Security – How to control remote access to Sonicwall VPN beyond passwords

It may be small comfort, but it’s working for us. The server is Windows Server 2003 R2 and the SonicWALL has SonicOS Enhanced 4.2.0.1-12e.

Here are the settings:

• Authentication method for login: LDAP + Local Users
• LDAP Server tab:
  • Chose “Give bind distinguished name”
  • Bind distinguished name: sonicwall_ldap@OURDOMAIN.local (a user we created to allow the SonicWALL to read LDAP)
  • Use TLS (SSL) checked
    • Send LDAP ‘Start TLS’ request: checked
    • Require valid certificate from server: unchecked (we use a self-signed cert)
    • Local certificate for TLS: None
• Did not configure RADIUS as a fallback.

Now, before your logins will work you have to go to the Directory tab and click “Auto-configure.” If auto-configure fails, make sure the SonicWALL’s LDAP username and password (e.g. sonicwall_ldap@OURDOMAIN.local) is correct.

After doing auto-configure make sure “Trees containing user groups:” includes the section of your AD tree that has the users who will be logging in. Once you do that, on the “Test” tab you should be able to test with:

• User: username (Note:**AD domain name should **not be included in the username because the SonicWALL will search the user contexts that were specified on the Directory tab).
• Password: (their password)

There is a limit on the number of licensed VPN connections. By default, ASA 5505 has 2 SSL VPNs and 10 “remote access” VPNs. Which of these two limits applies when the CISCO VPN client is used? Note that 10 is enough for us, however 2 isn't.

The standard Cisco VPN client is IPSEC, and uses a "remote access" VPN license. The SSL VPN is a clientless VPN and not worth much, unless you purchase the AnyConnect SSL VPN licenses

VPN connection limit is floating (=currently used) or named (per-assigned-user)?

VPN licenses are per VPN peer, and for a mobile access setup it's "concurrent connections."

Is it really possible to utilize certificate-based authentication for VPN connection and will it work with a Windows-based Certification Authority?

I don't know the answer to this for sure, but my gut feeling is "yes."

Yes, Microsoft CA supported.

Are there any viable, more cost-effective alternatives to ASA 5505 for Location 2, providing same security, similar routing capabilities? Integrated WiFi access point is a plus.

I connect Cisco ASAs to various other firewalls via Site to Site IPSEC VPNs quite frequently, so anything that supports the IPSEC VPN standard would be an alternative for site 2.