Monday, October 14, 2013

SonicWALL - Forward Packets to Remote VPNs

Older versions of the SonicWALL operating system used to include a feature called, "Forward packets to remote VPNs." This feature, when enabled in a hub and spoke VPN topology, allowed for spoke sites to communicate with each other via a hub site. This is advantageous for a few reasons:
  1. SonicWALL does not support Group VPN (GDOI) or other mesh VPN technologies, leaving manual configuration as the only option.
  2. Configuring site to site VPNs for each and every site in your organization is time consuming, and depending on your SonicWALL model you may be limited by the number of IPSec tunnels allowed on your device (i.e. The TZ-105 only allows 5 IPSec tunnels).
I recently ran into this very situation. I was deploying a phone system at multiple sites for a customer, which required LAN-like communication between all sites. Rather than building tunnels at each site to every other site, I remembered the 'Forward packets to remote VPNs," feature. It would be great because it would save me time, as all traffic would just route through the hub site. However, in newer versions of the software this option is no longer present, so I had to do some research on how to make it work. I thought I would share what I did, since there is really no information out there (none that I could find anyway...) that walks you through the process.

For simplicity's sake, let's assume that we have 3 sites:
  • Los Angeles - This is our main office (AKA the hub site). The LAN subnet for this site is 10.0.0.0/24.
  • Austin - This is a branch office (AKA our first spoke site). The LAN subnet for this site is 192.168.0.0/24.
  • Atlanta - This is a branch office (AKA our second spoke site). The LAN subnet for this site is 172.16.0.0/24.
Here are the general configuration steps:
  1. On Los Angeles (the hub site):
    1. Define address objects for each site under Network -> Address Objects:
      1. Los Angeles:
        1. Name: Los Angeles LAN
        2. Zone Assignment: VPN
        3. Type: Network
        4. Network: 10.0.0.0
        5. Netmask: 255.255.255.0
      2. Austin:
        1. Name: Austin LAN
        2. Zone Assignment: VPN
        3. Type: Network
        4. Network: 192.168.0.0
        5. Netmask: 255.255.255.0
      3. Atlanta:
        1. Name: Atlanta LAN
        2. Zone Assignment: VPN
        3. Type: Network
        4. Network: 172.16.0.0
        5. Netmask: 255.255.255.0
    2. Create an address group for each site under Network -> Address Objects:
      1. Create a group called Austin:
        1. Add Atlanta LAN
        2. Add Los Angeles LAN
          1. Note that we are calling this group "Austin" even though we are not adding Austin LAN to the group. This group will be referenced in a VPN policy that will allow both the Los Angeles LAN and Atlanta LAN subnets to communicate with Austin. More information to follow...
      2. Create a group called Atlanta:
        1. Add Austin LAN
        2. Add Los Angeles LAN
          1. Same thing applicable here as above. We are calling the group Atlanta because it will be applied to the Atlanta VPN, but these address objects we are referencing do not include the Atlanta LAN address object.
    3. Create VPNs to each remote site under VPN -> Settings:
      1. Create a VPN called Austin:
        1. Under the General tab:
          1. Policy Type: Site to Site
          2. Authentication Method: IKE using Preshared Secret
          3. Name: Austin
          4. IPSec Primary Gateway Name or Address: (public IP of Austin site)
          5. Shared Secret: (enter whatever password you want here, just remember that it has to match on both ends)
        2. Under the Network tab:
          1. Local Networks: (choose Austin from the list)
          2. Remote Networks: (choose Ausitn LAN from the list)
        3. Under the Proposals tab:
          1. This varies, but I usually choose IKEv2 mode, and AES-256 for encryption at the very least.
        4. Under the Advanced tab:
          1. Check the Enable Keep Alive check box
      2. Create a VPN called Atlanta:
        1. Under the General tab:
          1. Policy Type: Site to Site
          2. Authentication Method: IKE using Preshared Secret
          3. Name: Atlanta
          4. IPSec Primary Gateway Name or Address: (public IP of Atlanta site)
