VPN Between a Dell SonicWALL and a Juniper Networks SRX

I have seen multiple people in forums asking how to setup a site to site VPN between a Juniper SRX firewall and a Dell SonicWALL firewall. I originally created this post to provide the steps to get things working. I noticed while working with a client that following the old steps no longer work. Below are the revised steps that I took to get it working, and is based on the following topology:

First we will configure the SRX:

Configure Interfaces:

set interfaces ge-0/0/0 unit 0 family inet address 10.10.10.2/30
set interfaces ge-0/0/1 unit 0 family inet address 192.168.1.1/24
set interfaces st0 unit 0 point-to-point family inet

Configure Routing:

set routing-options static route 172.16.1.0/24 next-hop st0.0
set routing-options static route 0.0.0.0/0 next-hop 10.10.10.1

Configure VPN Parameters:

set security ike policy SRX-TO-SW mode main
set security ike policy SRX-TO-SW proposal-set standard
set security ike policy SRX-TO-SW pre-shared-key ascii-text thisismypsk

set security ike gateway SRX-TO-SW ike-policy SRX-TO-SW
set security ike gateway SRX-TO-SW address 11.11.11.2
set security ike gateway SRX-TO-SW external-interface ge-0/0/0.0

set security ipsec policy SRX-TO-SW proposal-set standard

set security ipsec vpn SRX-TO-SW bind-interface st0.0
set security ipsec vpn SRX-TO-SW ike gateway SRX-TO-SW
set security ipsec vpn SRX-TO-SW ike proxy-identity local 192.168.1.0/24
set security ipsec vpn SRX-TO-SW ike proxy-identity remote 172.16.1.0/24
set security ipsec vpn SRX-TO-SW ike proxy-identity service any
set security ipsec vpn SRX-TO-SW ike ipsec-policy SRX-TO-SW
set security ipsec vpn SRX-TO-SW establish-tunnels immediately

set security flow tcp-mss ipsec-vpn mss 1350

Configure Security Zones:

set security zones security-zone UNTRUST interfaces ge-0/0/0.0
set security zones security-zone UNTRUST host-inbound-traffic system-services ike
set security zones security-zone TRUST interfaces ge-0/0/1.0
set security zones security-zone TRUST host-inbound-traffic system-services all
set security zones security-zone TRUST host-inbound-traffic protocols all
set security zones security-zone VPN interfaces st0.0 host-inbound-traffic system-services all
set security zones security-zone VPN interfaces st0.0 host-inbound-traffic protocols all

Configure Security Policies:

set security policies from-zone TRUST to-zone UNTRUST policy TRUST-TO-UNTRUST match source-address any
set security policies from-zone TRUST to-zone UNTRUST policy TRUST-TO-UNTRUST match destination-address any
set security policies from-zone TRUST to-zone UNTRUST policy TRUST-TO-UNTRUST match application any
set security policies from-zone TRUST to-zone UNTRUST policy TRUST-TO-UNTRUST then permit

set security policies from-zone TRUST to-zone VPN policy TRUST-TO-VPN match source-address any
set security policies from-zone TRUST to-zone VPN policy TRUST-TO-VPN match destination-address any
set security policies from-zone TRUST to-zone VPN policy TRUST-TO-VPN match application any
set security policies from-zone TRUST to-zone VPN policy TRUST-TO-VPN then permit

set security policies from-zone VPN to-zone TRUST policy VPN-TO-TRUST match source-address any
set security policies from-zone VPN to-zone TRUST policy VPN-TO-TRUST match destination-address any
set security policies from-zone VPN to-zone TRUST policy VPN-TO-TRUST match application any
set security policies from-zone VPN to-zone TRUST policy VPN-TO-TRUST then permit

Configure NAT:

set security nat source rule-set TRUST-TO-UNTRUST from zone TRUST
set security nat source rule-set TRUST-TO-UNTRUST to zone UNTRUST
set security nat source rule-set TRUST-TO-UNTRUST rule SRC-NAT match source-address 192.168.1.0/24
set security nat source rule-set TRUST-TO-UNTRUST rule SRC-NAT then source-nat interface

Next we will configure the TZ:

Enable and add a VPN:

Navigate to VPN->Settings, and then check the box to enable VPN and then click Accept.

Add a new VPN by selecting Add... under VPN Policies on the same page. Enter parameters as shown in the subsequent screenshots for each tab, and then click OK.

