Policies_VPN_Configure

Policies_VPN_Configure_Snwls

Configuring VPNs in SonicOS Standard

This section describes how to configure VPN version 1.0 for SonicOS Standard. To configure VPN for SonicOS Enhanced, refer to the Configuring VPNs in SonicOS Enhanced.

SonicWALL GMS supports several methods for establishing and maintaining security associations (SAs). These include:

IKE Using SonicWALL Certificates

The following sections describe how to configure SAs for Internet Key Exchange (IKE) using SonicWALL certificates:

Note: This section assumes that you are familiar with Public Key Infrastructure (PKI) and the implementation of digital certificates with VPN.

A digital certificate is an electronic means to verify identity by using a trusted third party known as a Certificate Authority (CA). SonicWALL certificates are the easiest certificate solution for establishing the identity of peer VPN devices and users.

Internet Key Exchange (IKE) is an important part of IPSec VPN solutions, and it can use digital signatures to authenticate peer devices before setting up security associations. Without digital signatures, VPN users must authenticate by manually exchanging shared secrets or symmetric keys. Devices using digital signatures do not require configuration changes every time a new device is added to the network.

Note: Although SAs can be established with most IPSec-compliant devices, SonicWALL Certificates can only be used between SonicWALL appliances.

This section describes how to establish SAs between SonicWALL appliances that are managed by SonicWALL GMS and SonicWALL appliances that are not managed by SonicWALL GMS.

Note: Before establishing SAs using SonicWALL certificates, you must obtain a Public Key Infrastructure (PKI) administrator certificate and apply it to each SonicWALL appliance.

When All Appliances are Managed by SonicWALL GMS

To enable VPN using certificates, perform the following steps:

Expand the VPN tree and click Configure. The VPN Configure page displays.

Select the Use Interconnected Mode check box.
For the IPSec Keying Mode, Select IKE using SonicWALL Certificates.
Select from the following:

To add a new SA, select Add a new Security Association.
To delete an existing SA, select Delete an existing Security Association.
To edit an existing SA, select Modify an existing Security Association.

Click Select Destination.

A dialog box that contains all SonicWALL appliances managed by this SonicWALL GMS displays.

Select the SonicWALL appliance or group to which you will establish SAs and click the Select button. The name of the target displays in the Target SonicWALL Group/Node field.
Aggressive mode improves the performance of IKE SA negotiation by only requiring three packet exchanges. However, it provides no identity protection. To enable aggressive mode, select Aggressive Mode from the Exchange list box. Otherwise, select Main Mode.
Select the Diffie-Hellman (DH) group that will be used when the VPN devices are negotiating encryption and authentication keys from the Phase 1 DH Group list box.

Note: Group 1 specifies a 768-bit Diffie-Hellman value, Group 2 specifies a more secure 1024-bit Diffie-Hellman value, and Group 5 specifies the currently most secure 1536-bit Diffie-Hellman value.

Select the Diffie-Hellman group that will be used when the VPN devices have established an SA from the Phase 2 DH Group list box.
Select the type of encryption and authentication keys used when the VPN devices are negotiating encryption and authentication keys from the Phase 1 Encryption/Authentication list box.
Select the type of encryption and authentication keys used for the SAs from the Phase 2 Encryption/Authentication list box.
To specify the default LAN gateway, enter the IP address of the gateway in the Default LAN Gateway field.

A Default LAN Gateway is used at a central site in conjunction with a remote site using the Route all Internet traffic through this destination unit check box. The Default LAN Gateway field allows the network administrator to specify the IP address of the default LAN route for incoming Internet Protocol Security (IPSec) packets for this SA.

Incoming packets are decoded by the SonicWALL and compared to static routes configured in the SonicWALL. Since packets can have any IP address destination, it is impossible to configure enough static routes to handle the traffic. For packets received via an IPSec tunnel, the SonicWALL looks up a route for the LAN. If no route is found, the SonicWALL checks for a Default LAN Gateway. If a Default LAN Gateway is detected, the packet is routed through the gateway. Otherwise, the packet is dropped.

To specify how long the tunnel is active before being renegotiated, enter a value in the SA Lifetime field. We recommend a value of 28,800 seconds (8 hours).
To prevent repeated compromises of the same security key when reestablishing a tunnel, select the Enable Perfect Forward Secrecy check box.
To configure the VPN tunnel to remain open as long as there is network traffic on the SA, select the Enable Keep Alive check box.
To configure the SonicWALL appliance to establish the VPN tunnel before users generate any VPN traffic, select the Try to bring up all possible SAs check box.
To disable this SA, select Disable This SA.
Select Enable Wireless Secure Bridging Mode to enable wireless secure bridging mode, a feature that allows two or more physically separated networks to be joined using a secure wireless connection.
To enable NetBIOS broadcasts across the SA, select the Enable Windows Networking Broadcast check box.
To allow the remote VPN tunnel to be included in the routing table, select the Forward Packets to Remote VPNs check box.

