Solved

Two VPNs to same IP Address

Posted on 2013-06-24
5
1,000 Views
Last Modified: 2013-06-25
I've got a Sonicwall TZ205 at each of two locations. There is an IP phone system server at the main location and IP phones at the remote location. Currently, phones share a VPN between offices along with remote desktop applications and file transfer. The main location has 2 separate internet connections (only one is used at the moment). I would like to setup 2 VPNs between the offices. Firstone being the current and second being for the phone system only. The remote location only has 1 static IP address so I would be creating 2 VPNs going to the same IP address. The configuration page warns you about this and the settings for one end up stomping all over the settings for the other. Does anybody have any ideas about how to get this to happen?
Thanks.
0
Comment
Question by:Dalamar9
  • 2
  • 2
5 Comments
 
LVL 12

Accepted Solution

by:
TomRScott earned 500 total points
Comment Utility
Static IP addresses are fairly cheap. I would consider getting a second static address for the remote location.

Given that the documentation warns against two VPNs from the same firewall destined to a single VPN, that would be the simplest, safest and possibly cheapest solution.

 - Tom
0
 
LVL 25

Expert Comment

by:Fred Marshall
Comment Utility
The first issue I would consider would be:

What are the subnets involved?
If you have only one subnet at a site (and one public IP address) then I think there's "no way".
That's because packets destined for the remote subnet will be routed to "THE" VPN device.  And "THE" VPN device will route to the appropriate tunnel for that subnet.  

Even if you have multiple public addresses, how to get around the common subnet issue?  I don't think you can.

So, if this is what's going on then I don't see how it's surmountable.  Hopefully the VOIP uses a different subnet than the computer LAN at each site.
0
 

Author Comment

by:Dalamar9
Comment Utility
I'm working on getting another IP address at the remote location, but I'm planning on using the routing capability of the sonicwall to split the traffic. I can set it up so that all traffic from an IP address (phone server on one side) to/from a group of IP addresses (phones on other side) goes through VPN2 and all other traffic from one subnet to the other goes through VPN1.

I was playing around with the idea of using a second (extra) sonicwall behind the first since I could create a third subnet as an intermediary, but I was having trouble routing the traffic correctly.
0
 
LVL 25

Expert Comment

by:Fred Marshall
Comment Utility
I'm not at all sure that you need more than one public address per site.
I can envison Tunnel 1:
subnet 1A <> Public Address 1 <>Tunnel A<> Public Address 2 <> subnet 2A
and Tunnel 2:
subnet 1B <> Public Address 1 <>Tunnel B<> Public Addressd 2 <> subnet 2B.

What's important is that subnets 1A, 1B, 2A and 2B are all different.
It shouldn't matter that the Public Addresses used are single addresses per site as long as the device can terminate multiple tunnels.

Example:
Packet launched from subnet 1A destined for subnet 2A.
Is directed into Tunnel A and reaches subnet 2A.
Packet launched from subnet 1B destined for subnet 2B
Is directed into Tunnel B and reaches subnet 2B.
That the public addresses involved in the 2 separate tunnels are the same may not matter.
How the routing is done to reach the subnets is a detail that should be amenable to handling.

I think this works......
0
 

Author Closing Comment

by:Dalamar9
Comment Utility
The device is the shortcoming here. It won't negotiate 2 different IKE authentication proposals to the same destination. I had asked the question to see if anyone was familiar enough with the device that we could figure out a way around the issue.
I was able to get the powers that be to order multiple addresses for our account and it should be provisioned tomorrow.
Thanks everyone for your comments.
0

Featured Post

Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
Nic to NIC 5 43
one station on the LAN appears with 10 mbps speed 3 46
Security Alert 2 38
cisco nexus experiance 2 27
I've written this article to illustrate how we can implement a Dynamic Multipoint VPN (DMVPN) with both hub and spokes having a dynamically assigned non-broadcast multiple-access (NBMA) network IP (public IP). Here is the basic setup of DMVPN Pha…
I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now