Is there a way to restrict SSLVPN access BY DEVICE and not just by user?

VPN
1

The situation is that I can control who has remote VPN access but I can not control what device they access it with. Someone could easily install NetExtender on their non-company managed device and have access to our network.

I am just trying to figure out if there is some way I can enforce access controls for both at the user and device level.

2

The SonicWall Firewall’s built in SSLVPN service does not have this functionality. You’d have to look into a SMA for this capability.

3

There is somewhat of a way around this. To lock down VPN via GeoIP, we’ve setup DDNS clients on approved devices and the users do not have the credentials to the DDNS client. On the SonicWall side of things, we’ve added those devices by FQDN. Anything else is not approved.

4

Create address objects for each MAC address you want to allow, or create DHCP reservations for each using a contiguous range.

Then add all the address objects to a group, or create a range that covers the allowed IP range.

Create a SSLVPN to LAN rule that allows the address objects. Then create another rule with priority +1 that denies all traffic.

Allowed devices will hit the first rule and be allowed while everything else will hit the second rule and be blocked.

5

Would also like to know this, something I’ve wanted for a while but never found an answer for.

I wonder if the SonicWall SMA devices (as opposed to NSA / TZ firewalls) support device authentication or something?

6

This is myscenario;

  1. install python3 to fileserver and for example this servernetbios name is : filesrv
    Netbios name is : filesrv
    ip address: 192.168.1.10
    2)create folder for netextender folder
    3)Put the netextender created folder
  2. open the cmd promt and go to netextender folder via “cd” command
  3. and type this command: python3 -m http.server 80 ( this command create mini web server on this file server.
  4. check firewall on the file server. It must be accessable via outbound to local web port 80
  5. Publis this web server via WAN and create subdomain name filesrv (not netextender)
  6. edit managed cliets host file and add below config:
    Host file path: “c:\Windows\System32\Drivers\etc\hosts”
    netextendersrv.YOURCOUMPANYDOMAİN.COM WANIP
  7. SSLVPN/ Server Settings/ SSL VPN Client Download URL/ Use customer’s HTTP server as downloading URL- enable and add below link (for sonicos 6)
    http://netextendersrv.YOURCOUMPANYDOMAİN.COM/netextenderzipfilename.zip
    scenario is basic: managed computer has different name of fileserver and if user login via managed pc can access file server.
    I hope this is usefull for this cas
7

I didn’t think so, thanks.

8

Csn you please help on how I can do this?
I am a newbie and need some Instructions.
We are also trying to set up our sslvpn in a way that unapproved devices on the sslvpn should not be able to communicate with the LAN.

So ssl vpn to LAN = deny (unless coming from an approved device).

9

Nice. I was thinking about doing this but I forget why I thought it wouldn’t work… give it another try

10

But how would the firewall read the MAC adrldresses which are on ssl vpn?
Is sonicwall able to read MAc addresses of devices which are on the sal vpn zone?