PANEL_vpnConfig

PANEL_vpnConfig

For information on configuring VPNs in SonicOS Enhanced, see:

Configuring VPNs in SonicOS Enhanced

For an overview of VPNs in SonicOS Enhanced, see <Bold>VPN > Settings.

SonicWALL VPN, based on the industry-standard IPsec VPN implementation, provides a easy-to-setup, secure solution for connecting mobile users, telecommuters, remote offices and partners via the Internet. Mobile users, telecommuters, and other remote users with broadband (DSL or cable) or dialup Internet access can securely and easily access your network resources with the SonicWALL Global VPN Client and SonicWALL GroupVPN on your SonicWALL. Remote office networks can securely connect to your network using site-to-site VPN connections that enable network-to- network VPN connections.

Note         For more information on the SonicWALL Global VPN Client, see the SonicWALL Global VPN Client Administrator’s Guide.

SonicWALL’s GroupVPN provides automatic VPN policy provisioning for SonicWALL Global VPN Clients. The GroupVPN feature on the SonicWALL security appliance and the SonicWALL Global VPN Client dramatically streamline VPN deployment and management. Using SonicWALL’s Client Policy Provisioning technology, you define the VPN policies for Global VPN Client users. This policy information automatically downloads from the SonicWALL security appliance (VPN Gateway) to Global VPN Clients, saving remote users the burden of provisioning VPN connections.

You can easily and quickly create a site-to-site VPN policy or a GroupVPN policy using the VPN Policy Wizard. You can also configure GroupVPN or site-to-site VPN tunnels using the Management Interface. You can define up to four GroupVPN policies, one for each zone. You can also create multiple site-to-site VPN. The maximum number of policies you can add depends on your SonicWALL model.

Note         Remote users must be explicitly granted access to network resources on the Users > Local Users or Users > Local Groups pages. When configuring local users or local groups, the VPN Access tab affects the ability of remote clients using GVC connecting to GroupVPN; it also affects remote users using NetExtender, and SSL VPN Virtual Office bookmarks to access network resources. This is new behavior in SonicOS 5.6 and above. To allow GVC, NetExtender, or Virtual Office users to access a network resource, the network address objects or groups must be added to the “allow” list on the VPN Access tab.

VPN Policy Wizard

The VPN Policy Wizard walks you step-by-step through the configuration of GroupVPN or site-to-site VPN policies on the SonicWALL security appliance. After completing the configuration, the wizard creates the necessary VPN settings for the selected policy. You can use the SonicWALL Management Interface for optional advanced configuration options.

Note         For step-by-step instructions on using the VPN Policy Wizard, see Wizards > VPN Wizard.

VPN Global Settings

The Global VPN Settings section of the VPN > Settings page displays the following information:

VPN Policies

All existing VPN policies are displayed in the VPN Policies table. Each entry displays the following information:

The number of VPN policies defined, policies enabled, and the maximum number of Policies allowed is displayed below the table. You can define up to 4 GroupVPN policies, one for each zone. These GroupVPN policies are listed by default in the VPN Policies table as WAN GroupVPN, LAN GroupVPN, DMZ GroupVPN, and WLAN GroupVPN. Clicking on the edit icon in the Configure column for the GroupVPN displays the VPN Policy window for configuring the GroupVPN policy.

Below the VPN Policies table are the following buttons:

Navigating and Sorting the VPN Policies Entries

The VPN Policies table provides easy pagination for viewing a large number of VPN policies. You can navigate a large number of VPN policies listed in the VPN Policies table by using the navigation control bar located at the top right of the VPN Policies table. Navigation control bar includes four buttons. The far left button displays the first page of the table. The far right button displays the last page. The inside left and right arrow buttons moved the previous or next page respectively.

You can enter the policy number (the number listed before the policy name in the # Name column) in the Items field to move to a specific VPN policy. The default table configuration displays 50 entries per page. You can change this default number of entries for tables on the System > Administration page.

