AFP548 Changing the world one server at a time.

Trying to get connected to a Sonicwall …

Home › Forums › Archive › VaporSec › Trying to get connected to a Sonicwall …

Viewing 4 posts - 1 through 4 (of 4 total)
  • Author
    Posts
  • December 17, 2002 at 10:41 pm #354889
    Anonymous
    Participant

    I’m trying to setup a connection to a Sonicwall but am having trouble. Here’s what my config looks like:

    Security association: GroupVPN (default name)
    IPSec Keying Mode: IKE using pre-shared secret

    Phase 1 DH Group: Group1
    SA Life time (secs): 28800
    Phase1 Encryption/Authentication: DES & SHA1 (I also tried triple DES and SHA1)
    Phase 2 encryption/authentication: Encrypt and Authenticate (ESP DES HMAC MD5)

    The Sonicwall’s internal network is 192.168.3.0/24, which is the value I put into VaporSec. The shared secret is the same. But it’s not working. Any suggestions?

    Thanks!

    Jen

    December 18, 2002 at 4:51 am #354893
    jennyw
    Participant

    Thanks for the advice! Unfortunately, after making the changes you suggested, it’s still not working. I admit I don’t understand all the stuff on the Advanced page of the Sonicwall VPN config … can you let me know if there’s anything else that should be filled in there?

    I’ve also looked through /var/log/system.log and it doesn’t seem to have any helpful information (such as if the secret is bad, or if it can’t connect to the host, etc.).

    Thanks!

    Jen

    December 19, 2002 at 3:04 am #354901
    opus
    Participant

    The release notes I saw on VersionTracker said that v0.9 uses main mode IKE negotiation instead of aggressive mode. If you are connecting to the GroupVPN SA of a SonicWALL aggressive mode must be used.

    Don’t worry about the advanced options except to turn on PFS if the client is also set to use it.

    December 19, 2002 at 6:33 am #354905
    opus
    Participant

    There was a major bug in older SonicWALL firewall firmware releases that allowed a main mode connection to the GroupVPN SA. This was fixed with the v6.3.0.0 release.

    If you are using the original SOHO and TELE models as stated in a previous post then the last release available to you is v5.1.7.0, which contains this bug.

    This bug is bad because it means that a vital authentication bit is not being used. IKE main mode requires that the IP address be used as part of the authentication. If the IP address of the client is not known in advance, then aggressive mode must be used and another piece of information (FQDN, user-FQDN, the SonicWALL’s unique firewall identifier, etc.) must be used instead.

    In the GroupVPN SA there is no place to enter the IP addresses of the clients connecting to the SonicWALL, so by definition aggressive mode must be used.

  • Author
    Posts
Viewing 4 posts - 1 through 4 (of 4 total)
  • You must be logged in to reply to this topic.