DHCP over VPN Sonicwall Introduction

This document shows an example of how to configure a VPN tunnel between 2 SonicWALL firewalls, one running SonicOS Enhanced at the main site (central site) and the other one running SonicOS standard at the remote site. Remote PCs located behind the SonicWALL appliance on the remote site will obtain IP addresses automatically from a DHCP server located on the LAN zone of the Enhanced unit.

Versions Used SonicWALL recommends using the latest firmware version on the units. On this document this feature has been tested on SonicOS Enhanced 5.8.1.10-44o (Remote Site) and SonicOS Enhanced 5.9.0.1-100o (Central Site).

Ilustracin 1. VPN Layout.

Task List Please note that this setup requires having a DHCP server correctly configured on the LAN zone of this firewall. On the SonicWALL units: At the central site: o Add and configure a VPN policy o Configure DHCP over VPN At the remote site: o Add and configure a VPN policy o Configure DHCP over VPN

Testing: Verify that the VPN tunnel comes up Verify that the DHCP client at the remote site obtains an IP address Verify that traffic flows correctly between the sites Verify that the DHCP client has access to its own network Before You Begin First of all make sure to have an available internet connection. If not, do so before completing any further steps. Make sure that you know the IP and MAC addresses of all static devices located on the remote site.

Setup Steps
SonicWALL Central Site Configuration Go to the VPN > Settings page. Click the Add button to create a new VPN tunnel. A new pop-up screen will appear. On the General tab: From the IPSec Keying Mode drop-down, select IKE using Preshared Secret. In the Name: box, enter to remote site. In the IPSec Primary Gateway Name or Address box, enter the WAN IP address of the remote SonicWALL device. Leave the box next to IPSec Secondary Gateway Name or Address untouched. In the Shared Secret: box, enter in the Preshared key you wish to use (you will need to enter this same key on the remote SonicWALL device). Leave the Local IKE ID and Peer IKE ID options untouched. On the Network tab: Select the address object that you wish you use as Local Network, in this example LAN Primary Subnet. Select the radio button next to Destination network obtains IP addresses using DHCP through this VPN tunnel on the Destination Networks. On the Proposals tab: From the Phase 1 Exchange drop-down, select Main Mode. From the Phase 1 DH Group drop-down, select Group 2. From the Phase 1 Encryption drop-down, select 3DES. From the Phase 1 Authentication drop-down, select SHA1. In the Phase 1 box next to Life Time (seconds), enter 28800. From the Phase 2 Protocol: drop-down, select ESP. From the Phase 2 Authentication: drop-down, select SHA1. Do not check the box next to Enable Perfect Forward Secrecy. In the Phase 2 box next to Life Time (seconds), enter 28800.

On the Advanced tab: Select Enable Keep Alive. When done, click the OK button at the bottom to save and activate this VPN tunnel.

Ilustracin 2. VPN Setup Settings.

Ilustracin 3. VPN Setup Settings.

To finalize the configuration of the SonicWALL appliance at the central site, go to the VPN > DHCP over VPN page Keep it as Central Gateway and click the Configure button. Select the checkbox Send DHCP requests to the server addresses listed below and add the IP address of your DHCP server (here: 192.168.100.7). Click OK and then Apply.

Ilustracin 4. VPN Setup Configuration.

Ilustracin 5. VPN Setup Configuration.

SonicWALL Remote Site Configuration

Log into the Remote SonicWALL devices Management GUI and go to the VPN > Settings page. Click the Add button to create a new VPN tunnel. A new pop-up screen will appear.

On the General tab: From the IPSec Keying Mode drop-down, select IKE using Preshared Secret. In the Name: box, enter to central site. In the IPSec Primary Gateway Name or Address box, enter the WAN IP address of the Central SonicWALL device. Leave the box next to IPSec Secondary Gateway Name or Address untouched In the Shared Secret: box, enter in the Preshared key you wish to use (the same key you specified on the Central SonicWALL device). Select the radio button next to Specify destination networks below. Click on the Add button to enter in the Central SonicWALLs LAN IP network(s) and subnet mask.

On the Proposals tab: From the Phase 1 Exchange drop-down, select Main Mode. From the Phase 1 DH Group drop-down, select Group 2. From the Phase 1 Encryption drop-down, select 3DES. From the Phase 1 Authentication drop-down, select SHA1. In the Phase 1 box next to Life Time (seconds), enter 28800. From the Phase 2 Protocol: drop-down, select ESP. From the Phase 2 Authentication: drop-down, select SHA1. Do not check the box next to Enable Perfect Forward Secrecy. In the Phase 2 box next to Life Time (seconds), enter 28800. When done, click the OK button at the bottom to save and activate this VPN tunnel. On the Advanced tab: Select Enable Keep Alive.

Ilustracin 6. VPN Setup Settings.

Ilustracin 7. VPN Setup Settings.

To finalize the configuration of the SonicWALL appliance at the Remote Site, go to the VPN > DHCP over VPN page. Choose Remote Gateway and click on the Configure button. The DHCP over VPN Configuration window is displayed. On the General tab: Select the VPN policy to be used for the VPN tunnel from the Relay DHCP through this VPN Tunnel menu. In our case it will be Samb. You can enter a static IP address in the Relay IP Address field. This static IP address is from the pool of specific IP addresses on the Central Gateway. It should not be available in the scope of DHCP addresses. The SonicWALL can also be managed through the Relay IP address. In this example we will leave it with zeros. Enter an IP address in the Remote Management IP Address field. This setting is used to manage the SonicWALL remotely through the VPN tunnel from behind the Central Gateway. Here we use 192.168.168.192. Leave the rest of the settings of this tab untouched.

Ilustracin 8. VPN Setup Configuration.