-
Products
-
SonicPlatform
SonicPlatform is the cybersecurity platform purpose-built for MSPs, making managing complex security environments among multiple tenants easy and streamlined.
Discover More
-
-
Solutions
-
Federal
Protect Federal Agencies and Networks with scalable, purpose-built cybersecurity solutions
Learn MoreFederalProtect Federal Agencies and Networks with scalable, purpose-built cybersecurity solutions
Learn More - Industries
- Use Cases
-
-
Partners
-
Partner Portal
Access to deal registration, MDF, sales and marketing tools, training and more
Learn MorePartner PortalAccess to deal registration, MDF, sales and marketing tools, training and more
Learn More - SonicWall Partners
- Partner Resources
-
-
Support
-
Support Portal
Find answers to your questions by searching across our knowledge base, community, technical documentation and video tutorials
Learn MoreSupport PortalFind answers to your questions by searching across our knowledge base, community, technical documentation and video tutorials
Learn More - Support
- Resources
- Capture Labs
-
- Company
- Contact Us
7.1.1 SonicOSX (NSv and 15K Firewalls) Source-based restriction for management traffic has no effect on the VPN traffic.
12/21/2023 
0 People found this article helpful
148,319 Views
Description
Although you have a source address base restriction on an interface on the firewall, VPN users will still be able to access and the source restriction will not have an effect on management traffic.
For example:
If you try to restrict the management traffic from X0 subnet only.
SSLVPN and VPN users can still or could manage the firewall via HTTPS.
Source Limiting HTTPS / ping / SSH Management is done differently in SonicOS / SonicOSX 7.1.1, compared to SonicOS / SonicOSX 7.0.1. The new features work as designed, and this means that configurations where source objects chosen under the Network Interfaces for these management services, correctly allow only specified sources from LAN to LAN, or from WAN to WAN, and block sources which are not allowed there. Any previously done customizations of Security Policies, from LAN to LAN, or from WAN to WAN, etc., will have no effect now.
On this sample I am trying to add a group from two different zones LAN and WAN address abject group.
NOTE: This is a know issue and we are actively working to address it.
Resolution
Create a security policy to Deny the HTTPS management traffic from the VPN remote subnets.
Related Articles
- How to Block Google QUIC Protocol on SonicOSX 7.0?
- How to block certain Keywords on SonicOSX 7.0?
- How internal Interfaces can obtain Global IPv6 Addresses using DHCPv6 Prefix Delegation
YES
NO