GlobalSign Enterprise Solutions
SonicWALL VPN User Guide
Building a secure network using Enterprise PKI, SonicWALL Firewall, and Mobile Connect app for iOS
TABLE OF CONTENTS
Introduction ... 3 About This Document ... 3 Document Focus ... 3 Settings for SonicWALL Firewall Device ... 3 Obtain An SSL Certificate ... 4 Import SSL Certificate into SonicWALL Security Appliance ... 4 Enable SSL ... 6 Create the User Account and Add to SSLVPN Services... 6 Settings for Enterprise PKI ... 8 Create a Configuration Profile ... 8 Upload Configuration Profiles ... 10 Issuance of a Certificate ... 12 Setting Up the End‐User Device ... 13 Connecting to your VPN ... 15 GlobalSign Contact Information ... 15INTRODUCTION
ABOUT THIS DOCUMENT
In this document we will describe how using a digital certificate enabled Apple configuration profile delivered through GlobalSign’s Enterprise PKI (ePKI) service for the iPhone/iPad can be used to make a secure SSL‐VPN connection via the SonicWALL Mobile Connect app for iOS to a SonicWALL Firewall device. Implementing certificate‐based two‐factor authentication on iOS devices can help organizations protect sensitive resources stored on internal networks. The contents described in this material were confirmed in our verification environment and results may differ depending on exact organization environment.DOCUMENT FOCUS
The procedures in this document have been tested in the following environments. SonicWALL TZ210 GlobalSign Enterprise PKI iPhone4 (iOS 5.1) SonicWALL Mobile Connect (Secure Mobility Client) 1.0.25SETTINGS FOR SONICWALL FIREWALL DEVICE
The following steps are required to install the server certificate, enable the VPN connection, and install the client certificate that will access the VPN. Detailed instructions for each step are provided below. 1. Obtain an SSL Certificate ‐ Create an SSL certificate via your GlobalSign GCC Account. For this step, you should create a certificate using AutoCSR; this will give you a certificate in PKCS12 format for easy importing into the SonicWALL Security Appliance. 2. Import SSL Certificate into SonicWALL Security Appliance. 3. Enable SSL – After your SSL Certificate is imported, enable the SSL VPN connection in the firewall. 4. SSL Server Configuration 5. Create the User Account and add to SSLVPN servicesOBTAIN
To apply fo enrolling fo After certif the SonicWIMPORT
First, you w Navigate to CertificateAN SSL CE
or a server cert or an SSL certif ficate issuance WALL ApplicatioT SSL CERT
will need to log o System > Cer popup windowERTIFICATE
tificate using th ficate. Use yo e, it will be poss on. The file wilTIFICATE IN
g into the Sonic rtificates. Clic w will appear.E
he GlobalSign C our VPN URL a sible to retriev l be deliveredTO SONICW
cWALL Security ck the Import bCertificate Cen s common nam ve the PKCS12 f in a .pfx forma
WALL SECU
y Appliance. button at the b nter (GCC) pane me in your cert file (certificate at.URITY APPL
bottom of the s el, select the A tificate request e + private key)LIANCE
screen. The fol AutoCSR metho t.
for importing llowing Import od of into t
Choose the of the PKCS
Back on th certificates
e Import a loca S12 file and br e System > Cer s and request al end‐user cer rowse to the lo rtificates scree view. rtificate with p ocation of the P n, you can view private key… o PKCS12 file. C w the certificat option. Enter Click the Impor te you just imp a Certificate N rt button when ported by selec
Name, the pass n finished. cting the Impo sword orted
ENABLE
This sectio Within the clients will and SSL ceCREATE
Within theE SSL
n allows you to e SonicWALL Se be connecting rtificate used bTHE USER
e SonicWALL Se o enable or dis ecurity Applian g from; on sele by the server.R ACCOUNT
ecurity Applian sable SSL and s nce, navigate to ection the zoneT AND ADD
nce, navigate to select the inter o SSL VPN > Ser e(s) should turnD TO SSLVP
o Users > Local rface you want rver Settings. S n green. Here yPN SERVICE
l Users. t turned on. Select (click) th you can also chES
he zone(s) that hange the VPNt your N Port
Click on th who will ha On the Gro list to mov Finally, clic each user r e Add User bu ave access to y oups tab, Selec e this group to
ck the OK butt requiring acces
utton and enter your VPN.