Normally, inbound traffic is decrypted and only forwarded to the local LAN or a manually specified route (refer to the Configuring Routing in SonicOS Enhanced). This option enables you to create a “hub and spoke” network configuration where all traffic is routed among branch offices via the corporate office.

Note: To create a “hub and spoke” network, make sure to select the Forward Packets to Remote VPNs check box for each SA.

To force all network traffic to the WAN through a VPN to a central site, select the Route all Internet traffic through destination unit check box.

When this option is selected, all traffic that is not destined for another SA is forwarded through this VPN tunnel. If this option is not specified and the destination does not match any SA, the packet is forwarded unencrypted to the WAN.

Note: Only one SA can have this option enabled.

Select one the following VPN termination options:

To configure the VPN tunnel to terminate at the LAN or WorkPort, select LAN. Users on the other side of the SA will be able to access the LAN, but not the OPT.
To configure the VPN tunnel to terminate at the OPT or DMZ, select OPT. Users on the other side of the SA will be able to access the OPT, but not the LAN.
To allow users on the other side of the SA to access both the LAN and DMZ, select LAN/OPT.

Select from the following NAT and Firewall Rules:

To disable NAT and not apply firewall rules to traffic coming through this SA, select Disabled.
To enable NAT and firewall rules for the selected SonicWALL appliance, select Source. If NAT is enabled, all traffic originating from this appliance will appear to originate from a single IP address and network firewall rules will be applied to all traffic on this SA.
To enable NAT and firewall rules for the selected SonicWALL appliance and its peer, select Source and Destination. If NAT is enabled, all traffic originating from this appliance will appear to originate from a single IP address and all traffic originating from its peer will appear to originate from a single IP address. Network firewall rules will be applied to all traffic on this SA.

Note: Applying firewall rules can dramatically affect services that run between the networks. Understanding the Network Access Rules Hierarchy

Select how local users are authenticated:

To disable authentication for local users, select Disabled.
To configure local users to be authenticated locally, either through the SonicWALL device or the RADIUS server, select Source.
To configure local users to be authenticated on the destination network, either through the SonicWALL device or the RADIUS server, select Destination.
To authenticate local users both locally and on the destination network, select Source and Destination.

Similarly, select how remote users are authenticated.
When you are finished, click Update. The settings are changed for each selected SonicWALL appliance. To clear all screen settings and start over, click Reset.

When One Appliance Is Not Managed by SonicWALL GMS

Although SAs can be established with most IPSec-compliant devices, Certificates can only be used between SonicWALL appliances.

This section describes how to establish SonicWALL certificate-based SAs between SonicWALL appliances that are managed by SonicWALL GMS and SonicWALL appliances that are not managed by SonicWALL GMS.

To create SAs using certificates, perform the following steps:

Expand the VPN tree and click Configure. The VPN Configure page displays.

Deselect the Use Interconnected Mode check box.
Select IKE using SonicWALL Certificates.
Select the appropriate option to add, delete or modify a Security Association.
Enter the name of the remote firewall/VPN gateway in the Security Association Name field. This name must match exactly if the device has a dynamic IP address.
Enter the IP address of the remote firewall/VPN gateway in the IPSec Gateway Address field. This address must be valid and will be the public IP address if the remote LAN has NAT enabled. If the remote VPN gateway has a dynamic IP address, this field can be left blank if the name matches.
To specify how long the tunnel is active before being renegotiated, enter a value in the SA Lifetime field. We recommend a value of 28,800 seconds (8 hours).
To specify the default LAN gateway, enter the IP address of the gateway in the Default LAN Gateway field.

A Default LAN Gateway is used at a central site in conjunction with a remote site using the Route all internet traffic through destination unit check box. The Default LAN Gateway field allows the network administrator to specify the IP address of the default LAN route for incoming IPSec packets for this SA.

To disable this SA, select Disable This SA.
To prevent repeated compromises of the same security key when reestablishing a tunnel, select the Enable Perfect Forward Secrecy check box.
Select Enable Wireless Secure Bridging Mode to enable wireless secure bridging mode, a feature that allows two or more physically separated networks to be joined using a secure wireless connection
To enable NetBIOS broadcasts across the SA, select the Enable Windows Networking Broadcast check box.
To apply NAT and firewall rules to all traffic coming through this SA, select the Apply NAT and firewall rules check box.

This feature is useful for hiding the LAN subnet from the corporate site. All traffic will appear to originate from a single IP address.

To allow the remote VPN tunnel to be included in the routing table, select the Forward Packets to Remote VPNs check box.

