Site-to-site VPN connections are very easy to create between Sonicwall devices, almost ridiculously easy. Here’s how to do it.
Sonicwall let’s you set up site-to-site VPN’s in a number of ways. I find the easiest and fastest way is to use the procedure that Sonicwall recommends when one of the VPN gateway Sonicwalls receives its WAN address via DHCP even if both of your gateway devices have static addresses. The reason I do this is the process pretty much never fails, is easy to troubleshoot and can be completed in minutes.
To use this process you have to decide on one Sonicwall as the “master” as it will always “listen” for VPN connections; the other Sonicwall will be the initiator. If you are going to have multiple remote sites coming back to a main site then it only makes sense to make the main site the master. If you only have two units involved then pick one as the master.
On the master unit perform the following steps:
Go to VPN –> Settings. On that screen make sure Enable VPN is ticked and then change the “Unique Firewall Identifier” to be something that is easily identifiable like “MASTER” or “VICTORIA FIREWALL” or whatever and click the Accept button. This will be the NAME you use in following steps. Now, click the ADD button under VPN Policies, the following will appear:
Fill in your entries as follows:
- Leave Policy type as is
- Leave Authentication method as is
- For Name fill in the name that you will be giving the OTHER Sonicwall (the one at the other end of the VPN tunnel)
- Enter 0.0.0.0 for both the Primary and Secondary gateways. The reason for this is that you are setting up this unit to “listen” for the VPN connection and the remote end will pass this information through upon making the connection.
- Enter your desired “shared secret” for the encryption key. Make note of what you enter as you will need to enter the same key on the other Sonciwall. Longer, more random secrets are better than short, easily “guessed’ secrets.
- For the Local IKE ID select Firewall Identifier from the dropdown box then enter THIS Sonicwall’s name.
- For the Peer ID select Firewall Identifier from the dropdown box then enter THE OTHER Sonicwall’s name.
Click on the Network tab:
On the Local Networks select LAN Subnets from the dropdown list.
On the Remote Networks select Create New Address Object and fill in the info for the LAN at the other end of the VPN similar to the following:
You should then have something like the following:
Click on the Proposals tab and set like the following:
Click on the Advanced tab and set like the following:
Click the OK button to save the settings.
The new policy will be displayed on the VPN Policies page. Now, switch yourself over to the other Sonicwall and repeat the same steps with the following differences:
Enter the WAN IP address OR the FQDN of the master Sonicwall as the Primary gateway. Remember, the Sonicwall you are configuring is the initiator of the VPN connection so it has to know what it needs to connect to.
On the Network tab you do the same thing as you did the first time around only this time the Remote Network will be the LAN behind the master Sonicwall.
The Proposals should match the other side:
On the Advanced tab the only change is to ensure the Enable Keep Alive is ticked.
Click the OK button to save the policy.
Assuming you’ve made no typo’s and all is well with your WAN connections, the VPN tunnel should come up on both Sonicwalls. The tunnel is up when both Sonicwalls display the green ball icon on the VPN policy. You will also see tunnel information appear under the Currently Active VPN Tunnels when a tunnel is established:
Once your VPN policies are created you can make modifications that expand what traffic is allowed to flow over the tunnel. In this case we just allowed traffic on each primary LAN behind each Sonicwall to reach the primary LAN behind the other Sonicwall. We set this up on the Networks portion of each policy and bound the policies to the LAN subnets at each end. If you want to expand to allow access to more subnets behind a Sonicwall then all you have to do is create an Address Object on each firewall that includes the subnets you want to access and reference that object instead of the one used when first setting up the tunnel. Just remember that whatever you reference as the LOCAL networks on one side of the tunnel has to also be referenced as the REMOTE networks on the other side of the tunnel. An example of how multiple networks display under a VPN policy follows:
As you can see, this tunnel knows about 3 separate networks at the other end.
I use this procedure all the time and have many, many site-to-site VPN’s in the field configured in this manner. Of course, as I mentioned up front, there are many other methods available to configure the tunnels, including the new IKE v2 process available with the latest SonicOS firmware, and each method has its advantages and disadvantages. Use the method that best suits your needs but for rapid configuration you can’t beat this!