You can sort the entries in the table by clicking on the column header. The entries are sorted by ascending or descending order. The arrow to the right of the column entry indicates the sorting status. A down arrow means ascending order. An up arrow indicates a descending order.

Currently Active VPN Tunnels

A list of currently active VPN tunnels is displayed in this section. The table lists the name of the VPN Policy, the local LAN IP addresses, and the remote destination network IP addresses as well as the peer gateway IP address.

Click the Renegotiate button to force the VPN Client to renegotiate the VPN tunnel.

Viewing VPN Tunnel Statistics

In the Currently Active VPN Tunnels table, click on the Statistics icon in the row for a tunnel to view the statistics on that tunnel. The VPN Tunnel Statistics icon displays:

For detailed information on configuring VPNs in SonicOS Enhanced, see:

Configuring GroupVPN Policies

SonicWALL GroupVPN facilitates the set up and deployment of multiple SonicWALL Global VPN Clients by the SonicWALL security appliance administrator. GroupVPN is only available for SonicWALL Global VPN Clients and it is recommended you use XAUTH/RADIUS or third party certificates in conjunction with the Group VPN for added security.

For more information on the SonicWALL Global VPN Client, see the SonicWALL Global VPN Client Administrator’s Guide.

The default GroupVPN configuration allows you to support SonicWALL Global VPN Clients without any further editing of the VPN policy, except to check the Enable box for GroupVPN in the VPN Policies table.

SonicWALL supports four GroupVPN policies. You can create GroupVPN policies for the DMZ, LAN, WAN, and WLAN zones. These GroupVPN policies are listed in the VPN policies tables as WAN Group VPN, LAN GroupVPN, DMZ GroupVPN, and WLAN GroupVPN. For these GroupVPN policies, you can choose from IKE using Preshared Secret or IKE using 3rd Party Certificates for your IPsec Keying Mode.

Tip             You can easily create GroupVPN policies using the VPN Policy Wizard. For complete step-by-step instructions on using the VPN Policy Wizard, see Wizards > VPN Wizard.

Note         See the GroupVPN Setup in SonicOS Enhanced technote on the SonicWALL documentation Web site http://www.sonicwall.com for more GroupVPN configuration information.

SonicOS supports the creation and management of IPsec VPNs.

Configuring GroupVPN with IKE using Preshared Secret on the WAN Zone

To configure the WAN GroupVPN, follow these steps:

  1. Click the edit icon for the WAN GroupVPN entry. The VPN Policy window is displayed.

  2. In the General tab, IKE using Preshared Secret is the default setting for Authentication Method. A Shared Secret is automatically generated by the SonicWALL security appliance in the Shared Secret field, or you can generate your own shared secret. Shared Secrets must be minimum of four characters. You cannot change the name of any GroupVPN policy.

  3. Click the Proposals tab to continue the configuration process.

  4. In the IKE (Phase 1) Proposal section, use the following settings:

    5. Note        The Windows 2000 L2TP client and Windows XP L2TP client can only work with DH Group 2. They are incompatible with DH Groups 1 and 5.

  5. In the IPsec (Phase 2) Proposal section, select the following settings:

    6. Note         The Windows 2000 L2TP client and Windows XP L2TP client can only work with DH Group 2. They are incompatible with DH Groups 1 and 5.

  6. Click the Advanced tab.

  7. Select any of the following optional settings you want to apply to your GroupVPN policy:

  8. Click the Client tab, select any of the following settings you want to apply to your GroupVPN policy.

  9. Click OK.

Configuring GroupVPN with IKE using 3rd Party Certificates

To configure GroupVPN with IKE using 3rd Party Certificates, follow these steps:

Caution        Before configuring GroupVPN with IKE using 3rd Party Certificates, your certificates must be installed on the SonicWALL.

