SonicWALL SMA 210 Quick reference guide

SonicWall®Secure Mobile
Access 210/410
Deployment Guide

SMA 210/410 Deployment Guide
Contents
1
2
Deployment Scenarios Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Selecting a Deployment Scenario . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
SMA 210/410 Deployment Scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Overview of Scenario A: SMA on a New DMZ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Overview of Scenario B: SMA on an Existing DMZ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Overview of Scenario C: SMA on the LAN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Connecting the SMA on a New DMZ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Connecting the SMA to the Gateway . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Allowing a WAN to SMA Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Allowing an SMA to LAN Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Connecting the SMA on an Existing DMZ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Connecting the SMA to the Gateway . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Allowing WAN to DMZ Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Allowing DMZ to LAN Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Deploying SMA on the LAN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Connecting the SMA to the Gateway . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Configuring SMA to LAN Connectivity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Additional Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Configuring the X0 IP Address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Configuring a Default Route . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Adding a NetExtender Client Route . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Setting Your NetExtender Address Range . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Adding a New SMA Custom Zone . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Testing and Troubleshooting Your Remote Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Verifying a User Connection from the Internet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Firewall > Access Rules Matrix View . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
SonicWall Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
About This Document . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Contents

SMA 210/410 Deployment Guide
Deployment Scenarios Overview
1
3
Deployment Scenarios Overview
Welcome to the SonicWall SMA Deployment Guide. SonicWall® Secure Mobile Access 210/410 provides a unified
secure gateway to access all network and cloud resources. This guide contains configuration guidelines for
deployment scenarios involving new DMZ, existing DMZ, and LAN deployments, along with basic configuration
settings for those scenarios.
Topics:
•Selecting a Deployment Scenario
•SMA 210/410 Deployment Scenarios
Selecting a Deployment Scenario
The deployment scenarios described in this guide are based on actual customer deployments and are
SonicWall-recommended deployment best practices for SMA appliances.
An SMA appliance is commonly deployed in one-arm mode over the DMZ interface on an accompanying
gateway appliance, such as a SonicWall NSA 3600. This method of deployment offers additional layers of
security control, plus the ability to use SonicWall’s security services, including Gateway Anti-Virus,
Anti-Spyware, Content Filtering, Intrusion Prevention Service, and Comprehensive Anti-Spam Service, to scan all
incoming and outgoing traffic.
The primary interface (X0) on the SonicWall SMA connects to an available segment on the gateway device. The
encrypted user session is passed through the gateway to the SMA appliance. The SonicWall SMA appliance
decrypts the session and determines the requested resource.
The session traffic then traverses the gateway appliance to reach the internal network resources. The gateway
appliance applies security services as data traverses the gateway. The internal network resource then returns
the requested content to the SonicWall SMA appliance through the gateway, where it is encrypted and sent to
the client.
SMA 210/410 Deployment Scenarios
Gateway Appliance Deployment Scenario Requirements on Gateway Appliance
SonicOS 5.8.1 or higher:
•TZ Series
•NSA E-Class
•NSA Series
•SM 9000 Series
(SonicOS 6.1+)
SMA on New DMZ •An unused interface
•NEW DMZ configured for NAT or Transparent
Mode
SMA on Existing DMZ •One dedicated interface in use as an existing
DMZ
SMA on LAN •None

SMA 210/410 Deployment Guide
Deployment Scenarios Overview 4
The following illustrations provide an overview of each deployment scenario:
•Overview of Scenario A: SMA on a New DMZ
•Overview of Scenario B: SMA on an Existing DMZ
•Overview of Scenario C: SMA on the LAN
Overview of Scenario A: SMA on a New DMZ
Overview of Scenario B: SMA on an Existing DMZ
Secure Mobile Access 400 |O | O |
!
X2
X3
X0
X1
WAN DMZ LAN
SMA Appliance
X2, etc
X1
X0
X0
Remote Users
Switch
Router
Network Nodes
SonicWall Gateway Appliance
CONSOLE
SDHC
MGMT X17
X16 X14 X12 X10 X8 X6 X4
1GE
10GE
X2 X0
X1X3X5X7
X9X11X13X15
ALARM
M0
TEST
PWR
DMZ LANWAN
X2, etc
X1 X0
X0
Remote Users Network Nodes
SonicWall Gateway Appliance
SwitchSwitch
Router
SMA Appliance
Secure Mobile Access 400 |O | O |
!
X2
X3
X0
X1
SonicWall NSA 3600 CONSOLE
SDHC
MGMT X17
X16 X14 X12 X10 X8 X6 X4
1GE
10GE
X2 X0
X1X3X5X7
X9X11X13X15
ALARM
M0
TEST
PWR

