How to authenticate WAN users before they access the LAN ?

GAG

Hi,

I have a WEB server on my LAN and need remote users be able to access it from WAN.

Setting up of this scenario is straight forward and it's working already, but what I need is that those remote users get authenticated by my TZ-400 before they reach my WEB server. I don't want my server asking for credentials directly to an unknown user in the WAN zone.

I've read several articles (some original from SonicWALL) explaining the reverse scenary (authenticate LAN users against the FW before the reach the Internet). Some of these articles says that this user authentication can be configured between whatever zones but I can't make it work.

Any advice would be apreciated.

Greetings!!

BWC

Hi @GAG

I've never tried this before, but did you enabled User Login in the WAN Interface settings? Secondly your access rule WAN -> LAN needs to specfiy "Users included" like Everyone or specific users.

No guarantee that this will work, but that's IMHO the 2 bases to cover.

--Michael@BWC

shiprasahu93

@GAG,

I completely agree with @BWC. Please enable user login on the WAN interface and on the access rule created from WAN to LAN, use the Users included field as Trusted Users/Everyone. Leave the NAT policy as it is.

I tested this is my lab and it worked as expected. I created a local user on the firewall and once I successfully authenticated with it, I was redirected to the internal web server.

Could you please let us know how you have configured it at the moment. Also, what behavior do you see on your end?

Thanks!

GAG

@shiprasahu93

GAG

Hi,

Thanks BWC and Shiprasahu93 for your help. I've made already the steps both of you said.

I have Single-sign-on configured with 2 internal servers that runs SonicWALL SSO Agent.

I've just disabled SSO Agent on "Users->Settings->Authentication" and know it's running OK, just as I wanted (and as it's supossed to be)

I don't really need SSO so I'll keep it disabled.

Thanks for your help!!

shiprasahu93

@GAG,

Yes, the SSO feature uses NetAPI/ WMI queries to the end machine to find out the username which cannot reach a machine connecting from WAN side. But, good to know that things are working as expected.

Thanks for confirming. Have a good one!