Solved

SonicWALL - Static Route a VLAN

Posted on 2016-08-09
8
58 Views
Last Modified: 2016-08-17
Hi,

I am struggeling with routing specific WAN/LAN IP's on a specific VLAN Interface, through a VPN connection instead of routing through the default gateway.

Lets say the customers VLAN IP is 192.168.1.0/24 and the default customer gw is 192.168.1.1. They have a VPN box on this network that has a site to site connection to another location, with the IP: 192.168.1.2.

I need to route some specific IP's through this VPN box, 192.168.1.2, and not the default gateway, 192.168.1.1.

The rules is as follows:

Source: VLAN56 Subnet (192.168.1.0/24)
Destination: Address Object Group (192.168.2.5, 192.168.2.9 etc)
Service: Any
Gateway: VPN Box - 192.168.1.2
Interface: VLAN56 Interface (the customer VLAN interface)


Because I have not been able to solve this, I've used a temp quick fix on windows level. By using a bat file, like this:

route ADD 192.168.2.5 MASK 255.255.255.255 192.168.1.2

This works for now, but I'd rather manage this route with our FW.

Note: I have only tested this SonicWALL route on a virtual machine, and no physical machines, if that matters.

Edit: I should add that this is my first time trying to add a Static route in SonicWALL. I have used the information I could find online on how to do this, and there might be some basic config mistakes/errors. :-)
0
Comment
Question by:itavdelingenas
  • 4
  • 3
8 Comments
 
LVL 5

Assisted Solution

by:Manuel Flores
Manuel Flores earned 500 total points
ID: 41748827
If I understand correctly, the PC that must to connect to network 192.168.2.x is on the same router network 192.168.1.x

In such a case, a static route configured in each PC of 192.168.1.x network is the solution.  You made it using route ADD 192.168.2.5 MASK 255.255.255.255 192.168.1.2 and it worked as far as I understand.

Under my point of view this correct.  You could force/apply some domain (if it exists) level script to setup that route to all the machines.

Please, let me know.

..MFlores..
1
 
LVL 5

Assisted Solution

by:Manuel Flores
Manuel Flores earned 500 total points
ID: 41748840
You can also try changing the config...  aprox to:

Current config
                    192.168.1.x net  
router gw ----------------------------------------
                             |             |      |      |
                 VPN router      PC    PC   PC


New config
                   192.168.3.x net                                          192.168.1.x net
router gw-------------------------------------- VPN router --------------------------------
                                                                                                    |      |       |      
                                                                                                  PC    PC     PC

And configure VPN router with default gw to the router gw and a VPN route to the correct vpn gw

This way you don't need to change anything on the PC

..MFlores..
0
 

Author Comment

by:itavdelingenas
ID: 41748901
Hi Manuel,

Thanks for answering this fast. Yes, the BAT file is already a logon script, so it applies to every machine in the domain at this moment.

We have a primary management network that is 10.0.0.0/24, and the SonicWALL has IP of 1. And we have several VLANs for customers, that has its own VLAN interface and network. The 192.168.1.0 is the customer network.

I was really hoping this was possible with a Static route or maybe by adding a NAT rule?


I have added a simple paint pic on how the setups is, roughly.
simple-description.png
0
 
LVL 5

Assisted Solution

by:Manuel Flores
Manuel Flores earned 500 total points
ID: 41748916
No, if the PC's are in the same network of the VPN router, a static route into the PC is the solution.  You must think that, indeed, you have two gateways in the client network, you must indicate to the PC what should be routed for what gateway.
0
Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

 

Author Comment

by:itavdelingenas
ID: 41748924
I see. If we take the VPN box out of the actual network, and set it some kind of DMZ zone, a different network than the clients/servers, will that allow us to route it properly?

This might be what you already explained, Im just slow.. :-)
0
 
LVL 5

Accepted Solution

by:
Manuel Flores earned 500 total points
ID: 41748939
That is possible, and apart from having configured the VLAN correctly, the topology is aprox.:

New config
                   192.168.3.x net                                          192.168.1.x net
router gw-------------------------------------- VPN router --------------------------------
                                                                                                    |      |       |      
                                                                                                  PC    PC     PC

So the VPN box is the only gateway for 192.168.1.x, and a couple of static routes configured on it; the default to external world, and the one to 192.168.2.x network will be enough and should work.

..MFlores..
1
 

Author Comment

by:itavdelingenas
ID: 41748964
Thanks for all your help Manuel. I will make the changes you suggested. :-)
0
 
LVL 5

Expert Comment

by:JSpoor
ID: 41759102
Use Route Based VPN rather than policy based VPN

View more example configurations and the SonicWALL webui and features on http://livedemo.sonicwall.com or http://ngfw-demo.com
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Shadow IT is coming out of the shadows as more businesses are choosing cloud-based applications. It is now a multi-cloud world for most organizations. Simultaneously, most businesses have yet to consolidate with one cloud provider or define an offic…
David Varnum recently wrote up his impressions of PRTG, based on a presentation by my colleague Christian at Tech Field Day at VMworld in Barcelona. Thanks David, for your detailed and honest evaluation!
Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now