Accessing remote site resources when connected to the main site via remote VPN client

04/12/2021 1236 26967

DESCRIPTION:

In many scenarios, VPN users who are connected to the main site via a remote VPN Client need to have access to the resources behind the remote site in addition to the resources on main site. This KB article shows how to configure SonicWall to meet this need.

RESOLUTION:

Resolution for SonicOS 7.X

This release includes significant user interface changes and many new features that are different from the SonicOS 6.5 and earlier firmware. The below resolution is for customers using SonicOS 7.X firmware.

1. Login to the SonicWall management GUI
2. Click Network tab.
3. Navigate to IPSec VPN |  Rules and Settings.
4. Click on the Configure option of the appropriate VPN policy intended for remote site.
   
   
   
   
5. Navigate to Networks tab in the new window and make a note of the address object/group set in the Choose destination network from list drop down list. (This may vary depending upon the remote site resource access privilege of the VPN users).
   
   
   
    EXAMPLE: If the remote site resources access for the VPN user is restricted to a single IP address or subnet, then appropriate address object must be created in Network | Address Objects page with zone VPN.
   
   
6. Navigate to the Device| Users | Local Users & Groups page and click  configure option of the remote VPN user account.
   
   
   
   
7. Navigate to VPN Access tab in the new window and enforce the respective Address Object/Group of the remote site from left to right by clicking on the appropriate option as shown below in the image - In the example the object was NSA2650 Site.
   
   

How to Test this Scenario

• When using GVC
  

1. Disconnect the Global VPN Client session, reconnect & try to access (ping) the remote site resource.
2. The client will be able to access the resources without any issues.

• When using NetExtender

1. Click Policy tab.
2. Navigate to Rules and Policies | Access Rules, click on view style matrix.
3. Click on SSLVPN to VPN matrix button.
4. Ensure there is an Allow Rule as shown below in the image.
5. Check the same from VPN to SSLVPN zones.
6. Disconnect the NetExtender client session, reconnect & try to access (ping) the remote site resource.
7. The client will be able to access the resources without any issues.
   
   
   
   

Resolution for SonicOS 6.5

This release includes significant user interface changes and many new features that are different from the SonicOS 6.2 and earlier firmware. The below resolution is for customers using SonicOS 6.5 firmware.

1. Login to the SonicWall management GUI.
2. Click  Manage tab.
3. Navigate to VPN |  Base Settings.
4. Click on the Configure option of the appropriate VPN policy intended for remote site.
   
5. Navigate to Networks tab in the new window and make a note of the address object/group set in the Choose destination network from list drop down list. (This may vary depending upon the remote site resource access privilege of the VPN users).
   
    EXAMPLE: If the remote site resources access for the VPN user is restricted to a single IP address or subnet, then appropriate address object must be created in Network | Address Objects page with zone VPN.
   
   
6. Navigate to the Users | Local Users & Groups page and click  configure option of the remote VPN user account.
   
   
7. Navigate to VPN Access tab in the new window and enforce the respective Address Object/Group of the remote site from left to right by clicking on the appropriate option as shown below in the image - In the example the object was NSA2650 Site.
   

How to Test this Scenario

• When using GVC
  

1. Disconnect the Global VPN Client session, reconnect & try to access (ping) the remote site resource.
2. The client will be able to access the resources without any issues.
   
   

• When using NetExtender

1. ClickManage tab.
2. Navigate to Rules | Access Rules, click on view style matrix.
3. Click on SSLVPN to VPN matrix button.
4. Ensure there is an Allow Rule as shown below in the image.
5. Check the same from VPN to SSLVPN zones.
6. Disconnect the NetExtender client session, reconnect & try to access (ping) the remote site resource.
7. The client will be able to access the resources without any issues.
   

Resolution for SonicOS 6.2 and Below

The below resolution is for customers using SonicOS 6.2 and earlier firmware. For firewalls that are generation 6 and newer we suggest to upgrade to the latest general release of SonicOS 6.5 firmware.

1. Login to the SonicWall management GUI.
2. Navigate to VPN | Settings page.
3. Click on the Configure option of the appropriate VPN policy intended for remote site.
   
4. Navigate to Networks tab in the new window and make a note of the address object/group set in the Choose destination network from list drop down list. (This may vary depending upon the remote site resource access privilege of the VPN users).
   
   

   EXAMPLE: If the remote site resources access for the VPN user is restricted to a single IP address or subnet, then appropriate address object must be created in Network | Address Objects page with zone VPN.
   
   

5. Navigate to the Users | Local Users page and click on the configure option of the remote VPN user account.
6. Navigate to VPN Access tab in the new window and enforce the respective address object/group of the remote site from left to right by clicking on the appropriate option as shown below in the image.
   

How to Test this Scenario

• When using GVC
  1. Disconnect the Global VPN client session, reconnect & try to access (ping) the remote site resource.
  2. The client will be able to access the resources without any issues.
• When using NetExtender
  1. Navigate to Firewall | Access Rules, click on view style matrix.
  2. Click on SSLVPN to VPN matrix button.
  3. Ensure there is an allow rule as shown below in the image.
  4. Check the same from VPN to SSLVPN zones.
  5. Disconnect the NetExtender Client session, reconnect & try to access (ping) the remote site resource.
  6. The client will be able to access the resources without any issues.