How can I access remote sites over SSL-VPN with Tunnel-All mode disabled?

10/14/2021 1,196 People found this article helpful 104,605 Views

Description

Access to remote site over SSL-VPN if there is not tunnel all mode enabled on the firewall. For instance the access to remote site needs to be examined/secured by the security services available on the SonicWall.

Resolution

Resolution for SonicOS 7.X

This release includes significant user interface changes and many new features that are different from the SonicOS 6.5 and earlier firmware. The below resolution is for customers using SonicOS 7.X firmware.

Add address object of the destination with the zone assignment of VPN by navigating to OBJECT | MAtch Objects | Addresses

Name of the object - Remote Site
Zone assignment - VPN
Type - Host
IP Address - 188.226.140.221
Add route to this object in SSL-VPN | Client Settings
Click Client Routes and choose the address object previously created (here Remote Site), click OK.
Navigate to Users|Local Groups.
Open the SSLVPN Services group.
Click on tab VPN Access.
Add Remote Site to the list from left hand side pane. click Save
Navigate to Rules and Policies | Access rules and choose the access rules (SSLVPN | VPN).
Navigate to access rules (SSLVPN | WAN) and check the existence of the rule respectively.
Connect with NetExtender.
In the routes there should be seen the (Remote Site's IP create previously 188.226.140.221) among ip addresses for the routes available for SSL-VPN connections.

NOTE: In Packet Monitor will be looking for IP packets of type TCP, Destination IP should be the address object ip of Remote Site (188.226.140.221) and you shall see on the SSL-VPN firewall that the access to188.226.140.221 will be coming out with the external IP address of that firewall.

Resolution for SonicOS 6.5

This release includes significant user interface changes and many new features that are different from the SonicOS 6.2 and earlier firmware. The below resolution is for customers using SonicOS 6.5 firmware.

Add address object of the destination with the zone assignment of VPN by navigating to Manage | Objects | Address objects.

Name of the object - Remote Site
Zone assignment :VPN
Type: Host
IP Address: 188.226.140.221
Add route to this object in SSL-VPN routes .
Click Client Routes and choose the address object previously created (here Remote Site), click OK.
Navigate to Users|Local Groups.
Open the SSLVPN Services group.
Click on tab VPN.
Add Remote Site to the list from left hand side pane. click OK.
Navigate to Rules | Access rules and choose the access rules (SSLVPN | VPN).
Navigate to access rules (SSLVPN | WAN) and check the existence of the rule respectively.
Connect with NetExtender.
In the routes there should be seen the (Remote Site's IP create previously 188.226.140.221) among ip addresses for the routes available for SSL-VPN connections.

NOTE: In Packet Monitor will be looking for IP packets of type TCP, Destination IP should be the address object ip of Remote Site (188.226.140.221) and you shall see on the SSL-VPN firewall that the access to188.226.140.221 will be coming out with the external IP address of that firewall.

Resolution for SonicOS 6.2 and Below

The below resolution is for customers using SonicOS 6.2 and earlier firmware. For firewalls that are generation 6 and newer we suggest to upgrade to the latest general release of SonicOS 6.5 firmware.

Add address object of the destination with the zone assignment of VPN.

Name of the object : Remote Site
Zone assignment :VPN
Type: Host
IP Address: 188.226.140.221
Add route to this object in SSL-VPN routes - go to SSL VPN / Status in 5.8.x.x firmware.
Click Client routes and choose the address object previously created (here Remote Site) confirm with OK.
Go to Users|Local Groups.
Open the SSLVPN Services group.
Click on tab VPN.
Add Remote Site to the list from left hand side pane.Click OK.
Navigate to Network /NAT Policies create NAT policy (only in 5.9.x.x needed).

Original Source: SSL-VPN RANGE
Translated Source :X1 IP
Original Destination: Any
Translated Destination: Original
Original Source: (can be ANY or the one that is needed)
Translated Service: Original
Inbound Interface: Any
Outbound interface: Any
Enable NAT policy should be ticked.
Navigate to firewall access rules and choose the access rules (SSLVPN | VPN).
Check if there is a rule (SSL-VPN IP RANGE) to Remote Site ( SSLVPN IP Pool in 5.8.x.x Firmware ).
Go to Access Rules (SSLVPN | WAN) and check the existence of the rule respectively.
Connect with NetExtender.
In the routes there should be seen the (Remote Site's IP create previously 188.226.140.221) among ip addresses for the routes available for SSL-VPN connections.

NOTE: In Packet Monitor will be looking for IP packets of type TCP, Destination IP should be the address object ip of Remote Site (188.226.140.221) and you shall see on the SSL-VPN Firewall that the access to188.226.140.221 will be coming out with the external IP address of that firewall.