SMA 100: Why do my NetExtender clients get IP address 192.168.200.100?

03/26/2020 7 8664

DESCRIPTION:

When the SMA 100 series appliance is initially configured the X0 IP address is 192.168.200.1 and the related NetExtender Client Address Range is 192.168.200.100 to 192.168.200.200.  The intended implementation is to set the NetExtender Client Address Range to the same IP subnet as the X0 interface to minimize the impact on routing in the LAN. 

On page 199 of the SonicWall Secure Mobile Access 8.6 Administration Guide it says:

“Setting NetExtender Client Address Range and Route

To configure the NetExtender client address range and route on the SMA/SRA appliance: 1 Navigate to NetExtender > Client Addresses to set the NetExtender Client Address Range. Client Addresses are assigned in the same subnet of the SMA/SRA X0 interface. Exclude the SMA/SRA appliance X0 interface and the firewall DMZ interface IP address.”

CAUSE:

 If the X0 IP address is changed to a different subnet the NetExtender Client Address Range, and the client address range is left at defaults, packets from the NetExtender clients appear to be IP spoofing. Firewalls drop IP spoofed packets, preventing NetExtender clients communicating. 

RESOLUTION:

Following normal implementation, configure the NetExtender Client Address Range to the same subnet as the X0 interface. With the clients in the same subnet as the X0 interface no special routing configurations are needed on the firewall.

However, if it is desired to configure the NetExtender Client Address Range in a different subnet than the X0 interface it will be necessary to configure the firewall or routing device to properly route traffic.  

For example, if the X0 interface IP is modified (for this example to 192.168.50.1) but the NetExtender Client Address Range is left to the default (192.168.200.100 to 192.168.200.200) a client will have an address in that range.  In this example the first user connecting is provided address 192.168.200.100. 

When the user pings google.com the firewall may drop the packet as an IP Spoof.  

This is what the route on the firewall looks like to support the client address range:

Where:

SMA500v_Network = 192.168.200.0/24

SMA500v = the IP address of the SMA on X0:V80 (192.168.50.1)

The firewall will properly route traffic to the SMA clients on the SMA appliance as shown by this successful ping: