2

I've inherited a Sonicwall TZ-210 (SonicOS Enhanced 5.5.20-3o) firewall running a multiple interface config:

1st Interface: Running LAN (data network) 2nd Interface: Running PBX network (voice network)

I've disabled some NAT settings for the PBX server, and now the server (on X5) cannot communicate with the internet, nor is it reachable from X1. I've tried re-enabling the NAT policies and restarting the server, however there is still no luck.

Additionally, there is no status for the voice network (X5) as indicated in the screenshot below.

Sonicwall Interface setup, why is there no status for X5?

Question: How can I allow internet and access from X1 (WAN) to all of X5 interface or just the PBX server running on X5?

Here are the NAT policies: enter image description here

..and here are the Routing policies: enter image description here

Thanks!

Improve this question
23
  • 1
    Noah, it's hard to give you a specific answer without seeing your configuration. If you could post some more details, we could probably help you. You are obviously missing NAT or FW policies to allow the traffic you want. but without seeing your configuration or topology, it's difficult to say what they should be.
    – Ron Trunk
    Feb 10, 2014 at 12:50
  • Also, are you running SonicOS Enhanced or standard? This will help clarify where settings are in your configuration
    – Mike Naylor
    Feb 10, 2014 at 14:43
  • @Ron and Mike, thanks for getting back to me! I've updated the question with some screenshots that may help. The TZ-210 is running SonicOS Enhanced. I've also noticed that there is no interface status for X5 as outlined in the 1st screenshot, is this normal? The NAT policies screenshot (not sure if this helps), shows the active NAT policies. I've disabled and removed policies for the PBX server in X5. So now, how do I enable the policies of forwarding to the server in X5?
    – Noah
    Feb 10, 2014 at 19:47
  • If x5 is showing 'No Link' then I'd look into resolving that first. Especially if there is a connection present. The NAT policy is not terribly difficult if you have the Address Object setup for your server and Service objects configured for the ports needed. Verify the connection on x5, the Server is in the Address Objects List and the services are available first. Once that is done we can work on the policies.
    – Mike Naylor
    Feb 10, 2014 at 19:53
  • Just posted an answer with a quick and dirty on creating the NAT rule. Also, word of advice from an ongoing support case: Don't upgrade to Sonic OS 5.9 if you have multiple IPs on a single NIC that will hit more than one interface, ie. a NIC with a 10.20.70.x and 10.20.71.y IP configured. The 5.9 and newer firmware does not support this configuration.
    – Mike Naylor
    Feb 10, 2014 at 20:09

1 Answer 1

Reset to default
1

With the Sonicwall Enhanced OS you can define Address Objects and Service objects to make management much simpler. First, make sure your host or server is listed as an Address Object under Network -> Address Objects. Then move on to Network -> Services to add your services you wish to route. Note that you can add individual services and put them into groups. This makes it simpler to route items based on individual ports or port groups.

Once your Address Object and Services are ready, go to the Firewall->Access Rules and make sure you Allow the service(s) you wish to route from the WAN to LAN zones. Now that you've allowed the traffic you can go to Network -> NAT policies and click Add at the top. Here you will use the Address Object and Service/Service group that you created.

Sample NAT Policy

Above you see that the source is ANY allowing all external IPs, the Translated Source keeps the original information, the Original destination is your WAN IP of your WAN interface, the Translated Destination is your target host, and the Original Service is the ports you wish to map to that target server. You can translate the services if you like, for instance routing port 3390 to 3389 for RDP on a machine to avoid registry hacks but ensure you have a reverse rule enabled for the outbound path. You can also define which interfaces this policy is bound to if you like, so for your example the Inbound would be x1 and Outbound x5.

This should allow you to point to your external IP for these services via x.x.x.x:port and route to the target server.

EDIT:

For the internal routing under Network-->Zones choose LAN and check the box for Allow Interface Trust. This should allow traffic to flow between interfaces. Keep in mind this does open all LAN interfaces to share traffic so any segmentation that is currently configured may be broken. If you do not wish for all traffic to be trusted between interfaces then do not use this option.

For specific LAN routing you can manually add a route from x5 subnet to x0 subnet over any service with the local gateway (0.0.0.0) and use the x0 interface. If you wish to route directly to an individual host then select it as your Destination instead of the x5 Subnet. Make sure that there is a converse rule to allow traffic from that host to the x0 subnet as well.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.