• SonicOS 7.1
• About SonicOS
  • Working with SonicOS
  • SonicOS Workflow
  • How to Use the SonicOS Administration Guides
  • Guide Conventions
• IPSec VPN Overview
  • About Virtual Private Networks
  • VPN Types
    • IPsec VPN
    • DHCP over VPN
    • L2TP with IPsec
    • SSL VPN
  • VPN Security
    • About IKEv1
    • About IKEv2
    • Mobility and Multi-homing Protocol for IKEv2 (MOBIKE)
    • About IPsec (Phase 2) Proposal
    • About Suite B Cryptography
  • VPN Base Settings and Displays
    • Policies
    • Active Tunnels
    • Settings
  • IPv6 VPN Configuration
• Site to Site VPNs
  • Planning Site to Site Configurations
  • General VPN Configuration
    • Configuring Settings on the General Tab
    • Configuring Settings on the Network Tab
    • Configuring Settings on the Proposals Tab
    • Configuring Settings on the Advanced Tab
  • Managing GroupVPN Policies
    • Configuring IKE Using a Preshared Secret Key
    • Configuring IKE Using 3rd Party Certificates
    • Downloading a GroupVPN Client Policy
  • Creating Site to Site VPN Policies
    • Configuring with a Preshared Secret Key
    • Configuring with a Manual Key
    • Configuring with a Third-Party Certificate
    • Configuring the Remote SonicWall Network Security Appliance
    • Configuring VPN Failover to a Static Route
• VPN Auto Provisioning
  • About VPN Auto Provisioning
    • Defining VPN Auto Provisioning
    • Benefits of VPN Auto Provisioning
    • How VPN Auto Provisioning Works
      • About Establishing the IKE Phase 1 Security Association
      • About Establishing IKE Phase 2 using a Provisioned Policy
  • Configuring a VPN AP Server
    • Starting the VPN AP Server Configuration
    • Configuring VPN AP Server Settings on General
    • Configuring VPN AP Server Settings on Network
    • Configuring Advanced Settings on Proposals
    • Configuring Advanced Settings on Advanced
  • Configuring a VPN AP Client
• Rules and Settings
  • Adding a Tunnel Interface
    • Creating a Static Route for the Tunnel Interface
  • Route Entries for Different Network Segments
  • Redundant Static Routes for a Network
• Advanced
  • Configuring Advanced VPN Settings
  • Configuring IKEv2 Settings
  • Using OCSP with SonicWall Network Security Appliances
    • OpenCA OCSP Responder
    • Loading Certificates to Use with OCSP
    • Using OCSP with VPN Policies
• DHCP over VPN
  • DHCP Relay Mode
  • Configuring the Central Gateway for DHCP Over VPN
  • Configuring DHCP over VPN Remote Gateway
  • Current DHCP over VPN Leases
• L2TP Servers and VPN Client Access
  • Configuring the L2TP Server
  • Viewing Currently Active L2TP Sessions
  • Configuring Microsoft Windows L2TP VPN Client Access
  • Configuring Google Android L2TP VPN Client Access
• AWS VPN
  • Overview
  • Creating a New VPN Connection
  • Reviewing the VPN Connection
    • Configuration on the Firewall
    • Configuration on Amazon Web Services
  • Route Propagation
  • AWS Regions
  • Deleting VPN Connections
• SonicWall Support
  • About This Document

Configuring VPN AP Server Settings on Network

To configure VPN AP server settings on the Network screen

3. Navigate to the NETWORK | IPSec VPN > Rules and Settings page.
2. Select IPv4 for the IP Version.
3. Click +Add. The VPN Policy dialog displays.
4. On the General tab, select SonicWall Auto Provisioning Server for the Authentication Method.

5. Click the Network tab.

   

6. Under Local Networks, select Require Authentication of VPN AP Clients via XAUTH to force the use of user credentials for added security when establishing the SA.

7. If the XAUTH option is enabled, select the user group for the allowed users from the User Group for XAUTH Users drop-down menu. You can select an existing group such as Trusted Users or another standard group, or select Create a new user group to create a custom group.

   For each authenticated user, the authentication service returns one or more network addresses which are sent to the VPN AP Client during the provisioning exchange.

   If XAUTH is enabled and a user group is selected, the user on the VPN AP Client side must meet the following conditions for authentication to succeed:

   • The user must belong to the selected user group.

   • The user can pass the authentication method configured in DEVICE | Users > Settings | User Authentication Method.

   • The user has VPN access privileges.

8. If the XAUTH option is disabled, select a network address object or group from the Allow Unauthenticated VPN AP Client Access drop-down menu, or select Create a new address object/group to create a custom object or group. The selected object defines the list of addresses and domains that can be accessed through this VPN connection. It is sent to the VPN AP Client during the provisioning exchange and then used as the VPN AP Client's remote proxy ID.

9. Under Remote Networks, select one of the following radio buttons and choose from the associated list, if applicable:

   • Choose destination network from list – Select a network object from the drop-down menu of remote address objects that are actual routable networks at the VPN AP Client side, or create a custom object.

   VPN Auto Provisioning does not support using a “super network” that includes all the AP Clients’ protected subnets. To allow multiple AP Clients with different protected subnets to connect to the same AP Server, configure an Address Group that includes all of the AP Clients’ protected subnets and use that in the Choose destination network from list field. This Address Group must be kept up to date as new AP Clients are added.

   • Obtain NAT Proxy via Authentication Service – Select this option to have the RADIUS server return a Framed-IP Address attribute for the user, which is used by the VPN AP Client to NAT its internal addresses before sending traffic down the IPsec tunnel.

   • Choose NAT Pool – Select a network object from the drop-down menu, or create a custom object. The chosen object specifies a pool of addresses to be assigned to the VPN AP Client for use with NAT. The client translates its internal address to an address in the NAT pool before sending traffic down the IPsec tunnel.

     When deploying VPN Auto Provisioning, you should allocate a large enough NAT IP address pool for all the existing and expected VPN AP Clients. Otherwise, additional VPN AP Clients cannot work properly if all the IP addresses in the pool have already been allocated.

     Configuring a large IP pool does not consume more memory than a small pool, so it is safe and a best practice to allocate a large enough pool to provide redundancy.

10. Continue to Configuring Advanced Settings on Proposals.