Solution to your SonicPoint WLAN woes.

| Saturday, February 12th, 2011 | 57 Comments »

I recently blogged an article on how to quickly and easily configure a SonicPoint with your SonicWALL firewall. If you haven’t read it, you can read it here before reading further. If you have read it, keep on reading!

Below is an example of a typical but small deployment utilizing a SonicPoint for wireless access.

Small Network Deployment

Small Network Deployment

As you can see, it’s pretty straight forward. Your LAN users are connected to the X0 port(LAN zone) and your SonicPoint is connected to the X6 port(WLAN zone).

This kind of scenario assumes that your firewall and SonicPoint are in close proximity with one another.

The Problem

There are times where the firewall is in one location, but placement of the SonicPoint is well out of range of your firewall. Below are two scenarios where your Sonicpoint is in another location.

Scenario#1: In this scenario, the firewall is on the first floor while the SonicPoint is somewhere around the 5th floor. You only have one feed that is already connected to the LAN zone.

Scenario #1

Scenario #1

Scenario#2: In this scenario, the SonicPoint is in a completely different building!

Scenario #2

Scenario #2

I want to explain why this causes a problem with the SonicPoints. The SonicPoints need a direct connection to the WLAN zone. So if X6 is assigned to the WLAN zone, that means that your SonicPoint needs to connect to that port.  If you’re on the 5th floor, or in another building, how can you connect to it?! You can’t run another cable from X6 all the way up to the 5th floor(well I suppose you can but it would be costly) or run another feed to the other building.(again, costly)

You may also think, why not just connect the SonicPoint to the same LAN zone as everyone else, can’t the SonicPoint just obtain an IP address from the LAN zone like everyone else and then broadcast its own wireless traffic? Nope!

SonicPoints use the SDP protocol. It’s a layer-2 broadcast that helps automatically provision SonicPoints. Here’s some info on how SDP works.

  • Advertisement – SonicPoint devices without a peer will periodically and on startup announce or advertise themselves via a broadcast. The advertisement will include information that will be used by the receiving SonicOS device to ascertain the state of the SonicPoint. The SonicOS device will then report the state of all peered SonicPoints, and will take configuration actions as needed.
  • Discovery – SonicOS devices will periodically send discovery request broadcasts to elicit responses from L2 connected SonicPoint units.
  • Configure Directive – A unicast message from a SonicOS device to a specific SonicPoint unit to establish encryption keys for provisioning, and to set the parameters for and to engage configuration mode.
  • Configure Acknowledgement – A unicast message from a SonicPoint  to its peered SonicOS device acknowledging a Configure Directive.
  • Keepalive – A unicast message from a SonicPoint to its peered SonicOS device used to validate the state of the SonicPoint.

The Solution

So what is the solution when you only have one feed?

  1. VLAN’s
  2. Trunking

VLAN’s

Up until SonicOS 5.6, only the NSA class series had the ability to create VLANs. Basically sub-interfaces, or virtual interfaces. With the new release of SonicOS 5.8, SonicWALL is now giving you access to VLAN’s on lower end firewalls, such as the TZ series. What this means is that you now have greater flexibility with your TZ series that once were only available to higher end models!

The trick is to create a new sub-interface off of X0.(LAN zone) But when you create this sub-interface you must assign it a separate VLAN ID and zone. The default VLAN is 1. So we can’t use that. So we’ll use VLAN 10(it can be any number lower than 4095). The zone will be WLAN! How can you have WLAN within the LAN zone?

The rules for SonicWALL zones is that a “zone” cannot be apart of two or more interfaces. So it can only belong to one interface. But by creating a sub-interface, SonicWALL treats the sub-interface as a virtual interface with all the same properties as a real physical interface. This means that the sub-interface can be a separate zone, effectively tricking the SonicWALL!

Check it out!

Creating the VLAN (sub-interface)

Creating the VLAN (sub-interface)

Trunking

It doesn’t stop there though! You cannot just plug the SonicPoint into X0 port and expect it to work. The SonicPoint cannot form a trunk! If it can’t form a trunk, then only the default, native VLAN traffic can pass through, and that is VLAN 1, the LAN zone traffic. This means your SonicPoint will not automatically provision itself with SDP.