  1. In the VPN > Settings page click the edit icon under Configure. The VPN Policy window is displayed.

  2. In the Security Policy section, select IKE using 3rd Party Certificates from the Authentication Method menu. The VPN policy name is GroupVPN by default and cannot be changed.

  3. Select a certificate for the SonicWALL from the Gateway Certificate menu.

  4. Select one of the following Peer ID types from the Peer ID Type menu:

    5. Up to three organizational units can be specified. The usage is c=*;o=*;ou=*;ou=*;ou=*;cn=*. The final entry does not need to contain a semi-colon. You must enter at least one entry, i.e. c=us.

  5. Enter the Peer ID filter in the Peer ID Filter field.

  6. Check Allow Only Peer Certificates Signed by Gateway Issuer to specify that peer certificates must be signed by the issuer specified in the Gateway Certificate menu.

  7. Click on the Proposals tab.

  8. In the IKE (Phase 1) Proposal section, select the following settings:

    9. Note         The Windows 2000 L2TP client and Windows XP L2TP client can only work with DH Group 2. They are incompatible with DH Groups 1 and 5.

  9. In the IPsec (Phase 2) Proposal section, select the following settings:

    10. Note         The Windows 2000 L2TP client and Windows XP L2TP client can only work with DH Group 2. They are incompatible with DH Groups 1 and 5.

  10. Click on the Advanced tab and select any of the following optional settings that you want to apply to your GroupVPN Policy:

  11. Click on the Client tab and select any of the following boxes that you want to apply to Global VPN Client provisioning:

  12. Click OK.

Exporting a VPN Client Policy

If you want to export the Global VPN Client configuration settings to a file for users to import into their Global VPN Clients, follow these instructions:

Caution        The GroupVPN SA must be enabled on the SonicWALL to export a configuration file.

  1. Click the Disk icon in the Configure column for the GroupVPN entry in the VPN Policies table. The Export VPN Client Policy window appears.

  2. rcf format is required for SonicWALL Global VPN Clients is selected by default. Files saved in the rcf format can be password encrypted. The SonicWALL provides a default file name for the configuration file, which you can change.

  3. Click Yes. The VPN Policy Export window appears.

  4. Type a password in the Password field and reenter it in the Confirm Password field, if you want to encrypt the exported file. If you choose not to enter a password, the exported file is not encrypted.

  5. Click Submit. If you did not enter a password, a message appears confirming your choice.

  6. Click OK. You can change the configuration file before saving.

  7. Save the file.

  8. Click Close.

The file can be saved to a floppy disk or sent electronically to remote users to configure their Global VPN Clients.

Site-to-Site VPN Configurations

When designing VPN connections, be sure to document all pertinent IP addressing information and create a network diagram to use as a reference. A sample planning sheet is provided on the next page. The SonicWALL must have a routable WAN IP address whether it is dynamic or static. In a VPN network with dynamic and static IP addresses, the VPN gateway with the dynamic address must initiate the VPN connection.

Site-to-Site VPN configurations can include the following options:

Creating Site-to-Site VPN Policies

Tip             You can easily create site-to-site VPN policies using the VPN Policy Wizard. For complete step-by-step instructions on using the VPN Policy Wizard, see Wizards > VPN Wizard.

You can create or modify existing VPN policies using the VPN Policy window. Clicking the Add button under the VPN Policies table displays the VPN Policy window for configuring the following IPsec Keying mode VPN policies:

This section also contains information on configuring a static route to act as a failover in case the VPN tunnel goes down. See Configuring VPN Failover to a Static Route for more information.

Tip             Use the VPN Planning Sheet for Site-to-Site VPN Policies to record your settings. These settings are necessary to configure the remote SonicWALL and create a successful VPN connection.

Note         For configuring VPN policies between SonicWALL security appliances running SonicOS Enhanced and SonicWALL security appliances running SonicWALL Firmware version 6.5 (or higher), see the technote: Creating IKE IPsec VPN Tunnels between SonicWALL Firmware 6.5 and SonicOS Enhanced, available at the SonicWALL documentation Web site http://www.sonicwall.com/us/Support.html.

