SonicWALL ex9000 User manual

Getting Started Guide SonicWALL / Aventail Secure Remote Access EX9000

Thank You For Selecting SonicWALL®
Protection
SonicWALL offers a wide range of high performance network
security, content security for Web and e-mail security, secure
remote access, continuous data protection, and management
and reporting solutions. To take a deeper look at all the
SonicWALL solutions please visit http://www.sonicwall.com/
products/. To ensure the optimal performance and operation,
visit https://www.mysonicwall.com to register your appliance
and download the latest firmware, product documentation, and
release notes.
E-Class Support 24x7
In case you need assistance, contact our Global Support
Center at the numbers listed here: http://www.sonicwall.com/us/
support/contact.html. Have the serial number of your appliance
available so that we can validate your contract and begin
resolving any issues you may have.
If you are located in the Americas or Asia
Pacific:
Call our toll-free Enterprise Support phone number at 1-866-
360-1949 (your call will be transferred to SonicWALL's E-Class
Technical Support team), or contact us at
[email protected].
If you are located in Europe, the Middle
East, or Africa:
Call the phone number listed for your country, and then select
the “Enterprise Support” option when prompted so that your call
is transferred to our Enterprise Technical Support team.

SonicWALL SRA EX9000 Getting Started Guide Page 1
Registering and Obtaining the License
In this Section:
This section describes how to register your SonicWALL Aventail appliance and then download the license file from MySonicWALL.
You can register your SonicWALL Aventail appliance before you initialize or deploy it. Registration provides access to essential
resources, such as your license file, firmware updates, documentation, and technical support information.
•Registering Your Appliance on page 2
•Retrieving Your SonicWALL License on page 2
1

Page 2 Registering Your Appliance
Registering Your Appliance
To register your appliance, perform the following steps:
1. Locate your appliance serial number and authentication
code, which is printed on your appliance label.
The serial number and authentication code are also
displayed in AMC on the General Settings page once you
initialize and connect to your appliance.
2. In your Web browser, navigate to
https://www.mysonicwall.com and do one of the following:
• Log in to your MySonicWALL account with your
username and password
• Create a MySonicWALL account if you do not have
one
Note: MySonicWALL registration information is not sold or
shared with any other company.
3. Enter the appliance serial number into the Register A
Product field and click Next.
4. Enter a friendly name for this appliance.
5. Click Register to continue, and follow the online prompts
to fill out the survey and complete the registration process.
Continue with the next section to download the appliance
license file from MySonicWALL.
Retrieving Your SonicWALL License
You can retrieve an initial user license from MySonicWALL that
is valid for one user (the administrator plus one end user) for an
unlimited number of days. You can use this limited license until
ready to deploy the appliance to production with full licensing.
To become familiar with AMC and test it in your environment
with additional users, request a lab license.
To retrieve the license file for your appliance, perform the
following steps:
1. In your Web browser, go to https://www.mysonicwall.com
and log in with your username and password.
2. Click My Products to view the list of your registered
appliances.
3. Click the link for the appliance that requires a license.
4. On the Service Management page, click the View License
Keyset link for the license file.
5. Copy the license text to your clipboard and save it as an
XML file (.xml) on your computer. Once the appliance is
running you must import this license file using AMC.

SonicWALL SRA EX9000 Getting Started Guide Page 3
Installation and Licensing
In this Section:
This section provides the steps to perform the initial installation and import the license to the SonicWALL Aventail appliance. For more
detailed information, the Installation and Administration Guide has complete instructions for installing and licensing your SonicWALL
Aventail appliance.
•SonicWALL Aventail EX9000 Appliance Diagram on page 4
•Preparing the Hardware on page 5
•Gathering Serial Number and Auth Code on page 5
•Rack Mounting the Appliance on page 5
•Starting the Appliance on page 5
•Entering Network Settings Using the LCD on page 6
•Connecting Network Interfaces on page 7
•Running the Setup Wizard on page 7
•Connecting to AMC on page 8
•Importing Your SonicWALL License on page 8
2