What you will now need to do is trunk your X0 port(LAN zone) to a switch that understands trunking. In my example, I use a Cisco 2960G switch. The 2960G switch only supports the 802.1Q protocol so it makes creating the trunk a lot easier.

Below I connect the X0 port on the SonicWALL firewall to the GigabitEthernet 0/1 port on the Cisco 2960G switch.

TZ 210 to 2960G

TZ 210 to 2960G

Configure the switchport for trunking and verify.

Switchport Trunk Configuration

Switchport Trunk Configuration

Switch Trunk Verification

Switch Trunk Verification

As you can see, G0/1 is now trunking with SonicWALL’s X0 port.

This means that now you can carry multiple VLAN traffic. The native VLAN and the newly created VLAN 10 are being carried to the Cisco 2960G switch. The final task is to now assign a switchport to VLAN 10 so that the SonicPoint can connect directly to it. Below, I assign GigabitEthernet port 20 to VLAN 10.

Assign port 20 to VLAN 10

Assign port 20 to VLAN 10

As soon as I connected the SonicPoint to port 20, it automatically provisioned and started broadcasting!

SonicPoint Operational

SonicPoint Operational

Notice what the interface says. It is seen as X0:V10. The X0 indicates the X0(LAN zone) and the V10 indicates your VLAN ID: 10, but the SonicPoint thinks it is connected to the WLAN zone  because it doesn’t know any better!

Hope this offers you some ways to continue to use your SonicPoint(s) in your environment. For the multiple building scenario, it’s basically the same concept. Just make sure that the switches you are using to connect to one another are trunked, and that you assigned the proper port to the correct VLAN.

Comments and feedback are welcomed! Thanks again for reading!

Share

Tags: , , , , , , , ,
Posted in Networking, Sonicwall

Newer Comments →

  • Pingback: Tweets that mention BrandonTek » Blog Archive » Solution to your SonicPoint WLAN woes. -- Topsy.com

  • Ronald McCormick

    I would love to see a quick how-to for doing virtual access points with a Cisco switch in a similiar configuration

  • http://twitter.com/brandontek Brandon Kim

    That is not a bad idea. Need to see what kinda of WAP’s Cisco has out now. Definitely won’t be getting any kind of WLC anytime soon, that would be one very expensive lab!

  • Pingback: Sonicpoint Setup To Access From WLAN Zone to LAN « Vin's Mostly Admin Blog

  • Anonymous

    Please make clear that the Virtual Access Point functionality cannot be used with the setup above.
    Possibly it could if you make the SonicPoint switch-port an untagged member for de VAP VLANs.
     
    Regards,
    George.
     
    http://www.totalsecure.nl – SonicWALL Experts
     

  • http://twitter.com/brandontek Brandon Kim

    Hi, thanks for the tip, let me look into this as this sounds like a very important feature!!

  • Pingback: BrandonTek » Blog Archive » SonicWALL-on-a-Stick

  • Anonymous

    I came across this post and comments, and this looks similar to a situation that I have.

    I have an NSA240 with (2) SonicPoints that use Virtual Access Points to provide employee & guest access in the main building.  We’ve recently taken over some space in a nearby building that we’ve connected with an ISP provided metro fiber connection (private LAN).

    Thus, we have two buildings connected as though they are on the same LAN.  Yet, at the remote building there is not a way to connect a remote SonicPoint to the local WLAN port.  So, I want to use a VLAN.

    With the Virtual Access Points and Sonicwall based VLAN IDs, it seems that there may be a conflict.

    Is what I’m trying to do even possible?

  • http://twitter.com/brandontek Brandon Kim

    Hey there,

    You mentioned that the two buildings are connected as “though” they are on the same LAN. Can I get confirmation that they are utilizing the same IP addressing scheme on the LAN? Or is there routing in place somewhere that is sending two different LAN networks to each other? Basically, what’s the addressing at each location?

    There are other methods to getting your SonicPoint to work on the LAN with or without utilizing VLAN’s and sub-interfaces. This article just touches up on one of the options.

    If you could provide a little bit more info on your setup, we can look at resolving this issue for you.

