SonicWALL VPN Client Configuration
A Tech Note prepared by SonicWALL, Inc.
SonicWALL, Inc. 1160 Bordeaux Drive Sunnyvale, CA 94089-1209 1-888-557-6642 http://www.sonicwall.com

Introduction

SonicWALL VPN includes one VPN Client for Windows (95, 98 or NT) license for secure remote management of the SonicWALL Internet Security Appliance.

Quick Configuration

Setting up your SonicWALL Internet Security Appliance 1. Click the button labeled VPN on the left side of the browser window and then click the tab labeled Summary at the top of the window. A window similar to the following will be displayed
Check the Enable VPN checkbox and assign an alphanumeric name for the SonicWALL in the Unique Firewall Identifier field. The Unique Firewall Identifier may range from 4 to 32 characters in length.
Click the Update button. The operation will take a few seconds to complete. Once completed, a message confirming
SonicWALL VPN Client Tech Note - Page 1
the update will be displayed at the bottom of the Web browser window.
Click the Configure tab at the top of your screen. A window similar to the following will be displayed.
On the Configure page, create a new Security Association by selecting Add New SA from the Security Association menu.
5. Select IKE from the IPSec Keying Mode menu.
Enter a descriptive name that identifies the VPN client in the Name field, such as the clients location or name.
Leave the Destination Network, Destination Subnet Mask, and IPSec Gateway Address fields blank.
Select Encrypt and Authenticate (ESP DES HMAC MD5) from the Encryption Method drop down menu.
Define a shared secret in the Shared Secret field. The alphanumeric shared secret must match the VPN clients Shared Key and may contain up to 128 characters. Create a Shared Secret that can not be guessed by
Page 2 - SonicWALL VPN Client Tech Note
someone else. Avoid using names of friends, family, pets or places. Instead, enter a combination of letters, numbers and symbols, such as "Aa8*^Hjj@e$FF#," for greater security.
Once all fields are completed, click the Update button. The operation will take a few seconds to complete. Once completed, a message confirming the update will be displayed at the bottom of the Web browser window. Restart the SonicWALL for changes to take effect.
Installing the VPN Client Software
1. When the SonicWALL product is registered at http://register.sonicwall.com, a unique VPN client serial number is returned, as well as a link to download the VPN client installer.
Double-click the installer and follow the VPN client setup programs step by step instructions. Enter the VPN clients serial number when prompted.
After the VPN client setup program has finished copying files to your computer, it will prompt you to restart your computer. Select No, I will restart my computer later and continue with the next section.
Configuring VPCom Adapters TCP/IP Settings
1. Open the Network Control Panel. A window similar to the following will be displayed.
SonicWALL VPN Client Tech Note - Page 3
Double click the TCP/IP VPCom Adapter option in the network configuration window. A window similar to the following will be displayed.
Assign the VPCom adapter a private IP address. The IP address must be different from the SonicWALL's LAN subnet. Examples of private IP addresses are 10.0.0.0--10.255.255.255, 172.16.0.0--172.31.255.255, 169.254.0.0--169.254.255.255, and 192.168.0.0--192.168.255.255.
Assign the VPCom Adapter a subnet mask in the Subnet Mask field.
Click OK in both the TCP/IP Properties and Network windows and then restart the computer.
Configuring the VPN Client
To launch the VPCom Security Agent, select the program from the Windows Start menu, or double-click the VPCom Security Agent icon in the Windows Task Bar. A window similar to the following will be displayed.
Page 4 - SonicWALL VPN Client Tech Note
In the VPCom Security Agent window, highlight the Security Policy Configuration and click the Gateway button. A Remote Security Gateway window, similar to the following, will be displayed.
2. Assign a name for this Security Policy, such as Main Office Security Policy, in the Description field.
Leave the Server ID field blank.
Type the IP address of the SonicWALL in the IP Address field. If Network Address Translation has been enabled on SonicWALL, then enter the NAT Public Address.
You may leave the Domain Name field blank.
SonicWALL VPN Client Tech Note - Page 5
6. Enter the SonicWALLs Shared Secret in the Shared Key field. Click OK.
Highlight the newly created Security Policy (in this case "Main Office Security Policy") below the Security Policy Configuration and click the Remote Host button. A Remote Host window, similar to the following, will be displayed.

