Sonic wall mobile_connect_for_ios_user_guide-rev_b

Using SonicWALL Mobile Connect for
Apple iOS

SonicWALL Mobile Connect for Apple iOS is an app for iPhone, iPod touch, and iPad that
enables secure, mobile connections to private networks protected by SonicWALL security
appliances.
This document contains the following sections:
• “How SonicWALL Mobile Connect Works” on page 2
• “Prerequisites” on page 2
– “Apple Product Support” on page 2
– “SonicWALL Appliance Support” on page 3
– “Required Network Information” on page 3
• “Installing SonicWALL Mobile Connect” on page 4
• “Using SonicWALL Mobile Connect” on page 5
– “Creating a Connection” on page 5
– “Connecting to the Mobile Connect Server” on page 17
– “Configuring SonicWALL Mobile Connect Settings” on page 20
– “Configuring Connect on Demand” on page 23
– “Using the iPhone Configuration Utility with SonicWALL Mobile Connect” on page 25
• “Monitoring SonicWALL Mobile Connect” on page 28
• “Troubleshooting SonicWALL Mobile Connect” on page 30

Using SonicWALL Mobile Connect for Apple iOS 1

How SonicWALL Mobile Connect Works

How SonicWALL Mobile Connect Works
Modern business practices increasingly require that users be able to access any network
resource (files, internal websites, etc.), anytime, anywhere. At the same time, ensuring the
security of these resources is a constant struggle. While most users are aware that they must
take care to protect computers from network security risks, this security awareness does not
always extend to mobile devices like the iPhone, iPod touch and iPad. And yet, mobile devices
are increasingly subject to security attacks. Furthermore, mobile devices often use insecure,
untrusted, public wi-fi hotspots to connect to the Internet. It is therefore a challenge to provide
secure, mobile access while still guarding against the inherent security risks of using mobile
devices.
The SonicWALL Mobile Connect app for iPhone, iPod touch, and iPad provides secure, mobile
access to sensitive network resources. SonicWALL Mobile Connect establishes a Secure
Socket Layer Virtual Private Network (SSL VPN) connection to private networks that are
protected by SonicWALL security appliances. All traffic to and from the private network is
securely transmitted over the SSL VPN tunnel.
To get started with SonicWALL Mobile Connect:
1. Install SonicWALL Mobile Connect from the App Store.
2. Enter connection information (server name, username, password, etc.).
3. Initiate a connection to the network.
4. SonicWALL Mobile Connect establishes a SSL VPN tunnel to the SonicWALL security
appliance.
5. You can now access resources on the private network. All traffic to and from the private
network is securely transmitted over the SSL VPN tunnel.

Prerequisites
The following sections describe prerequisites for SonicWALL Mobile Connect:
• “Apple Product Support” on page 2
• “SonicWALL Appliance Support” on page 3
• “Required Network Information” on page 3

Apple Product Support
SonicWALL Mobile Connect is supported on the following devices:
• iPhone 4S – running Apple iOS 5 or higher
• iPhone 4 – running Apple iOS 4.2 or higher
• iPhone 3GS – running Apple iOS 4.2 or higher
• iPhone 3G – running Apple iOS 4.2 or higher
• iPad 2 – running Apple iOS 4.2 or higher
• iPad – running Apple iOS 4.2 or higher
• iPod touch (2nd Generation or later) – running Apple iOS 4.2 or higher

2 Using SonicWALL Mobile Connect for Apple iOS

Prerequisites

SonicWALL Appliance Support
SonicWALL Mobile Connect is a free app, but requires a concurrent user license on one of the
following SonicWALL solutions in order to function properly:
• SonicWALL firewall appliances including the TZ, NSA, E-Class NSA running SonicOS
5.8.1.0 or higher
• SonicWALL SRA appliances running 5.5 or higher
• SonicWALL Aventail E-Class Secure Remote Access (SRA) appliances running 10.5.4 or
higher

Required Network Information
In order to use SonicWALL Mobile Connect, you will need the following information from your
network administrator or IT support:
• Server name or address – This is either the IP address or URL of the SSL VPN server that
you will connect to.
• Username and password – Typically, you will be required to enter your username and
password, although some connections may not require this.
• Domain name – The domain name of the SSL VPN server. SonicWALL Mobile Connect may
be able to automatically determine this when it first contacts the server, or there may be
multiple domains that can be selected.

DNS Domain Settings on SonicWALL Appliances for Mobile Connect
In order for SonicWALL Mobile Connect users to be able to access the private network, the
network administrator must configure the DNS Domain on the SonicWALL appliance. When the
Mobile Connect user accesses a URL on the private network, the configured DNS domain is
used to resolve the hostname lookup. For public domains that do not match the configured DNS
domain, the DNS server for the wi-fi or 3G network is used.