This will enable the SonicWALL appliance to receive VPN traffic, decrypt it, and forward it to another VPN tunnel. This feature can be used to create a “hub and spoke” network configuration by routing traffic among SAs. To do this, make sure to enable this option for all SAs.

To configure the VPN tunnel to remain open as long as there is network traffic on the SA, select the Enable Keep Alive check box.
To configure the SonicWALL appliance to establish the VPN tunnel before users generate any VPN traffic, select the Try to bring up all possible SAs check box.
To require local users to authenticate locally before accessing the SA, select the Require authentication of local users check box.
To require remote users to authenticate with this SonicWALL appliance or the local RADIUS server before accessing resources, select the Require authentication of remote users check box.
Enter the serial number of the target SonicWALL appliance in the Peer SonicWALL Serial # field.
Aggressive mode improves the performance of IKE SA negotiation by only requiring three packet exchanges. However, it provides no identity protection. To enable aggressive mode, select Aggressive Mode from the Exchange list box. Otherwise, select Main Mode.
Select the Diffie-Hellman group that will be used when the VPN devices are negotiating encryption and authentication keys from the Phase 1 DH Group list box.

Note: Group 1 specifies a 768-bit Diffie-Hellman value, Group 2 specifies a more secure 1024-bit Diffie-Hellman value, and Group 5 specifies the currently most secure 1536-bit Diffie-Hellman value.

Select the Diffie-Hellman group that will be used when the VPN devices have established an SA from the Phase 2 DH Group list box.
Select the type of encryption and authentication keys used when the VPN devices are negotiating encryption and authentication keys from the Phase 1 Encryption/Authentication list box.
Select the type of encryption and authentication keys used for the SAs from the Phase 2 Encryption/Authentication list box.
Specify the destination networks by selecting from the following:

To allow this SA to be used as the default route for all Internet traffic, select Use this SA as default route for all Internet traffic.
If the destination network will receive its IP addresses on this network using DHCP, select Destination network obtains IP addresses using DHCP.
To specify destination networks, select Specify destination networks below. Then, click Add Networks and enter the destination network IP addresses and subnet masks.

When you are finished, click Update. The settings are changed for each selected SonicWALL appliance. To clear all screen settings and start over, click Reset.

IKE Using Third-Party Certificates

Note: This section assumes that you are familiar with Public Key Infrastructure (PKI) and the implementation of digital certificates with VPN.

A digital certificate is an electronic means to verify identity by using a trusted third party known as a Certificate Authority (CA). SonicWALL now supports third party certificates in addition to the existing Authentication Service. The difference between third party certificates and the SonicWALL Authentication Service is the ability to select the source for your CA certificate. Using Certificate Authority Certificates and Local Certificates is a more manual process than using the SonicWALL Authentication Service; therefore, experience with implementing Public Key Infrastructure (PKI) is necessary to understand the key components of digital certificates.

SonicWALL has implemented X.509v3 as its certificate form and CRLv2 for its certificate revocation list. SonicWALL supports the following two vendors of Certificate Authority Certificates:

• VeriSign

• Entrust

Obtaining a Certificate

To obtain a certificate, refer to the Generating a Certificate Signing Request. After you have obtained certificates for both devices, continue to configure the VPN.

When All Appliances are Managed by SonicWALL GMS

Setting up a VPN tunnel between appliances requires you to configure several parameters on both appliances. When setting up VPN tunnels between SonicWALL appliances managed by SonicWALL GMS, all selected appliances are automatically configured based on the settings that you entered.

To enable VPN using third-party certificates when both devices are managed by SonicWALL GMS, perform the following steps:

Expand the VPN tree and click Configure. The VPN Configure page displays.

Select the Use Interconnected Mode check box.
Select IKE using 3rd Party Certificates.

Note: SonicWALL GMS automatically creates a pre-shared key, SPI, encryption key, authentication key, or certificate information as applicable.

Select the appropriate option to add, delete, or modify a security association.
Click Select Destination. A dialog box that contains all SonicWALL appliances managed by this SonicWALL GMS displays.
Select the SonicWALL appliance or group to which you will establish SAs and click the Select button. The name of the target displays in the Target SonicWALL Group/Node field.
Aggressive mode improves the performance of IKE SA negotiation by only requiring three packet exchanges. However, it provides no identity protection. To enable aggressive mode, select Aggressive Mode from the Exchange list box. Otherwise, select Main Mode.
Select the Diffie-Hellman (DH) group that will be used when the VPN devices are negotiating encryption and authentication keys from the Phase 1 DH Group list box.

Note: Group 1 specifies a 768-bit Diffie-Hellman value, Group 2 specifies a more secure 1024-bit Diffie-Hellman value, and Group 5 specifies the currently most secure 1536-bit Diffie-Hellman value.