Enter any descriptive name in the Description field.
9. You may skip the Host Name entry field.
10. Enter the SonicWALLs LAN IP Address in the IP Address field.
11. Type the SonicWALLs LAN Subnet Mask in the Subnet Mask field.
12. You may skip the Domain Name entry field. Click OK.
Negotiating a VPN Session Between VPN Client and the SonicWALL
Restart your computer. The VPN client will automatically establish a VPN tunnel if your computer has an active Internet connection when it is restarted. If it does not, you can manually negotiate a VPN tunnel by following the steps listed below:
1. To complete the first phase of VPN negotiation, highlight the Security Policy (in our example " Main Office Security Policy") below the Security Policy Configuration and click the Negotiate button. This operation
Page 6 - SonicWALL VPN Client Tech Note
will take a few seconds to complete 2. To complete the second phase of VPN negotiation, expand everything below the Security Policy Configuration by clicking the + symbols preceding each entry. A window similar to the following will be displayed.
3. Highlight Wildcard Connections and click the Negotiate button. This operation will take a few seconds to complete.
After successfully negotiating the VPN session, the administrator will be able to securely manage the remote SonicWALL by entering its LAN IP address in a browser on the computer running the VPN client software.
SonicWALL VPN Client Tech Note - Page 7

SECURE REMOTE ACCESS

Global VPN Client

SonicWALL VPN Clients

Virtual Private Network (VPN) for secure remote access
Businesses large and small need to address the growing demands of more distributed work sites and an increasingly mobile workforce in order to compete in todays global marketplace. Remote access has become a business imperative. SonicWALL VPN Clients offer a flexible easy-to-use, easy-to-manage Virtual Private Network (VPN) solution that provides distributed and mobile users with secure, reliable remote access to corporate assets via broadband, wireless and dial-up connections. For remote client-tohost secure access, SonicWALL offers both SSL VPN and IPSec VPN connectivity options. For SSL VPN, SonicWALL NetExtender provides thin client connectivity and clientless Web-based remote access for Windows, Windows Mobile, Mac and Linux-based systems. For IPSec VPN, SonicWALL Global VPN Client enables the client system to download the VPN client for a more traditional client-based VPN experience.

Features and Benefits

Enhanced layered security is enabled when a SonicWALL Network Security Appliance uses powerful deep packet inspection technology to scan VPN traffic for malicious threats such as viruses, worms, Trojans and spyware. The combined solution is known as SonicWALL Clean VPN*. Easy VPN management SonicWALLs award-winning Global Management System (GMS) provides simplified management of SonicWALL VPN Client connections. SSL VPN for Network Security NetExtender Clientless connectivity removes the need for a pre-installed or fat VPN client, thus freeing administrators from the tedious and costly task of installing and updating a client on users Windows, Mac or Linux-based systems. NetExtender technology provides enhanced capabilities such as network level access to additional resources, services and applications on the corporate network. Mobile device support to access an entire intranet as well as Web-based applications provides greater flexibility for a remote workforce. Global VPN Client Easy-to-follow wizards help users install and configure a VPN connection quickly and easily. IPSec VPN users simply enter the domain name or IP address of the SonicWALL VPN gateway and the Global VPN Client configuration policy is automatically downloaded. Extended user reach and productivity by connecting from any single or dual-processor computer running one of a broad range of Microsoft Windows platforms. Further extending secure remote access, the Global VPN Client enables encapsulated VPN traffic to traverse any IP network using Network Address Translation (NAT). VPN session reliability provides simultaneous Global VPN Client connections that can be established to multiple SonicWALL VPN gateways. The Global VPN Client supports redundant SonicWALL VPN gateways to ensure mission-critical network access in the event the primary gateway fails.

n Enhanced n Easy

layered security

VPN management wizards

n Ease-to-follow n Extended
user reach and productivity
session reliability connectivity technology

n Clientless

n NetExtender n Mobile

device support

*Clean VPN requires an active Gateway Anti-Virus, Anti-Spyware and Intrusion Prevention subscription for the governing SonicWALL network security appliance.