Page 4 SonicWALL Aventail EX9000 Appliance Diagram
SonicWALL Aventail EX9000 Appliance Diagram
D0
2 TB
D0
2 TB
X3 X1
X2 X0
X5X7
X4X6
X8X9
X10X11
Serial
Console
Port
USB
Ports
LED Indicators (top to bottom)
HDD - Hard disk drive activity
ALARM - Alarm condition
TEST - Quick blinking: Initializing;
Solid: Test mode
PWR 1/2 - Blue: operating correctly;
Yellow: Unconnected power supply or failure
-- Turn o alarm by pressing the alarm reset
button on back panel
Diagnostic Port
Back Panel Power & Alarm Buttons:
10 Gigabit Ports
X8 - Internal network interface
X9 - External network interface
X10 - High availability cluster interface
Hard Drives
LCD Screen and Controls
For initial conguration of basic network settings
X0 - X7
High speed Gigabit Ethernet Ports
X0 - Internal network interface
X1 - External network interface
X2 - High availability cluster interface
Power supply alarm reset button
Power on/o button

SonicWALL SRA EX9000 Getting Started Guide Page 5
Preparing the Hardware
To prepare the SonicWALL appliance before running the Setup
Wizard, complete the tasks described in the following sections:
•Gathering Serial Number and Auth Code
•Rack Mounting the Appliance
•Starting the Appliance
•Entering Network Settings Using the LCD
Gathering Serial Number and Auth Code
The serial number and authentication code are needed when
you register your product on MySonicWALL. Product
registration gives you access to essential resources, such as
your license file, firmware updates, documentation, and
technical support information.
You can find the information in one or both of these places:
• Printed on your appliance label.
• Displayed on the General Settings page once you
complete setup and start the Aventail Management
Console
For registration instructions, see Registering Your Appliance on
page 2.
Rack Mounting the Appliance
The SonicWALL appliance is designed to be mounted in a
standard 19-inch rack. The product packaging contains a slide
rail kit for mounting the appliance in a four-post cabinet. Before
installing the appliance in an equipment rack, the rails must be
attached to the appliance and to the rack posts.
See the Rack Mounting Instructions on page 38.
Starting the Appliance
The SRA EX9000 includes dual power supplies for redundant
AC power and added reliability. Two power cords are included
with the appliance. These are for AC mains installation only.
Field conversion is available to convert to DC mains. DC power
supplies use different input connectors and power cables. See
Safety and Regulatory Information on page 37 for information.
For European Union customers, a power cord is not included.
Power cords are included with units in North America or Japan
only.
To connect the power, plug in each power cord to one of the
power supplies on the back of the appliance, and then connect
each cord to an AC outlet. For best reliability, connect the two
cords to outlets on different circuits.
添付の電源コードに関して：電気安全を確保するために、弊社製品に
ご使用いただく電源コードは必ず製品同梱の電源コードをご使用くだ
さい。この電源コードは他の製品では使用できません。

Page 6 Entering Network Settings Using the LCD
Entering Network Settings Using the LCD
Before you can run the Setup Wizard, you must first enter basic
network settings so that you can use a Web browser to connect
to the appliance. The LCD screen on the front bezel is used for
this part of the initial configuration.
To the right of the LCD screen on the front of your appliance are
four buttons used to enter your settings. Press Up and Down to
read the welcome screen, and press Right to continue past it.
The SonicWALL Aventail EX9000 provides four 10 gigabit ports
on interfaces X8 - X11. You can activate the 10 gigabit ports
during the LCD initialization process. If you do so, you must
connect a 10 Gb device to X8 to complete the setup process.
Warning: Activating 10 Gb networking will disable the 1 Gb
X0-X3 network ports.
To configure settings using the LCD:
1. Press Up and Down to read the welcome screen, and
press Right to continue past it.
2. Press Right to continue past the 10 Gb warning.
3. At the “Use 10Gb, disable X0-3?” prompt, do one of the
following:
• Press Right for 1 Gb networking using ports X0-X3
• Press Left for 10 Gb networking using ports X8-X11
4. Enter the IP address for your internal interface
To change the IP address that appears, use the Left and
Right buttons to position your cursor over the number you
want to change, and then use Up and Down to change the
number. Press Right to continue to the next screen.
5. Enter your subnet mask
Again, use the four buttons to change the IP address
displayed on the LCD screen. Press Right to continue to
the next screen.
6. Cluster configuration
Specify whether the appliance you are configuring will be
part of a cluster (a high-availability pair of appliances), and
which node it is (enter “1” for the master node, and “2” for
the slave node). Press Right to continue to the next screen.
7. Confirm your settings
Review your settings and confirm them.
After the appliance is updated, you are ready to connect the
interfaces and continue configuring the appliance using the
Web-based Setup Wizard.