Note The SonicWALL Mobile Connect user does not need to perform any configuration tasks
related to DNS. The following information is for SonicWALL network administrators.

The DNS Domain configuration process varies, depending on the type of SonicWALL appliance
being used:
• SonicWALL firewall appliances – On the SSL VPN > Client Settings page, enter the
DNS domain name in the DNS Domain field.
• SonicWALL SRA appliances – The DNS domain can be configured either globally, at the
group level, or at the individual user level:
– Global level: On the Network > DNS page, enter the DNS domain name in the DNS
Domain field.
– Group level: On the Users > Local Groups page, click the edit icon for the group. Click
on the NX Settings tab and enter the DNS domain the DNS Domain field.
– User level: On the Users > Local Users page, click the edit icon for the user. Click on
the NX Settings tab and enter the DNS domain the DNS Domain field.


Installing SonicWALL Mobile Connect

• SonicWALL Aventail E-Class SRA appliances – The DNS domain can be configured
either globally or for specific IP address pools:
– Global level: From the main navigation menu in the Aventail Management Console
(AMC), click Network Settings. In the Name resolution area, click Edit. The
Configure Name Resolution page appears. Enter the DNS domain name in the
Search domains field.
– IP address pool level: From the main navigation menu in the AMC, click Services.
Under Access services, in the Network tunnel service area, click Configure. The
Configure Network Tunnel Service page appears. Click the name of the IP address
pool you want to edit. The Configure IP Address Pool page appears. To the right of
the Advanced heading, click the arrow icon. Select the Customize default
settings checkbox and enter the DNS domain name in the Search domains field.

Installing SonicWALL Mobile Connect
SonicWALL Mobile Connect is installed through the Apple App Store.
1. On your iPhone, iPod touch, or iPad, tap on the App Store icon.

2. Go to the Search tab, enter SonicWALL Mobile Connect, and tap Search.
3. In the search results, select SonicWALL Mobile Connect.
4. Tap Free and then Install. The app will install on your device. When installation is complete,
the SonicWALL Mobile Connect icon will appear on your device.

Note If you encounter an error when attempting to download SonicWALL Mobile Connect, please
see iTunes Store Customer Support, where you can find troubleshooting procedures and
instructions on how to report the issue using your iTunes account:
http://www.apple.com/support/itunes/


Using SonicWALL Mobile Connect

The following sections describe how to use SonicWALL Mobile Connect:
• “Creating a Connection” on page 5
• “Connecting to the Mobile Connect Server” on page 17
• “Configuring SonicWALL Mobile Connect Settings” on page 20
• “Configuring Connect on Demand” on page 23
• “Using the iPhone Configuration Utility with SonicWALL Mobile Connect” on page 25

Creating a Connection
The process of creating a Mobile Connect connection is slightly different depending on which
type of SonicWALL appliance you are connecting to. The following sections describe how to
create a connection:
• “Creating a Connection to SonicWALL Firewall and SRA Appliances” on page 6
• “Creating a Connection to SonicWALL Aventail Appliances” on page 11



Creating a Connection to SonicWALL Firewall and SRA Appliances
1. The first time you launch SonicWALL Mobile Connect, you will be prompted to enable VPN
functionality. Tap Enable.

iPhone / iPod touch iPad



2. You will then be presented with the screen to begin your first connection. Tap Add
connection.
– Name: Enter a descriptive name for the connection.
– Server: Enter the URL or IP address of the server.




3. Tap Next. SonicWALL Mobile Connect will then attempt to contact the SonicWALL
appliance. If the attempt fails, a warning message will display, asking if you want to save
the connection.


4. Before tapping Save, verify that the server address or URL is spelled correctly.



5. If SonicWALL Mobile Connect successfully contacts the server, you will be prompted to
enter your Username and Password (unless the server does not require this information).


Note If the screenshots above do not match what is displayed on your device, you are connecting
to a SonicWALL Aventail appliance. Proceed to “Creating a Connection to SonicWALL
Aventail Appliances” on page 11, step 5.



6. The Domain field is auto-populated with the default domain from the server. To select a
different domain, tap on Domain to display a dropdown menu of the available options.


7. Tap Save.



Creating a Connection to SonicWALL Aventail Appliances
1. The first time you launch SonicWALL Mobile Connect, you will be prompted to enable VPN
functionality. Tap Enable.




2. You will then be presented with the screen to begin your first connection. Tap Add
connection.
– Name: Enter a descriptive name for the connection.
– Server: Enter the URL or IP address of the server.




3. Tap Next. SonicWALL Mobile Connect will then attempt to contact the SonicWALL
appliance. If the attempt fails, a warning message will display, asking if you want to save
the connection.