That's really it. You can then enable or disable the VPN on the SonicWALL at any time via a checkbox next to the newly created VPN on the VPN->Settings page.

Monitoring the Tunnel:

On the TZ:

You can verify tunnel status by going to VPN->Settings, and looking under Currently Active VPN Tunnels. 

On the SRX:

To verify Phase1 is complete, from operational mode issue the following command:

show security ike security-associations

To verify Phase 2 is complete, from operational mode issue the following command:

show security ipsec security-associations

SonicWALL - Forward Packets to Remote VPNs

Older versions of the SonicWALL operating system used to include a feature called, "Forward packets to remote VPNs." This feature, when enabled in a hub and spoke VPN topology, allowed for spoke sites to communicate with each other via a hub site. This is advantageous for a few reasons:

1. SonicWALL does not support Group VPN (GDOI) or other mesh VPN technologies, leaving manual configuration as the only option.
2. Configuring site to site VPNs for each and every site in your organization is time consuming, and depending on your SonicWALL model you may be limited by the number of IPSec tunnels allowed on your device (i.e. The TZ-105 only allows 5 IPSec tunnels).

I recently ran into this very situation. I was deploying a phone system at multiple sites for a customer, which required LAN-like communication between all sites. Rather than building tunnels at each site to every other site, I remembered the 'Forward packets to remote VPNs," feature. It would be great because it would save me time, as all traffic would just route through the hub site. However, in newer versions of the software this option is no longer present, so I had to do some research on how to make it work. I thought I would share what I did, since there is really no information out there (none that I could find anyway...) that walks you through the process.

For simplicity's sake, let's assume that we have 3 sites:

• Los Angeles - This is our main office (AKA the hub site). The LAN subnet for this site is 10.0.0.0/24.
• Austin - This is a branch office (AKA our first spoke site). The LAN subnet for this site is 192.168.0.0/24.
• Atlanta - This is a branch office (AKA our second spoke site). The LAN subnet for this site is 172.16.0.0/24.

Here are the general configuration steps:

