Solved

SonicWALL NSA 2400 VPN Issues with Avaya IP Office 500 units

Posted on 2014-01-27
17
3,130 Views
Last Modified: 2014-03-15
Hi,

We are using Site-to-Site VPN connectivity from India to UK using SonicWALL NSA 2400 firewalls.

India Network - 172.16.0.0/23
UK Network - 10.0.0.0/23

Site-to-Site VPN works fine no issues with network connectivity or accessibility with devices

We are using Avaya IP Office 500 telephone system unit at India site where all India Avaya IP Phones are connected to India Avaya IP Office. Phones get IPs from India Avaya telephone system.

Our Avaya IP Office is configured to pass all calls to UK Avaya IP Office. e.g. our calls goes to UK from India telephone system-->UK Telephone System-->in/out side UK calls.

Issue:
Daily I get error on my India IP Phones when I am dialing any extension or number in UK e.g. UNOBTAINABLE

To resolve this issue I have to RESET VPN tunnel (Un-tick and Tick again VPN check box on SonicWALL) everyday to start calling to UK.

India site is also connected to other different sites over Site-to-Site VPN terminology where we are only accessing DATA. These tunnels I never had to reset or had any issues with network connectivity.

I would like to know if anyone has come across this type of issue or experts can advice how I can make it permanent so that daily RESETTING VPN goes away.

SonicWALL Firmware Version: SonicOS Enhanced 5.9.0.3-117o

Thanks for your help in advance.
0
Comment
Question by:ketanaagja
  • 8
  • 6
17 Comments
 
LVL 8

Expert Comment

by:amatson78
Comment Utility
Are you using MAIN Mode or Agressive Mode (Static IPs at both ends or is one side at least dynamic?) Are keep alives enabled on both or either of the VPN sides?

Keep Alive Settings
0
 
LVL 2

Author Comment

by:ketanaagja
Comment Utility
I am using Aggressive mode in IKE Phase 1 proposal, however I already had tried all other modes but situation is same in every proposal modes.

I am even using 1 week of life time (604800 seconds) for VPN tunnels but no effect as daily I have to reset tunnels to start calling over VPN.

Keep Alive is enable on one of the firewall. Both ends have Static IPs configured with 20mb dedicated internet line.

I have attached screenshots from both firewalls for your reference.

VPN Advance TAB screenshot
VPN Proposal screenshot
0
 
LVL 24

Expert Comment

by:diverseit
Comment Utility
Hi ketanaagja,

Are there any other VPN s2s tunnels running between those two locations? If so are the the ones you are saying which have no problem?

If they are not try changing the MTU, here's how: http://www.experts-exchange.com/A_12615-Unstable-Slow-Performing-Networks-or-VPNs-just-go-grocery-shopping.html

Let me know how it goes. Thanks!
0
 
LVL 24

Expert Comment

by:diverseit
Comment Utility
Any update on this?
0
 
LVL 2

Author Comment

by:ketanaagja
Comment Utility
Hi,

Apologies for later reply as I was out of station due to marriage.

As per instructions I tried setting up MTU size from default 1500 to 1472 and lower but got no success.

While checking MTU response from my Windows XP PC it seems there is more issue with MTU.

Default 1500 MTU size.
I got REQUEST TIMED OUT message on 1470 MTU size (is this normal?) and lower than 1470 also. I am only getting PING response on 512 MTU size which looks strange to me. Below is the screenshot for review.

512 MTU Size Response

Shall I try SonicWALL interface MTU size to 512 or other size? This is where entire confusion is.

MTU Route application shows below status:

MTU Route Information
0
 
LVL 24

Expert Comment

by:diverseit
Comment Utility
That is strange. Are you connecting to the Internet via PPP?

The MTU of many PPP connections is 576, so if you connect to the Internet via PPP, you might see your machine's MTU to 576 or lower.

Also, try this command:
mturoute www.google.com

Open in new window

- that should auto size the correct MTU for you. Tell me what the results are.
0
 
LVL 2

Author Comment

by:ketanaagja
Comment Utility
Hi,

I am using fiber link on SonicWALL through ISP and its dedicated 20mb internet line.

Below is the screenshot of mturoute www.google.com

mturoute result
0
How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

 
LVL 24

Expert Comment

by:diverseit
Comment Utility
I'd check with your upstream and make sure there are no issues and call the ISP. But as it stands 540 is your optimum MTU.
0
 
LVL 2

Author Comment

by:ketanaagja
Comment Utility
Hi,

Today I called down to Dell SonicWALL support and tech guy set two rules as per below screenshots:

LAN>VPN and from VPN>LAN

VPN1
UDP timeout settings
Here they changed UDP timeout settings from 30 seconds to 300 seconds and asked me to monitor tomorrow morning if your voice gets failed or not.

This has been added on both end's SonicWALL firewalls.

I'll be monitoring this one tomorrow if this works or not.
0
 
LVL 2

Author Comment

by:ketanaagja
Comment Utility
Hi,

300 UDP timeout seconds did not work and again I found out losing phone calls on avaya IP units where I had to disable/re-enable VPN tunnels.

Upon contacting SonicWALL support they again asked me to change 300 UDP timeout to 3600 seconds and check tomorrow.
0
 
LVL 24

Expert Comment

by:diverseit
Comment Utility
These Access Rules should have been setup by default if the VPN was setup properly.

Did you check with your ISP yet?
0
 
LVL 2

Author Comment

by:ketanaagja
Comment Utility
Access rules which are created automatically is for entire network not specifically for Avaya IP telephone systems. SonicWALL support guy entered both rules manually specifically having both telephone system IPs and setting up priority to 1.

1472 MTU size is working on ISP side and the same I configured yesterday on firewall but issue was generated today in afternoon where I lost phone calls connectivity.
0
 
LVL 2

Accepted Solution

by:
ketanaagja earned 0 total points
Comment Utility
Finally the issue got resolved.

Anti-Spyware module of the SonicWALL NSA 2400 firewall was blocking VoIP packets on 24 hour interval. (Why every 24 hours SonicWALL support is still to answer)

SonicWALL Support also unchecked prevention of "Low Danger Level Spyware". (As visible in attached screenshot)

When both Avaya IP Unit's IPs have been bypassed from Anti-Spyware module issue got resolved.

antispyware
0
 
LVL 2

Author Closing Comment

by:ketanaagja
Comment Utility
Other experts guided the solutions but it did not work out the solution as needed. I engaged core support of firewall and they took 3 weeks to solve out the issue thoroughly by analyzing issue packet by packet. Once issue got resolved I thought to publish the same on experts exchange site so that other users who might face such issue can instantly solve their queries.
0
 
LVL 24

Expert Comment

by:diverseit
Comment Utility
Glad you got it resolved. As a best practice I log all attacks and only block high and medium attacks for anti-spyware, antivirus & IPS regardless of running VoIP traffic. I wouldn't guessed it to be the culprit in this instance though. Thanks for sharing.
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Creating an OSPF network that automatically (dynamically) reroutes network traffic over other connections to prevent network downtime.
If you are thinking of adopting cloud services, or just curious as to what ‘the cloud’ can offer then the leader according to Gartner for Infrastructure as a Service (IaaS) is Amazon Web Services (AWS).  When I started using AWS I was completely new…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now