Specifications

SonicWALL Network Security Appliance
Global VPN Client Site-to-Site VPN NetExtender

NetExtender Users

SonicWALL UTM SSL VPN Client SonicWALL UTM SSL VPN 1 License 01-SSC-8629 SonicWALL UTM SSL VPN 5 Licenses 01-SSC-8630 SonicWALL UTM SSL VPN 10 Licenses 01-SSC-8631 SonicWALL UTM SSL VPN 25 Licenses 01-SSC-8632 SonicWALL UTM SSL VPN 50 Licenses 01-SSC-8633 License Bundles Hardware TZ 100/TZ 100 W-N TZ 200/TZ 200 W-N TZ 210/TZ 210 W-N NSA 240 NSA 2400 NSA 3500 NSA 4500 NSA 5000 NSA E5500 NSA E6500 NSA E7500 SSL VPN Client Licenses Bundled/Max 1/5 1/10 2/10 2/15 2/25 2/30 2/30 2/30 2/50 2/50 2/50 GVC Client Licenses Bundled/Max 0/5 2/10 2/25 2/25 10/250 50/1,000 500/3,000 500/3,000 2,000/4,000 2,000/6,000 2,000/10,000 System Requirements for Global VPN Client Hardware Requires third-, fourth- or fifth-generation SonicWALL network security appliance Requires firmware version 6.4.2 or higher or SonicOS 3.0 or higher IBM-compatible computer with an Intel/AMD processor 32 Bit 64 Bit XP Professional SP2 Yes Yes XP Home SP2 Yes No Vista Enterprise SP1 Yes Yes Vista Business SP1 Yes Yes Vista Home Basic SP Yes Yes Vista Home Premium SP1 Yes Yes Vista Ultimate SP1 Yes Yes 38 MB 512 MB Ethernet network interface card with NDIS compliant driver and/or dial-up adapter (internal or external modem, ISDN terminal adaptor) or wireless LAN

Servers

Comprehensive Gateway Security Suite includes gateway anti-virus, gateway anti-spyware, intrusion prevention, Application Firewall, content ltering, ViewPoint reporting, and 24x7 support.
Clean VPN to encrypt and decontaminate trac.
Global VPN Client Global VPN Client for Windows
1 License 01-SSC-5310 Global VPN Client for Windows 5 Licenses 01-SSC-5316 Global VPN Client for Windows 10 Licenses 01-SSC-5311 Global VPN Client for Windows 50 Licenses 01-SSC-5313 Global VPN Client for Windows 100 Licenses 01-SSC-5314 Global VPN Client for Windows 1,000 Licenses 01-SSC-2897
Firmware/OS Available Hard Disk Space RAM
SonicWALL Global VPN Client
System Requirements for NetExtender Hardware Firmware/OS TZ 100, 200, 210 Series, NSA or E-Class NSA Series Appliance Requires firmware version 5.2 or higher Windows 2000, 2003, XP/Vista (32-bit and 64-bit) Win Mobile 5 (Pocket PC), Win Mobile 6 (Classic/Professional), MacOS 10.4+ (PowerPC and Intel), Linux Fedora Core 3+ / Ubuntu 7+ / OpenSUSE

Network Connection

Technical Specifications for Global VPN Client IPsec Modes Encryption Algorithms Data Integrity Authentication and Key Management User Authentication Certificate Support Standards and RFCs Supported ESP (Encapsulated Security Payload) DES (56-Bit), 3DES (168-Bit), AES (256-Bit) MD5, SHA-1 IKE (Internet Key Exchange) RADIUS with XAUTH, Local User, LDAP, Microsoft Active Directory, Novell eDirectory Microsoft, Verisign, Entrust ESP Tunnel Mode, IKE (ISAKMP/Oakley): Internet RFCs Supported Key Exchange (RFC2407-2409), NAT-Traversal (IETF drafts), X.509 v3 certificates: (RFC2459), PKCS #7: Cryptographic Message Syntax Standard (RFC2315), PKCS #12: Personal Information Exchange Syntax Standard, FIPS Pub 46-1: Data Encryption Standard, FIPS Pub 180-1: Secure Hash Standard, Microsoft Vista 32-bit
SonicWALLs line-up of dynamic security solutions SonicWALL, Inc. 2001 Logic Drive, San Jose, CA 95124 T +1 408.745.9600 F +1 408.745.9300 www.sonicwall.com

NETWORK SECURITY

WEB AND E-MAIL SECURITY

BACKUP AND RECOVERY

POLICY AND MANAGEMENT
PROTECTION AT THE SPEED OF BUSINESS
2010 SonicWALL and the SonicWALL logo is registered trademarks of SonicWALL, Inc. Other product names mentioned herein may be trademarks and/or registered trademarks of their respective companies. Specifications and descriptions subject to change without notice. 05/10 SW 984