  • Anonymous

    Yes, in fact, the two locations are on the same subnet.  The metro ethernet service utilizes fiber and some private routing (via the ISP since it utilizes their network).  So we just plug a cat6 cable into our switches on both sides, and they are connected.  3mb now with the ability to pay more for faster connection.

    I can check with the ISP to see if the metro ethernet connection will pass VLAN tags.  My hope is that it will, but I’m not 100% sure.

  • http://twitter.com/brandontek Brandon Kim

    Let me know what your ISP says regarding the VLAN tagging. Are you running 5.8 on your NSA240? I have spoken with SonicWALL engineers and development team and I believe that there are changes in the way they will handle SonicPoint’s SDP protocol in the near future. I think specifically to address these kinds of issues.

    In any event, I’m sure we can devise a solution.

  • Anonymous

    I have confirmed that the Metro-Ethernet will pass VLAN tags.

  • http://twitter.com/brandontek Brandon Kim

    Good to hear! I was able to lab up a possible scenario for you but ran out of time to finish. I was able to get the SonicPoint to work through the sub-interface using VLAN ID 10. (like my lab above)
    Then trunk the X0 interface to a switch.
    Then take a port on that switch and assign it to VLAN 10 and put the SonicPoint on it. It will communicate with the SonicWALL. I was able to get a laptop to connect to the SonicPoint and even reboot the SonicPoint from the firewall, so communications is not a problem. I am also able to ping the SonicPoint from the LAN zone.

    You should try this locally first within your LAN in the same building. Once you can confirm it works. Then make sure your switches between the two buildings are trunked together so that they can carry multiple VLAN’s.

    Then assign a port to VLAN 10  (or whatever VLAN you gave the WLAN) to a port on the switch in the other building.

    I need more time, perhaps this weekend to thoroughly go over it but hopefully what I wrote makes sense and you can try to give it a shot….

    The key is creating the WLAN sub-interface off X0. Then trunk to your switch. Then edit your VAP configuration, choose the newly created VLAN ID.

  • Anonymous

    Instead of finding a nice cinderbrick wall to go pound my forehead I figured I would run this by you.  The scenario: I have a Sonicwall firewall and two, soon to be three Sonicpoint access points.  Currently I have the Sonicpoints on separate interfaces but I want to be able to feed them off the main LAN interface so that I can place them anywhere on my network without having to do home runs back to the data center.

    I have configured the Sonicwall as per your instructions to provision Sonicpoints on VLAN 10 and have confirmed with Sonicwall support that my configuration is correct (I did have to get bumped up to second tier as first tier told me it was impossible). The Sonicwall is connected to port g45 on the switch and the Sonicpoint to port g43.  This is the running config:

    interface ethernet g3
    switchport mode trunk
    exit
    interface range ethernet g(41,45)
    switchport mode general
    exit
    vlan database
    vlan 10
    exit
    interface ethernet g43
    switchport access vlan 10
    exit
    interface ethernet g45
    switchport general allowed vlan add 10
    exit
    interface vlan 10
    name Sonicpoint
    exit
    voice vlan oui-table add 0001e3 Siemens_AG_phone________
    voice vlan oui-table add 00036b Cisco_phone_____________
    voice vlan oui-table add 00096e Avaya___________________
    voice vlan oui-table add 000fe2 H3C_Aolynk______________
    voice vlan oui-table add 0060b9 Philips_and_NEC_AG_phone
    voice vlan oui-table add 00d01e Pingtel_phone___________
    voice vlan oui-table add 00e075 Polycom/Veritel_phone___
    voice vlan oui-table add 00e0bb 3Com_phone______________
    iscsi target port 860 address 0.0.0.0
    iscsi target port 3260 address 0.0.0.0
    interface vlan 1
    ip address 10.1.10.47 255.255.255.0
    exit
    ip default-gateway 10.1.10.1
    username admin password 7d02e23eb3d8c04518b9f027ea1fa26b level 15 encrypted
    snmp-server community Dell_Network_Manager rw view DefaultSuper
    clock timezone -5
    clock summer-time recurring usa

    Default settings:
    Service tag: xxxxxxxxx

    SW version 2.0.0.35 (date  27-Jan-2009 time  18:13:34)

    Gigabit Ethernet Ports
    =============================
    no shutdown
    speed 1000
    duplex full
    negotiation
    flow-control off
    mdix auto
    no back-pressure

    interface vlan 1
    interface port-channel 1 – 8

    spanning-tree
    spanning-tree mode STP

    qos basic
    qos trust cos
    Am I missing something obvious?  The Sonicpoint does not get provisioned.
    Thanks in advance for any help

  • http://twitter.com/brandontek Brandon Kim

    Oh yes, the joys of level 1 support!! Hey, they are only trying to do their jobs, but to say it’s impossible is incorrect. That is where they need to draw the line if they are unsure….

