How can I access remote sites over SSL-VPN with Tunnel-All mode disabled?

12/20/2019 1171 17243

DESCRIPTION:

Access to remote site over SSL-VPN if there is not tunnel all mode enabled on the firewall. For instance the access to remote site needs to be examined/secured by the security services available on the SonicWall.

RESOLUTION:

1. Add address object of the destination with the zone assignment of VPN by navigating to Manage | Objects  | Address objects.
   
   Name of the object - Remote Site
   Zone assignment :VPN
   Type: Host
   IP Address: 188.226.140.221
   
   
   
2. Add route to this object in SSL-VPN routes .
3. Click Client Routes and choose the address object previously created (here Remote Site), click OK.
   
   
4. Navigate to Users/Local Groups.
5. Open the SSLVPN Services group.
6. Click on tab VPN.
   
   
   
7. Add Remote Site to the list from left hand side pane. click OK.
8. Navigate to Rules | Access rules and choose the access rules (SSLVPN | VPN).
   
   
9. Go to access rules (SSLVPN | WAN) and check the existence of the rule respectively.
10. Connect with NetExtender.
    
    
    
11.  In the routes there should be seen the (Remote Site's IP create previously 188.226.140.221) among ip addresses for the routes available for SSL-VPN connections.
    
    

    NOTE: In Packet Monitor will be looking for IP packets of type TCP, Destination IP should be the address object ip of Remote Site  (188.226.140.221) and you shall see on the SSL-VPN firewall that the access to188.226.140.221 will be coming out with the external IP address of that firewall.

Resolution for SonicOS 6.2 and Below

The below resolution is for customers using SonicOS 6.2 and earlier firmware. For firewalls that are generation 6 and newer we suggest to upgrade to the latest general release of SonicOS 6.5 firmware.

1. Add address object of the destination with the zone assignment of VPN.
   
   Name of the object : Remote Site
   Zone assignment :VPN
   Type: Host
   IP Address: 188.226.140.221
   
   
   
2. Add route to this object in SSL-VPN routes  - go to SSL VPN / Status in 5.8.x.x firmware.
3. Click Client routes and choose the address object previously created (here Remote Site) confirm with OK.
   
   
4. Go to Users/Local Groups.
5. Open the SSLVPN Services group.
6. Click on tab VPN.
   
7. Add Remote Site to the list from left hand side pane.Click OK.
8. Navigate to Network /NAT Policies create NAT policy (only in 5.9.x.x needed).
   
   Original Source: SSL-VPN RANGE
   Translated Source :X1 IP
   Original Destination: Any
   Translated Destination: Original
   Original Source: (can be ANY or the one that is needed)
   Translated Service: Original
   Inbound Interface: Any
   Outbound interface: Any
   Enable NAT policy should be ticked.
   
   
9. Go to firewall access rules and choose the access rules (SSLVPN | VPN).
   
   
   
10. Check if there is a rule (SSL-VPN IP RANGE) to Remote Site ( SSLVPN IP Pool in 5.8.x.x Firmware ).
11. Go to Access Rules (SSLVPN > WAN) and check the existence of the rule respectively.
12. Connect with NetExtender.
    
    
    
13. In the routes there should be seen the (Remote Site's IP create previously 188.226.140.221) among ip addresses for the routes available for SSL-VPN connections.
    
    
    

    NOTE: In Packet Monitor will be looking for IP packets of type TCP, Destination IP should be the address object ip of Remote Site  (188.226.140.221) and you shall see on the SSL-VPN Firewall that the access to188.226.140.221 will be coming out with the external IP address of that firewall.