SonicWALL SRA EX9000 Getting Started Guide Page 7
Connecting Network Interfaces
After selecting your networking type (1 Gigabit or 10 Gigabit) in
the LCD panel, you can connect the appliance’s physical
interfaces to your network infrastructure as follows:
Running the Setup Wizard
The Setup Wizard guides you through the initial setup for your
SonicWALL E-Class SRA appliance.
To run the Setup Wizard:
1. Using a computer on the same subnet, physically connect
to the internal interface selected during LCD initialization:
• X0 for 1 gigabit networking
• X8 for 10 gigabit networking
2. Access the wizard:
Start a Web browser and type:
https://<IPaddress>:8443
where <IPaddress> matches the address you defined for
the internal network interface.
3. Enter your configuration settings:
Follow the instructions in the wizard to accept the license
agreement, create an administrator password, configure
the network interfaces and routing, and then enter optional
clustering information. You can also make some decisions
regarding user access and an initial access policy for
users, which you can refine later in AMC.
4. Apply your changes:
When you're done with the wizard, click Finish to apply
your settings. The appliance restarts, which causes you to
lose your current connection. Wait a few minutes and then
connect to Aventail Management Console (AMC).
Designated
Network 1 Gigabit Networking 10 Gigabit Networking
Internal Subnet
(LAN) X0 X8
External Network
(WAN) X1 X9
High Availability
Cluster Connectivity X2 X10
Not Used -
Do Not Connect X3 - X7 X8 - X11 X11 X0 - X7

Page 8 Connecting to AMC
Connecting to AMC
AMC is the Web-based application used to administer the
appliance. Once the Setup Wizard finishes, the login page is
displayed in your browser.
Type admin in the Username box, and then enter the password
you created with the Setup Wizard. Both are case-sensitive.
Click Login to log in to the Management Console.
You can use the Setup Checklist on the AMC home page to
jump to the right configuration page in AMC, and to track your
progress (as each configuration item is completed, a check
mark is added):
Importing Your SonicWALL License
When you are ready to move the appliance into production after
initial setup and testing, download your appliance license file
from MySonicWALL and then use AMC to import it to the
appliance. See Registering and Obtaining the License on
page 1 for information. The process for importing an appliance
license file is described in detail in the online help for AMC.
The SonicWALL Aventail SRA EX9000 supports up to 20,000
concurrent users, when licensed accordingly.
To import an appliance license, perform the following steps:
1. Log in as admin to AMC.
2. Click General Settings.
3. Click the Edit link in the Licensing area.
The Manage Licenses page appears.
4. Click Import License.
5. In the License file box, click Browse to locate the license
file you retrieved from your MySonicWALL account.
6. Click Upload to copy the license to the appliance.
7. Apply the change by clicking the Pending changes link in
the upper-right corner.
Note: When you upload a Spike License, the countdown of
the number of days it is valid begins once you activate
it and apply the pending change in AMC. Do not click
the Activate link until you are ready to start using it.

SonicWALL SRA EX9000 Getting Started Guide Page 9
Deploying Resource Access to Users
In this Section:
This section describes a variety of deployment scenarios and introduces you to how the configuration elements of AMC interact.
Deploying secure remote access for users to resources through the SonicWALL Aventail appliance is discussed.
•Deployment Overview on page 10
•Verifying Your Firewall Policies on page 10
•Deploying Aventail WorkPlace on page 12
•Deploying Access for Trusted Users on page 13
•Deploying Access for Less-Trusted Users on page 15
•Deploying an End Point Control Agent on page 16
•Denying Access on page 17
•Access Policy Scenarios on page 17
•Application-Specific Scenarios on page 17
•Authentication Scenarios on page 19
•Access Component Provisioning on page 19
3