    What you are looking to do is doable, as my blog has shown. The issue probably lies more with the switch, and I’m going to have to go with the assumption that your Sonicwall is configured properly since Level 2/3 said so.

    The switch configuration is a little odd, it says that you created a trunk on “ethernet g3″ I’m not sure how port g3 has any role in this since the only two ports I’m aware of are “g45″ and “g43″.

    “g45″ is connected to your firewall, so that port needs to be in “trunk mode”. That will carry all your VLAN’s. Don’t worry about setting any “allowed vlan add 10″ type entries, just make it carry all VLAN’s.
    When you start specifying which VLAN’s to add, you can run the risk of not properly including all VLAN’s.
    So say you wanted VLAN’s 10 and 20 but you specified “add vlan 10″, it will only allow VLAN 10, which is what you may not want since VLAN 20 will not be included!!

    In any event, “g43″ configuration looks correct.

    I would start over by clearing the switch. Make “g45″ a trunk port and that’s it. Don’t specify any vlans.
    Make “g43″ part of VLAN 10 which you did correctly.

    Last but not least, I’m not familiar with the “switchport mode general” command but that doesn’t look correct so leave that part out.

    In short, it should look something like this. (what kind of switch are you using?)

        interface ethernet g5
        switchport mode trunk
        exit
        vlan database
        vlan 10
        exit
        interface ethernet g43
        switchport access vlan 10
        exit
        interface vlan 10
        name Sonicpoint
        exit

  • Anonymous

    Thanks. g3 was a leftover from where I messed up – I had that originally connected to teh firewall and was messing around with tagged and untagged and locked everybody out of the firewall.  I am planning on trying your suggestions this weekend so I don’t interrupt work again.  I will let you know how I make out.

  • Anonymous

    Ok – It worked! I also discovered that the Sonicpoints would not connect to a port on the Dell Powerconnect 5448 that was set to autonegotiate – had to force to 100BaseT and then it all came up! Thanks a bunch

  • http://twitter.com/brandontek Brandon Kim

    Excellent! That’s what I wanted to hear. Good job!

  • http://twitter.com/oscarkapac Oscar Kapac

    Hi,
    Thanks for you article.
    We use multiple SSID and VAP (on Sonicwall and Sonicpoint) quite a lot in my company, but actually, we are facing a problem in 2 different sites…
    The configuration works perfectly when there is only one switch, but we have 2 cases where we have 2 switch (Dlink DGS3100-48) between a NSA2400 in a case and a 4500 in the other case, and the sonicpoints.

    I spent hours on the phone with Dlink and Sonicwall supports, trying a lot of config, trunking Vlans, untrunking Vlans, tag or untag ports,… but it still not work and the sonicpoints which are after the second switch desesperatly cannot communicate with the Sonicwall…

    depending of configurations, they are constantly rebooting or non-responsive…

    If any one already got this problem and have a solution, or any clue, i’m interested.

    Thanks.

    Al.

  • http://twitter.com/brandontek Brandon Kim

    Hey Oscar,

    Thanks for finding my blog. It’s always difficult when you’re missing different switching vendors. I don’t know much about the DLINK switch and we as IT guys are always at the mercy of different vendors working well together.

    You mentioned that you were on the phone with SonicWALL support. So does that mean that what you are attempting to do is SUPPOSE to work? Otherwise, SonicWALL wouldn’t spend all that time trying to help you out.

    When dealing with VAP’s it does get tricky and I have had issues myself so you may not be the only one. If you can upload an image or diagram it would help me in understanding what you are trying to accomplish. I’m just not sure how you are connecting your switches to your SonicWALL and how you are plugging your Sonicpoints.

