VPN Definition SonicWall:

Transcription

1 VPN Definition SonicWall: Note: If you have only DHCP-WAN IP at the EdgeMAX side, unfortunatly you must input the WAN-IP as Peer IKE ID. If you have also a DHCP-WAN IP at the SonicWall side, you can input as Local IKE. See also the pink highlighted Lines at the End of EdgeMAX Konfig-File.

2

3 Firewall-Rules SonicWall: My runnig Konfig from EdgeMAX: Please note: - The WAN Port in my configuration is the eth5 (-> change this to your situation) - The eth0 to eth4 Ports are combined to a switch - I use also a Unifi AP with a separte VLAN 10 for my Guest-WIFI with separete IP-Range and DHCP - Attention: At Port eth4 the PoE is enable! First, create your own config-file starting from the following: Note : In my config you have my encrypted password! So you must first export your actuel config, so you can copy/paste your known password. firewall { all-ping enable broadcast-ping disable ipv6-receive-redirects disable ipv6-src-route disable ip-src-route disable log-martians enable name WAN_IN { default-action drop description "packets from Internet to LAN" enable-default-log rule 1 { description "allow established sessions" state { established enable related enable rule 2 { action drop description "drop invalid state" state {

4 invalid enable rule 3 { description "allow vpn traffic from site-a" destination { address /24 ipsec { match-ipsec source { address /24 name WAN_LOCAL { default-action drop description "packets from Internet to router" enable-default-log rule 1 { description "allow established sessions" state { established enable related enable rule 2 { action drop description "drop invalid state" state { invalid enable rule 3 { description "allow vpn traffic from site-a to the router" destination { address ipsec { match-ipsec

5 source { address /24 rule 4 { description "allow IKE-UDP-500" destination { port 500 protocol udp source { port 500 rule 5 { description "allow ESP-50" protocol esp rule 6 { description "allow NAT-T-UDP-4500" destination { port 4500 protocol udp receive-redirects disable send-redirects enable source-validation disable syn-cookies enable interfaces { ethernet eth0 { description Local ethernet eth1 { description Local ethernet eth2 {

6 description Local ethernet eth3 { description Local ethernet eth4 { description AccessPoint poe { output 24v ethernet eth5 { address dhcp description Internet firewall { in { name WAN_IN local { name WAN_LOCAL loopback lo { switch switch0 { address /24 description Local mtu 1500 switch-port { interface eth0 interface eth1 interface eth2 interface eth3 interface eth4 vif 10 { address /24 description GuestWIFI mtu 1500

7 service { dhcp-server { disabled false hostfile-update disable shared-network-name GuestWIFI { authoritative disable subnet /24 { default-router dns-server dns-server lease start { stop shared-network-name LAN { authoritative disable subnet /24 { default-router dns-server domain-name sternschnuppe.local lease start { stop dns { dynamic { interface eth5 { service dyndns { host-name XXXXXXXXX.no-ip.biz login DynDNS-User password DynDNS-Password server dynupdate.no-ip.com forwarding { cache-size 150 listen-on switch0 gui { https-port 443 nat {

8 rule 5000 { description "exclude masquerade for IPSEC" destination { address /24 exclude log enable outbound-interface eth5 source { address /24 type masquerade rule 5001 { description "masquerade for WAN" log enable outbound-interface eth5 type masquerade ssh { port 22 protocol-version v2 system { host-name ubnt login { user ubnt { authentication { encrypted-password $7$3jbJ7VeX7U2AbLT$xK5DJogm9G/HiQYDkjdSNoUGA.H9bX9fb7HOVz95xu0RpPeZYWwMOs. XiMD3WmuM8UIvVw09tGLpHIOOuYhW7/ plaintext-password "" full-name "" level admin ntp { server 0.ubnt.pool.ntp.org { server 1.ubnt.pool.ntp.org { server 2.ubnt.pool.ntp.org { server 3.ubnt.pool.ntp.org {

9 syslog { global { facility all { level notice facility protocols { level debug time-zone UTC vpn { ipsec { disable-uniqreqids esp-group BG { compression disable lifetime 3600 mode tunnel pfs disable proposal 1 { encryption aes128 hash sha1 ike-group BG { lifetime proposal 1 { dh-group 2 encryption aes128 hash sha1 ipsec-interfaces { interface eth5 nat-traversal disable site-to-site { peer =>WAN-IP or Domainname from your SonicWall { authentication { mode pre-shared-secret pre-shared-secret MySharedSecret connection-type initiate default-esp-group BG ike-group BG local-address any => if your EdgeMAX has a DHCP-IP or the fixed WAN-IP tunnel 1 { allow-nat-networks disable

10 allow-public-networks disable esp-group BG local { prefix /24 remote { prefix /24 /* Warning: Do not remove the following line. */ /* === vyatta-config-version: "config-management@1:conntrack@1:cron@1:dhcp-relay@1:dhcpserver@4:firewall@5:ipsec@5:nat@3:qos@1:quagga@2:system@4:ubnt-pptp@1:ubntutil@1:vrrp@1:webgui@1:webproxy@1:zone-policy@1" === */ /* Release version: v */ To transfer and activate the config, I use the pscp.exe from putty.org: For transfer use this command similar on your Windows CMD: c:\>pscp starter-config.boot ubnt@ :/tmp/ To load and enable the config use putty with this commands: stupiderror@stupiderror:~$ configure stupiderror@stupiderror# load /tmp/starter-config.boot stupiderror@stupiderror# commit stupiderror@stupiderror# save