Configuring a VPN Policy with IKE using Preshared Secret

To configure a VPN Policy using Internet Key Exchange (IKE), follow the steps below:

  1. Click Add on the VPN > Settings page. The VPN Policy window is displayed.

  2. In the General tab, select IKE using Preshared Secret from the Authentication Method menu.

  3. Enter a name for the policy in the Name field.

  4. Enter the host name or IP address of the remote connection in the IPsec Primary Gateway Name or Address field.

  5. If the Remote VPN device supports more than one endpoint, you may optionally enter a second host name or IP address of the remote connection in the IPsec Secondary Gateway Name or Address field.

    6. Note         Secondary gateways are not supported with IKEv2.

  6. Enter a Shared Secret password to be used to setup the Security Association the Shared Secret and Confirm Shared Secret fields. The Shared Secret must be at least 4 characters long, and should comprise both numbers and letters.

    7. Optionally, specify a Local IKE ID (optional) and Peer IKE ID (optional) for this Policy. By default, the IP Address (ID_IPv4_ADDR) is used for Main Mode negotiations, and the SonicWALL Identifier (ID_USER_FQDN) is used for Aggressive Mode.

  7. Click the Network tab.

  8. Under Local Networks, select a local network from Choose local network from list if a specific local network can access the VPN tunnel. If hosts on this side of the VPN connection will be obtaining their addressing from a DHCP server on the remote side of the tunnel, select Local network obtains IP addresses using DHCP through this VPN tunnel. If traffic can originate from any local network, select Any Address. Use this option if a peer has Use this VPN tunnel as default route for all Internet traffic selected.

    9. Note         DHCP over VPN is not supported with IKEv2.

  9. Under Destination Networks, select Use this VPN Tunnel as default route for all Internet traffic if traffic from any local user cannot leave the SonicWALL security appliance unless it is encrypted. You can only configure one SA to use this setting. If the remote side of this VPN connection is be obtaining its addressing from a DHCP server on this side of the tunnel, select Destination network obtains IP addresses using DHCP server through this tunnel. Alternatively, select Choose Destination network from list, and select the address object or group.

  10. If IKEv2 is selected for the Exchange method on the Proposals tab, a third option is available under Destination Networks: the use IKEv2 IP pool option assigns remote clients with an IP address from the selected IP address pool.

  11. Click the Proposals tab.

  12. Under IKE (Phase 1) Proposal, select either Main Mode, Aggressive Mode, or IKEv2 from the Exchange menu. Aggressive Mode is generally used when WAN addressing is dynamically assigned. IKEv2 causes all the negotiation to happen via IKEv2 protocols, rather than using IKE Phase 1 and Phase 2. If you use IKEv2, both ends of the VPN tunnel must use IKEv2.

  13. Under IKE (Phase 1) Proposal, the default values for DH Group, Encryption, Authentication, and Life Time are acceptable for most VPN configurations. Be sure the Phase 1 values on the opposite side of the tunnel are configured to match. You can also choose AES-128, AES-192, or AES-256 from the Authentication menu instead of 3DES for enhanced authentication security.

    14. Note         The Windows 2000 L2TP client and Windows XP L2TP client can only work with DH Group 2. They are incompatible with DH Groups 1 and 5.

  14. Under IPsec (Phase 2) Proposal, the default values for Protocol, Encryption, Authentication, Enable Perfect Forward Secrecy, DH Group, and Lifetime are acceptable for most VPN SA configurations. Be sure the Phase 2 values on the opposite side of the tunnel are configured to match.