    Also make sure you are using the latest firmware, 5.8. At least we know that you are starting off with the best of the best firmware…

  • Anonymous

    Brandon, I was curious if you have run into the situation I am in and if you know the proper configuration. I am currently running a SW NSA 2400 attached to a Cisco Catalyst 3560 switch which as my SonicPoints connected to it. I have been charged by my betters to setup both a guest wireless and an internal wireless network without purchasing additional hardware. Unfortunately all 4 sonicPoints are required to cover the entire building. Is it possible to setup two SSIDs, one Internal and one for guest using the same Sonicpoints? I have setup the switch and sonicwall to the best of my knowledge but thus far have only been able to get one or the other working at the same time.

  • http://twitter.com/brandontek Brandon Kim

    Hi Aaron,

    Have you looked into VAP’s? Virtual Access Points. You should be able to create different profiles with SSID’s, this will allow you to create guest networks, private networks etc etc…

    The Sonicpoints can support multiple SSID’s. You may want to upgrade your firmware if you’re behind. I’ve been running on 5.8.1 with no problems….

  • Anonymous

    Brandon,

    Thank you for your quick reply. Currently I have the 4 APs setup in a VAP group (VAP Group 1. I have both SSIDs setup (Corporate and Guest) but so far only the Corporate one will work. Both SSIDs are visibile to the client and I can connect toto the Corporate . However, when attempting to connect to the Guest wireless the client will acquire an IP. I’ve confirmed that DHCP is configured and enabled. Using packet monitor on the SonicWall for the VLAN which is vlan 20 for the guest shows no traffic via IP protocol.

    The current configuration is as follows

    The 4 APs (SonicPoints) are hooked into the Cisco switch in ports 24,26,28 and 30. Port 22 from the switch is setup up as a trunk and is going to X5 on my SonicWall.
     
    -Aaron

  • http://twitter.com/brandontek Brandon Kim

    Interesting. What exact firmware are you running on your firewall and the sonicpoints?

    Also, can you confirm that the trunking is working? What does “show interface trunk” display on your Cisco switch?

    I also need to know the Sonicpoint models. I think older models have some limitations.

  • Anonymous

    Brandon,

    The firewall is a SonicWall NSA2400 running 5.8.0.2-37o firmware.
    The SonicPoints are AVC13-07C SonicPointNA

    A show interface trunk results in

    Port        Mode         Encapsulation  Status        Native vlan
    Fa0/2       on           802.1q         trunking      1
    Fa0/22      on           802.1q         trunking      1

    Port        Vlans allowed on trunk
    Fa0/2       1-4094
    Fa0/22      1-4094

    Port        Vlans allowed and active in management domain
    Fa0/2       1-4,12,26,241
    Fa0/22      1-4,12,26,241

    Port        Vlans in spanning tree forwarding state and not pruned
    Fa0/2       1-4,12,26,241
    Fa0/22      1-4,12,26,241
    sw-sac-12#sw-sac-12#show interface trunk

  • Anonymous

    Brandon,

    It appears that the Cisco switch is not passing VLAN information. Nothing from my guest wireless is getting to the sonic wall. I had SonicWall support confirm my settings yesterday.

  • http://twitter.com/brandontek Brandon Kim

    Hey Aaron,

    Sorry for the delay. I have been hammered the last week or so with some work.

    I noticed that your switch has two trunks. One is on port 22 and the other is on port 2. What is port 2 all about, since I know that port 22 goes into your X5 interface.

    Also, please run this command on all your 4 ports so I can see how they are configured.

    “show run int fa0/24″
    “show run int fa0/26″
    “show run int fa0/28″
    “show run int fa0/30″

     If I get some time this weekend I will see if I can replicate your setup.