          5. Shared Secret: (enter whatever password you want here, just remember that it has to match on both ends)
        2. Under the Network tab:
          1. Local Networks: (choose Atlanta from the list)
          2. Remote Networks: (choose Atlanta LAN from the list)
        3. Under the Proposals tab:
          1. This varies, but I usually choose IKEv2 mode, and AES-256 for encryption at the very least.
        4. Under the Advanced tab:
          1. Check the Enable Keep Alive check box
  2. On Austin (the spoke site):
    1. Define address objects for each site under Network -> Address Objects:
      1. Los Angeles:
        1. Name: Los Angeles LAN
        2. Zone Assignment: VPN
        3. Type: Network
        4. Network: 10.0.0.0
        5. Netmask: 255.255.255.0
      2. Austin:
        1. Name: Austin LAN
        2. Zone Assignment: VPN
        3. Type: Network
        4. Network: 192.168.0.0
        5. Netmask: 255.255.255.0
      3. Atlanta:
        1. Name: Atlanta LAN
        2. Zone Assignment: VPN
        3. Type: Network
        4. Network: 172.16.0.0
        5. Netmask: 255.255.255.0
    2. Create an address group for the other sites under Network -> Address Objects:
      1. Create a group called Other Sites:
        1. Add Atlanta LAN
        2. Add Los Angeles LAN
    3. Create a VPN to the Los Angeles site under VPN -> Settings:
      1. Under the General tab:
        1. Policy Type: Site to Site
        2. Authentication Method: IKE using Preshared Secret
        3. Name: Los Angeles
        4. IPSec Primary Gateway Name or Address: (public IP of Los Angeles site)
        5. Shared Secret: (enter the same password you entered when you created the Austin VPN on the Los Angeles SonicWALL)
      2. Under the Network tab:
        1. Local Networks: (choose Austin LAN from the list)
        2. Remote Networks: (choose Other Sites from the list)
      3. Under the Proposals tab:
        1. Enter the same information you entered on the Los Angeles SonicWALL
      4. Under the Advanced tab:
        1. Leave everything as is
  3. On Atlanta (the other spoke site):
    1. Define address objects for each site under Network -> Address Objects:
      1. Los Angeles:
        1. Name: Los Angeles LAN
        2. Zone Assignment: VPN
        3. Type: Network
        4. Network: 10.0.0.0
        5. Netmask: 255.255.255.0
      2. Austin:
        1. Name: Austin LAN
        2. Zone Assignment: VPN
        3. Type: Network
        4. Network: 192.168.0.0
        5. Netmask: 255.255.255.0
      3. Atlanta:
        1. Name: Atlanta LAN
        2. Zone Assignment: VPN
        3. Type: Network
        4. Network: 172.16.0.0
        5. Netmask: 255.255.255.0
    2. Create an address group for the other sites under Network -> Address Objects:
      1. Create a group called Other Sites:
        1. Add Austin LAN
        2. Add Los Angeles LAN
    3. Create a VPN to the Los Angeles site under VPN -> Settings:
      1. Under the General tab:
        1. Policy Type: Site to Site
        2. Authentication Method: IKE using Preshared Secret
        3. Name: Los Angeles
        4. IPSec Primary Gateway Name or Address: (public IP of Los Angeles site)
        5. Shared Secret: (enter the same password you entered when you created the Atlanta VPN on the Los Angeles SonicWALL)
      2. Under the Network tab:
        1. Local Networks: (choose Atlanta LAN from the list)
        2. Remote Networks: (choose Other Sites from the list)
      3. Under the Proposals tab:
        1. Enter the same information you entered on the Los Angeles SonicWALL
      4. Under the Advanced tab:
        1. Leave everything as is
Upon completion, you will see a green light on the VPN -> Settings page, which indicates that the VPN is up. On the remote sites, you will see 2 green lights, indicating connectivity to both the hub and spoke sites.

9 comments:

  1. I get the green lights but i am only able to ping the gateway address. Nothing on the other side of the vpn is accessible.

    ReplyDelete
    Replies
    1. I would look at the firewall rules and verify that we are allowing LAN <--> WAN and WAN <--> LAN on both firewalls. I would also verify that there are no static NAT rules that are in place that would conflict with the LAN networks in question.

