Configuring custom GroupVPN from a VLAN

03/26/2020 29 8920

DESCRIPTION:

This article describes how to create a custom GroupVPN.

Scenario:

We have V10 (DMZ) configured behind the X0 (LAN) and we want users from DMZ zone to access LAN subnet through GroupVPN.

By default, when a zone is not associated with any physical interface, RCF file for the GroupVPN will contain the X1 IP as target, otherwise it will contain the IP of the Physical Interface associated with that zone.

CAUSE:

When exporting the RCF file, it will contain the X1 IP as target and the GroupVPN connection won't work over the X1 IP.

RESOLUTION:

Create the DMZ GroupVPN:

1. Go to Manage tab | Network | Zones
2. Configure the DMZ zone and enable "Create GroupVPN"
   
3. Go to VPN | Base Setting, enable the DMZ GroupVPN and download the RCF File
   
4. Import the RCF File on Global VPN Client

NOTE: The target IP will be the X1 IP. The connection will not work as your users are coming from the DMZ subnet.

Create NAT Rule and Access Rule to allow the traffic to get to the X0:V10 IP:

1. Create the following NAT Rule that will translate the IKE traffic from your DMZ subnet to the X1 IP forwarding it to the X0:V10 IP
   
2. Create the following Access Rule that will allow this traffic from DMZ to DMZ but passing through X1 IP:
   

Now you should be able to get to your X0:V10 IP through the X1 IP by using SonicWall Global VPN Client.