  • Anonymous

    Port 2 is trunking to another of our switches. This was configured before I came board. I’m not really using it for anything.

    sw-sac-12#show run int fa0/24
    Building configuration…

    Current configuration : 58 bytes
    !
    interface FastEthernet0/24
     switchport mode access
    end

    sw-sac-12#show run int fa0/26
    Building configuration…

    Current configuration : 58 bytes
    !
    interface FastEthernet0/26
     switchport mode access
    end

    sw-sac-12#show run int fa0/28
    Building configuration…

    Current configuration : 58 bytes
    !
    interface FastEthernet0/28
     switchport mode access
    end

    sw-sac-12#show run int fa0/30
    Building configuration…

    Current configuration : 58 bytes
    !
    interface FastEthernet0/30
     switchport mode access
    end

  • http://twitter.com/brandontek Brandon Kim

    First issue is that your ports aren’t assigned to any VLAN’s. What are the VLAN’s you created for your different wireless networks?

     

  • Anonymous

    Brandon,

    I actually got it resolved. I ended up setting fa0/24,26,28 and 30 to trunk mode. This resolved the issue.

  • http://twitter.com/brandontek Brandon Kim

    Exactly! Good job. That was why I wanted to see how your switchports were setup. Orginally they were not applied to any VLAN. But since the Sonicpoints were carrying different VLAN tags for each of your SSID’s, those ports would need to be trunked.

    In any event, good job!
     

  • Anonymous

    Brandon,

    Thank you! I never would have solved it without your help. Your questions got me thinking along the correct lines. Thanks again!

  • http://www.webhostings.in/ web hosting in india

    Above all the points are explained very clearly.You have done a great job by sharing this informative post. I would like to appreciate your good work and also would like to encourage you to keep it up.

  • Anonymous

    Thanks! I really appreciate the comments!

  • Paul Owen

    Hi Brandon,

    I came across your website as I’m trying to set up exactly what you’ve described here, and other of your pages have pointed me in the right direction. However, we use HP Procurve switches and I’m banging my head against a wall trying to getting the wireless working. Our firewall is an NSA3500 and I’m trying to deploy Sonicpoint Ne APs.

    I’ve created two sub-interfaces of X0 on the Sonicwall: V50 for a guest WLAN and V100 for a private WLAN (I’ve also obviously set up the VAPs as well), and I’ve created two VLANs on the Procurve (50 & 100)

    The X0 LAN interface from the NSA3500 connects to port B1 on the Procurve
    B1 is ‘untagged’ in the default VLAN and ‘tagged’ in VLANs 50 & 100 (if I ‘tag’ it in the default VLAN, no-one can talk to the firewall).

    For initial testing I’ve added one other port (F24) which is ‘tagged’ in VLANs 50 & 100. I’ve tried both tagged and untagged in the default VLAN, but whatever I try, I can’t seem to get the Sonicpoint to provision.

    I nkow your blog is Cisco centric, but wondered if you can offer any comment as what I’m doing wrong. Any advice will be massively appreciated.

    All the best,
    Paul

  • http://twitter.com/brandontek Brandon Kim

    Hi Paul,

    Thanks for finding my blog. You should be able to accomplish what you are attempting.

    HP has a different definition for “trunking” so make sure that B1 on your HP is properly carrying VLAN’s to the SonicWALL. I remember trying to setup “trunking” on an HP switch for HOURS, only to find out that their definition of “trunking” is basically port aggregation. Nothing to do with carrying multiple VLANs.

    What I would do is go back to basics, forget about the AP’s. Put two PC’s on both VLANs 50 and 100 with the proper IP addressing for each VLAN and see what their behavior is.

    If you get the expected behavior, then throw the AP’s in to the mix… and see what happens..

  • Tom Lyczko

    Hello, I just discovered this — I am in exactly the same pickle. :)

    Being quite new to SonicWalls etc. I don’t understand what IP I should give to the sub-interface since I cannot direct-connect the SonicPoint to the NSA3500 *except* like in your other blog article.

    Should I follow the other blog article first and attach the SonicPoint to the NSA3500 first so it can get some sort of IP address??

    Then for the HP switch upon which I created a VLAN #100 I should tag the X0 port with that VLAN??

    Thank you, Tom

  • Tom Lyczko

    Does anyone reading this know of other good writeups about setting up SonicPoints?? Particularly to HP switches??
     

  • http://twitter.com/brandontek Brandon Kim

    Hey Tom!

    Because I’m not that proficient with HP switches and they tend to twist terminologies. Be careful of what they call “Trunking” as that is not what you want to do. Trunking to them is port aggregation.

