1

I'm in the process of replacing a ForeFront TMG 2010 firewall with a SonicWall NSA 3600; the current firewall provides VPN access to our network using SSTP, and it works like a charm with any recent Windows client, without requiring the installation of any additional software.

The SonicWall firewall supports SSL VPNs, but it apparently requires a software called NetExtender to be installed; it can be downloaded directly from the firewall login page, thus it's not really a big deal... but we would really prefer to avoid installing any software and use only the Windows built-in VPN client.

Is it possible to estblish a SSL VPN connection to a SonicWall firewall from a Windows computer using only the built-in VPN client? If yes, how?


N.B. The firewall also supports L2TP ant it works fine with the Windows built-in VPN client (and several other ones); unfortunately, this is not an option: our people often travel to customer sites were Internet access is restricted to HTTP/S, thus a SSL VPN is a must.

2 Answers 2

5

For Sonicwall (either NSA-series or TZ-series firewalls using SSL-VPN, or SRA-series SSL-VPN appliances) you need to use NetExtender for Windows 8.0 or previous (or Mac OS X 10.8 or previous). Off hand, I know of no way to use the native VPN in Win 8.0 (or earlier) to connect to the SSL-VPN on Sonicwalls, only to the IPSEC/L2TP client VPN.

For Windows 8.1, there is support built-in for Sonicwall SSL-VPN in the native Win 8.1 VPN client - you just pick "Sonicwall" as the type when setting it up and enter the name (FQDN) or IP address of your Sonicwall gateway and off you go.

Note: digging into the saved settings on Win 8.1, it appears to create an SSTP connection, and I'm not sure how that ties in with the 'SSL-VPN' support on the Sonicwall end. Sonicwall state that Win8.1 "includes" their (newer, NetExtender replacement) "Sonicwall Mobile Connect" VPN client but I'm not sure of the underlying tech mechanism here for Win 8.1 - that's a tech dive I need to do some time to understand what's happening underneath better!

Note: Current versions of OS X, iOS and Android also now use versions of Mobile Connect instead of NetExtender - it's much better than NetExtender.

Scott.

1
  • I already found this thanks to SonicWall support, I just didn't update the question yet because but I'm struggling with a (known) bug which causes this configuration to not pass DNS servers to VPN clients. Anyway, the answer is completely correct, thus accepted.
    – Massimo
    Jul 24, 2015 at 16:10
1

EDIT: this reply is valid for WinXP/7/8, while for Win8.1 see the accepted answer.

Unfortunately, the answer is NO.

Trying to establish an SSTP-based connection, results is the Windows client immediately terminate it, with no log on the SSL/SRA device.

Moreover, in the SSL/SRA manual there is not mention at all of the SSTP protocol.

5
  • However, in Windows 8.1 if you create a VPN connection through the new interface, it lets you choose the VPN provider... and Juniper is in the list; it still creates (what seems to be) a SSTP connection, but it probably tweaks it in some strange way, because it then actually connects. Now however I'm stuck trying to get anything to flow trough the tunnel...
    – Massimo
    Jul 21, 2015 at 9:21
  • Unfortunately, VPN connection software is a key vendor lock-in piece. This means that even standard/open protocols are often modified in a incompatible manner, forcing vendor lock-in...
    – shodanshok
    Jul 21, 2015 at 9:28
  • True. But if (as it seems) Juniper VPNs are explicitly supported by the Windows 8.1 built-in VPN client software, they should work out-of-the-box...
    – Massimo
    Jul 21, 2015 at 9:29
  • It works on Windows 8.1 (see the other answer).
    – Massimo
    Jul 24, 2015 at 16:11
  • Hi, the VPN infrastructure in both Win 8.1 and Win Phone 8.1 is extensible - in fact, Microsoft licensed some of the various SSL VPN providers to bundle them in its OS. I was thinking your request was about Win 7/8. Glad to see it works anyway!
    – shodanshok
    Jul 24, 2015 at 16:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .