SSL-VPN Series

The SSL-VPN appliance line from SonicWALL provides SSL protected network access capabilities to remote workers. The product line is split into two families: The original SSL-VPN appliances from SonicWALL, targeted to SMB deployments; and the E-Class SSL VPN appliances, which are targeted to SMB to Enterprise level deployments and themselves are the result of SonicWALL's acquisition of Aventail Corporation in 2007.

In the original SMB-targeted line, workers access the network and open the connection through their Web browser; and, after providing appropriate credentials (user id, password, and OTP if so configured), they are then granted access to a personalized portal allowing them to utilize the corporate E-mail, files, applications and intranet pages/apps to which they have been given access rights. User authentication is through integration with Vasco or RSA components and/or Active Directory, RADIUS and LDAP directories; or through the appliance's own internal DB (RSA authentication is not offered in the SSL-VPN-200). The one-time-password option provides a means of two-factor authentication by sending a one-time use code to the user via their E-mail/pager which must be entered in addition to their standard ID and password.

As mentioned, users can access the appliance and their designated application via their Web browsers (IE 5.01+, Mozilla 1.7.1+, FF 1.0.6+, Opera 8.2+, Safari 1.3.1+) without requiring additional components to be pre-installed (though for some usage, the browsers may need ActiveX, Java, and/or JavaScript enabled for full functionality). The vendor states that pure browser access is all that's required for access to proxied Web-based applications; and for access to other applications or functionality additional Java or ActiveX applets are pushed as needed to the client browser. Supported proxy applications/protocols include HTTP, HTTPS, FTP, SSH, Telnet, RDP, VNC, and Windows File Sharing (Windows SMB/CIFS). The higher end offerings (the SSL-VPN 2000/4000) additionally support the proxying of Citrix apps.

In addition to the above components, the vendor offers their NetExtender technology--a downloadable thin client--which extends the platform's features to support connectivity to any resource on the corporate network, including servers or custom applications. The NetExtender component can be configured to remain resident on the client computer after the browser is closed. With NetExtender, the client is issued an IP address from an IP address pool for access to the corporate network resources. A stand alone NetExtender Client can additionally be deployed to end users, facilitating VPN access without requiring the browser. NetExtender functionality support Windows, Mac OS X and Linux clients.

Finally, a remote support add-on module--called SonicWALL Virtual Assist--is also available for the SMB (2000/4000) line, which allows technicians to remotely control a customer's PC. Up to 4 concurrent technician tunnels are supported on the SSL-VPN 2000, while up to 25 tunnels are supported on the SSL-VPN 4000.

Three SSL-VPN appliances are offered in the SMB line:

- SSL-VPN 200, a desktop model targeted to offices with 50 or fewer employees. The SSL-VPN 200 is recommended for networks with a maximum of 10 concurrent users.

- SSL-VPN 2000, a rackmount model (1U) targeted to organizations with 500 or fewer employees. The SSL-VPN 2000 is recommended for networks with a maximum of 50 concurrent users.

- SSL-VPN 4000, also a rackmount model (1U) and targeted to organizations with better than 500 employees. The SSL-VPN 4000 is recommended for networks with a maximum of 200 concurrent users.

With all the SMB units, there is no per-concurrent tunnel licensing fee.

New features in the SSL-VPN 2000 and SSL-VPN 4000 are focused primarily on Virtual Assist enhancements, including enhanced hot-keys (chat, file transfer, launch customer's start/task menu); a diagnostic utility that provides information pertaining to a customer's computer configuration; E-mail alerts for customer requests; and new logging and reporting features that record the details of support sessions. Also improved is the remote access administration interface.

As mentioned above, the enterprise-class SSL VPN appliances (the E-Class offerings) are the result of the Aventail acquisition. Features of the appliances include extended access control granularity; mobile device support; endpoint controls (including client interrogation before access); and high-availability features including active/active stateful failover, integrated load balancing for up to 2 nodes, and support for external load balancing of up to 8 nodes.

Current entries in the E-Class line of appliances include:

- EX-750, with support for 10-50 concurrent users

- EX-1600, with support for 25-250 concurrent users

- EX-2500, with support for 50-2000 concurrent users

With the EX line, licensing is by concurrent users.

Note that not all features described above may be available in both product lines. Visit the SonicWALL Web site for further information.