Page 10 Deployment Overview
Deployment Overview
In addition to basic security policy, you can use AMC on the
SRA EX9000 to define resources and multiple access policies.
After you have defined your resources and access policy, you
can make those resources available to remote users.
Using AMC, you can make Web resources, file shares, and
terminal server resources available to users in the WorkPlace
portal using the clients and agents you specify for them.
Before you begin further configuration, refer to the SonicWALL
Aventail Deployment Planning Guide for conceptual information
about:
• Key SSL VPN concepts
• Remote access features for authentication and resource
access policy
• Client components and the WorkPlace portal
• VPN planning
The SonicWALL Aventail Deployment Planning Guide is
available on MySonicWALL when you download the current
firmware for your SRA EX9000. You can also access it on the
Support pages of www.sonicwall.com:
http://www.sonicwall.com/us/support/3891.html
Verifying Your Firewall Policies
For the appliance to function correctly, you must open ports on
your external (Internet-facing) and internal firewalls.
Opening Ports on the External Firewall
For secure access to the appliance from a Web browser,
Connect Tunnel, or OnDemand Tunnel, you must make sure
that ports 80 and 443 are open on firewalls at your site.
Opening your firewall to permit SSH access is optional, but can
be useful for performing administrative tasks from a remote
system.
To use client-to-client applications such as VoIP when your
appliance is using NAT, you can use ESP (Encapsulating
Security Payload) to encapsulate and decapsulate packets
inside of a UDP wrapper (port 4500). ESP encapsulation
provides a performance improvement over SSL tunnel for all
types of traffic, but UDP port 4500 must be open in network
Traffic
type Port/ protocol Usage Required?
HTTP 80/tcp Unencrypted network access x
HTTPS 443/tcp Encrypted network access x
SSH 22/tcp Administrative access to the
appliance

SonicWALL SRA EX9000 Getting Started Guide Page 11
firewalls when using it. If the external appliance traffic is subject
to NAT, then NAT must be configured for UDP port 4500. See
the Installation and Administration Guide for more information
and configuration procedures.
Opening Ports on the Internal Firewall
If you have a firewall on the internal network, you may need to
adjust its policy to open ports for back-end applications with
which the appliance must communicate. In addition to opening
ports for standard network services such as DNS and e-mail,
you may need to modify your firewall policy to enable the
appliance to access the following services:
Traffic type Port/protocol Usage
Microsoft
networking • 138/tcp and 138/ udp
• 137/tcp and 137/
udp
• 139/udp
• 162/snmp
• 445/smb
Used by Aventail WorkPlace
to perform WINS name
resolution, browse
requests, and access file
shares
LDAP
(unencrypted
)
389/tcp Communicate with an LDAP
directory or Microsoft Active
Directory
LDAP over
SSL
(encrypted)
636/tcp Communicate with an LDAP
directory or Microsoft Active
Directory over SSL
RADIUS 1645/udp or 1812/udp Communicate with a
RADIUS authentication
server
NTP 123/udp Synchronize the appliance
clock with an NTP server
Syslog 514/tcp Send system log
information to a syslog
server
SNMP 161/udp Monitor the appliance from
an SNMP management tool
ActiveSync • 443/tcp
• 80/tcp Communicate with an
Exchange server.
Traffic type Port/protocol Usage

Page 12 Deploying Aventail WorkPlace
Deploying Aventail WorkPlace
Aventail WorkPlace is a Web portal that provides users with
dynamically personalized access to your network. It provides
an easy way for you to deploy resources directly from the
appliance and give users access to the major components of
your VPN. On a per-community basis, you determine how the
portal is laid out and what elements users will see.
•Web shortcuts and Shortcut groups provide users with
quick access to Web resources. Network shortcuts give
them access to file system resources, and Graphical
terminal shortcuts give them Web-based access to
resources that are available through Windows Terminal
Services or Citrix hosts.
•TheNetwork Explorer page provides Web-based access
to file shares. Its Windows Explorer-like interface supports
most common file management tasks, such as opening,
uploading, downloading, and copying files. The appliance’s
file system access policy is used to control each user’s
access privileges. You can also disable file uploads from
Aventail WorkPlace, or disable access to file shares
entirely.
• Users can create and manage personal Bookmarks that
point to URLs and other resources that are protected by
the appliance. These personal links are stored on the
appliance, so users have access to them whenever (and
however) they are logged in to WorkPlace.
•TheIntranet Address box enables users to type a URL or
UNC path name for access to resources for which you
have not yet created specific shortcuts. For example, a
user could type the host name of a Web server, or a
specific folder on a Windows share.
WorkPlace also provides support for a variety of smaller
devices: when a user logs in to WorkPlace from a small form
factor device, WorkPlace detects the device type and
automatically transforms to best match the capabilities of the
client device.
One- or two-
column layout
Personal
Bookmarks
Shortcut group
(collapsible)
Navigation: tabs
or side menu
Greeting
Company
logo
WorkPlace title Link to custom help file
Custom URL
Intranet box: an additional way to access resources