  15. Click the Advanced tab and select any of the following optional settings you want to apply to your VPN policy:

    16. The term Trigger Packet refers to the use of initial Traffic Selector payloads populated with the IP addresses from the packet that caused SA negotiation to begin. It is recommended practice to include Trigger Packets to assist the IKEv2 Responder in selecting the correct protected IP address ranges from its Security Policy Database. Not all implementations support this feature, so it may be appropriate to disable the inclusion of Trigger Packets to some IKE peers.

  16. Click OK.

Configuring a VPN Policy using Manual Key

To manually configure a VPN policy between two SonicWALL appliances using Manual Key, follow the steps below:

Configuring the Local SonicWALL Security Appliance

  1. Click Add on the VPN > Settings page. The VPN Policy window is displayed.

  2. In the General tab of the VPN Policy window, select Manual Key from the IPsec Keying Mode menu. The VPN Policy window displays the manual key options.

  3. Enter a name for the policy in the Name field.

  4. Enter the host name or IP address of the remote connection in the IPsec Gateway Name or Address field.

  5. Click the Network tab.

  6. Select a local network from Choose local network from list if a specific local network can access the VPN tunnel. If traffic can originate from any local network, select Any Address. Use this option is a peer has Use this VPN Tunnel as default route for all Internet traffic selected. You can only configure one SA to use this setting. Alternatively, select Choose Destination network from list, and select the address object or group.

  7. Click on the Proposals tab.

  8. Define an Incoming SPI and an Outgoing SPI. The SPIs are hexadecimal (0123456789abcedf) and can range from 3 to 8 characters in length.

    9. Caution        Each Security Association must have unique SPIs; no two Security Associations can share the same SPIs. However, each Security Association Incoming SPI can be the same as the Outgoing SPI.

  9. The default values for Protocol, Phase 2 Encryption, and Phase 2 Authentication are acceptable for most VPN SA configurations.

    10. Note         The values for Protocol, Phase 2 Encryption, and Phase 2 Authentication must match the values on the remote SonicWALL.

  10. Enter a 16 character hexadecimal encryption key in the Encryption Key field or use the default value. This encryption key is used to configure the remote SonicWALL encryption key, therefore, write it down to use when configuring the SonicWALL.

  11. Enter a 32 character hexadecimal authentication key in the Authentication Key field or use the default value. Write down the key to use while configuring the SonicWALL settings.

    12. Tip             Valid hexadecimal characters include 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, a, b, c, d, e, and f. 1234567890abcdef is an example of a valid DES or ARCFour encryption key. If you enter an incorrect encryption key, an error message is displayed at the bottom of the browser window.

  12. Click the Advanced tab and select any of the following optional settings you want to apply to your VPN policy.

  13. Click OK.

  14. Click Accept on the VPN > Settings page to update the VPN Policies.

Configuring the Remote SonicWALL Security Appliance

  1. Click Add on the VPN > Settings page. The VPN Policy window is displayed.

  2. In the General tab, select Manual Key from the IPsec Keying Mode menu.

  3. Enter a name for the SA in the Name field.

  4. Enter the host name or IP address of the local connection in the IPsec Gateway Name or Address field.

  5. Click the Network tab.

  6. Select a local network from Choose local network from list if a specific local network can access the VPN tunnel. If traffic can originate from any local network, select Any Address. Select Use this VPN Tunnel as default route for all Internet traffic if traffic from any local user cannot leave the SonicWALL security appliance unless it is encrypted. You can only configure one SA to use this setting. Alternatively, select Choose Destination network from list, and select the address object or group.

  7. Click the Proposals tab.

  8. Define an Incoming SPI and an Outgoing SPI. The SPIs are hexadecimal (0123456789abcedf) and can range from 3 to 8 characters in length.

    9. Warning         Each Security Association must have unique SPIs; no two Security Associations can share the same SPIs. However, each Security Association Incoming SPI can be the same as the Outgoing SPI.

  9. The default values for Protocol, Phase 2 Encryption, and Phase 2 Authentication are acceptable for most VPN SA configurations.

