWALL SonicWave 432e Manual de usuario

SonicWALL

SonicWALL SonicWave 432i Manual del propietario

SonicWALL

SonicWALL SonicPoint N2 Manual de usuario

SonicWALL

SonicWALL SOHO 250 Manual del propietario

SonicWALL

SonicWALL APL43-0C2 Manual del propietario

SonicWALL

SonicWALL SonicPoint Manual de usuario

SonicWALL

SonicWALL SonicWave 200 Series Guía de referencia rápida

SonicWALL

SonicWALL SonicWave 224w Manual del propietario

Manuales populares de Punto de acceso inalámbrico de otras marcas

D-Link

D-Link DWL-2100AP - AirPlus Xtreme G Manual de usuario

Ubiquiti

Ubiquiti NanoStation NSM2 Manual de usuario

Cisco

Cisco Aironet 1550 Series Manual de usuario

Aruba

Aruba IAP-335 Manual de usuario

Advantek Networks

Advantek Networks AWN-AP-54MR Manual de usuario

IP-COM

IP-COM AP355 Manual de usuario

Buffalo

Buffalo AirStation WLA-L11G Manual de usuario

EnGenius

EnGenius EnStationACv2 Manual de usuario

D-Link

D-Link DAP-3662 Manual de usuario

xG Technology

xG Technology xMax CN1300 Manual de usuario

Widelink

Widelink ezWave WAP-1100 Series Manual de usuario

Edimax

Edimax CAP1200 Manual de usuario

Ubiquiti

Ubiquiti LBE-5AC-Gen2 Manual de usuario

Aruba

Aruba AP-203R Manual de usuario

LuXout Shades

LuXout Shades LUXSHADE MOTION Manual de usuario

CreatComm

CreatComm TB5F Manual de usuario

SineDigital

SineDigital MW-1500AP(H) Manual de usuario

TP-Link

TP-Link AP9650 V1 Manual de usuario