SonicWALL SRA EX9000 Getting Started Guide Page 13
For complete information on configuring Aventail WorkPlace,
see the Installation and Administration Guide. For an example
illustrating how to set up two different communities, each with its
own WorkPlace “look”, see Customizing WorkPlace on
page 28.
Deploying Access for Trusted Users
To better understand how to deploy a remote access VPN, this
section provides an overview of how the SonicWALL Aventail
access clients and agents are deployed to users.
Providing Access to Web Resources
Web resources are applications or services that run over the
HTTP or HTTPS protocols, such as Microsoft Outlook Web
Access or a corporate intranet. There are several ways to give
users access to these resources—choose the method that is
appropriate for your various audiences. For example, you can
give business partners narrow access to a Web application by
specifying a particular URL in your resource definition.
Employees are granted broader access if you define the domain
in which that Web application is located as a resource.
Defining Specific Web Resources
To provide user access to a specific Web application or other
Web resource:
1. Define a URL resource on the Add/Edit Resource page.
2. Create an access control rule referencing the URL on the
Add/Edit Access Rule page.
3. Add a Web shortcut to WorkPlace on the WorkPlace
Shortcuts page.
Access method Deployment options
Connect Tunnel client • Users can download and install the client
for Windows, Macintosh, or Linux in
Aventail WorkPlace.
• Administrators can create a custom
installer package of Connect Tunnel
components and make it available for
users to install from another network
location (without requiring them to log in
to Aventail WorkPlace), or distribute the
client as a disk image.
OnDemand Tunnel
agent • The agent is automatically activated each time a user logs in to Aventail WorkPlace
and authenticates using a Web browser.
Connect Mobile client • The client is installed using a Windows
setup program that extracts the
application files and then copies the files
to the user’s Windows Mobile-powered
device.
Translated Web access • Translated Web provides access through
the Aventail WorkPlace portal as a
fallback for systems that do not support
other access methods.
Access method Deployment options

Page 14 Deploying Access for Trusted Users
Web Resources on a Portion of Your Network
To provide user access to any Web resource on a given portion
of your network:
1. Define a resource (such as a subnet or IP address range)
for the portion of the network containing the Web resources
on the Add/Edit Resource page.
2. Create a rule referencing the network object on the Add/
Edit Access Rule page.
3. Instruct your users to type the host name or URL for any
Web resources in the Intranet Address box on
WorkPlace.
All Web Resources on Your Network
To provide user access to all the Web resources on your
network:
1. Define a resource (such as a domain) for all internal DNS
domains on the Add/Edit Resource page.
2. Create a rule referencing the network object on the Add/
Edit Access Rule page.
3. Instruct users to type the host name or URL for any Web
resources in the Intranet Address box on WorkPlace.
Web-Based File Access to Entire Networks
To provide Web-based access to all the file system resources
within a domain:
1. Define a resource referencing your Windows domain on
the Add/Edit Resource page.
2. Create a rule referencing the domain on the Add/Edit
Access Rule page.
3. Add a network shortcut referencing the domain on the
WorkPlace Shortcuts page.
4. Make sure the WorkPlace Network Explorer tab is
enabled (this is the default state).
5. Instruct your users to click the appropriate link to the file
system resource in Network Explorer.
Broad Access to Network Resources
To give users comprehensive access to your network resources
from devices that are owned and managed by your
organization, distribute the following clients, which run on a
wide variety of devices:
• Connect Tunnel clients run on Windows, Macintosh, and
Linux devices
• The Connect Mobile client gives users with Windows
Mobile-powered devices access to both Web and client/
server applications
To allow broad, “in-office” access to your network:
1. Define a resource referencing your DNS domain on the
Add/Edit Resource page.
2. Create a rule referencing the domain on the Add/Edit
Access Rule page.
3. Configure and distribute the network tunnel clients to your
users.