SMA 210/410 Deployment Guide
Deployment Scenarios Overview 5
Overview of Scenario C: SMA on the LAN
LAN
WAN
LAN Port
X0
Remote Users
Existing Gateway Device
or Switch / Hub
Internet
Router
SMA Appliance
Secure Mobile Access 400 |O | O |
!
X2
X3
X0
X1

SMA 210/410 Deployment Guide
Connecting the SMA on a New DMZ
2
6
Connecting the SMA on a New DMZ
The following procedures explain how to configure your gateway appliance on a new DMZ:
•Connecting the SMA to the Gateway
•Allowing a WAN to SMA Connection
•Allowing an SMA to LAN Connection
Connecting the SMA to the Gateway
To connect the SMA 210/410 using Scenario A:
1 Connect one end of an Ethernet cable to an unused port on your SonicWall gateway appliance.
2 Connect the other end of the Ethernet cable to the X0 port on the front of your SonicWall Secure Mobile
Access 210/410. The X0 Port LED lights up indicating an active connection.
3 Configure the SMA X0 IP address. Refer to Configuring the X0 IP Address.
Allowing a WAN to SMA Connection
To allow a WAN to SMA connection:
1 Click the Wizards icon in the top right corner of the gateway appliance management interface.
NOTE: Before continuing, you must add a new SMA custom zone. Refer to Adding a New SMA Custom
Zone for more information.

SMA 210/410 Deployment Guide
Connecting the SMA on a New DMZ 7
2 On the Welcome page, select the Public Server Guide, and then click Next.
3 On the Public Server Guide, select these options:
4 In the Add Service Group dialog box, create a service group for HTTP and HTTPS:
•Enter a Name for the service.
•Select both HTTP and HTTPS and click the arrow button to move them to the right column.
•Click OK.
Service Type Other
Services Create new group

SMA 210/410 Deployment Guide
Connecting the SMA on a New DMZ 8
5 On the Server Private Network Configuration page, enter the following server and SMA information, and
then click Next:
6 On the Server Public Information page, accept the default IP address, or enter an IP address in your
allowed public IP range. Click Next.
7 The Public Server Configuration Summary page displays all the configuration actions that will be
performed. Click Apply to create the configuration and allow access from the WAN to the SMA on the
DMZ.
Allowing an SMA to LAN Connection
When users have connected to the SMA, they need to be able to connect to resources on the LAN.
To allow an SMA to LAN connection:
1 Navigate to the Network > Address Objects page on the gateway appliance.
2 In the Address Objects tab, click Add.
3 In the Add Address Object dialog box, create an address object for the X0 interface IP address of your
SMA appliance:
4 Click Add to create the object. Once done, click Close.
5 Click Add again to create an address object for the NetExtender range.
Server Name Specify the name for the SMA appliance
Server Private IP Address SMA appliance X0 IP address
Server Comment Brief description of the server
NOTE: The default IP address is the WAN IP address of your SonicWall security appliance. If you
accept this default, all HTTP and HTTPS traffic to this IP address will be routed to your SMA
appliance.
Name Name of the SMA appliance
Zone Assignment SMA
Type Host
IP Address SMA appliance X0 IP address (default 192.168.200.1)

SMA 210/410 Deployment Guide
Connecting the SMA on a New DMZ 9
6 In the Add Address Object dialog box, create an address object for the NetExtender range:
7 Click Add to create the object. Once added, click Close.
8 On the Network > Address Objects page, click the Address Groups tab.
9 Click Add Group.
10 In the Add Address Object Group dialog box, create a group for the X0 interface IP address of your SMA
appliance and the NetExtender IP range:
•Enter a name for the group.
•In the left column, select the address objects you created and click the right arrow button.
•Click OK to create the group when both objects are in the right column.
11 Navigate to the Firewall > Access Rules page, and select the Matrix view style.
12 Click the SMA > LAN icon.
Name Name for NetExtender range
Zone Assignment SMA
Type Range
Starting IP Address Start of the NetExtender IP address range (default 192.168.200.100)
Ending IP Address End of the NetExtender IP address range (default 192.168.200.200)

SMA 210/410 Deployment Guide
Connecting the SMA on a New DMZ 10
13 On the page that displays for SMA to LAN, click Add.
14 In the Add Rule window, create a rule to allow access to the LAN for the address group you just created:
15 Click OK to create the rule.
This completes Scenario A.
Continue to Additional Configuration and Testing and Troubleshooting Your Remote Connection.
From SMA
To LAN
Source Port Any
Service Any
Source The address group you just created, such as SMA and
NetExtender.
Destination Any
Users Allowed All
Users Excluded None
Schedule Always on
Select the following check box(es) • Enable Logging
•Allow Fragmented Packets
NOTE: Some gateway appliances have a default zone named SSLVPN. Do not select this zone when
configuring for the SMA appliance. The SSLVPN zone is intended for use with the more limited SSLVPN
features that are included in the firewall products.

