How do I configure SonicWall access points for layer 3 management over SSLVPN?

03/26/2020 1194 12184

DESCRIPTION:

SonicWall UTM appliances running SonicOS Enhanced firmware are capable of discovering and managing SonicPoints over SSL-VPN
- A SSL VPN connection is established between the SonicPoint and the managing UTM appliance
- GRE / DTLS (phase II) tunnel is established between the SonicWall UTM appliance and the SonicPoint to carry management and data traffic(Within the SSLVPN session)

RESOLUTION:

Scenario:

Discovering and managing SonicPoints using SSLVPN over the Internet / WAN.
Please Note: The settings shown in this technote is just an example, you must substitute the settings as per your setup.
Deployment Steps:

Part 1: Configuration on the SonicWall UTM appliance

Part2: Configuration on the SonicPoint

Detailed configuration steps:

Part 1: Configuration on the SonicWall UTM appliance

Step 1: Creating a WLAN Tunnel Interface

1. Login to the SonicWall Management Interface and go to Network > Interfaces page
2. Select WLAN tunnel interface in the Add Interface drop down menu and configure as per your setup

Zone: WLAN
Tunnel ID: 0 (zero)
Tunnel Source Interface: X0 / LAN
Mode / IP Assignment: Static
IP Address: 172.16.35.1
Subnet Mask: 255.255.255.0

Step 2: Enable SSL VPN and Create a SSLVPN profile for SonicPoint Layer-3 Management

1. Enable SSLVPN on the WAN zone
2.  Ensure https mgmt is enabled on the wan interface.
3. Create a address object for SSL VPN IP Pool. Network | Address Object | Create a new Address object with the Address type as range/network for SSL VPN IP POOL (refer the note)
4. Goto SSLVPN ----->Client settings and configure the "SonicPoint L3 Management Default Device Profile" as below

Note : The SSLNEW NW is a range address object having an unused eip range from the X0 subnet (LAN) (the interface to which the WT0 is bound to)
This object must be assigned with the zone SSLVPN

Step 3: Create a user account on the UTM for use on the SonicPoint for SSLVPN login from the SonicPoint into the UTM
Create a local user account on the firewall and ensure that the user is a member of the SSLVPN services group

Add X0 subnet and WLAN subnets to the VPN access list

Part 2: Configuration on the SonicPoint

Step 1: Downloading the SonicOS 5.9 compatible firmware for SonicPoint
Method 1: Connecting SonicPoints to SonicWall UTM appliance running SonicOS 5.9 and above
When the SonicPoints are connected to a SonicWall UTM appliance's WLAN interface/Zone running SonicOS 5.9 and above, they will be automatically updated with the latest firmware.
Method 2: Manually updating the SonicPoint firmware

1. Download the TSR from a SonicWall UTM appliance
    

1. Open the TSR in a Text reader/editor and find the SonicPoint download URL
2. Copy-Paste the Download URL in a Web Browser and download the appropriate SonicPoint Image

Step 2: Accessing the SonicPoint Management Interface in Standalone Mode:

1. The default management interface of the SonicPoint is 192.168.1.20
2. If you are connecting to the LAN port on the SonicPoint directly from a PC or through only the PoE injector, you need to configure the Local Area Connection on the PC to be in the same subnet as the SonicPoint.
   • IP address: 192.168.1.100.
   • Netmask: 255.255.255.0.
3. Connect directly to the LAN port of the SonicPoint with a crossover cable or regular cat. 5 Ethernet cable.
   • Connect to the LAN port of the SonicPoint through the PoE injector with a regular cat. 5 Ethernet cable.
   • If the SonicPoint is connected to a port in a SonicWall security appliance and the port is not in a Wireless zone, you can connect to it through the security appliance provided there are rules to allow HTTP management traffic between the zone your management station is in and the zone the SonicPoint is in.
4. Start your Web browser and direct it to the default management IP address for the SonicPoint, 192.168.1.20

Troubleshooting Tip: If you are unable to access the SonicPoint you may press the Reset Button to access it in SafeMode and then follow the above step #2:

Step 3: Uploading the SonicOS 5.9 compatible firmware for SonicPoints

1. Start your Web browser and direct it to the default management IP address for the SonicPoint, 192.168.1.20
2. Login to the SonicPoint management interface with the default username "admin" and default password "password".

Step 4: Configuring the L3 Management Settings

1. Navigate to SonicPoint Network > SSL-VPN page
2. Enter the WAN ip-address of the UTM along with the SSLVPN port number
3. Enter the SSLVPN user credentials , enable the Auto-Reconnect checkbox and click connect
4. Navigate to SonicPoint Network > Interfaces page
5. Enable the Disable local DHCP Client option. (This setting is optional , incase of the ISP Router/Firewall acting as DHCP server for local LAN , you need not enable this option)

1. You will get a prompt at the bottom to Restart the SonicPoint, click on the link and restart the appliance.

Please Note: After the reboot the SonicPoint will try to establish a SSLVPN connection with the UTM and a GRE/DTLS tunnel would be setup within this SSLVPN connection to complete the SonicPoint provisioning. SonicPoint might reboot  and SSL VPN user logout several times before SonicPoint shows up as operational because of the provisioning process that the SonicPoint goes through.

How to Test
Go to SonicPoint > Status page, you must see the remote SonicPoint labeled MGMT: SSL -VPN