Select the Diffie-Hellman group that will be used when the VPN devices have established an SA from the Phase 2 DH Group list box.
Select the type of encryption and authentication keys used when the VPN devices are negotiating encryption and authentication keys from the Phase 1 Encryption/Authentication list box.
Select the type of encryption and authentication keys used for the SAs from the Phase 2 Encryption/Authentication list box.
To specify the default LAN gateway, enter the IP address of the gateway in the Default LAN Gateway field.

To specify how long the tunnel is active before being renegotiated, enter a value in the SA Lifetime field. We recommend a value of 28,800 seconds (8 hours).
To prevent repeated compromises of the same security key when reestablishing a tunnel, select the Enable Perfect Forward Secrecy check box.
To configure the VPN tunnel to remain open as long as there is network traffic on the SA, select the Enable Keep Alive check box.
To configure the SonicWALL appliance to establish the VPN tunnel before users generate any VPN traffic, select the Try to bring up all possible SAs check box.
To enable wireless secure bridging, select the Wireless Secure Bridging Mode check box.
To enable NetBIOS broadcasts across the SA, select the Enable Windows Networking Broadcast check box.
To allow the remote VPN tunnel to be included in the routing table, select the Forward Packets to Remote VPNs check box.

Note: To create a “hub and spoke” network, make sure to select the Forward Packets to Remote VPNs check box for each SA.

To force all network traffic to the WAN through a VPN to a central site, select the Route all Internet traffic through destination unit check box.

Note: Only one SA can have this option enabled.

If the remote side of this VPN connection is to obtain its addressing from a DHCP server on this side of the tunnel, select Enable "Destination network obtains IP addresses using DHCP through this SA" on Target.
Select one the following VPN termination options:

To configure the VPN tunnel to terminate at the LAN, select LAN. Users on the other side of the SA will be able to access the LAN, but not the DMZ.
To configure the VPN tunnel to terminate at the OPT or DMZ, select OPT. Users on the other side of the SA will be able to access the OPT, but not the LAN.
To allow users on the other side of the SA to access both the LAN and OPT, select LAN/OPT.

Select from the following NAT and Firewall Rules:

To disable NAT and not apply firewall rules to traffic coming through this SA, select Disabled.
To enable NAT and firewall rules for the selected SonicWALL appliance, select Source. If NAT is enabled, all traffic originating from this appliance will appear to originate from a single IP address and network firewall rules will be applied to all traffic on this SA.
To enable NAT and firewall rules for the selected SonicWALL appliance and its peer, select Source and Destination. If NAT is enabled, all traffic originating from this appliance will appear to originate from a single IP address and all traffic originating from its peer will appear to originate from a single IP address. Network firewall rules will be applied to all traffic on this SA.

Note: Applying firewall rules can dramatically affect services that run between the networks. Understanding the Network Access Rules Hierarchy

Select how local users are authenticated:

To disable authentication for local users, select Disabled.
To configure local users to be authenticated locally, either through the SonicWALL device or the RADIUS server, select Source.
To configure local users to be authenticated on the destination network, either through the SonicWALL device or the RADIUS server, select Destination.
To authenticate local users both locally and on the destination network, select Source and Destination.

Similarly, select how remote users are authenticated.
When you are finished, click Update. The settings are changed for each selected SonicWALL appliance. To clear all screen settings and start over, click Reset.

When One Appliance Is Not Managed by SonicWALL GMS

This section describes how to configure VPN when the target appliance is not managed by SonicWALL GMS. To create SAs using third-party certificates, perform the following steps:

Expand the VPN tree and click Configure. The VPN Configure page displays.

Deselect the Use Interconnected Mode check box.
Select IKE using 3rd Party Certificates.
Select the appropriate option to add, delete or modify a security association.
Enter the name of the remote firewall/VPN gateway in the Security Association Name field. This name must match exactly if the device has a dynamic IP address.
Select the certificate to use from the Select Certificate list box.
Enter the IP address of the remote firewall/VPN gateway in the IPSec Gateway Address field. This address must be valid and will be the public IP address if the remote LAN has NAT enabled. If the remote VPN gateway has a dynamic IP address, this field can be left blank if the name matches. Optionally, you can specify a IPSec Secondary Gateway Name or Address.
To specify how long the tunnel is active before being renegotiated, enter a value in the SA Lifetime field. We recommend a value of 28,800 seconds (8 hours).
To specify the default LAN gateway, enter the IP address of the gateway in the Default LAN Gateway field.

To prevent repeated compromises of the same security key when reestablishing a tunnel, select the Enable Perfect Forward Secrecy check box.
To enable wireless secure bridging, select the Wireless Secure Bridging Mode check box.
To enable NetBIOS broadcasts across the SA, select the Enable Windows Networking Broadcast check box.
To apply NAT and firewall rules to all traffic coming through this SA, select the Apply NAT and firewall rules check box. This feature is useful for hiding the LAN subnet from the corporate site. All traffic will appear to originate from a single IP address.
To allow the remote VPN tunnel to be included in the routing table, select the Forward Packets to Remote VPNs check box. This will enable the SonicWALL appliance to receive VPN traffic, decrypt it, and forward it to another VPN tunnel.This feature can be used to create a “hub and spoke” network configuration by routing traffic among SAs. To do this, make sure to enable this option for all SAs.
To configure the VPN tunnel to remain open as long as there is network traffic on the SA, select the Enable Keep Alive check box.
To configure the SonicWALL appliance to establish the VPN tunnel before users generate any VPN traffic, select the Try to bring up all possible SAs check box.
To require local users to authenticate locally before accessing the SA, select the Require authentication of local users check box.
To require remote users to authenticate with this SonicWALL appliance or the local RADIUS server before accessing resources, select the Require authentication of remote users check box.
Aggressive mode improves the performance of IKE SA negotiation by only requiring three packet exchanges. However, it provides no identity protection. To enable aggressive mode, select Aggressive Mode from the Exchange list box. Otherwise, select Main Mode.
Select the Diffie-Hellman group that will be used when the VPN devices are negotiating encryption and authentication keys from the Phase 1 DH Group list box.

Note: Group 1 specifies a 768-bit Diffie-Hellman value, Group 2 specifies a more secure 1024-bit Diffie-Hellman value, and Group 5 specifies the currently most secure 1536-bit Diffie-Hellman value.

Select the Diffie-Hellman group that will be used when the VPN devices have established an SA from the Phase 2 DH Group list box.
Select the type of encryption and authentication keys used when the VPN devices are negotiating encryption and authentication keys from the Phase 1 Encryption/Authentication list box.
Select the type of encryption and authentication keys used for the SAs from the Phase 2 Encryption/Authentication list box.
Select whether the peer device uses a distinguished name, email ID, or domain name as its certificate ID from the Peer Certificate’s ID list box.
Enter the peer device’s certificate ID in the Peer Certificate’s ID field.
Select from the following:

To allow this SA to be used as the default route for all Internet traffic, select Use this SA as default route for all Internet traffic.
If the destination network will receive its IP addresses on this network using DHCP, select Destination network obtains IP addresses using DHCP.
To specify destination networks, select Specify destination networks below. Then, click Add Networks and enter the destination network IP addresses and subnet masks.

When you are finished, click Update. The settings are changed for each selected SonicWALL appliance. To clear all screen settings and start over, click Reset.

Note: To disable this SA without deleting it, select the Disable this SA check box and click Update.

IKE Using Pre-Shared Secret

When using IKE with a pre-shared secret, two VPN devices establish encryption and authentication keys using a shared secret. After the SA expires, the SonicWALL appliances will reestablish an SA using the same shared secret, but will not use the same security and authentication keys.

When All Appliances are Managed by SonicWALL GMS

To configure an SA using IKE with pre-shared secrets, perform the following steps:

Expand the VPN tree and click Configure. The VPN Configure page displays.

Select the Use Interconnected Mode check box.
Select IKE using Pre-shared Secret.
Select the appropriate option to add, delete, or modify a security association.
Click Select Destination. A dialog box that contains all SonicWALL appliances managed by this SonicWALL GMS displays.
Select the SonicWALL appliance or group to which you will establish SAs and click the Select button. The name of the target displays in the Target SonicWALL Group/Node field.
Aggressive mode improves the performance of IKE SA negotiation by only requiring three packet exchanges. However, it provides no identity protection. To enable aggressive mode, select Aggressive Mode from the Exchange list box. Otherwise, select Main Mode.
Select the Diffie-Hellman group that will be used when the VPN devices are negotiating encryption and authentication keys from the Phase 1 DH Group list box.

Note: Group 1 specifies a 768-bit Diffie-Hellman value, Group 2 specifies a more secure 1024-bit Diffie-Hellman value, and Group 5 specifies the currently most secure 1536-bit Diffie-Hellman value.

Select the Diffie-Hellman group that will be used when the VPN devices have established an SA from the Phase 2 DH Group list box.
Select the type of encryption and authentication keys used when the VPN devices are negotiating encryption and authentication keys from the Phase 1 Encryption/Authentication list box.
Select the type of encryption and authentication keys used for the SAs from the Phase 2 Encryption/Authentication list box.
To specify the default LAN gateway, enter the IP address of the gateway in the Default LAN Gateway field.