SMA 210/410 Deployment Guide
Connecting the SMA on an Existing DMZ
3
11
Connecting the SMA on an Existing
DMZ
The following procedures explain how to configure your gateway on an existing DMZ:
•Connecting the SMA to the Gateway
•Allowing WAN to DMZ Connection
•Allowing DMZ to LAN Connection
Connecting the SMA to the Gateway
To connect the SMA using Scenario B:
1 Connect one end of an Ethernet cable to your DMZ, either directly to the corresponding port on your
existing SonicWall gateway appliance, to a hub, or to a switch on your DMZ.
2 Connect the other end of the Ethernet cable to the X0 port on your SonicWall SMA 210/410. The X0 Port
LED lights up indicating an active connection.
3 Configure the SMA X0 with an IP address in the DMZ subnet. Refer to Configuring the X0 IP Address for
more information.
Allowing WAN to DMZ Connection
If you are already forwarding HTTP or HTTPS to an internal server and you only have a single public IP address,
you will need to select different (unique) ports of operation for either the existing servers or for the SMA
appliance, because both cannot concurrently use the same IP address and port combinations.
To allow a WAN to DMZ connection:
1 Log into your gateway appliance as an administrator and click the Wizards icon at the top right of the
interface.
2 On the Welcome page, select the Public Server Guide, and then click Next.
3 On the Public Server Guide page of the Wizard, select:
The Add Service Group dialog box is displayed.
Service Type Other
Services Create new group

SMA 210/410 Deployment Guide
Connecting the SMA on an Existing DMZ 12
4 In the Add Service Group dialog box, create a service group for HTTP and HTTPS:
• Enter a name for the service.
•Select both HTTP and HTTPS and click the arrow button to move to the right column.
•Click OK.
5 On the Server Private Network Configuration page, enter the following Server information and click Next:
6 On the Server Public Information page, accept the default IP address or enter a new IP address in your
allowed public IP range. Click Next.
7 The Public Server Configuration Summary page displays all configuration actions that will be performed.
Click Apply to create the configuration and allow access from the WAN to the SMA appliance on the
DMZ.
Allowing DMZ to LAN Connection
When users have connected to the SMA, they need to be able to connect to resources on the LAN.
To allow a DMZ to LAN connection:
1 On your gateway appliance, navigate to the Network > Address Objects page.
2 In the Address Objects tab, click Add.
3 In the Add Object dialog box, create an address object for the X0 interface IP address of your SMA
appliance:
4 Click OK to create the object. Once added, click Close.
5 Click Add again to create an address object for the NetExtender range.
6 In the Add Object dialog box, create an address object for the NetExtender range using the following
options, then click Add:
Server Name Name for the SMA appliance
Server Private IP Address The X0 IP address of the SMA appliance within your DMZ range,
such as 10.1.1.10/24.
Server Comment Brief description of the server
NOTE: The default IP address is the WAN IP address of your SonicWall firewall. If you accept this
default, all HTTP and HTTPS traffic to this IP address will be routed to your SMA appliance.
Name Name for the SMA appliance
Zone Assignment DMZ
Type Host
IP Address X0 IP address of the SMA appliance within your DMZ range, such as 10.1.1.10.
Name Name for NetExtender
Zone Assignment DMZ
Type Range

SMA 210/410 Deployment Guide
Connecting the SMA on an Existing DMZ 13
7 On the Network > Address Objects page, click the Address Groups tab.
8 Click Add Group.
9 In the Add Address Object Group dialog box, create a group for the X0 interface IP address of your SMA
appliance and the NetExtender IP range:
•Enter a name for the group.
•In the left column, select the address objects you created and click the right arrow button.
•Click OK to create the group when both objects are in the right column.
10 On the Network > Interfaces page, verify that the assigned zone is DMZ for the interface connected to
your SMA appliance.
11 Navigate to the Firewall > Access Rules page, and select the Matrix view style.
12 Click the DMZ > LAN icon.
13 On the page that displays for DMZ to LAN, click Add.
14 In the Add Rule window, create a rule to allow access to the LAN for the address group you just created:
Starting IP address Start of the NetExtender IP
address range within your DMZ
range, such as 10.1.1.220.
Ending IP address End of the NetExtender IP
address range within your DMZ
range, for example 10.1.1.249.
From DMZ
To LAN
Service Port Any
Service Any

