Solved

Site-to-Site VPN w/ two Sonicwall TZ 100 devices - need beginner help

Posted on 2011-03-08
11
2,163 Views
Last Modified: 2012-05-11
I have been doing networking for a while, but am fairly new to VPN setup/config.  I've been asked to help a friend setup what I believe is a simple site-to-site VPN between their north & south side offices.

I'm using two Sonicwall TZ 100 devices and I cannot make this work properly.  Both ends are behind DSL modems and are double NATed - I cannot get around this limitation.  I have forwarded the external IPs to the WAN port on the TZ 100s.

From what I've read, I need to setup my VPN on each device to point to the other, using different subnets.  I've done that such that:

North Office: 192.168.10.0/24
South Office: 192.168.20.0/24

I've setup DynDNS accounts for each and in my VPN setup my IPsec primary gateway for each end is the other's dyndns domain.

I'm not 100% sure how I should be setting up the "Network" tab.  Right now it's set to "firewalled subnets" for local and a group I created with the opposite ends IP range for remote.

I see failed IKE connection attempts in the logs, but the VPN itself never comes up.

I don't know if I'm making this more difficult than it needs to be, but I cannot figure it out.  Does anyone have any good advice or a walk through on setting up a point-to-point VPN using the TZ100s?

Here's a snipping of the log from the south office:

15      03/08/2011 21:22:32.736      Warning      VPN IKE      IKE Responder: Proposed IKE ID mismatch      x.x.x.x, 500      y.y.y.y, 500      VPN Policy: ticketsnorth; Local ID:
99.61.213.116;Remote ID: 192.168.1.2
00              
16      03/08/2011 21:22:32.464      Info      VPN IKE      IKE Responder: Received Main Mode request (Phase 1)      x.x.x.x, 500      y.y.y.y, 500                     
17      03/08/2011 21:22:26.192      Info      VPN IKE      IKE negotiation aborted due to timeout      y.y.y.y, 500      x.x.x.x, 500      VPN Policy: ticketsnorth              
18      03/08/2011 21:22:15.448      Info      VPN IKE      IKE Responder: Received Main Mode request (Phase 1)      x.x.x.x, 500      y.y.y.y, 500                     
19      03/08/2011 21:22:06.464      Info      VPN IKE      IKE Responder: Received Main Mode request (Phase 1)      x.x.x.x, 500      y.y.y.y, 500                     
20      03/08/2011 21:22:01.560      Info      VPN IKE      IKE Responder: Received Main Mode request (Phase 1)      x.x.x.x, 500      y.y.y.y, 500                     
21      03/08/2011 21:21:52.192      Info      VPN IKE      IKE Initiator: Remote party timeout - Retransmitting IKE request.      y.y.y.y, 500      x.x.x.x, 500      VPN Policy: ticketsnorth
0
Comment
Question by:jcazzell
  • 6
  • 3
11 Comments
 
LVL 33

Expert Comment

by:digitap
Comment Utility
go to the sonicwall on both ends and review VPN > Advanced. is NAT Traversal enabled? do tyou have the SA configured in aggressive mode or main mode? edit the VPN policies and review the third tab. it will be the first option.
0
 

Author Comment

by:jcazzell
Comment Utility
I've got NAT traversal turned on for both devices.  It seems to make no difference either way.

I've tried both aggressive & main mode.  Right now on both ends IKE phase 1 is set to:

Aggressive mode / Group 2 / 3DES / SHA-1 / 28800

IPsec phase 2 is set to:

ESP / 3DES / SHA-1 / 28800

How should I have the "networks" tab on the VPN policies screen set?  At the moment it's "LAN subnets" for local and "north" or "south" for remote (depending on the device).  These are defined as the internal IP subnet for the respective network (e.g. 192.168.10.0/24 or 192.168.20.0/24).

Are there any default firewall settings that need to be enabled/disabled?  I just can't quite wrap my head around what's wrong here.
0
 
LVL 8

Accepted Solution

by:
dosdet2 earned 250 total points
Comment Utility
Your DSL Modems should be set to bridge mode so that the public IP sits on the Sonicwall's WAN port.  

You might be able to get it working without this, but it's going to be so much easier and more stable if the Sonicwalls host the public IPs.  

Most modems have this capability.  What make and model are your modems?
0
 

Author Comment

by:jcazzell
Comment Utility
I can bridge the modem at the south location - it's a Speedstream that I know supports that.  At the north location it's a very (very) old Motorola surfboard DSL modem/router on which I can find no identifying model numbers, just the FCC ID (GZ53347)

I've been around and around it's config options and do not see a way to bridge it.  I think I have access to another DSL modem which will bridge - I cat test it to see if that corrects the issue or moves me further along to correcting the issue.
0
 
LVL 33

Assisted Solution

by:digitap
digitap earned 250 total points
Comment Utility
dosdet2 hit on where i was going...eventually. IPSec doesn't like NAT. it's the primary reason this is failing. you have to bridge one side, which may not work either. bridge the side you know you can bridge. configure it in aggressive mode, with 0.0.0.0 as the primary IP within the SA. then, on the non-bridged side, you configure it to initiate the VPN. what you hope is it to be similar to a remote client connecting to your sonicwall when they are behind a NAT'ing router.
0
How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

 
LVL 33

Expert Comment

by:digitap
Comment Utility
and, if this configuration doesn't work, then you have to replace the old DSL modem with something that will bridge. putting the WAN interface of the sonicwall directly on the internet will guarantee your vpn will connect.
0
 
LVL 33

Expert Comment

by:digitap
Comment Utility
B? take a look at this: http://www.experts-exchange.com/help.jsp#hs=29&hi=403

our answers were EXACTLY what you did per your explanation here, http:#a35090589.
0
 
LVL 33

Expert Comment

by:digitap
Comment Utility
thanks!
0
 

Author Comment

by:jcazzell
Comment Utility
Sorry for the screw-up on my part all.  I asked a mod to re-grade this.  I did not read the guidelines for grading ahead of this and for that I sincerely apologize.

0
 
LVL 33

Expert Comment

by:digitap
Comment Utility
no worries. hope i wasn't too harsh...working on that and not perfected yet.
0

Featured Post

NetScaler Deployment Guides and Resources

Citrix NetScaler is certified to support many of the most commonly deployed enterprise applications. Deployment guides provide in-depth recommendations on configuring NetScaler to meet specific application requirements.

Join & Write a Comment

For a while, I have wanted to connect my HTC Incredible to my corporate network to take advantage of the phone's powerful capabilities. I searched online and came up with varied answers from "it won't work" to super complicated statements that I did…
This is an article about my experiences with remote access to my clients (so that I may serve them) and eventually to my home office system via Radmin Remote Control. I have been using remote access for over 10 years and have been improving my metho…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now