SMA 210/410 Deployment Guide
Deployment Scenarios Overview
1
3
Deployment Scenarios Overview
Welcome to the
SonicWall SMA Deployment Guide
. SonicWall
®
Secure Mobile Access 210/410 provides a unified
secure gateway to access all network and cloud resources. This guide contains configuration guidelines for
deployment scenarios involving new DMZ, existing DMZ, and LAN deployments, along with basic configuration
settings for those scenarios.
Topics:
•
Selecting a Deployment Scenario
•
SMA 210/410 Deployment Scenarios
Selecting a Deployment Scenario
The deployment scenarios described in this guide are based on actual customer deployments and are
SonicWall-recommended deployment best practices for SMA appliances.
An SMA appliance is commonly deployed in one-arm mode over the DMZ interface on an accompanying
gateway appliance, such as a SonicWall NSA 3600. This method of deployment offers additional layers of
security control, plus the ability to use SonicWall’s security services, including Gateway Anti-Virus,
Anti-Spyware, Content Filtering, Intrusion Prevention Service, and Comprehensive Anti-Spam Service, to scan all
incoming and outgoing traffic.
The primary interface (X0) on the SonicWall SMA connects to an available segment on the gateway device. The
encrypted user session is passed through the gateway to the SMA appliance. The SonicWall SMA appliance
decrypts the session and determines the requested resource.
The session traffic then traverses the gateway appliance to reach the internal network resources. The gateway
appliance applies security services as data traverses the gateway. The internal network resource then returns
the requested content to the SonicWall SMA appliance through the gateway, where it is encrypted and sent to
the client.
SMA 210/410 Deployment Scenarios
Gateway Appliance
Deployment Scenario
Requirements on Gateway Appliance
SonicOS 5.8.1 or higher:
•
TZ Series
•
NSA E-Class
•
NSA Series
•
SM 9000 Series
(SonicOS 6.1+)
SMA on New DMZ
•
An unused interface
•
NEW DMZ configured for NAT or Transparent
Mode
SMA on Existing DMZ
•
One dedicated interface in use as an existing
DMZ
SMA on LAN
•
None