SMA 210/410 Deployment Guide
Connecting the SMA on an Existing DMZ 14
15 Click OK to create the rule.
This completes Scenario B.
Continue to Additional Configuration and Testing and Troubleshooting Your Remote Connection.
Source The address group you just created, such as SMA and NetExtender 2.
Destination Any
Users Allowed All
Users Excluded None
Schedule Always on
Select the following
check box(es)
•Enable Logging
•Allow Fragmented Packets
NOTE: Some gateway appliances have a default zone named SSLVPN. Do not select this zone when
configuring for the SMA appliance. The SSLVPN zone is intended for use with the more limited
SSLVPN features that are included in the firewall products.

SMA 210/410 Deployment Guide
Deploying SMA on the LAN
4
15
Deploying SMA on the LAN
The following procedures explain how to configure your gateway appliance on the LAN:
•Connecting the SMA to the Gateway
•Configuring SMA to LAN Connectivity
Connecting the SMA to the Gateway
To connect the SMA on the LAN:
1 Connect one end of an Ethernet cable to an unused port on your LAN hub or switch.
2 Connect the other end of the Ethernet cable to the X0 port on the front of your SonicWall SMA 210/410.
The X0 Port LED lights up indicating an active connection.
3 Configure the SMA X0 IP address. Refer to Configuring the X0 IP Address for more information.
Configuring SMA to LAN Connectivity
In order for users to access local resources through the SMA appliance, you must configure your gateway device
to allow an outside connection through the SMA into your LAN.
To allow an SMA to LAN connection:
1 Log into your gateway appliance as an administrator and navigate to the Network > Address Objects
page.
2 In the Address Objects tab, click Add.
3 In the Add Object dialog box, create an address object for the X0 interface IP address of your SMA:
4 Click Add to create the object. After adding, click Close.
5 Click Add again to create an address object for the NetExtender range.
NOTE: Before continuing, you must add a new SMA custom zone. Refer to Adding a New SMA Custom
Zone for more information.
Name Name for the SMA appliance
Zone Assignment SMA
Type Host
IP Address SMA appliance X0 IP address (default 192.168.200.1)

SMA 210/410 Deployment Guide
Deploying SMA on the LAN 16
6 In the Add Object dialog box, create an address object for the NetExtender range, using the following
options:
7 Click Add to create the object. Once added, click Close.
8 On the Network > Address Objects page, click the Address Group tab.
9 Click Add Group.
10 In the Add Address Object Group dialog box, create a group for the X0 interface IP address of your SMA
and the NetExtender IP range:
•Enter a name for the group.
•In the left column, select the two address objects you created and click the right arrow button.
•Click OK to create the group when both objects are in the right column.
11 Navigate to the Firewall > Access Rules page, and select the Matrix view style.
12 Click the SMA > LAN icon.
13 On the page that displays for SMA to LAN, click Add.
14 In the Add Rule window, create a rule to allow access to the LAN for the address group you just created:
15 Click OK to create the rule.
This completes Scenario C.
Name Name for NetExtender
Zone Assignment SMA
Type Range
Starting IP Address Start of the NetExtender IP address range (default 192.168.200.100)
Ending IP Address End of the NetExtender IP address range (default 192.168.200.200)
From SMA
To LAN
Source Port Any
Service Any
Source The address group you just created, such as SMA to LAN.
Destination Any
Users Allowed All
Users Excluded None
Schedule Always on
Select the following
check box(es)
Enable Logging
Allow Fragmented Packets

SMA 210/410 Deployment Guide
Deploying SMA on the LAN 17
Continue to Additional Configuration and Testing and Troubleshooting Your Remote Connection.
NOTE: Some gateway appliances have a default zone named SSLVPN. Do not select this zone when
configuring for the SMA appliance. The SSLVPN zone is intended for use with the more limited SSLVPN
features that are included in the firewall products.