    10. Note         The values for Protocol, Phase 2 Encryption, and Phase 2 Authentication must match the values on the remote SonicWALL.

  10. Enter a 16 character hexadecimal encryption key in the Encryption Key field or use the default value. This encryption key is used to configure the remote SonicWALL encryption key, therefore, write it down to use when configuring the remote SonicWALL.

  11. Enter a 32 character hexadecimal authentication key in the Authentication Key field or use the default value. Write down the key to use while configuring the remote SonicWALL settings.

    12. Tip             Valid hexadecimal characters include 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, a, b, c, d, e, and f. 1234567890abcdef is an example of a valid DES or ARCFour encryption key. If you enter an incorrect encryption key, an error message is displayed at the bottom of the browser window.

  12. Click the Advanced tab and select any of the following optional settings you want to apply to your VPN policy:

    13. Warning         You cannot use this feature if you have selected Use this VPN Tunnel as the default route for all Internet traffic on the Network tab.

  13. Click OK.

  14. Click Accept on the VPN > Settings page to update the VPN Policies.

Tip             Since Window Networking (NetBIOS) has been enabled, users can view remote computers in their Windows Network Neighborhood. Users can also access resources on the remote LAN by entering servers’ or workstations’ remote IP addresses.

Configuring a VPN Policy with IKE using a Third Party Certificate

Warning         You must have a valid certificate from a third party Certificate Authority installed on your SonicWALL before you can configure your VPN policy with IKE using a third party certificate.

To create a VPN SA using IKE and third party certificates, follow these steps:

  1. In the VPN > Settings page, click Add. The VPN Policy window is displayed.

  2. In the Authentication Method list in the General tab, select IKE using 3rd Party Certificates.The VPN Policy window displays the 3rd party certificate options.

  3. Type a Name for the Security Association in the Name field.

  4. Type the IP address or Fully Qualified Domain Name (FQDN) of the primary remote SonicWALL in the IPsec Primary Gateway Name or Address field. If you have a secondary remote SonicWALL, enter the IP address or Fully Qualified Domain Name (FQDN) in the IPsec Secondary Gateway Name or Address field.

  5. Under IKE Authentication, select a third party certificate from the Local Certificate list. You must have imported local certificates before selecting this option.

  6. Select one of the following Peer ID types from the Peer IKE ID Type menu:

    7. The format of any Subject Distinguished Name is determined by the issuing Certificate Authority. Common fields are Country (C=), Organization (O=), Organizational Unit (OU=), Common Name (CN=), Locality (L=), and vary with the issuing Certificate Authority. The actual Subject Distinguished Name field in an X.509 Certificate is a binary object which must be converted to a string for matching purposes. The fields are separated by the forward slash character, for example: /C=US/O=SonicWALL, Inc./OU=TechPubs/CN=Joe Pub

    To find the certificate details (Subject Alternative Name, Distinguished Name, etc.), navigate to the System > Certificates page and click on the icon_boot_or_export.jpg Export button for the certificate.

  7. Type an ID string in the Peer IKE ID field.

  8. Click on the Network tab.

  9. Under Local Networks, select a local network from Choose local network from list if a specific local network can access the VPN tunnel. If hosts on this side of the VPN connection will be obtaining their addressing from a DHCP server on the remote side of the tunnel, select Local network obtains IP addresses using DHCP through this VPN tunnel. If traffic can originate from any local network, select Any Address.

  10. Under Destination Networks, select Use this VPN Tunnel as default route for all Internet traffic if traffic from any local user cannot leave the SonicWALL security appliance unless it is encrypted. You can only configure one SA to use this setting. If the remote side of this VPN connection is be obtaining its addressing from a DHCP server on this side of the tunnel, select Destination network obtains IP addresses using DHCP server through this tunnel. Alternatively, select Choose Destination network from list, and select the address object or group.

