Link to home
Start Free TrialLog in
Avatar of Computers4me
Computers4me

asked on

Site to site VPN over 3 sites

I have a VPN setup with 3 Sites. 1 Main Office has a static IP and 2 satellite offices have Dynamic IP addresses.

All sites are using a sonicwall TZ190 Router.

MAIN Office can PING site 2 and 3
Site 2 can PING site 1
Site 3 can PING site 1

Are there any setting on the router I'm not aware of that would allow site 2 and 3 to ping each other through the main office router VPN setup?
Avatar of hypercube
hypercube
Flag of United States of America image

I think you mean that you have a VPN device at each of 3 sites and that you have 2 VPNs.  One for each remote site to the main site.
So, if I'm right, then you may want to consider setting up a 3rd VPN between the two remote sites.  After all, they all have the necessary devices and setting up another VPN (i.e. "tunnel") isn't much to do now that you've already done it a couple of times.
That should take care of it.

But you did say that you want to go through the main site.  I wouldn't recommend it under the circumstances that you have complete control over the other VPNs.  But, just for completeness, I'll mention this:
In some cases I have 3rd party VPN devices that are NOT under my control - let's just say at a main site.  And, I might want to communicate to the far end of its tunnel from a remote site.  In that case one would need to go through the main site.
So it would be:
Remote site <> VPN1 <> Main Site <> {VPN2} <> 3rd party site.

I've shown VPN2 in brackets because I have no control over it.
In this case what I'd want to do is launch a packet from the Remote site, have it arrive at the Main site and be forwarded to the 3rd party site and to get responding packets back at the Remote site via the Main site.

In the cases that I've tried this, it didn't work.  I have heard explanations of why it cannot work and I have heard explanations of how it can be made to work.  In the end I abandoned the quest and still don't know if it can work.  I do know that the devices I had been using would not do it.

So, I'm naturally a little leery of "going through the Main site"......
It's harder to do if it's possible.
Avatar of Computers4me
Computers4me

ASKER

What I have set up now is a HUB and Spoke topology and would like to setup more of a mesh topology
The 2 sites I would create a 3rd VPN for are both Dynamic External addresses. I understand if I had static addresses at all 3 locations I would be fine.
I would then have to setup either site 2 or 3 router with a DDNS name and setup a 3rd VPN using the DNS Name rather then IP address. ( Sonicwall tz190 supports DDNS VPN)
I tried just that. I created a DDNS for one of the  dynamic sites and created an aggressive mode vpn tunnel from site 2 to site 3 and it works. It's an IT miracle. LOL
Yes, the dynamic IPs with DDNS should work fine.
So, the 3rd VPN should be easy enough to do..... right?

I don't know how to quite differentiate between hub and mesh (I understand the words and their implication) when the real objective is to *connect*.    But it sounds like you're on the right track by suggesting a mesh.  I would rather think that a true mesh would be where one could connect between nodes going in a variety of directions / hops.  Here there would be no hops through interim nodes - just dedicated tunnels between (all) nodes.
ASKER CERTIFIED SOLUTION
Avatar of Miftaul H
Miftaul H

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
I tried your suggestion of creating the group and adding both other networks and works great. This way I don't need to utilize a DDNS name. Thank you all for your help.