SMA 210/410 Deployment Guide
Additional Configuration
5
18
Additional Configuration
This section describes some additional configuration settings for your SMA 210/410, depending on the
deployment scenario you selected.
Topics:
•Configuring the X0 IP Address
•Adding a NetExtender Client Route
•Setting Your NetExtender Address Range
•Adding a New SMA Custom Zone
Configuring the X0 IP Address
When deploying the SMA in any of the scenarios mentioned in Selecting a Deployment Scenario on page 3, you
need to reset the IP address of the X0 interface on the SMA to an address within the range of the new or existing
DMZ or the existing LAN subnet.
To configure the X0 IP address:
1 Connect your computer to X0 and log into the SMA appliance by navigating to
https://192.168.200.1 on your Web browser.
2 Navigate to the Network > Interfaces page.
3 In the Interfaces table, click the Configure icon for the X0 interface.
4 In the Interface Settings dialog box, set the IP Address to an unused address within your DMZ or LAN
subnet.
5 For the Subnet Mask, enter the value that matches your DMZ or LAN subnet mask, such as
255.255.255.0.
6 Click Accept. A warning displays that you are changing the X0 IP Address. Click OK to acknowledge.
7 Reset the management computer to have a static IP address in the range you just set for the X0 interface.
For example, if you set X0 to 10.1.1.10, you could set your computer to 10.1.1.20.
8 Log into the SMA management interface again, using the IP address you just configured for the X0
interface. For example, point your browser to https://10.1.1.10.
TIP: For additional information, see the SMA 210/410 Quick Start Guide.

SMA 210/410 Deployment Guide
Additional Configuration 19
Configuring a Default Route
Refer to the following table to correctly configure your default route for the scenario you selected.
To configure a default route:
1 Navigate to the Network > Routes page.
2 Enter the upstream gateway device’s IPv4 address in the Default IPv4 Gateway field or the IPv6 address
in the Default IPv6 Gateway field.
3 Select X0 as the interface and click Accept.
Adding a NetExtender Client Route
NetExtender allows remote clients to have seamless access to resources on your local network.
To configure a NetExtender client route:
1 Navigate to the NetExtender > Client Routes page.
2 To force all SMA client traffic to pass through the NetExtender tunnel, select Enabled from the Tunnel All
Mode drop-down list.
If you are using scenario: Your upstream gateway IP address will be:
A - SMA on a New DMZ The IP address of the DMZ interface you create
B - SMA on an Existing DMZ The existing DMZ interface IP address
C - SMA on the LAN The LAN interface IP address

SMA 210/410 Deployment Guide
Additional Configuration 20
3 Click Add Client Route.
4 Enter the network address of the trusted network to which you would like to provide access with
NetExtender in the Destination Network field. For example, if you are connecting to an existing DMZ on
the 10.1.1.0/24 subnet and you want to provide access to your LAN network on the 192.168.168.0/24
subnet, you would enter 192.168.168.0.
5 Enter the subnet mask of the destination network in the Subnet Mask/Prefix field. Continuing the
example, enter 255.255.255.0.
6 Click Accept to finish adding this client route.
Setting Your NetExtender Address Range
The NetExtender address range defines the IP address pool from which addresses will be assigned to remote
users during NetExtender sessions. The range needs to be large enough to accommodate the maximum number
of concurrent NetExtender users you wish to support.
The range should fall within the same subnet as the interface to which the SMA appliance is connected, and it
must not overlap or collide with any assigned addresses if other hosts are on the same segment as the SMA
appliance.
Determine the correct subnet based on your network scenario selection:
To set your NetExtender address range:
1 Navigate to the NetExtender > Client Settings page.
2 Enter an address range in the Client Address Range Begin and Client Address Range End fields.
3 Click Accept to add the Client Address Range.
Scenario A 192.168.200.100 to 192.168.200.200 (default range)
Scenario B Select a range that falls within your existing DMZ subnet. For example, if your DMZ uses the
10.1.1.0/24 subnet, and you want to support up to 30 concurrent NetExtender sessions, you
could use 10.1.1.220 to 10.1.1.249.
Scenario C Select a range that falls within your existing LAN subnet. For example, if your LAN uses the
192.168.168.0/24 subnet, and you want to support up to 10 concurrent NetExtender sessions,
you could use 192.168.168.240 to 192.168.168.249.
NOTE: DHCP/DHCPv6 is supported and can manage the IPv4 and IPv6 addresses in the LAN and the
NetExtender client address ranges.
Scenario A 192.168.200.100 to 192.168.200.200 (default range)
Scenario B An unused range within your DMZ subnet.
Scenario C An unused range within your LAN subnet.