r/sonicwall

Setup Info

• SonicWall NSA4700
• NetExtender 10.3.5
• Hybrid M365 setup (Local Domain syncs to M365)
  • All "live" user accounts exist in local domain, as well as M365.
  • All "live" groups exist in local domain, as well as M365.
  • For testing: M365 cloud-only accounts (only used when noted below)
  • For testing: M365 cloud-only groups (only used when noted below)
• Setup: I followed this KB Article.
  • Exception: In Part B, Step 13, I selected "On Premises Group Security Identifier"

Issue

User accounts must be manually created on the SonicWall. If there is no manual account creation on the SonicWall, I receive the error "User has no privileges for login from that location"

Troubleshooting

1. Created domain user account manually on SonicWall, and added it to the "SSLVPN Services" Group on the Sonicwall. Result: Login Successful.
2. Deleted domain user account from SonicWall. Result: "User has no privileges for login from that location"
3. Created cloud-only Test user account, cloud-only Test group, & altered group claim to "Cloud-only group display names". Result: "User has no privileges for login from that location"
4. Verified under SAML Configuration that "Allow only users listed locally" is NOT enabled. Result: It was already off...no change.
5. Reverted back to step 1. Result: Login Successful.
6. Removed user created in Step 5 from the "SSLVPN Services" Group on the SonicWall. Result: "User has no privileges for login from that location"
7. Manually added user to Application in Entra. Result: "User has no privileges for login from that location"

Not sure why, but I have to create the account locally for it to be able to login to SSLVPN. It honestly acts as though the user account has no groups listed. I'm guessing I have done something wrong, but I followed the KB Article setup exactly. Perhaps the group identifier is incorrect?

We have a couple of trials going and in both instances users have a requirement to access various file servers via mapped drives.

In both cases we have issuses where they connect to CSE and are not able to access mapped drives.

Sometimes - clicking on the drive either gives the 'device already in use' error, or it prompts for says the drive is 'not accessible. the system cannot conact a domain controller'. Remapping the drives tends to make them accessible again.

We have tried adding Kerboros and LDAP ports to the access policy, but I'm not sure if this is the correct path to pursue.

We are working with pre-sales tech engineers but they haven't had many helpful suggestions yet.

Anyone seen this?

.*************.

UPDATE: This entire issue seems to be intermittent. We were working with a test PC this moring, testing the remapping script, and were running into more issues. Tried same PC again this afternoon, and now we can't even recreate the original issue. Everything is working as expected. For those suggesting that we may not have some needed port opened - that does not appear to be a factor. We have had the drives mapped working with as little as 1 server port 445 open and nothing else.

Used a TZ670 as the root to onboard a new NSa2800 a couple of months ago. I did the service transfer immediately rather than allow the longer period. Just come to factory erase my first 7th gen. and you need a maintenance key to access the recovery page! I can’t get that because the firewall is no longer in the console.

Tech Support can’t issue the maintenance key because it’s been deleted. They say to register the device again to get the key. MySonicwall says no - the serial was used in an upgrade so can’t be registered. And round and round we go with Tech Support.

I’ve asked if I remove the storage card from the bottom and destroy that will it have removed everything…can’t answer it.

Why so difficult!

We have a cisco which locks down each subnet pretty extensively w/ access rules. I need to open up RDP on the LAN for one particular CSE user/device but given it doesn't get an IP the LAN will be aware of (100.x.x.x subnet) when LAN is 10.x.x.x and it does not get a MAC I cannot add this device/IP to any access rule to whitelist. How are you guys locking down your LAN but letting certain users/devices access network resources? I am aware of tunnel policies and already implement those but that won't help me here.

Thanks much,

Dave

Is there a way to nuke/wipe Gen6 TZ's via the serial console? We have to process dozens and this would make it much easier to crank through them on a workbench.

I've fought this issue all day and cannot figure it out.

We've got SCIM enabled with Entra.

I've got a role group created in CSE called "staff" and I've assigned a role attribute by group membership to that role (the group is an Entra group).

The user in question is a part of the Entra group which is assigned to that role attribute group.

I can navigate to any user profile in CSE and immediately see that they've been granted that role except the single user in question.

I've confirmed that the user exists inside the Entra group numerous times. I don't know what else to check.

Any ideas on what I'm missing? As a result this user cannot login.

Edit: we’ve confirmed that Entra seems to not be sending the group memberships. So it’s an Entra issue but given it’s only one user out of around 90, I’m not sure why.

Anyone have major issues with remote users and field workers using verizon hotspot / router devices and VPNing in with Sonicwall Global VPN Client? We actually had to open a case for a verizon m106 pro hotspot that would connect but not pass traffic over VPN, the CSGConnect team that manages the devices said it has something to do with 4g network issues? You can lower the MTU on the VPN Client but that's not a valid answer for 60+ remote users in the field...

We have some users created locally in SonicWall CSE rather than using an external identity provider. I’m trying to enable MFA for these users, but I don't see an option to configure MFA the same way I can with users coming from an IdP. Does CSE support MFA for local users, or does MFA require an external identity provider such as Microsoft Entra ID or another SAML/IdP solution

Hey all,

I've just configured SDWAN for our WAN and VOIP system. The following is setup and showing live, SLA Probes, SLA CLass Objects, PSP and Rules.

However, when I navigate to Monitor -> SDWANS -> SD-WAN Connections. Nothing shows here. When I look in Policy -> Rules Both SDWAN rules show up and have hits against them.

TZ670 - 7.3.3-7015

Any help would be appreciated. 🙏

Has anyone found that the TZ370 is extra sensitive to surges? I realize that equipment should not get power surges but I’ve had a TZ 370 X1 die multiple times. The modem is fine but X1 won’t show a link. I have other TZ series and this is the only site with repeat thunderstorm / surge issues. i’m sure the problem is the site but at the same time I don’t think I had this kind of problems with their Cisco firewall.

Is there any additional protection that can help? I was looking at some ethernet surge suppressors. What are your thoughts and experiences with SonicWall and surges?

I submitted a ticket asking a general question and the AI Assistant responds asking me to complete 10 questions before we could proceed. I responded that I didn’t think answering those questions was relevant to my initial inquiry and the AI Assistant responded yet again with an even longer response.

How do you actually speak to an engineer now?

I'm not seeing this here yet, so thought I'd post it.

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0012

I’m checking in with the collective group on how/if you’re leveraging AI to audit your SonicWall configuration.