To specify how long the tunnel is active before being renegotiated, enter a value in the SA Lifetime field. We recommend a value of 28,800 seconds (8 hours).
To prevent repeated compromises of the same security key when reestablishing a tunnel, select the Enable Perfect Forward Secrecy check box.
To configure the VPN tunnel to remain open as long as there is network traffic on the SA, select the Enable Keep Alive check box.
To configure the SonicWALL appliance to establish the VPN tunnel before users generate any VPN traffic, select the Try to bring up all possible SAs check box.
To enable wireless secure bridging, select the Wireless Secure Bridging Mode check box.
To enable NetBIOS broadcasts across the SA, select the Enable Windows Networking Broadcast check box.
To allow the remote VPN tunnel to be included in the routing table, select the Forward Packets to Remote VPNs check box.

Note: To create a “hub and spoke” network, make sure to select the Forward Packets to Remote VPNs check box for each SA.

To force all network traffic to the WAN through a VPN to a central site, select the Route all internet traffic through destination unit check box.

Note: Only one SA can have this option enabled.

If the remote side of this VPN connection is to obtain its addressing from a DHCP server on this side of the tunnel, select Enable "Destination network obtains IP addresses using DHCP through this SA" on Target.
Select one the following VPN termination options:

To configure the VPN tunnel to terminate at the LAN or WorkPort, select LAN. Users on the other side of the SA will be able to access the LAN, but not the OPT.
To configure the VPN tunnel to terminate at the OPT or DMZ, select OPT. Users on the other side of the SA will be able to access the OPT, but not the LAN.
To allow users on the other side of the SA to access both the LAN and OPT, select LAN/OPT.

Select from the following NAT and Firewall Rules:

To disable NAT and not apply firewall rules to traffic coming through this SA, select Disabled.
To enable NAT and firewall rules for the selected SonicWALL appliance, select Source. If NAT is enabled, all traffic originating from this appliance will appear to originate from a single IP address and network firewall rules will be applied to all traffic on this SA.
To enable NAT and firewall rules for the selected SonicWALL appliance and its peer, select Source and Destination. If NAT is enabled, all traffic originating from this appliance will appear to originate from a single IP address and all traffic originating from its peer will appear to originate from a single IP address. Network firewall rules will be applied to all traffic on this SA.

Note: Applying firewall rules can dramatically affect services that run between the networks. Understanding the Network Access Rules Hierarchy

Select how local users are authenticated:

To disable authentication for local users, select Disabled.
To configure local users to be authenticated locally, either through the SonicWALL device or the RADIUS server, select Source.
To configure local users to be authenticated on the destination network, either through the SonicWALL device or the RADIUS server, select Destination.
To authenticate local users both locally and on the destination network, select Source and Destination.

Similarly, select how remote users are authenticated.
Select either Remote users behind VPN gateway or Remote VPN clients with XAUTH.
When you are finished, click Update. The settings are changed for each selected SonicWALL appliance. To clear all screen settings and start over, click Reset.

Note: To disable this SA, select the Disable this SA check box and click Update.

When One Appliance Is Not Managed by SonicWALL GMS

This section describes how to configure VPN when the target appliance is not managed by SonicWALL GMS.

To enable VPN using IKE with a pre-shared secret, perform the following steps:

Expand the VPN tree and click Configure. The VPN Configure page displays.

Deselect the Use Interconnected Mode check box.
Select IKE using Pre-Shared Secret in the IPSec Keying mode section.
Select the appropriate option to add, delete, or modify a security association.
Enter the name of the remote firewall/VPN gateway in the Security Association Name field. This name must match exactly if the device has a dynamic IP address.
Enter the IP address of the remote firewall/VPN gateway in the IPSec Gateway Address field. This address must be valid and will be the public IP address if the remote LAN has NAT enabled. If the remote VPN gateway has a dynamic IP address, this field can be left blank if the name matches.
Enter the amount of time before an IKE SA will automatically negotiate (120 to 2,499,999 seconds) in SA Lifetime.
To specify the default LAN gateway, enter the IP address of the gateway in the Default LAN Gateway field.

A Default LAN Gateway is used at a central site in conjunction with a remote site using the Route all Internet traffic through destination unit check box. The Default LAN Gateway field allows the network administrator to specify the IP address of the default LAN route for incoming IPSec packets for this SA.

To prevent repeated compromises of the same security key when reestablishing a tunnel, select the Enable Perfect Forward Secrecy check box.
To enable wireless secure bridging, select the Wireless Secure Bridging Mode check box.
To access remote resources within the Windows Network Neighborhood, select the Enable Windows Networking (NetBIOS) Broadcast check box.
To apply NAT and firewall rules to all traffic coming through this SA, select the Apply NAT and firewall rules check box.

