1

Looking for suggestions on a remote access solution to replace our existing solution. Currently:

  • Support a handfull of remote-access users, under 2 use-cases:
  • Remote workers with a company issued surface.
  • On-Prem workers that require occasional remote access from a personal device.- On-Prem AD, federated with Azure. Mot services users are accessing are legacy applications that are exposed via RDS (either RemoteApp or Virtual Desktop)

Current Solution:

  • Sonicwall SRA1600
    • Company devices have NetExtender, users must login to device and start the NetExtender tunnel and auth. Published apps are “installed” onto the device, its less then seamless, often users will try to start a remoteApp and forget to start their tunnel.
    • For occasional access, users will login to the virtual office. From there they can access RDS published apps, or virtual desktop. The SRA is just a proxy for them to access RDS that sits behind the firewall.
    • We have an NSA2600 that serves as the firewall.
    • Currently not using RADIUS (LDAP Auth), no NPS

Specific issues i’m trying to address:

  • SRA1600 is EoL, given recent news I lack confidence in this device.
  • Would like the company issued devices to use something more seamless to users. I think always-on-vpn with a user-tunnel would be the best tech to give them an easier experience connecting to company resources.
  • Enabling TOTP or otherwise integrate with Azure MFA to protect logins to “virtual office”

Potential Solutions - Suggestions on any of these paths is appreciated:

  1. All-Windows solution - Configure an on-prem NPS and RA server. Setup always-on-vpn profile for company issued devices. For occasional access expose the RDS Gateway, secure it with azure MFA, allow users to connect to virtual desktop.
  2. Sonicwall SMA210 / 500v - Upgrade the SRA1600 to a SMA210 or 500v, deploy on prem NPS server. Continue to use the SMA for occasional access. Configure the always-on-vpn to use the sonicwall SMA as the VPN server.

Some of my additional questions:

  • Do i really need an SMA at this point? The only thing “occasional” users connect to is a RDP desktop, that can be secured with azure MFA; am i gaining anything else?
  • Anyone used a SMA device with always on VPN? Am i going to run into issues trying to get the user-tunnel to use certificate auth, while requiring web logins to use some MFA?
  • With the large pricing difference between the SMA210 physical appliance, and 500v virtual appliance, any reason to go with physical hardware anymore? (We run everything on-prem with hyper-v)
  • Can i use the UTMs SSL VPN for the occasional access and negate the need for an SMA/SRA device?

Thank you in advance for the advice

3 Spice ups
2

Hi, @danhaddad .
Have you used alternative remote desktop solutions?
Consider trying out the Action1 cloud-based solution. It is entirely free to use to manage up to 50 endpoints and suits well for enterprises too. With the Action1 platform, you’ll be able to get secure remote access to connect to computers of employees working from home or in the office, with no extra configuration or additional downloads on user’s end.

And since it is entirely a cloud-based solution — it requires no manual maintenance on your end and can support remote computers and workforce without VPN configurations.
Give it a shot for free.

3

If you are a microsoft shop and want always on VPN check out MS VPN Anywhere

chances are you have everything in place already and just need to setup the services