10
S
ONIC
WALL S
ONIC
P
OINT
A
DMINISTRATOR
’
S
G
UIDE
:
facilitate recovery from compromised states of operation. When the SonicPoint is operating in
SafeMode, it will be possible to upload a new firmware image using FTP. This is different from
SonicOS devices which use an HTTP POST for firmware uploads. Under normal conditions, it will not
be necessary to manually update firmware using with FTP on the SonicPoint. SonicPoint firmware is
embedded within SonicOS and updates are automatically performed while operating in Managed
Mode as part of the auto-provisioning process.
Operating in Managed Mode requires L2 connectivity to a security appliance interface assigned to a
Wireless Zone. The Wireless Zone type has certain unique characteristics:
•
Additional configuration tabs for 'Wireless' and 'Guest Services'. The 'Wireless' and 'Guest
Services' tabs have the following default settings:
WiFiSec Enforcement Enabled.
Require WiFiSec for Site-to-Site VPN Tunnel Traversal.
Trust WPA traffic as WiFiSec.
SonicPoint Provisioning Profile set to 'SonicPoint.'
Wireless Guest Services Disabled.
•
Enforces that all traffic that enters the zone arrive from a SonicPoint. All other traffic will be
dropped (i.e. traffic from wired network systems, or wireless traffic originating from a non-
SonicPoint device). You cannot use a third-party wireless Access Point device in a Wireless Zone.
•
The only Zone type on which SDP and SSPP operate.
•
The only Zone type on which Guest Services, and WiFiSec enforcement is available.
•
The size of the subnet mask will vary with the number of SonicPoint devices available. For more
details on this, see the following section.
•
A DHCP scope will be activated on Wireless Zones, and based on the platform, the top range of
addresses will be reserved for SonicPoints. Refer to the table on page 3 for platform specific
numbers.
•
The IP Address assigned to the Wireless Zone interface may not conflict with the SonicPoint
address reservations described above (for example, for a /24 subnet on a PRO4060, the assigned
address must be .238 or below).
•
The WLAN GroupVPN (the default Wireless Zone) will NOT be activated by default, due to the fact
that an interface must first be added to correctly auto-create Access Rules. The WLAN GroupVPN
must be manually activated, and upon activation will employ the following WiFiSec optimized
default settings:
HTTP and HTTPS Management using this SA Enabled.
Require authentication of VPN clients using XAUTH.
User Group for XAUTH Users set to Trusted Users.
Cache XAUTH User Name and Password on Client set to Single Session.
Allow Connections to All Secured Gateways.
Set Default Route as this Gateway.
Note: In SonicOS Enhanced, WLAN is the default instance of the Wireless zone type. You can modify
the WLAN zone or create a new zone of the Wireless type.
When in Managed Mode, operating parameters for SonicPoint units will be controlled by the peered
SonicWALL security appliance. If a security appliance discovers a SonicPoint for which it has no
stored configuration, it will consider that SonicPoint to be unprovisioned, and it will use the Zone’s
assigned SonicPoint Profile to auto-provision the SonicPoint. This can occur in the following cases:
•
The SonicPoint had never been previously provisioned.
•
The SonicPoint had been provisioned, but was manually deleted using the SonicOS GUI.
•
The SonicPoint was provisioned by one security appliance, and then moved to a different security
appliance that contains no stored configuration for that SonicPoint.