This feature is useful for hiding the LAN subnet from the corporate site. All traffic will appear to originate from a single IP address.

To allow the remote VPN tunnel to be included in the routing table, select the Forward Packets to Remote VPNs check box.

To configure the VPN tunnel to remain open as long as there is network traffic on the SA, select the Enable Keep Alive check box.
To configure the SonicWALL appliance to establish the VPN tunnel before users generate any VPN traffic, select the Try to bring up all possible SAs check box.
To require local users to authenticate locally before accessing the SA, select the Require authentication of local users check box.
To require remote users to authenticate with this SonicWALL appliance or the local RADIUS server before accessing resources, select the Require authentication of remote users check box.
Select either Remote users behind VPN gateway or Remote VPN clients with XAUTH.

Note: Only SonicWALL VPN clients can authenticate to a RADIUS server. Users tunneling from another VPN gateway will not be able to complete the VPN tunnel if this check box is selected.

Enter the shared secret in the Shared Secret field.
Aggressive mode improves the performance of IKE SA negotiation by only requiring three packet exchanges. However, it provides no identity protection. To enable aggressive mode, select Aggressive Mode from the Exchange list box. Otherwise, select Main Mode.
Select the Diffie-Hellman group that will be used when the VPN devices are negotiating encryption and authentication keys from the Phase 1 DH Group list box.

Note: Group 1 specifies a 768-bit Diffie-Hellman value, Group 2 specifies a more secure 1024-bit Diffie-Hellman value, and Group 5 specifies the currently most secure 1536-bit Diffie-Hellman value.

Select the Diffie-Hellman group that will be used when the VPN devices have established an SA from the Phase 2 DH Group list box.
Select the type of encryption and authentication keys used when the VPN devices are negotiating encryption and authentication keys from the Phase 1 Encryption/Authentication list box.
Select the type of encryption and authentication keys used for the SAs from the Phase 2 Encryption/Authentication list box.
Select from the following:

To allow this SA to be used as the default route for all Internet traffic, select Use this SA as default route for all Internet traffic.
If the destination network will receive its IP addresses on this network using DHCP, select Destination network obtains IP addresses using DHCP.
To specify destination networks, select Specify destination networks below. Then, click Add Network and enter the destination network IP addresses and subnet masks.

When you are finished, click Update. The settings are changed for each selected SonicWALL appliance. To clear all screen settings and start over, click Reset.
Create an SA in the remote VPN device for each SonicWALL appliance that you have configured.

Note: To disable this SA without deleting it, select the Disable this SA check box and click Update.

Manual Keying

Manual keying involves exchanging keys in encryption and authentication keys in advance. Although this is the simplest method of establishing an SA between two VPN devices, the SA will always use the same encryption and authentication keys. If the keys are compromised by an outside party, they will remain compromised until the keys are changed.

When All Appliances are Managed by SonicWALL GMS

To enable VPN using manual keying, perform the following steps:

Expand the VPN tree and click Configure. The VPN Configure page displays.

Select the Use Interconnected Mode check box.
Select Manual Key.
Select the appropriate option to add, delete, or modify a security association.
Click Select Destination. A dialog box that contains all SonicWALL appliances managed by this SonicWALL GMS displays.
Select the SonicWALL appliance or group to which you will establish SAs and click the Select button. The name of the target displays in the Target SonicWALL Group/Node field.
Select one of the encryption methods from the Encryption Method list box.
To specify the default LAN gateway, enter the IP address of the gateway in the Default LAN Gateway field.

To enable wireless secure bridging, select the Wireless Secure Bridging Mode check box.
To enable NetBIOS broadcasts across the SA, select the Enable Windows Networking (NetBIOS) Broadcast check box.
To allow the remote VPN tunnel to be included in the routing table, select the Forward Packets to Remote VPNs check box.

Note: To create a “hub and spoke” network, make sure to select the Forward Packets to Remote VPNs check box for each SA.

To force all network traffic to the WAN through a VPN to a central site, select the Route all Internet traffic through destination unit check box.

Select one the following VPN termination options:

To configure the VPN tunnel to terminate at the LAN, select LAN. Users on the other side of the SA will be able to access the LAN, but not the DMZ.
To configure the VPN tunnel to terminate at the OPT or DMZ, select OPT. Users on the other side of the SA will be able to access the OPT, but not the LAN.
To allow users on the other side of the SA to access both the LAN and OPT, select LAN/OPT.

Select from the following NAT and Firewall Rules:

To disable NAT and not apply firewall rules to traffic coming through this SA, select Disabled.
To enable NAT and firewall rules for the selected SonicWALL appliance, select Source. If NAT is enabled, all traffic originating from this appliance will appear to originate from a single IP address and network firewall rules will be applied to all traffic on this SA.
To enable NAT and firewall rules for the selected SonicWALL appliance and its peer, select Source and Destination. If NAT is enabled, all traffic originating from this appliance will appear to originate from a single IP address and all traffic originating from its peer will appear to originate from a single IP address. Network firewall rules will be applied to all traffic on this SA.

