Site to Site VPN via two Sonicwall firewalls – With DHCP over VPN

Leave a reply

Introduction: This document shows an example of how to configure a VPN tunnel between 2 SonicWALL firewalls, one running SonicOS Enhanced at the main site (central site) and the other one running SonicOS standard at the remote site. Remote PC’s located behind the SonicWALL appliance on the remote site will obtain IP addresses automatically from a DHCP server located on the LAN zone of the Enhanced unit.

Versions Used: SonicWALL recommends using the latest firmware version on the units. On this document this feature has been tested on SonicOS Enhanced 5.6.0.11-61o and SonicOS Enhanced 4.2.1.0-20e.  SonicWALL’s original document, which can be found here, shows support for this configuration on SonicOS Enhanced 3.0.0.4-21e and SonicOS Standard 3.0.0.1-28s. Please note that SonicOS Enhanced runs on TZ170, PRO2040, PRO3060, PRO 4060, Pro 5060 models, and NSA 3500. SonicOS Standard only runs on the TZ 150, TZ170, PRO2040, and PRO3060 models. Customers with current service/software support contracts can obtain updated versions of SonicWALL firmware from the MySonicWALL customer portal at https://www.mysonicwall.com. Updated firmware is also freely available to customers who have registered the SonicWALL device on MySonicWALL for the first 90 days.

Network Topology: 

Prerequisites: This guide assumes the following:

• DHCP Server is up and running on the Central Site
• The DHCP Server is in the LAN Zone
• WAN Interfaces have been configured properly for internet access at both the remote and central site

Task List:

• Configurations at the central site:
  • Set Firewall Unique Identifier
  • Add and configure a VPN policy 
  • Configure DHCP over VPN 
• Configurations at the remote site: 
  • Set Firewall Unique Identifier
  • Add and configure a VPN policy 
  • Configure DHCP over VPN 
• Testing
  • Verify that the VPN tunnel comes up
  • Verify that the DHCP client at the remote site obtains an IP address
  • Verify that traffic flows correctly between the sites
  • Verify that the DHCP client has access to its own network

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~SonicWALL Central Site Configuration

1. Login to your SonicWALL at the Central Site
2. Click on VPN->Settings
3. In the Unique Firewall Identifier box, enter CentralSite and click Apply
   1. 
4. On the VPN->Settings page, click the Add… button
   1. Use the configuration below:
      1. General Tab
         1. Policy Type: Site to Site
         2. Authentication Method: IKE using Preshared Secret
         3. Name: RemoteSite
         4. IPsec Primary Gateway Name or Address: yourwanipaddressoftheremotesite
         5. IPsec Secondary Gateway Name or Address: Leave this blank
         6. Shared Secret: Enter a good long password here!
         7. Confirm Shared Secret: Enter the same good long password you used above!
         8. Local IKE ID and Peer IKE ID: Leave these settings their default values
         9. 
      2. Network Tab
         1. Local Networks: Select Choose local network from list and select LAN Subnets
         2. Remote Networks: Select Destination network obtains IP addresses using DHCP through this VPN tunnel
         3. 
      3. Proposals Tab
         1. IKE (Phase 1) Proposal
            1. Exchange: Main Mode
            2. DH Group: Group 2
            3. Encryption: AES-256
            4. Authentication: SHA1
            5. Life Time (seconds): 28800
         2. IKE (Phase 2) Proposal
            1. Protocol: ESP
            2. Encryption: AES-256
            3. Authentication: SHA1
            4. Enable Perfect Forward Secrecy: unchecked
            5. Life Time (seconds): 28800
         3. 
      4. Advanced Tab
         1. Enable Keep Alive: this should be unchecked and grayed out
         2. Suppress automatic Access Rules creation for VPN Policy: unchecked
         3. Require authentication of VPN clients by XAUTH: unchecked
         4. Enable Windows Networking (NetBIOS) Broadcast: unchecked
         5. Enable Multicast: unchecked
         6. Apply NAT Policies: unchecked
         7. Management via this SA: all options unchecked
         8. User login via this SA: all options unchecked
         9. Defualt LAN Gateway (optional): 0.0.0.0
         10. VPN Policy bound to: Zone WAN
         11. 
5. Click OK
6. Click on VPN->DHCP over VPN
   1. Select Central Gateway from the dropdown and click the Configure… button
      1. 
   2. Click on the Add… button and then type in the IP address of your DHCP server at the CentralSite.
      1. 
   3. Click OK

SonicWALL Remote Site Configuration

1. Login to your SonicWALL at the remote site
2. Click on VPN->Settings
3. In the Unique Firewall Identifier box, enter RemoteSite and click Apply
   1. 
4. On the VPN->Settings page, click the Add… button
   1. Use the configuration below:
      1. General Tab
         1. Authentication Method: IKE using Preshared Secret
         2. Name: CentralSite
         3. IPsec Primary Gateway Name or Address: yourwanipaddressofthecentralsite
         4. IPsec Secondary Gateway Name or Address: Leave this blank
         5. Shared Secret: Use the same secret as the CentralSite
         6. Confirm Shared Secret: Use the same password as the CentralSite
         7. Local IKE ID and Peer IKE ID: Leave these settings their default values
         8. 
      2. Network Tab
         1. Local Networks: Select Local network obtains IP addresses using DHCP through this VPN Tunnel
         2. Remote Networks: Select Create new address object
            1. Enter in your CentralSite’s LAN information (this will be the network you pull DHCP IPs from.
               1. 
         3. On the Choose destination network from list, you can now selectCentralSite LAN
            1. 
      3. Proposals Tab
         1. IKE (Phase 1) Proposal
            1. Exchange: Main Mode
            2. DH Group: Group 2
            3. Encryption: AES-256
            4. Authentication: SHA1
            5. Life Time (seconds): 28800
         2. IKE (Phase 2) Proposal
            1. Protocol: ESP
            2. Encryption: AES-256
            3. Authentication: SHA1
            4. Enable Perfect Forward Secrecy: unchecked
            5. Life Time (seconds): 28800
         3. 
      4. Advanced Tab
         1. Enable Keep Alive: check this option if it is not grayed out
         2. Suppress automatic Access Rules creation for VPN Policy: unchecked
         3. Require authentication of VPN clients by XAUTH: unchecked
         4. Enable Windows Networking (NetBIOS) Broadcast: unchecked
         5. Enable Multicast: unchecked
         6. Apply NAT Policies: unchecked
         7. Management via this SA: all options unchecked
         8. User login via this SA: all options unchecked
         9. Defualt LAN Gateway (optional): 0.0.0.0
         10. VPN Policy bound to: Zone WAN
         11. 
5. Click OK

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Testing/Verification

1. Open up one of the SonicWALL devices (either Central or Remote) and head over to VPN->Settings
   1. You should see a green dot indicating the connection is active.  Additionally, at the bottom of the same page, you can see the “Current Active VPN Tunnels”.  You should see the tunnel has been established their as well.
      1. 
   2. Active connections from the RemoteSite’s SonicWALL
      1. 
2. Next, head over to a workstation on the RemoteSite’s network.
   1. Type ipconfig /release on the workstation
   2. Type ipconfig /renew on the workstation
   3. Type ipconfig and verify the IP address is in the correct range from the Central Site.
3. On the CentralSite’s SonicWALL, go to VPN->DHCP over VPN
   1. Under Current DHCP over VPN Leases, you should see your client
4. Try to ping a server at the CentralSite, you should receive a successful reply.