CLICK HERE TO WATCH VEDIO
UTM - VPN: Configuring Aggressive Mode Site to Site VPN when a Site has Dynamic WAN IP address in SonicOS Enhanced (KB Article and Video Tutorial) (SW4834)
Return
Title
UTM - VPN: Configuring Aggressive Mode Site to Site VPN when a Site has Dynamic WAN IP address in SonicOS Enhanced (KB Article and Video Tutorial)Resolution
Article Applies To:
Gen6 SM E10000 series: NSA E10800, NSA E10400, NSA E10200, NSA E10100
Gen6 SM 9000 series: NSA 9600, NSA 9400, NSA 9200
Gen6 NSA Series: NSA 6600, NSA 5600, NSA 4600, NSA 3600, NSA 2600Gen5: NSA E8510, E8500, E7500, NSA E6500, NSA E5500, NSA 5000, NSA 4500, NSA 3500, NSA 2400, NSA 2400MX, NSA 220, NSA 220W NSA 240, NSA 250M, NSA250MW
Gen5 TZ series: TZ 100, TZ 100W, TZ 105, TZ 105W TZ 200, TZ 200W, TZ 205, TZ 205W TZ 210, TZ 210W,TZ 215, TZ 215W.
Gen4: PRO series: PRO 5060, PRO 4100, PRO 4060,PRO 3060, PRO 2040, PRO 1260
Gen4: TZ series: TZ 190, TZ 190 W, TZ 180, TZ 180 W, TZ 170, TZ 170 W, TZ 170 SP, TZ 170 SP Wireless
Firmware/Software Version: SonicOS Enhanced
Services: VPN
To watch a video tutorial on this topic, click here
Feature/Application:This solution explains the configuration of a Site to Site VPN on SonicWALL firewall (UTM) appliances when a site has dynamic WAN IP address. The VPN policy is setup using Aggressive Mode.Procedure:
Configuring a Site to Site VPN on the central location (Static WAN IP address)Device used on central site: SonicWALL PRO 4060 appliance with SonicOS Enhanced 4.0.0.2e firmware.Central location network configuration:1. LAN Subnet: 192.168.168.02. Subnet Mask: 255.255.255.03. WAN IP: 66.249.72.1154. Local IKE ID SonicWALLl Identifier:
- Login to the central location SonicWALL appliance
- Navigate to Network > Address Objects page.
- Scroll down to the bottom of the page and click on Add button, enter the following settings.
Name – newyork vpn,Zone – VPN,Type – Network,Network – 10.10.10.0,Netmask – 255.255.255.0
- Click OK when finished.Step 2: Configurating a VPN Policy:a. Click on VPN > Settingsb. Check the box “Enable VPN” under Global VPN Settings.c. Click on the “Add” button under VPN Policies section. The VPN Policy window pops up.Click the General taba. Select the Authentication method as “IKE Using Preshared Secret”b. Name:c. IPsec Primary Gateway Name or Address: 0.0.0.0Note: Since the WAN IP address changes frequently, it is recommended to use the 0.0.0.0 IP address as the Primary Gateway.d. IPsec Secondary Gateway Name or Address: 0.0.0.0e. Shared Secret: sonicwall (The Shared Secret would be the same at both SonicWALL’s)f. Local IKE ID: SonicWALL Identifier - chicago (This could be any string except it has to match the remote location VPN'sPeer IKE ID SonicWALLl Identifier)g. Peer IKE ID: SonicWALL Identifier - newyork (This could be any string except it has to match the remote location VPN'sLocal IKE ID SonicWALLl Identifier)Click the Network tabØ Local NetworksSelect Choose local network from list, and select the Address Object – X0 Subnet (Lan subnet)Ø Destination NetworksSelect Choose destination network from list, and select the Address Object – newyork vpnClick the Proposals tabIKE (Phase 1) ProposalExchange: Aggressive ModeDH Group: Group 2Encryption: 3DESAuthentication: SHA1Life Time (seconds): 28800Ipsec (Phase 2) ProposalProtocol: ESPEncryption: 3DESAuthentication: SHA1Enable Perfect Forward Secrecy(not checked)DH Group: Group 2Life Time (seconds): 28800Click the Advanced tabEnsure that the VPN Policy bound to: Zone WAN
Configuring a Site to Site VPN on the remote location (Dynamic WAN IP address)Device used on remote location: SonicWALL TZ 170 appliance with SonicOS Enhanced 3.2.3.0 firmwareNetwork Configuration:1. LAN Subnet: 10.10.10.02. Subnet Mask: 255.255.255.03. WAN IP: DHCP (As this is a Dynamic IP Address)4. Local IKE ID SonicWALL Identifier: newyork (This has to match the central location VPN's Peer IKE ID SonicWALLl Identifier)
Step 1: Creating Address Object for remote site:
- Login to the Remote location SonicWALL appliance
- Navigate to Network > Address Objects page.
- Scroll down to the bottom of the page and click on Add button, enter the following settings.Name –Zone – VPNType – NetworkNetwork – 192.168.168.0Netmask – 255.255.255.0- Click OK when finishedStep 2: Configuration VPN Policy:a. Click on VPN > Settingsb. Check the box “Enable VPN” under Global VPN Settings.c. Click on the “Add” button under the VPN Policies section. The VPN Policy window pops up.
a. Select the Authentication method as “IKE Using Preshared Secret”b. Name:c. IPsec Primary Gateway Name or Address: 66.249.72.115d. IPsec Secondary Gateway Name or Address: 0.0.0.0e. Shared Secret: sonicwallf. Local IKE ID: SonicWALL Identifier - newyork (This has to match the central location VPN's Peer IKE ID SonicWALLl Identifier)g. Peer IKE ID: SonicWALL Identifier – chicago (This has to match the central location VPN's Local IKE ID SonicWALLl Identifier)Click the NetworkØ Local NetworksSelect Choose local network from list, and select the Address Object – LAN Primary SubnetØ Destination NetworksSelect Choose destination network from list, and select the Address Object –Click the Proposals tabIKE (Phase 1) ProposalExchange: Aggressive ModeDH Group: Group 2Encryption: 3DESAuthentication: SHA1Life Time (seconds): 28800Ipsec (Phase 2) ProposalProtocol: ESPEncryption: 3DESAuthentication: SHA1Enable Perfect Forward Secrecy (not checked)DH Group: Group 2Life Time (seconds): 28800Click the Advanced tabEnable Keep Alive box should be checkedVPN Policy bound to: Zone WAN- Click OK when finished
How to Test:From the remote location try to ping an IP address on the central location.