  11. Click the Proposals tab.

  12. In the IKE (Phase 1) Proposal section, select the following settings:

    13. Note         The Windows 2000 L2TP client and Windows XP L2TP client can only work with DH Group 2. They are incompatible with DH Groups 1 and 5.

  13. In the IPsec (Phase 2) Proposal section, select the following settings:

    14. Note         The Windows 2000 L2TP client and Windows XP L2TP client can only work with DH Group 2. They are incompatible with DH Groups 1 and 5.

  14. Click the Advanced tab. Select any optional configuration options you want to apply to your VPN policy:

  15. Click OK.

Configuring VPN Failover to a Static Route

Optionally, you can configure a static route to be used as a backup route in case the VPN tunnel goes down. The Allow VPN path to take precedence option allows you to create a backup route for a VPN tunnel. By default, static routes have a metric of one and take precedence over VPN traffic. The Allow VPN path to take precedence option gives precedence over the route to VPN traffic to the same destination address object. This results in the following behavior:

To configure a static route as a VPN failover, complete the following steps:

  1. Navigate to the Network > Routing page.

  2. Scroll to the bottom of the page and click on the Add button. The Add Route Policy window is displayed.

  3. Select the appropriate Source, Destination, Service, Gateway, and Interface.

  4. Leave the Metric as 1.

  5. Enable the Allow VPN path to take precedence checkbox.

  6. Click OK.

For more information on configuring static routes and Policy Based Routing, see Network > Routing.

Route Based VPN

A policy-based approach forces the VPN policy configuration to include the network topology configuration. This makes it difficult for the network administrator to configure and maintain the VPN policy with a constantly changing network topology.

With the Route Based VPN approach, network topology configuration is removed from the VPN policy configuration. The VPN policy configuration creates a Tunnel Interface between two end points. Static or Dynamic routes can then be added to the Tunnel Interface. The Route Based VPN approach moves network configuration from the VPN policy configuration to Static or Dynamic Route configuration.

Not only does Route Based VPN make configuring and maintaining the VPN policy easier, a major advantage of the Route Based VPN feature is that it provides flexibility on how traffic is routed. With this feature, users can now define multiple paths for overlapping networks over a clear or redundant VPN.

Using Route Based VPN

Route Based VPN configuration is a two step process. The first step involves creating a Tunnel Interface. The crypto suites used to secure the traffic between two end-points are defined in the Tunnel Interface. The second step involves creating a static or dynamic route using Tunnel Interface.

The Tunnel Interface is created when a Policy of type “Tunnel Interface” is added for the remote gateway. The Tunnel Interface must be bound to a physical interface and the IP address of that physical interface is used as the source address of the tunneled packet.

Adding a Tunnel Interface

The following procedures explain how to add a Tunnel Interface:

  1. Navigate to VPN>Settings>VPN Policies. Click the Add button. This will open the VPN Policy Configuration dialog box.

  2. On the General tab, select the policy type as “Tunnel Interface.”

    3. general_tab.jpg

     

  3. Next, navigate to the Proposal tab and configure the IKE and IPSec proposals for the tunnel negotiation.

    4. Proposal_tab.jpg

     

  4. Navigate to the Advanced tab to configure the advanced properties for the Tunnel Interface. By default, Enable Keep Alive is enabled. This is to establish the tunnel with remote gateway proactively.

    5. Advanced_tab.jpg

     

  5. The following other advanced options can be configured:

Creating a Static Route for Tunnel Interface

After you have successfully added a Tunnel Interface, you may then create a Static Route. Follow the procedures to create a Static Route for a Tunnel Interface:

Navigate to Network>Routing>Route Policies. Click the Add button. A dialogue window appears for adding Static Route. Note that the “Interface” dropdown menu lists all available tunnel interfaces.

static_route_interface.jpg

 

Note         If the “Auto-add Access Rule” option is selected, firewall rules are automatically added and traffic is allowed between the configured networks using tunnel interface.