SonicWALL SRA EX9000 Getting Started Guide Page 15
Remote Access for Mobile Users
There are two remote access solutions for mobile device users:
WorkPlace Mobile is a Web portal that provides access to
Web-based applications from virtually any mobile device with a
functional Web browser. You also have the option of
customizing the appearance of the portal for mobile devices.
For detailed information on this solution, see the “WorkPlace
and Small Form Factor Devices” section of the Installation and
Administration Guide or the AMC online help.
Connect Mobile is a proxy client for Windows Mobile-
powered devices that gives users access to a broad range of
Web and client/server applications. Connect Mobile users can
reach secure, intranet resources that are not available using
traditional Web-only access. A link in an e-mail message, for
example, to a confidential Word document located on an
internal server can be opened just as if the recipient were in the
office.
Connect Mobile can also be used with any client/server
application that is supported by the mobile device. A
salesperson, for example, can use inventory management and
CRM applications to send and receive account and supply
information securely from any location where there is Internet
access. Instead of synchronizing data at the end of the day,
opportunities and sales-related activities can be tracked in real-
time.
Deploying Access for Less-Trusted Users
This section provides examples of common steps for deploying
a VPN to less-trusted users, such as business partners. These
scenarios could also be useful in providing VPN access to
contractors or other third-party users who require access to
your network resources.
Access to a Specific Web Resource Using an Alias
To provide access to a specific Web resource, using an alias to
prevent users from seeing its internal host name:
1. Define a URL resource on the Add/Edit Resource page,
and then specify an alias for the resource in the
Advanced section.
2. Create a rule referencing the URL on the Add/Edit Access
Rule page.
3. Add a Web shortcut to WorkPlace on the WorkPlace
Shortcuts page.
Web-based Access to a Client/Server Application
To provide Web access to a client/server application, such as a
CRM system:
1. Define a network resource on the Add/Edit Resource
page, referencing the application’s host name or IP
address.
2. Create a rule on the Add/Edit Access Rule page
referencing the network resource.
3. Configure the OnDemand Tunnel client.
4. Add a Web shortcut on the WorkPlace Shortcuts page.

Page 16 Deploying an End Point Control Agent
Deploying an End Point Control Agent
You can deploy End Point Control to protect sensitive data and
ensure that your network is not compromised when accessed
from devices in untrusted environments.
For advanced cache cleaning and data protection, you can
configure the SRA EX9000 appliance to use the third-party
EPC tools provided by OPSWAT: Cache Cleaner and Secure
Virtual Desktop.
Both the Cache Cleaner and Secure Virtual Desktop share the
following deployment characteristics:
• Configured on the Configure Data Protection page,
accessed from the Agent Configuration page in AMC.
• EPC must be enabled on the End Point Control page.
• Deployed on a per-realm basis.
Quarantining Employees on Untrusted Systems
Follow these configuration steps to quarantine an employee
who logs in using a device that does not match any of your
device profiles. The only resources available will be those that
you set up. You could, for example, display a customized page
with links to Web resources for bringing the user’s system into
compliance with your security policies:
1. Define a device profile on the Device Profile Definition
page with an attribute referencing an application or other
attribute that is unique to your organization.
2. Configure a Standard zone that references the device
profile defined in step 1.
3. Configure a Quarantine zone that displays a custom Web
page with links to resources for bringing a user’s system
into compliance.
4. Create a community that references the Standard zone you
created, and identify the Quarantine zone as the fallback
option. Connection requests from devices that do not
match the trusted profile are automatically assigned to the
Quarantine zone.
Secure Virtual Desktop for Partners
To deploy OPSWAT Secure Virtual Desktop, a partof Advanced
EPC, to partners who connect from their company domain:
1. Enable Secure Virtual Desktop on the Agent
Configuration page in AMC.
2. Define a device profile with an attribute referencing the
partner’s Windows domain name.
3. Reference the device profile in a zone, and configure the
zone to require Secure Virtual Desktop.
4. Reference the zone in the community used by partners.
5. Configure the Default zone to block VPN access (this will
prevent unknown systems from accessing the network).