4. Before tapping Save, verify that the server address or URL is spelled correctly.



5. If SonicWALL Mobile Connect successfully contacts the server, you will be prompted to
select which Login Group on the appliance you want to connect to. If you do not know which
Login Group to connect to, contact your network administrator.


Note If the screenshots above do not match what is displayed on your device, you are connecting
to a SonicWALL firewall or SRA appliance. Proceed to “Creating a Connection to
SonicWALL Firewall and SRA Appliances” on page 6, step 5.



6. If the Login Group you connect to is not listed, select Other... to manually type in the group
name.




7. You will then be prompted to enter your Username and Password (unless the server does
not require this information).


8. Tap Login.



Connecting to the Mobile Connect Server
After you save a new connection, the list of all configured connections displays.




To establish a SonicWALL Mobile Connect session, perform the following tasks:
1. Tap on the connection in the list that you want to initiate. The Connection Status page
displays. Tap Connect.


2. Enter your username and password if prompted (depending on whether the SonicWALL
appliance you are connecting to allows for saving usernames and passwords).



3. When the connection is successfully established, the Status changes to Connected.


4. Press the Home button to return to your iPhone, iPod touch, or iPad’s home screen. You
can now navigate to other apps to access your Intranet network. The status bar at the top
of the iPhone, iPod touch or iPad will display a VPN icon to indicate that the session is still
connected.




If the VPN connection is interrupted, the VPN icon will disappear and you will no longer be able
to access the Intranet network. This can happen if your device’s connection transitions from wi-
fi to 3G or to another network type.
Return to SonicWALL Mobile Connect to reestablish the connection. Optionally, you can
configure the Automatic Reconnect option on the Settings tab to have SonicWALL Mobile
Connect automatically attempt to reestablish interrupted connections.

Configuring SonicWALL Mobile Connect Settings
SonicWALL Mobile Connect provides several settings for connection and logging options.


The Settings tab provides the following options:
• Connect on Launch - Sets Mobile Connect to automatically initiate a connection to the
last-used profile when it is launched.
• Automatic Reconnect - Sets Mobile Connect to automatically attempt to reconnect if the
connection is lost. The SSL VPN connection can be disrupted when your device’s
connection transitions to a different network type (for example, from wi-fi to 3G). This
setting lets applications rely on a sustained VPN connection. There is no limit on the
amount of time it takes to reconnect.



• Debug Logging - Enables full debug log messages of Mobile Connect activity. Leave this
setting disabled unless instructed to enable it by SonicWALL support staff.
• Email Logs - Launches an email to send the Mobile Connect log to SonicWALL support
staff. Tap Send to send the email.
There are two additional options that can be modified for connections to SonicWALL Aventail
appliances. To view these options, go to the Connection tab and tap on the Connection line
to bring up the list of connections. Tap on the blue arrow to the left of the connection you
want to modify. The Edit Connection window displays.




The following options can be configured:
• ESP - Enables Encapsulating Security Payload (ESP) to improve the performance of UDP
streaming applications like VoIP and FaceTime. This is enabled by default; however, some
networks may require this option be disabled. ESP requires that UDP port 4500 be open on
the network firewall. If this port cannot be opened, the ESP option should be disabled. Also,
in rare cases where the network environment does not properly implement PMTU discovery
(see RFC 1191), certain applications may run inefficiently or perhaps not at all when using
ESP encapsulation.
• Forget this Login Group - SonicWALL Mobile Connect remembers the Login Group that
you specified when configuring the connection. To change to a different Login Group, tap
Forget this Login Group. The next time you connect to the server, you will be prompted
to select a new Login Group.

Note If these options are not displayed, then you are connecting to either a SonicWALL firewall
or SRA appliance.



Configuring Connect on Demand

Note Connect on Demand is only available for connections to SonicWALL Aventail E-Class SRA
appliances.

The Connect on Demand feature provides the ability for SonicWALL Mobile Connect to
automatically establish a VPN connection when you attempt to access a domain on the private
network. This provides a seamless VPN connectivity experience without the need to manually
launch SonicWALL Mobile Connect.
The easiest way to determine if Connect on Demand is available for your connection is to look
at the Connection tab when a VPN session is active. If a blue arrow appears to the right of the
Status line, as shown in the screenshots below, Connect on Demand is available.


A VPN configuration must meet the following requirements to support Connect on Demand:
• The server must be a SonicWALL Aventail E-Class SRA appliances.
• The VPN tunnel must not be configured for Redirect-All mode.



• The realm must be configured to use client certificates for authentication. Chained
authentication (where a second authentication server is used) does not support Connect on
Demand.
• The valid client certificate for the realm must be present.
• The user must successfully connect to the appliance at least once.
To configure Connect on Demand, perform the following tasks:
1. Tap on the blue arrow in the status line on the Connection tab.