ct SSLVPN Serv o the Member
ton to comple ss.
r user’s userna
vices from the Of list on the r
te the SonicW
ame and passw list of User Gro right hand side WALL configurat word details. Re oups. After s e.
tion for this u
epeat this proc
selection, hit th
user and repea
cedure for each
he arrow unde
at this procedu h user
r the
SETTIN
Use Enterp Enter your ConfiguratCREATE
First you w download Add dumm URL: input Name: inp Subject: O= Challenge:Next Selec
NGS FOR E
prise PKI to sen Enterprise PK ion Utility, andA CONFIG
will need to cre on Apple’s site my values to the dummy value ut dummy valu =input dummy test t VPN in the mENTERPR
nd a configurat I account to up d then start witGURATION
ate a new conf e. Click the SC e following fiel ue y value, OU=inp menu on the lefRISE PKI
tion profile at t pload the confi th the issuancePROFILE
figuration prof CEP section on lds. The actu put dummy va ft. the same time iguration profi e of certificates file in the iPhon n the left side o ual values will b lue that you insta le that you cre s. ne Configuratio of the screen to be overwritten ll the certificat eated using the on Utility, avai o begin. n by the system te on the devic e iPhone lable as a freem. ce.
Here you s Conne Conne Server Set Passwo required to
At this poin implement section and set the followin ection Name: A ection type: So r: SonicWALL H ord as means o o create a sepa nt you can also ted before they d exchange set ng values: Any name nicWALL Mobi Host name or IP of User Authen arate profile fo o add, via the R y can enter you ttings via the E ile Connect P address you c ntication and e r each user. Restrictions se ur network. Y Exchange Activ connect to for enter the user’ ction, any secu You can also ad veSync section. VPN access s password yo urity restriction djust email acc . u created abov ns to the devic count settings ve. You will be ces you wish via the Email
Export th
UPLOAD
In your Glo left‐hand m during the he profile you jD CONFIGU
obalSign GCC a menu. You w first visit). ust created, eitURATION P
ccount click th ill be prompte ther with or wPROFILES
he Enterprise P d to present a ithout signatu KI tab. Click on certificate (yo re. n the Certificat u will need to te Managemen obtain an admnt item in the ministrator cert
ificate
After prese the Useful Clicking th This will br iPhone Con enting the cert Function sect at brings up th ring up the foll nfiguration Uti tificate, you wi ion.
he following scr owing screen. lity. Click the ll see a menu i reen. Click th Click Browse e Upload butto tem Edit iPhon he Edit button e to select the on and confirm ne configuratio
next to the ap configuration m the upload by on at the botto propriate prof profile that yo y clicking the N om left menu, file. ou created with Next button.
under
h the
The profile
ISSUAN
Issuance o New C New C Bulk CertifFor this exa section of Enter the C installed o e is now in plac
CE OF A CE
f certificates in Certificate Certificate Regi ficate Registrat ample, we will the left‐hand m Common Nam n one specific ce.ERTIFICATE
n Enterprise PK stration (BULK ion allows mul use single cer menu. Select e and Email Ad device, you caE
KI can be carrie K) ltiple certificat rtificate registra t the appropria ddress on the f n add the UDID ed out in two w e registrations ation. Click N ate profile and following scree D or IMEI to th ways: s to be created New Certificate license and th en. To ensure he Device Auth concurrently v e in the Certific hen click Next. e the certificat hentication IDvia a CSV uploa cate Managem te can only be field. The Pic ad. ment ckup
SETTIN
In the end‐ below. Before instNG UP TH
‐user device, c talling the certE END‐US
ertificate retrie ificate, ensureSER DEVI
eval and VPN a SonicWALL MICE
access is autom obile Connect matically set up iOS app is inst p by following t talled on the de the procedure evice.Using the e You will be Get Cert b Click the In email client on e redirected to utton, and foll nstall button o n the device, cli the GlobalSign ow the instruc n the screen b ick the URL in t n website and a ctions on the sc elow to finish the pickup em asked for the p creen to install installing the c ail you will rec pickup passwo l the certificate certificate.