      Delete
  2. If you get both VPN tunnels to the central site GREEN and you don't get connectivity between the remote sites you have to ADD a firewall rule from VPN > VPN that lets through the traffic. In it's simplest form "Source VPN > Destination VPN > Any Source > Any Destination > Any Service". (Our router is a NSA 4600 on SonicOS Enhanced 6.2.2.2-19n)

    ReplyDelete
  3. Hello, great guide but unfortunately for us it's not working. We are using nsa2600 SonicOS Enhanced 6.1.2.3-20n. We have main office as 192.168.0.0/23, two remotes as 192.168.122.0/24 and 172.16.0.0/24. We can vpn to main from both sides but not able to pass traffic from one vpn to another. No drops, nothing. Rules were automatically created upon creating vpn with 2 source nets(according to the guide),but no joy. We even created rules to direct pass one vpn to another- the same. any ideas?

    ReplyDelete
    Replies
    1. I would double check the VPN remote and local lan addresses and make sure that they are correctly configured.

      Delete
  4. Spencer, thank you for fast response! Seems to me that everything is set up correctly: remote1:
    S~ 192.168.0.0/ 255.255.254.0 via 62.233.177.90 VPN-1
    * 0.0.0.0/ 0.0.0.0 via 62.233.177.89 WAN1
    S~ 192.168.122.0/ 255.255.255.0 via 62.233.177.90 VPN-1
    C 62.233.177.88/ 255.255.255.248 directly connected WAN1
    C~ 172.16.0.0/ 255.255.255.0 directly connected LAN1

    Remote2:
    Key: C - connected, S - static, R - RIP, * - default, ~ - private
    S~ 192.168.0.0/ 255.255.254.0 via 62.233.177.90 VPN
    * 0.0.0.0/ 0.0.0.0 via 62.233.177.89 WAN1
    C~ 192.168.122.0/ 255.255.255.0 directly connected LAN
    C 62.233.177.88/ 255.255.255.248 directly connected WAN1
    S~ 172.16.0.0/ 255.255.255.0 via 62.233.177.90 VPN

    Above two are Drayteks (yeah, I know..)
    the HQ nsa:
    LAN > VPN 1 lanAnd_172 draytek-192_168_122
    LAN > VPN 2 lanAnd_122 draytek-172_16_0

    VPN > LAN 4 draytek-192_168_122 lanAnd_172
    VPN > LAN 5 draytek-172_16_0 lanAnd_122

    VPN > VPN 3 draytek-192_168_122 lanAnd_172
    VPN > VPN 4 lanAnd_172 draytek-192_168_122
    VPN > VPN 5 draytek-172_16_0 lanAnd_122
    VPN > VPN 6 lanAnd_122 draytek-172_16_0

    Every rule is allow any any. Everything created automatically upon creating vpns.

    lanAnd_172=local lan 192.168.0.0/23+vpn 172.16.0.0/24
    lanAnd_192=local lan 192.168.0.0/23+vpn 192.168.122.0/24
    draytek-192 and 172 are remote vpn lans.

    Am I missing something?


    ReplyDelete
    Replies
    1. as addition I found a source of connection problem:
      Ethernet Header
      Ether Type: IP(0x800), Src=[00:1d:aa:9f:27:01], Dst=[c0:ea:e4:cb:d7:d3]
      IP Packet Header
      IP Type: ICMP(0x1), Src=[172.16.0.1], Dst=[192.168.122.1]
      ICMP Packet Header
      ICMP Type = 8(ECHO_REQUEST), ICMP Code = 0, ICMP Checksum = 4579
      Value:[1]
      DROPPED, Drop Code: 339, Module Id: 20, (Ref.Id: _585_krugeQevgqpKprwv) 1:1)
      but the code means:
      339 Octeon Decrypyion Failed for inbound packet
      ???

      Delete
    2. Ok I have managed to find the reason and solution. Drayteks cannot properly send packets of you specify more than one network for single vpn. To workaround you need to create separate profile on draytek to each network it has to connect. There is an additional option called something like "create separate phase2 tunnel for each network" and this works same way like above workaround. Regards

      Delete
  5. For the hub site, I had to assign the local network Address Object to the LAN zone instead of VPN zone, then things began working as intended.

    ReplyDelete