Solved

Scripting on

Posted on 2014-11-23
7
103 Views
Last Modified: 2014-12-13
I put a Sonicwall TZ215 in for a site to site VPN connection to Amazon. After support calls with Sonicwall and AWS support, I learned that AWS tears down the tunnel after so many minutes without "interesting" traffic. Then I noticed that about every 24 hours all connections would quit working through the tunnel. The AWS side and the Sonicwall side of the tunnel were reporting the tunnel up, but no traffic was passing. I need to be able to schedule a script that resets the tunnel everyday at 6 AM. I found this script on one of the forum sites but am unsure of how to go about implementing. I downloaded Cygwin Terminal and placed it on one of the local servers that sits at our site. Is this the correct thing to do? How do I go about running the script on a Windows 2008 server so that the script hits the Sonicwall and keeps the tunnel up.

The bash script I found is as follows:

#! /bin/bash

(echo -e 'YOURPASSWORD'; sleep 2; echo 'configure'; sleep 2; echo 'y'; sleep 2; echo 'vpn'; sleep 2; echo 'policy tunnel-interface "NAMEOFVPNPOLICY"'; sleep 2; echo 'no enable'; sleep 2; echo 'commit'; sleep 2; echo 'enable'; sleep 2; echo 'commit'; sleep 2; echo 'exit'; sleep 2; echo 'exit'; sleep 2; echo 'exit'; sleep 2; echo 'exit'; sleep 2) | ssh -t -t SONICWALLUSERNAME@192.168.1.100
0
Comment
Question by:nybyte
  • 4
  • 2
7 Comments
 
LVL 61

Expert Comment

by:btan
Comment Utility
Supposedly , from Sonicwall, checking the "Enable Keep Alive" enabled should at least alleviate the sporadic dropping to get things got more stable. Also noticed that you have posted into AWS forum with regards to this matter for advices and hear off nothing. Running script per se doesnt seems a long term solution if heartbeat is really essential for AWS connection.

In fact, technically no tunnel will stay up 24x7. That's part of IPSec. You have a max lifetime (or max traffic) as part of the SA before it rekeys. Also there should not be any delay during the rekeying stage. It is still the IKE keepalives that keep thing running and do make sure the same timer value for both setup match in either end of the proposal exchange.

Nonetheless, you may also catch a technote configuration for Sonicwall tunnel to AWS and vice versa
http://www.sonicwall.com/downloads/Configuring_SonicOS_for_Amazon_VPC_Technote.pdf
Note: VPC requires a customer gateway to configure 2 route based VPN tunnels for each instance of dynamic route based VPNs at VPC. So there needs to be 2 tunnel interface VPNs and 2 tunnel interfaces, each with its own BGP configuration.

• VPN gateway on a secondary WAN interface, in the same VPC. VPNs are deployed on one interface only in a single VPC.
• The SonicWALL firewall for Amazon VPC cannot be deployed behind a NAT device. Amazon does not
support NAT traversal.
• Some platforms may require an expanded license for BGP support, required for a dynamic route-based
VPN.
0
 

Author Comment

by:nybyte
Comment Utility
I have the Keep Alive enabled along with the DPD for phase 1 and 2 but every morning the VPN connection has dropped. I followed the link you posted to get the VPN tunnel up originally and have talked to AWS support many times. They now want to close the ticket because they cannot figure out why it drops or so they say. The script is something I found on one of the AWS forums and would like to implement that but am unsure of exactly how to do it.
0
 
LVL 61

Expert Comment

by:btan
Comment Utility
if you are interested in the script, there is one EE posting that may be of interest (stated Sonicwall dropping vpn)
http://www.experts-exchange.com/Software/System_Utilities/Remote_Access/VPN/Q_26761709.html
Here's what I've done to keep the tunnel up and running and create "interesting traffic." This batch file sends a ping (I have mine scheduled for every 5 minutes) and copies a small PNG image to a share on the server. If the ping fails it immediately sends an email with the VB Script email.vbs telling me it's down.
0
Highfive + Dolby Voice = No More Audio Complaints!

Poor audio quality is one of the top reasons people don’t use video conferencing. Get the crispest, clearest audio powered by Dolby Voice in every meeting. Highfive and Dolby Voice deliver the best video conferencing and audio experience for every meeting and every room.

 
LVL 21

Expert Comment

by:eeRoot
Comment Utility
A common (but not ideal) trick to keeping a tunnel up is to schedule a file transfer or some other job to move a good amount of data once an hour.  Some firewalls do not consider pings to be "interesting traffic" so you may have better success with an actual file transfer.
0
 

Author Comment

by:nybyte
Comment Utility
I spoke to Sonicwall's support team and they created a new firmware package that is suppose to take care of the AWS VPN issue. I am going to apply this firmware on Dec 1st and will update on if this does in fact take care of the issue.
0
 

Accepted Solution

by:
nybyte earned 0 total points
Comment Utility
UPDATE - The firmware that Sonicwall supplied fixed the VPN issue.
0
 

Author Closing Comment

by:nybyte
Comment Utility
The firmware that Sonicwall provided was the firmware in fact that fixed the issue. The VPN has been up for 7 straight days without an issue and it has never stayed up that long.
0

Featured Post

Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

Join & Write a Comment

This article is a how to to configure a UCS Ethernet-uplink portchannel via the console. It is easy to do and can be done quite quickly. In certain versions of the UCS manager the portchannel has issues coming up and this is a workaround. I am…
Every server (virtual or physical) needs a console: and the console can be provided through hardware directly connected, software for remote connections, local connections, through a KVM, etc. This document explains the different types of consol…
Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…
This tutorial demonstrates a quick way of adding group price to multiple Magento products.

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now