SonicWALL SRA EX9000 Getting Started Guide Page 17
Denying Access
There may be situations in which you want to deny access to an
employee using a device that has an unacceptable profile. As
an example, follow these configuration steps to deny access to
an employee using a device that is running Google Desktop:
1. Define a device profile with an attribute referencing the
Google Desktop application.
2. Reference the device profile in a Deny zone.
3. Reference the Deny zone in the community used by your
employees.
When the appliance determines that a device is running
Google Desktop, the device is classified into the Deny
zone. Deny zones are always evaluated first: if Google
Desktop is running, no other zones are evaluated, the
access request is denied, and the user is logged out.
Access Policy Scenarios
Access control rules determine what resources are available to
users or groups. Rules can be defined broadly to provide
access from any access method, or defined narrowly so that
only a specific access method is permitted.
VPN connections typically involve what are called forward
connections—these are initiated by a user to a network
resource. All access methods support forward connections.
However, if you are running the network tunnel service and you
deploy the network tunnel clients to your users, you can also
create access control rules for bi-directional connections.
For the SonicWALL Aventail VPN, bi-directional connections
encompass:
•Reverse connections from a network resource to a VPN
user, such as an SMS server that “pushes” a software
update to users’ computers.
•Cross-connections using Voice over Internet Protocol
(VoIP) applications that enable one VPN user to telephone
another VPN user. These connections require a pair of
access control rules: one for the forward connection and
one for the reverse connection. For information on VoIP
scenarios, see Providing Access to Voice Over IP on
page 18.
• Other types of bi-directional connections include FTP
servers that download files to or upload files from a VPN
user, and remote Help Desk applications such as Virtual
Assist.
Application-Specific Scenarios
This section provides examples of configuring the appliance to
permit remote users to access some commonly used
applications, such as Microsoft Outlook Web Access and Citrix.

Page 18 Application-Specific Scenarios
Providing Access to Outlook Web Access
For convenience, AMC includes a pre-configured Web
application profile for Microsoft Outlook Web Access (OWA).
To provide user access to OWA:
1. Define a URL resource for the Outlook Web Access server
on the Add/Edit Resource page.
2. Select OWA/Single Sign-On as the Web application
profile on the Add/Edit Resource page. This automatically
configures single sign-on and content translation for OWA.
3. Create an access control rule referencing the OWA server
resource on the Add/Edit Access Rule page.
4. Add a Web shortcut to OWA for Aventail WorkPlace users
on the Add/Edit Web Shortcut page.
5. Use the Start page box on the Add/Edit Web Shortcut
page to append more specific information to the URL for
OWA. For example, if you want the shortcut to point to a
directory or file other than the root, type a relative path in
the Start page box. If the selected URL for Outlook Web
Access is owa.company_xyz.com, for example, you could
set the start page to /mail/root.asp. The resulting URL
would be https://owa.company_xyz.com/mail/root.asp.
You can also create a resource that will block email
attachments; see the description of the Matching URL resource
type in the AMC help.
Providing Access to Voice Over IP
To permit users running one of the network tunnel clients to call
each other using a Voice over IP (VoIP) telephony application:
1. Ensure that the network tunnel service is running on the
appliance; you can do this on the AMC home page or
Services page.
2. Create an IP address pool for the network tunnel clients
(Connect Tunnel or OnDemand Tunnel) on the Configure
Network Tunnel Service page.
3. Ensure that the users who will access the VoIP application
belong to a community that is configured to deploy one of
the network tunnel clients to their computers. This is done
on the Access Methods tab of the Configure Community
page.
4. Create an access control rule from the VoIP users to the
address pool that will be used for the VoIP application on
the Add/Edit Access Rule page.
5. Create a second access control rule from the address pool
for the VoIP application to the VoIP users on the Add/Edit
Access Rule page.
Providing Access to Windows Terminal Services or
Citrix Resources
To give users access to an individual Windows Terminal
Services or Citrix host, or a Citrix server farm:
1. Install or update the Windows Terminal Services agent or
the Citrix agent on the Configure Graphical
Terminal Agents page.
2. Define a resource on the Add/Edit Resource page for the
Windows Terminal Services or Citrix host, or the Citrix
server farm.
3. Create a rule on the Add/Edit Access Rule page
referencing the terminal-server resource.