1. On Los Angeles (the hub site):
1. Define address objects for each site under Network -> Address Objects:
1. Los Angeles:
1. Name: Los Angeles LAN
2. Zone Assignment: VPN
3. Type: Network
4. Network: 10.0.0.0
5. Netmask: 255.255.255.0
2. Austin:
1. Name: Austin LAN
2. Zone Assignment: VPN
3. Type: Network
4. Network: 192.168.0.0
5. Netmask: 255.255.255.0
3. Atlanta:
1. Name: Atlanta LAN
2. Zone Assignment: VPN
3. Type: Network
4. Network: 172.16.0.0
5. Netmask: 255.255.255.0
2. Create an address group for each site under Network -> Address Objects:
1. Create a group called Austin:
1. Add Atlanta LAN
2. Add Los Angeles LAN
1. Note that we are calling this group "Austin" even though we are not adding Austin LAN to the group. This group will be referenced in a VPN policy that will allow both the Los Angeles LAN and Atlanta LAN subnets to communicate with Austin. More information to follow...
2. Create a group called Atlanta:
1. Add Austin LAN
2. Add Los Angeles LAN
1. Same thing applicable here as above. We are calling the group Atlanta because it will be applied to the Atlanta VPN, but these address objects we are referencing do not include the Atlanta LAN address object.
3. Create VPNs to each remote site under VPN -> Settings:
1. Create a VPN called Austin:
1. Under the General tab:
1. Policy Type: Site to Site
2. Authentication Method: IKE using Preshared Secret
3. Name: Austin
4. IPSec Primary Gateway Name or Address: (public IP of Austin site)
5. Shared Secret: (enter whatever password you want here, just remember that it has to match on both ends)
2. Under the Network tab:
1. Local Networks: (choose Austin from the list)
2. Remote Networks: (choose Ausitn LAN from the list)
3. Under the Proposals tab:
1. This varies, but I usually choose IKEv2 mode, and AES-256 for encryption at the very least.
4. Under the Advanced tab:
1. Check the Enable Keep Alive check box
2. Create a VPN called Atlanta:
1. Under the General tab:
1. Policy Type: Site to Site
2. Authentication Method: IKE using Preshared Secret
3. Name: Atlanta
4. IPSec Primary Gateway Name or Address: (public IP of Atlanta site)
5. Shared Secret: (enter whatever password you want here, just remember that it has to match on both ends)
2. Under the Network tab:
1. Local Networks: (choose Atlanta from the list)
2. Remote Networks: (choose Atlanta LAN from the list)
3. Under the Proposals tab:
1. This varies, but I usually choose IKEv2 mode, and AES-256 for encryption at the very least.
4. Under the Advanced tab:
1. Check the Enable Keep Alive check box
2. On Austin (the spoke site):
1. Define address objects for each site under Network -> Address Objects:
1. Los Angeles:
1. Name: Los Angeles LAN
2. Zone Assignment: VPN
3. Type: Network
4. Network: 10.0.0.0
5. Netmask: 255.255.255.0
2. Austin:
1. Name: Austin LAN
2. Zone Assignment: VPN
3. Type: Network
4. Network: 192.168.0.0
5. Netmask: 255.255.255.0
3. Atlanta:
1. Name: Atlanta LAN
2. Zone Assignment: VPN
3. Type: Network
4. Network: 172.16.0.0
5. Netmask: 255.255.255.0
2. Create an address group for the other sites under Network -> Address Objects:
1. Create a group called Other Sites:
1. Add Atlanta LAN
2. Add Los Angeles LAN
3. Create a VPN to the Los Angeles site under VPN -> Settings:
1. Under the General tab:
1. Policy Type: Site to Site
2. Authentication Method: IKE using Preshared Secret
3. Name: Los Angeles
4. IPSec Primary Gateway Name or Address: (public IP of Los Angeles site)
5. Shared Secret: (enter the same password you entered when you created the Austin VPN on the Los Angeles SonicWALL)
2. Under the Network tab:
1. Local Networks: (choose Austin LAN from the list)
2. Remote Networks: (choose Other Sites from the list)
3. Under the Proposals tab:
1. Enter the same information you entered on the Los Angeles SonicWALL
4. Under the Advanced tab:
1. Leave everything as is
3. On Atlanta (the other spoke site):
1. Define address objects for each site under Network -> Address Objects:
1. Los Angeles:
1. Name: Los Angeles LAN
2. Zone Assignment: VPN
3. Type: Network
4. Network: 10.0.0.0
5. Netmask: 255.255.255.0
2. Austin:
1. Name: Austin LAN
2. Zone Assignment: VPN
3. Type: Network
4. Network: 192.168.0.0
5. Netmask: 255.255.255.0
3. Atlanta:
1. Name: Atlanta LAN
2. Zone Assignment: VPN
3. Type: Network
4. Network: 172.16.0.0
5. Netmask: 255.255.255.0
2. Create an address group for the other sites under Network -> Address Objects:
1. Create a group called Other Sites:
1. Add Austin LAN
2. Add Los Angeles LAN
3. Create a VPN to the Los Angeles site under VPN -> Settings:
1. Under the General tab:
1. Policy Type: Site to Site
2. Authentication Method: IKE using Preshared Secret
3. Name: Los Angeles
4. IPSec Primary Gateway Name or Address: (public IP of Los Angeles site)
5. Shared Secret: (enter the same password you entered when you created the Atlanta VPN on the Los Angeles SonicWALL)
2. Under the Network tab:
1. Local Networks: (choose Atlanta LAN from the list)
2. Remote Networks: (choose Other Sites from the list)
3. Under the Proposals tab:
1. Enter the same information you entered on the Los Angeles SonicWALL
4. Under the Advanced tab:
1. Leave everything as is

Upon completion, you will see a green light on the VPN -> Settings page, which indicates that the VPN is up. On the remote sites, you will see 2 green lights, indicating connectivity to both the hub and spoke sites.

VPN Between a SonicWALL TZ210 and a Juniper SRX100

I have seen multiple people in forums asking how to setup a site to site VPN between a Juniper SRX firewall and a SonicWALL firewall. Below are the steps that I took to get it working, and is based on the following topology:

First we will configure the SRX:

Configure Interfaces:

set interfaces fe-0/0/0 unit 0 family inet address 10.10.10.2/30
set interfaces fe-0/0/1 unit 0 family inet address 192.168.1.1/24

Configure Routing:

set routing-options static route 0.0.0.0/0 next-hop 10.10.10.1/30

Configure VPN Parameters:

NOTE: For this specific instance, one of the firewalls is using a dynamic public IP address for its WAN interface, thus the aggressive mode.

