Configuring custom GroupVPN from a VLAN

03/26/2020 36 People found this article helpful 192,882 Views

Download

Print

Share

• LinkedIn
• Twitter
• Facebook
• Email
• Copy URL The link has been copied to clipboard

Description

This article describes how to create a custom GroupVPN.

Scenario:

We have V10 (DMZ) configured behind the X0 (LAN) and we want users from DMZ zone to access LAN subnet through GroupVPN.

By default, when a zone is not associated with any physical interface, RCF file for the GroupVPN will contain the X1 IP as target, otherwise it will contain the IP of the Physical Interface associated with that zone.

Cause

When exporting the RCF file, it will contain the X1 IP as target and the GroupVPN connection won't work over the X1 IP.

Resolution

Create the DMZ GroupVPN:

1. Go to Manage tab | Network | Zones
2. Configure the DMZ zone and enable "Create GroupVPN"
   
3. Go to VPN | Base Setting, enable the DMZ GroupVPN and download the RCF File
   
4. Import the RCF File on Global VPN Client

NOTE: The target IP will be the X1 IP. The connection will not work as your users are coming from the DMZ subnet.

Create NAT Rule and Access Rule to allow the traffic to get to the X0:V10 IP:

1. Create the following NAT Rule that will translate the IKE traffic from your DMZ subnet to the X1 IP forwarding it to the X0:V10 IP
   
2. Create the following Access Rule that will allow this traffic from DMZ to DMZ but passing through X1 IP:
   

Now you should be able to get to your X0:V10 IP through the X1 IP by using SonicWall Global VPN Client.

Related Articles

• Bandwidth usage and tracking in SonicWall
• How to force an update of the Security Services Signatures from the Firewall GUI
• Configure Guest VLAN in the TZ firewall, for guest users to access Internet only.

Categories

• Firewalls > TZ Series > VPN
• Firewalls > SonicWall NSA Series > VPN
• Firewalls > SonicWall SuperMassive 9000 Series > VPN