Menu

Join the Conversation

To sign in, use your existing MySonicWall account. To create a free MySonicWall account click "Register".

Sign In Register

Mobile Connect always gives Access denied - please contact your administrator

JohnCHarrisJohnCHarris Newbie ✭
in SSL VPN

I'm doing some testing to get a working VPN on Android. I was hoping to use L2TP but I can't get that working.


Now I'm trying to use the Mobile Connect, but I always get the error "Access denied - please contact your administrator". I set up an additional test user, but I get the same error.


This is on a TZ 270.

Category: SSL VPN
Reply

Best Answer

  • CORRECT ANSWER
    MustafaAMustafaA SonicWall Employee
    Answer ✓

    You can test this with "Source NATing". Add the following NAT policy and see if that helps.

    Source: SSLVPN IP Pool

    Source Translation: X3 Interface IP

    Destination: 192.168.10.7

    Destination Translation: Original

Answers

  • A_ElliottA_Elliott Enthusiast ✭✭

    Mobile Connect...


    Do you have the SSL-VPN setup on the firewall? Do you have a proper certificate? Do you have the user you're trying to connect with in the SSLVPN group?

  • MustafaAMustafaA SonicWall Employee

    Are you able to make the connection and access the resource from a Windows computer with the same user creds?

  • JohnCHarrisJohnCHarris Newbie ✭

    @A_Elliott I think it is just a self singned cert.

    @MustafaA I can connect with the Global VPN client with those credentials.

  • JohnCHarrisJohnCHarris Newbie ✭

    I did a factory reset and reconfigured it with the same result.

    I have a control zone with static IPs. The router is 192.168.10.1

    I created an IP Pool

    image.png

    Setup the VPN Server:

    image.png
    image.png

    The policy was set automatically.

    Setup a user

    image.png

    I am connecting to the VPN server on 192.168.39.148.

  • MustafaAMustafaA SonicWall Employee

    You need to enable SSLVPN on the WAN zone. Make sure you have the Client Routes configured as well as the VPN Access for the user or group.

  • JohnCHarrisJohnCHarris Newbie ✭

    I enabled the WAN Zone. Now the VPN status is stuck at connecting on my phone.


    image.png


    image.png


    image.png


  • JohnCHarrisJohnCHarris Newbie ✭

    @MustafaA I factory reset the router and ran through the setup again. Now I can connect with my phone, but I can't access an internal website hosted on my control network. The IP I'm trying to connect to is 192.168.10.7. If I connect my laptop directly into that network I can access it.

    Thank you for your helps so far.


    John Harris

    image.png


    image.png


    Screenshot_20230727-123102.png


  • MustafaAMustafaA SonicWall Employee

    Can you do packet capture based on the source IP (given from the SSLVPN IP Pool)?

    Check if the packets are forwarded egress on the correct interface which 192.168.10.7 is part of.

  • JohnCHarrisJohnCHarris Newbie ✭

    I found that the user did not have access to the correct subnet. Here is my packet monitor after fixing that.


    image.png


  • MustafaAMustafaA SonicWall Employee

    It goes out (egress) on the correct interface X3, but looks like there is no response coming back from 192.168.10.7. There could be two reasons I can logically think of.

    1. 192.168.10.7 does not have a default gateway configured.
    2. 192.168.10.7 does have end point protection (eg. Windows Firewall) which blocks the communication coming from a different subnet.
  • JohnCHarrisJohnCHarris Newbie ✭

    That is an industrial network with statically assigned IP addresses. None of the devices have a gateway assigned. Is it possible to connect without a gateway? I could assign an address range on the control network if that would allow communication.

  • A_ElliottA_Elliott Enthusiast ✭✭
    https://community.sonicwall.com/technology-and-support/discussion/comment/18858#Comment_18858

    A device has to have a gateway for layer-3 connections.


    You might be able to do some funky ARP bridging or something, but that's not how I'd do it.

Sign In or Register to comment.