- Products
- Network Security
Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
Security ServicesComprehensive security for your network security solution
Network Security ManagerModern Security Management for today’s security landscape
- Advanced Threat Protection
Capture ATPMulti-engine advanced threat detection
Capture Security applianceAdvanced Threat Protection for modern threat landscape
- Access Security
Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
Secure Mobile AccessRemote, best-in-class, secure access
Wireless Access PointsEasy to manage, fast and secure Wi-FI
SwitchesHigh-speed network switching for business connectivity
- Email Security
Email SecurityProtect against today’s advanced email threats
- Cloud Security
Cloud App SecurityVisibility and security for Cloud Apps
Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
- Endpoint Security
Capture ClientStop advanced threats and rollback the damage caused by malware
Content Filtering ClientControl access to unwanted and unsecure web content
- Product Widgets
- Product Menu Right Image
- Network Security
- Solutions
- Solutions Widgets
- Solutions Image Widgets
- Solutions Widgets
- Partners
- Partner Widgets
- Partners Image Widgets
- Partner Widgets
- Support
- Support Widget
- Support Image Widgets
- Support Widget
- Products
- Network Security
- Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
- Security ServicesComprehensive security for your network security solution
- Network Security ManagerModern Security Management for today’s security landscape
- Advanced Threat Protection
- Capture ATPMulti-engine advanced threat detection
- Capture Security applianceAdvanced Threat Protection for modern threat landscape
- Access Security
- Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
- Secure Mobile AccessRemote, best-in-class, secure access
- Wireless Access PointsEasy to manage, fast and secure Wi-FI
- SwitchesHigh-speed network switching for business connectivity
- Email Security
- Email SecurityProtect against today’s advanced email threats
- Cloud Security
- Cloud App SecurityVisibility and security for Cloud Apps
- Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
- Endpoint Security
- Capture ClientStop advanced threats and rollback the damage caused by malware
- Content Filtering ClientControl access to unwanted and unsecure web content
- Product Widgets
- Product Menu Right Image
- Network Security
- Solutions
- Solutions Widgets
- Solutions Image Widgets
- Solutions Widgets
- Partners
- Partner Widgets
- Partners Image Widgets
- Partner Widgets
- Support
- Support Widget
- Support Image Widgets
- Support Widget
SMA 100: Why do my NetExtender clients get IP address 192.168.200.100?
03/26/2020 
8 People found this article helpful
39,927 Views
Description
When the SMA 100 series appliance is initially configured the X0 IP address is 192.168.200.1 and the related NetExtender Client Address Range is 192.168.200.100 to 192.168.200.200. The intended implementation is to set the NetExtender Client Address Range to the same IP subnet as the X0 interface to minimize the impact on routing in the LAN.
On page 199 of the SonicWall Secure Mobile Access 8.6 Administration Guide it says:
“Setting NetExtender Client Address Range and Route
To configure the NetExtender client address range and route on the SMA/SRA appliance: 1 Navigate to NetExtender > Client Addresses to set the NetExtender Client Address Range. Client Addresses are assigned in the same subnet of the SMA/SRA X0 interface. Exclude the SMA/SRA appliance X0 interface and the firewall DMZ interface IP address.”
Cause
If the X0 IP address is changed to a different subnet the NetExtender Client Address Range, and the client address range is left at defaults, packets from the NetExtender clients appear to be IP spoofing. Firewalls drop IP spoofed packets, preventing NetExtender clients communicating.
Resolution
Following normal implementation, configure the NetExtender Client Address Range to the same subnet as the X0 interface. With the clients in the same subnet as the X0 interface no special routing configurations are needed on the firewall.
However, if it is desired to configure the NetExtender Client Address Range in a different subnet than the X0 interface it will be necessary to configure the firewall or routing device to properly route traffic.
For example, if the X0 interface IP is modified (for this example to 192.168.50.1) but the NetExtender Client Address Range is left to the default (192.168.200.100 to 192.168.200.200) a client will have an address in that range. In this example the first user connecting is provided address 192.168.200.100.
When the user pings google.com the firewall may drop the packet as an IP Spoof.
This is what the route on the firewall looks like to support the client address range:
Where:
SMA500v_Network = 192.168.200.0/24
SMA500v = the IP address of the SMA on X0:V80 (192.168.50.1)
The firewall will properly route traffic to the SMA clients on the SMA appliance as shown by this successful ping:
Related Articles
- How to secure Virtual Office portal from all external access
- NetExtender users fail to get connected throwing an Error Failed to get vpn protocol on firmware 10.2.1.2 or above due to misconfigured protocol
- Is SRA/SMA appliance vulnerable to CVE-2016-2183 and CVE-2016-5915?
YES
NO