Configuring VPNs in SonicOS

For an overview of VPNs in SonicOS Enhanced, see VPN > Settings.

SonicWALL VPN, based on the industry-standard IPsec VPN implementation, provides a easy-to-setup, secure solution for connecting mobile users, telecommuters, remote offices and partners via the Internet. Mobile users, telecommuters, and other remote users with broadband (DSL or cable) or dialup Internet access can securely and easily access your network resources with the Dell SonicWALL Global VPN Client and GroupVPN on your firewall. Remote office networks can securely connect to your network using site-to-site VPN connections that enable network-to- network VPN connections.

The GroupVPN provides automatic VPN policy provisioning for Global VPN Clients. The GroupVPN feature on the Dell SonicWALL network security appliance and the Global VPN Client dramatically streamline VPN deployment and management. Using the Client Policy Provisioning technology, you define the VPN policies for Global VPN Client users. This policy information automatically downloads from the firewall (VPN Gateway) to Global VPN Clients, saving remote users the burden of provisioning VPN connections.

You can configure GroupVPN or site-to-site VPN tunnels using the Management Interface. You can define up to four GroupVPN policies, one for each zone. You can also create multiple site-to-site VPN. The maximum number of policies you can add depends on your SonicWALL model.

NOTE: Remote users must be explicitly granted access to network resources on the Users > Local Users or Users > Local Groups pages. When configuring local users or local groups, the VPN Access tab affects the ability of remote clients using GVC connecting to GroupVPN; it also affects remote users using NetExtender, and SSL VPN Virtual Office bookmarks to access network resources. To allow GVC, NetExtender, or Virtual Office users to access a network resource, the network address objects or groups must be added to the “allow” list on the VPN Access tab.

VPN Global Settings

The Global VPN Settings section of the VPN > Settings page displays the following information:

•	Enable VPN must be selected to allow VPN policies through the Dell SonicWALL security policies.

•	Unique Firewall Identifier - the default value is the serial number of the firewall. You can change the Identifier, and use it for configuring VPN tunnels.

VPN Policies

All existing VPN policies are displayed in the VPN Policies table. Each entry displays the following information:

•	Name: Displays the default name or user-defined VPN policy name.

•	Gateway: Displays the IP address of the remote firewall. If 0.0.0.0 is used, no Gateway is displayed.

•	Destinations: Displays the IP addresses of the destination networks.

•	Crypto Suite: Displays the type of encryption used for the VPN policy.

•	Enable: Selecting the check box enables the VPN Policy. Clearing the check box disables it.

•

Configure: Clicking the Edit icon allows you to edit the VPN policy. Clicking the Delete icon allows you to delete the VPN policy. The predefined GroupVPN policies cannot be deleted, so the Delete icons are dimmed. GroupVPN policies also have a Disk icon for exporting the VPN policy configuration as a file for local installation by SonicWALL Global VPN Clients.

The number of VPN policies defined, policies enabled, and the maximum number of Policies allowed is displayed below the table. You can define up to 4 GroupVPN policies, one for each zone. These GroupVPN policies are listed by default in the VPN Policies table as WAN GroupVPN, LAN GroupVPN, DMZ GroupVPN, and WLAN GroupVPN. Clicking on the edit icon in the Configure column for the GroupVPN displays the VPN Policy window for configuring the GroupVPN policy.

Below the VPN Policies table are the following buttons:

•	Add - Accesses the VPN Policy window to configure site-to-site VPN policies.

•	Delete - Deletes the selected (checked box before the VPN policy name in the Name column. You cannot delete the GroupVPN policies.

•	Delete All - Deletes all VPN policies in the VPN Policies table except the default GroupVPN policies.

Navigating and Sorting the VPN Policies Entries

The VPN Policies table provides easy pagination for viewing a large number of VPN policies. You can navigate a large number of VPN policies listed in the VPN Policies table by using the navigation control bar located at the top right of the VPN Policies table. Navigation control bar includes four buttons. The far left button displays the first page of the table. The far right button displays the last page. The inside left and right arrow buttons moved the previous or next page respectively.

You can enter the policy number (the number listed before the policy name in the # Name column) in the Items field to move to a specific VPN policy. The default table configuration displays 50 entries per page. You can change this default number of entries for tables on the System > Administration page.

You can sort the entries in the table by clicking on the column header. The entries are sorted by ascending or descending order. The arrow to the right of the column entry indicates the sorting status. A down arrow means ascending order. An up arrow indicates a descending order.

Currently Active VPN Tunnels

A list of currently active VPN tunnels is displayed in this section. The table lists the name of the VPN Policy, the local LAN IP addresses, and the remote destination network IP addresses as well as the peer gateway IP address.

Click the Renegotiate button to force the VPN Client to renegotiate the VPN tunnel.

Viewing VPN Tunnel Statistics

The table in the Currently Active VPN Tunnels section displays these statistics for each tunnel:

•	Create Time: The date and time the tunnel came into existence.

•	Tunnel valid until: The time when the tunnel expires and is force to renegotiate.

•	Packets In: The number of packets received from this tunnel.

•	Packets Out: The number of packets sent out from this tunnel.

•	Bytes In: The number of bytes received from this tunnel.

•	Bytes Out: The number of bytes sent out from this tunnel.

•	Fragmented In: The number of fragmented packets received from this tunnel.

•	Fragmented Out: The number of fragmented packets sent out from this tunnel.

For detailed information on configuring VPNs in SonicOS, see:

•	Configuring GroupVPN Policies

•	Site-to-Site VPN Configurations

•	Creating Site-to-Site VPN Policies

•	VPN Auto-Added Access Rule Control