Note: Applying firewall rules can dramatically affect services that run between the networks. Understanding the Network Access Rules Hierarchy

Select how local users are authenticated:

To disable authentication for local users, select Disabled.
To configure local users to be authenticated locally, either through the SonicWALL device or the RADIUS server, select Source.
To configure local users to be authenticated on the destination network, either through the SonicWALL device or the RADIUS server, select Destination.
To authenticate local users both locally and on the destination network, select Source and Destination.

Similarly, select how remote users are authenticated.
When you are finished, click Update. The settings are changed for each selected SonicWALL appliance. To clear all screen settings and start over, click Reset.

When One Appliance Is Not Managed by SonicWALL GMS

This section describes how to configure VPN when the target appliance is not managed by SonicWALL GMS.

To enable VPN using manual keying, perform the following steps:

Expand the VPN tree and click Configure. The VPN Configure page displays.

Deselect the Use Interconnected Mode check box.
Select Manual Key in the IPSec Keying mode section.
Select the appropriate option to add, delete or modify a security association.
Enter a descriptive name for the SA in the Security Association Name field.
Enter the IP address of the remote firewall in the IPSec Gateway Address field. This address must be valid and will be the public IP address if the remote LAN has NAT enabled.
To specify the default LAN gateway, enter the IP address of the gateway in the Default LAN Gateway field.

To enable wireless secure bridging, select the Wireless Secure Bridging Mode check box.
To access remote resources within the Windows Network Neighborhood, select the Enable Windows Networking (NetBIOS) Broadcast check box.
To apply NAT and firewall rules to all traffic coming through this SA, select the Apply NAT and firewall rules check box.

This feature is useful for hiding the LAN subnet from the corporate site. All traffic will appear to originate from a single IP address.

To allow the remote VPN tunnel to be included in the routing table, select the Forward Packets to Remote VPNs check box.

To require local users to authenticate locally before accessing the SA, select the Require authentication of local users check box.
To require remote users to authenticate with this SonicWALL appliance or the local RADIUS server before accessing resources, select the Require authentication of remote users check box.
Select one of the encryption methods from the Encryption Method list box.
Enter the key used for encryption in the Encryption Key field. The DES and ARCFour Keys must be exactly 16 characters long and be composed of hexadecimal characters. Encryption keys less than 16 characters will not be accepted; keys longer than 16 characters will be truncated.

Note: Valid hexadecimal characters are “0” to “9”, and “a” to “f” (i.e., 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, a, b, c, d, e, f). For example, a valid key would be “1234567890abcdef.”

This key must match the encryption key of the remote VPN gateway or client. If encryption is not used, this field is ignored.

Enter the key used for authentication in the Authentication Key field. The authentication key must be exactly 32 characters long and be composed of hexadecimal characters. Authentication keys less than 32 characters will not be accepted; keys longer than 32 characters will be truncated.

Note: Valid hexadecimal characters are “0” to “9”, and “a” to “f” (i.e., 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, a, b, c, d, e, f). For example, a valid key would be “1234567890abcdef1234567890abcdef.”

This key must match the authentication key of the remote VPN gateway or client. If authentication is not used, this field is ignored.

Enter the Security Parameter Index (SPI) that the remote location will send to identify the Security Association used for the VPN Tunnel in the Incoming SPI field.

Note: The SPI may be up to eight characters long and be composed of hexadecimal characters. Valid hexadecimal characters are “0” to “9”, and “a” to “f” (e.g., 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, a, b, c, d, e, f). The hexadecimal characters “0” to “ff” inclusive are reserved by the Internet Engineering Task Force (IETF) and are not allowed for use as an SPI. For example, a valid SPI would be “1234abcd.”

Note: The SPI for an SA must be unique when compared to SPIs for other SAs. However, the Incoming SPI can be the same as the Outgoing SPI on the same SA.

Enter the Security Parameter Index (SPI) that the local SonicWALL VPN will transmit to identify the Security Association used for the VPN Tunnel in the Outgoing SPI field.
Select from the following:

To allow this SA to be used as the default route for all Internet traffic, select Use this SA as default route for all Internet traffic.
To specify destination networks, select Specify destination networks below. Then, click Modify and enter the destination network IP addresses and subnet masks.

When you are finished, click Update. The settings are changed for each selected SonicWALL appliance. To clear all screen settings and start over, click Reset.
Create an SA in the remote VPN device for each SonicWALL appliance that you have configured.