set security ike proposal SRX-TO-SW authentication-method pre-shared-keys
set security ike proposal SRX-TO-SW dh-group group2
set security ike proposal SRX-TO-SW authentication-algorithm sha1
set security ike proposal SRX-TO-SW encryption-algorithm aes-256-cbc
set security ike proposal SRX-TO-SW lifetime-seconds 28800

set security ike policy SRX-TO-SW mode aggressive
set security ike policy SRX-TO-SW proposals SRX-TO-SW
set security ike policy SRX-TO-SW pre-shared-key ascii-text thisismypsk

set security ike gateway SRX-TO-SW ike-policy SRX-TO-SW
set security ike gateway SRX-TO-SW address 11.11.11.2
set security ike gateway SRX-TO-SW external-interface fe-0/0/0.0

set security ipsec proposal SRX-TO-SW protocol esp
set security ipsec proposal SRX-TO-SW authentication-algorithm hmac-sha1-96
set security ipsec proposal SRX-TO-SW encryption-algorithm aes-256-cbc
set security ipsec proposal SRX-TO-SW lifetime-seconds 28800

set security ipsec policy SRX-TO-SW proposals SRX-TO-SW

set security ipsec vpn SRX-TO-SW ike gateway SRX-TO-SW
set security ipsec vpn SRX-TO-SW ike ipsec-policy SRX-TO-SW

set security flow tcp-mss ipsec-vpn mss 1350

Configure Security Zones:

set security zones security-zone UNTRUST interfaces fe-0/0/0.0
set security zones security-zone UNTRUST host-inbound-traffic system-services ike
set security zones security-zone UNTRUST address-book address SW-NET 172.16.1.0/24
set security zones security-zone TRUST interfaces fe-0/0/1.0
set security zones security-zone TRUST host-inbound-traffic system-services all
set security zones security-zone TRUST address-book address SRX-NET 192.168.1.0/24

Configure Security Policies:

set security policies from-zone TRUST to-zone UNTRUST policy SRX-TO-SW match source-address SRX-NET
set security policies from-zone TRUST to-zone UNTRUST policy SRX-TO-SW match destination-address SW-NET
set security policies from-zone TRUST to-zone UNTRUST policy SRX-TO-SW match application any
set security policies from-zone TRUST to-zone UNTRUST policy SRX-TO-SW then permit tunnel ipsec-vpn SRX-TO-SW
set security policies from-zone TRUST to-zone UNTRUST policy SRX-TO-SW then permit tunnel pair-policy SW-TO-SRX

set security policies from-zone TRUST to-zone UNTRUST policy TRUST-TO-UNTRUST match source-address any
set security policies from-zone TRUST to-zone UNTRUST policy TRUST-TO-UNTRUST match destination-address any
set security policies from-zone TRUST to-zone UNTRUST policy TRUST-TO-UNTRUST match application any
set security policies from-zone TRUST to-zone UNTRUST policy TRUST-TO-UNTRUST then permit

set security policies from-zone UNTRUST to-zone TRUST policy SW-TO-SRX match source-address SW-NET
set security policies from-zone UNTRUST to-zone TRUST policy SW-TO-SRX match destination-address SRX-NET
set security policies from-zone UNTRUST to-zone TRUST policy SW-TO-SRX match application any
set security policies from-zone UNTRUST to-zone TRUST policy SW-TO-SRX then permit tunnel ipsec-vpn SW-TO-SRX
set security policies from-zone UNTRUST to-zone TRUST policy SW-TO-SRX then permit tunnel pair-policy SRX-TO-SW

Configure NAT:

set security nat source rule-set TRUST-TO-UNTRUST from zone TRUST
set security nat source rule-set TRUST-TO-UNTRUST to zone UNTRUST
set security nat source rule-set TRUST-TO-UNTRUST rule SRC-NAT match source-address 192.168.1.0/24
set security nat source rule-set TRUST-TO-UNTRUST rule SRC-NAT then source-nat interface

Next we will configure the TZ:

Enable and add a VPN:

Navigate to VPN->Settings, and then check the box to enable VPN and then click Accept.

Add a new VPN by selecting Add... under VPN Policies on the same page. Enter parameters as shown in the subsequent screenshots for each tab, and then click OK.

That's really it. You can then enable or disable the VPN on the SonicWALL at any time via a checkbox next to the newly created VPN on the VPN->Settings page. 

Monitoring the Tunnel:

On the TZ:

You can verify tunnel status by going to VPN->Settings, and looking under Currently Active VPN Tunnels. 

On the SRX:

To verify Phase1 is complete, from operational mode issue the following command:

show security ike security-associations

To verify Phase 2 is complete, from operational mode issue the following command:

show security ipsec security-associations