    Whatever setting is in the switch, you want to make sure it carries VLAN’s. I always try to simplify. First remove the Sonicpoints out of the equation and make sure that you have trunking and VLAN’s working properly. So make sure a switchport is applied to the proper VLAN and you can get out.

    The sub-interface on the Sonicwall is just like any other interface (X2, X3) the only difference is that it hangs off X0. (if X0 is what you’re using)

    Then when you replace your PC with your Sonicpoint, it will find your SonicWALL. The SDP protocol is what Sonicwall uses and unfortunately it is L2 based and is not routable. From what I hear, they are working on changing that, this way all of us won’t have to do what we are doing now in order to get the SonicPoint’s to provision.

    Once the SP’s can see the firewall, they should automatically provision based on the profile that you’ve created…

    So let’s say your VLAN is 101 off X0. It would look something like this:

    X0:V101

    The IP would be something like 172.16.1.1 /24.
    With your trunk to the HP switch, you then plug your SonicPoint to any switchport, apply that switch port to VLAN 101. Make sure you create VLAN 101 on your HP switch as well.

  • Paul Owen

     Good idea – I’ll give it a try and let you know how I get on. Many thanks.

  • http://twitter.com/japalm Jason Palm

    Great post and definitely gets me headed in the right direction. I see in your example that you created your subinterface WLAN to belong to a different subnet than your LAN zone. If I were to make my WLAN zone the same subnet as my LAN, would my WLAN traffic be able to access my LAN resources?

  • http://twitter.com/brandontek Brandon Kim

    Hi Jason,

    SonicWALL doesn’t allow the WLAN and LAN interfaces to be on the same subnet, trust me, I’ve tried! Obviously their thought process is to treat WLAN as if it’s DMZ for security purposes. I do wish though they would let you make that choice yourself though.

    There’s an undocumented feature that will let you have inter-communications fully, between the two segments, instead of typing it here, there’s a website that discusses the undocumented feature.

    Check it out, coincidentally he has a link back to this article! LOL…

    http://briandagan.com/fix-configuring-sonicpoint-aps-on-a-sonicwall#comment

  • http://twitter.com/japalm Jason Palm

    Thanks for the quick reply and link! I have another quick question:

    Would it be possible to add an uplink from the switch to another interface, lets say X6, and configure that switchport to trunk as well? So, you would trunk the X0 and the X6 off the same switch, thus eliminating the need to configure a sub-interface on the X0 port?

  • http://twitter.com/brandontek Brandon Kim

    You can create as many trunk ports as you have physical ports. You have to be careful and look under the advanced tab for VLAN filters. You don’t want to introduce L2 loops. So if you had two trunks. One trunk would carry VLAN’s 10 and 20, and the other trunk would carry 30 and 40 for example….

    You can use X6 solely for trunks, it doesn’t have to exist on X0….

  • Tom Lyczko

    Hello, I did not see this reply till now…I will try this out soon.

    I did more or less try the above approach with our SonicWall consultant and it did not seem to work so we went back to using X3 and the SP is not discovered…but we don’t want to test during the day since previous testing etc. caused a switch loop etc. and took down the network…

    Am I correct that the VLAN ID # must be applied to all downstream network switches and ports that might possibly carry WLAN traffic?? — regardless where they are physically within the subnet??

    Thank you, Tom

  • http://twitter.com/brandontek Brandon Kim

     Yes, make sure that you include all the necessary VLANs that you have created for your SP’s. What I usually do is not restrict any VLANs in order to avoid any issues. So on a Cisco switch, I’d just use the command that allows all VLANs.

    I always try not to limit myself at first, then once things are working, you can lock things down further…

  • David Roskelly

    Hi Brandon,

    I have my SonicPoint ‘piped’ directly to the X3 on my sonicwall TZ210 not the X0 (LAN), will this still work to have access to local resources on the LAN?

  • http://twitter.com/brandontek Brandon Kim

     Yes this should work, just make sure you properly configure your firewall/access rules so that the X3 subnet can access X0 subnet resources. You may or may not want it to have full access to everything on X0.

  • Pingback: Conveyancing Solicitors

  • Pingback: Wedges Shoes

Newer Comments →
Get Adobe Flash playerPlugin by wpburn.com wordpress themes