Solved

A problem to properly connect openSWAN to Sonicwall VPN server

Posted on 2013-10-26
1
714 Views
Last Modified: 2013-12-28
The question is related to this one.

Our office has the SonicWall TZ 170 hardware firewall/VPN server.
My home machine is Debian GNU/Linux v7. I use the OpenSWAN package to connect to the VPN.

The problem is as follows:
I have to switch the VPN policy "Allow connection to" on the VPN server to "All Secured Gateways" in order to make my Linux box get connected. But that's not good, because all other Windows-based clients VPN claim they have access only to the office network, the internet connection is forbidden for them during their VPN session (The "Allow connection to" should be "Split Tunnels" to let them access the internet during a VPN session).
If I connect when the "Split Tunnels" is set then no error is given, but no office's node is reachable.

I tried also to check the "Set Default Route as this Gateway" and specified the address in the "Default LAN Gateway" (on the advanced tab of the TZ170's VPN policy page) to at least make the internet access via the VPN tunnel, but in this case I can not connect at all.

Attached is the screenshot of the VPN policy editor, ipsec.conf file, the log what I see on a successful connection, and the log on "Split Tunnels" (no differences though)

This how I establish the connection:
ipsec setup --start
sleep 8
ipsec whack --listen
sleep 8
ipsec whack --name sonicwall --initiate

Open in new window


This is a help page for the server's VPN policy:
http://help.mysonicwall.com/sw/eng/705/ui2/23100/VPN/VPN_Policy_GroupVPN_IKE_Preshared_Secret.htm
vpn1.png
ipsec.conf.txt
good.log
bad.log
0
Comment
Question by:zc2
1 Comment
 
LVL 18

Accepted Solution

by:
zc2 earned 0 total points
Comment Utility
Found a good guide:
http://www.golinuxhub.com/2012/10/openswan-configuration-on-red-hat-5-for.html

Following the guide made the VPN work.

The key changes:
1) /proc/sys/net/ipv4/ip_forward has to contain 1  (configured in the /etc/sysctl.conf)
2) regenerated the site private key by executing
ipsec newhostkey --output /etc/ipsec.secrets --bits 2048 --verbose
(with restoring the @GroupVPN @xxxxxxxxxxx : PSK "Pre Shared Key" string)
0

Featured Post

How to improve team productivity

Quip adds documents, spreadsheets, and tasklists to your Slack experience
- Elevate ideas to Quip docs
- Share Quip docs in Slack
- Get notified of changes to your docs
- Available on iOS/Android/Desktop/Web
- Online/Offline

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
Connection timeouts with mobile vpn users 5 35
Cisco ASA two factor VPN 3 35
RDP connection error 5 31
Windows 10 VPN? 6 40
When you connect to your workplace's VPN, you may not notice that you are using your workplace's servers to serve up webpages.  This might be undesirable since the workplace can log all the places you've been.  It also might be very slow to load pag…
Some of you may have heard that SonicWALL has finally released an app for iOS devices giving us long awaited connectivity for our iPhone's, iPod's, and iPad's. This guide is just a quick rundown on how to get up and running quickly using the app. …
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now