MSS FW Best Practices: VPN (Site to Site & Client)

CAUTION: These documents are intended to provide partners with firewall configuration recommendations ONLY. They contain examples and caution should be exercised when making changes to your firewall as unplanned changed could result in downtime based on the complexity of the environment and/or configuration. 

MSS Recomended SonicWall Firewall Best Practices Index

Site to Site VPN

Notes/Recommendations

• Always remove unused tunnels. The firewall uses Core 0 to try and establish S2S VPN tunnels.
• It is recommended to use IKEv2, DH Group 5, and AES-256 Encryption if both sides support it.

Setup/Configuration

• For how to setup Site to Site VPNs, see the following SonicWall KB: Setting Up A Site to Site VPN Policy | SonicWall.
• See the following SonicWall KB for more information about the different kinds of VPN Scenarios and Configurations: Types of site to site VPN scenarios and configurations | SonicWall.

SSL VPN

Notes/Recommendations

• It is recommended to have a public (purchased) cert meeting the latest encryption standards. The self-signed cert provided by the firewall is adequate but will not pass PCI audits.

Setup/Configuration

1. See the following SonicWall KB for information on configuring SSLVPN on a firewall: Configuring the SSL-VPN Feature on SonicWall Firewalls | SonicWall.
2. Ensure that the following best practices are implemented as well:
   1. Server Settings:
      1. Change SSLVPN Port to 443 is possible.
         1. This is done to enhance the end user’s experience.
         2. You must first change the default HTTPS Management port (443) mentioned previously.
         3. SSLVPN terminates on the SonicWall’s Interface IP(s) and cannot be changed to another IP in Interface’s subnet. Note this so you can address other potential inbound NAT Policy conflicts.
   2. Client Settings (Edit the Default Device Profile):
      1. Settings
         1. Network Address is for the IP(s) that will be issued to the SSLVPN clients (make this a range that contains enough IPs equal to the number of SSLVPN licenses).
      2. Client Routes
         1. Client routes are the networks the SSLVPN clients will be able to access (This does not mean they will be allowed to).
      3. Client Settings
         1. Enter the internal DNS server(s).
         2. Enter the internal domain (with suffix).
            1. This is required for DNS/NetBIOS to work through NetExtender.
         3. Enable Client Auto update.
         4. Enable NetBIOS over SSLVPN
         5. Create Client Connection Profile
         6. Disable Username & Password Caching
   3. User/User Group Settings:
      1. Edit default SSLVPN Services user group.
         1. Add members as needed.
         2. VPN access are the networks the user/group can access. Anything here should be added as a route under client settings as well.
         3. Add Wan Remote Access Networks to VPN access.
            1. This is required for DNS/NetBIOS to work through NetExtender.

Restricting/Blocking IP Addresses From Accessing the SSLVPN

Blocking WAN SSLVPN Access

Use the following steps to Block Access to the SSLVPN for specific IP addresses:

1. Create Address Objects for the public IPs that will NOT be allowed to access the SSLVPN.
   1. If there are multiple public IPs, you will need to add them to an Address Object group.
2. Go to Policies > Rules and Policies > Access Rules
3. Change the View to WAN to WAN
   1. Click +Add and enter the following:
   2. Action: Deny
   3. Source Address: The Address Object Group of the IP address that you would like to block from accessing the SSLVPN.
   4. Destination Port/Services: SSLVPN
   5. Click Save

4. You should now see this Deny rule about the default SSLVPN allow rule.

5. To block additional IP addresses from accessing the SSLVPN, simply create an Address Object for them and add them to the Address Object Group with the rest.

Global VPN Client (WAN Group VPN)

1. See the following SonicWall KB for information on configuring Global VPN on a firewall - How can I configure WAN GroupVPN for connecting with Global VPN client? | SonicWall