Route Entries for Different Network Segments

After a tunnel interface is created, multiple route entries can be configured to use the same tunnel interface for different networks. This provides a mechanism to modify the network topology without making any changes to the tunnel interface.

The image below shows an example of same tunnel interface for different networks (Routes 1 & 2):

route_entries.jpg

 

Redundant Static Routes for a Network

After more than one tunnel interface is configured, you can add multiple overlapping static routes; each static route uses a different tunnel interface to route the traffic. This provides routing redundancy for the traffic to reach the destination.

The image below illustrates redundant static routes for a network (Routes 2 & 3):

redundant_static_routes.jpg

 

Drop Tunnel Interface

The drop tunnel interface is a pre-configured tunnel interface. This interface provides added security for traffic. An example of this would be if a static route bind interface is deemed the drop tunnel interface, then all the traffic for that route is dropped and not forwarded in clear. If a static route bind to tunnel interface is defined for traffic (source/destination/service), and it is desired that traffic should not be forwarded in the clear if the tunnel interface is down, it is recommended to configure a static route bind to drop tunnel interface for the same network traffic. As a result, if the tunnel interface is down, traffic will be dropped due to the drop tunnel interface static route.

Creating a Static Route for Drop Tunnel Interface

To add a static route for drop tunnel interface, navigate to Network>Routing>Routing Policies. Click the Add button. Similar to configuring a static route for a tunnel interface, configure the values for Source, Destination, and Service Objects. Under Interface, select “Drop_tunnelIf.”

drop_tunnel_interface.jpg

 

 

Once added, the route is enabled and displayed in the Route Polices.

drop_tunnel_ui.jpg

 

VPN Auto-Added Access Rule Control

When adding VPN Policies, SonicOS Enhanced auto-creates non-editable Access Rules to allow the traffic to traverse the appropriate zones. Consider the following VPN Policy, where the Local Network is set to Firewalled Subnets (in this case comprising the LAN and DMZ) and the Destination Network is set to Subnet 192.168.169.0.

While this is generally a tremendous convenience, there are some instances where is might be preferable to suppress the auto-creation of Access Rules in support of a VPN Policy. One such instance would be the case of a large hub-and-spoke VPN deployment where all the spoke site are addresses using address spaces that can easily be supernetted. For example, assume we wanted to provide access to/from the LAN and DMZ at the hub site to one subnet at each of 2,000 remote sites, addressed as follows:

remoteSubnet0=Network 10.0.0.0/24 (mask 255.255.255.0, range 10.0.0.0-10.0.0.255)
remoteSubnet1=Network 10.0.1.0/24 (mask 255.255.255.0, range 10.0.1.0-10.0.1.255)
remoteSubnet2=Network 10.0.2.0/24 (mask 255.255.255.0, range 10.0.2.0-10.0.2.255)
remoteSubnet2000=10.7.207.0/24 (mask 255.255.255.0, range 10.7.207.0-10.7.207.255)

Creating VPN Policies for each of these remote sites would result in the requisite 2,000 VPN Policies, but would also create 8,000 Access Rules (LAN -> VPN, DMZ -> VPN, VPN -> LAN, and VPN -> DMZ for each site). However, all of these Access Rules could easily be handled with just 4 Access Rules to a supernetted or address range representation of the remote sites (More specific allow or deny Access Rules could be added as needed):

remoteSubnetAll=Network 10.0.0.0/13 (mask 255.248.0.0, range 10.0.0.0-10.7.255.255) or
remoteRangeAll=Range 10.0.0.0-10.7.207.255

To enable this level of aggregation, the Advanced tab of the VPN Policy window page offers the option to Auto-Add Access Rules for VPN Policy setting. By default, the checkbox is selected, meaning the accompanying Access Rules will be automatically created, as they've always been. By deselecting the checkbox upon creating the VPN Policy, the administrator will have the ability and need to create custom Access Rules for VPN traffic.