2. Tap on Connect on Demand.
3. Set the Establish Connection option to If Needed to have SonicWALL Mobile Connect
establish a VPN connection when accessing a resource with any of the domain suffixes
listed.
4. Setting the Establish Connection option to Never disables Connect on Demand for the
domain suffixes listed.
5. If more than one domain is listed, you can enable Connect on Demand for individual
domains by tapping on the domain name.



6. Set Always Establish to ON to enable Connect on Demand for that domain.


Using the iPhone Configuration Utility with SonicWALL Mobile
Connect
The iPhone Configuration Utility provides the ability for administrators of enterprise
environments to create configuration profiles for the iPhone, iPod touch, and iPad. These
profiles provide the ability for administrators to preconfigure the device settings for enterprise
policies, such as VPN configuration, security policies, Wi-Fi settings, etc.
The iPhone Configuration Utility enables administrators to configure SonicWALL Mobile
Connect profiles for their users’ iOS devices. The iPhone Configuration Utility can be
downloaded here:
http://www.apple.com/support/iphone/enterprise/



To configure a SonicWALL Mobile Connect profile using the iPhone Configuration Utility,
perform the following steps.
1. Download, install and launch the iPhone Configuration Utility.
2. Click on File > New Configuration Profile.

3. Click on the VPN tab, and then click the Configure button.

4. In the Connection Name field, enter Connection Name.
5. In the Connection Type pulldown menu, select Custom SSL.



6. In the Identifier field, enter the following value:
com.sonicwall.SonicWALL-SSLVPN.vpnplugin
7. In the Server field, enter the hostname or IP address for the SonicWALL appliance.
8. (Optional) In the Account field, enter the username for the account.
9. Under the Custom Data window, click the plus sign to add a key and value.

10. For the Custom Data Key, enter:
LoginGroupOrDomain
11. The value of the Custom Data Value depends on the
– For profiles connecting to SonicWALL UTM or SRA appliances, the Value is the
Domain field that is shown in the Edit Connection window of the SonicWALL Mobile
Connect app.
– For profiles connecting to SonicWALL Aventail appliances, the Value is the value
selected in the Log in to window, when initiating a connection in SonicWALL Mobile
Connect.
12. In the User Authentication pulldown menu, select Password.
13. (Optional for connections to UTM or SRA appliances) In the Password field, enter the
password for the user account, if the SonicWALL appliance you are connecting to is
configured to allow for saving passwords. Note that only SonicWALL UTM or SRA
appliances can store passwords. SonicWALL Aventail E-Class SRA appliances cannot
allow for stored passwords.
14. (Optional for connections to Aventail E-Class SRA appliances) If a proxy server is used for
the connect, in the Proxy pulldown menu, select either Manual or Automatic. If a proxy
server is not used, leave this set to None. Note that only SonicWALL Aventail E-Class SRA
appliances support SonicWALL Mobile Connect over proxy. Currently, SonicWALL UTM
and SRA appliances do not support Mobile Connect over proxy.


Monitoring SonicWALL Mobile Connect

The Monitor tab displays additional details about the connection, statistics on traffic
transmitted, DNS information, and routes that have been installed.




The About tab of SonicWALL Mobile Connect displays the version number and legal text.



Troubleshooting SonicWALL Mobile Connect

Troubleshooting SonicWALL Mobile Connect
If you are unable to connect to the SonicWALL server, perform the following steps to
troubleshoot the connection.
1. Double check that you have entered the server name properly in the connection
configuration.
1. Go to the Safari browser on your iPhone, iPod touch, or iPad and attempt to navigate to the
SSL VPN appliance web portal.
2. If you are unable to load the web portal, the problem is with the SonicWALL appliance.
Contact your network administrator if the problem persists.
3. If the web portal loads successfully on the Safari browser and you still cannot establish a
SonicWALL Mobile Connect connection, notify SonicWALL support, as follows:
a. On the Settings tab, enable the Debug Logging option.
b. Attempt a connection to the server again to ensure that full debugging messages are
logged for the attempt.
c. Then return to the Settings tab and tap the Email Logs button. An email will launch in
your mail client with the SonicWALL Mobile Connect log attached. Add any additional
comments to the email and tap Send. SonicWALL support staff will contact you after
reviewing your case.

Trademarks
SonicWALL and Mobile Connect are registered trademarks of SonicWALL, Inc.
iPhone, iPod touch, and iPad are trademarks of Apple Inc.

30 Using SonicWALL Mobile Connect for Apple iOS 232-001142-00_Rev_B

Sonic wall mobile_connect_for_ios_user_guide-rev_b

More Related Content

What's hot (8)

Viewers also liked (15)

Similar to Sonic wall mobile_connect_for_ios_user_guide-rev_b (20)

More from PRONETIS (20)

Recently uploaded (20)

Sonic wall mobile_connect_for_ios_user_guide-rev_b