SonicWALL VPN WAN failover

Similar Questions

• Tunnel VPN RV-042 for Dual WAN Failover backup function

  We have customers with dual WAN failover scenarios with site-to-site VPN tunnels.

  In the past, the VPN tunnel backup feature has been available in the RV-082.

  One of the new RV-042 firmware versions have the function of backup Tunnel VPN available?

  The feature is supported on the RV042 V3 hardware.

• Peer VPN and failover

  Is it possible to have redundancy - say HSRP - within a VPN infrastructure? In other words - the peer IP address could be one HSRP or VRRP VIP? If no - one you wanted a redundancy of both VPN routers what mechanism would be used for a failover? Thank you.

  I have in fact recently been looking into this myself and there are a few options of derivation according to your platforms and design.

  VPN statefull failover 7200's and 3600's head. This allows failover statefull of the IPSEC Tunnels between a primary router secondary school.

  http://www.Cisco.com/en/us/products/SW/iosswrel/ps5207/products_feature_guide09186a00802d03f2.html

  Failover IPSEC using the injection of road HSRP and reverse. Stateless IOS base tunnel of failover. Closer to what you want if your using IOS VPN.

  http://www.Cisco.com/en/us/Partner/Tech/tk583/TK372/technologies_tech_note09186a00800942f7.shtml

  As I use ASA at the head end and IOS on the remote database, I'm currently looking for the use of static virtual tunnel interfaces on remote sites with HSRP followed these VTI interfaces with failover based on the status of the tunnel. Not quite sure that HSRP to track interfaces VTI but I guess he can.

  http://www.Cisco.com/en/us/products/SW/iosswrel/ps5207/products_feature_guide09186a008041faef.html

  The only other issues that leaves me with, is how the ASA handle routing where it as several tunnels of two different endpoints. Anyone know?

• RV042 v3 & RV082 v3: WAN Failover + restore VPN

  We have a v3 RV082 and RV042 v3 with latest firmware.

  They have all two Dual WAN (backup active Smartlink).

  They connect with each other via the VPN (with VPN enabled and configured backup Tunnel).

  When primary internet (WAN1) fails, and it switches to the internet backup (WAN2),

  We have to manually replace the VPN of WAN1 WAN2 interface to restore

  the VPN tunnel.

  We tried to create a second instance of VPN using WAN2, however it will not save

  due to a conflict of network with VPN original (even if we move the destination VPN

  IP and VPN backup tunnel IP).  I imagine that the conflict is the destination network.

  How do we automate the VPN interface change an outage of the internet?

  Or about what work can be done to ensure the VPN is restored after a

  failover of the Internet (WAN interface change).

  To address scenarios, you need the two operating sites in the double-wan load-balancing mode. The main tunnel is formed with two interfaces WAN1 and the backup tunnel is formed with two interfaces to WAN2.

• Domain policy by default in all of reception through Site to SIte VPN WAN

  We have a field of forrest with subdomains under it.  We have three subdomains.  All are different places and each site connects to the other with a VPN over WAN.  We have a WSUS server that is on the field T.  We have customers on all three areas, field T, S domain and domain CR.   All three areas can consult and get updates from the WSUS server in the T field.

  The problem is if the computer has been configured to the area S originally, and now the same computer and the user are field t, S domain computer can't get the default domain policy that it redirects to the WSUS server to domain T.

  We have about 15 computers that have the same problem.

  How can I do for this troubleshooting.  Why would he not the domain policy by default when the user connects.  When you perform a gpresult is always the local policy.  Never the default domain policy.

  You will find appropriate in the specific WSUS forum support: http://social.technet.microsoft.com/Forums/en-US/winserverwsus/threads

• Slow flow on MPLS VPN WAN

  Anyone have any ideas why a portion of the traffic is slow as it passes through a VPN MPLS WAN. My FTP copies are fast but copy all windows or windows file transfers are slow. Copies of windows are about three times slower as the FTP transfers. Can be optimized on routers or switches?

  Hello

  Thus, all transfers are done with CIFS are slow and other then CIFS are ok?

  All transfers are between XP/7 and servers (before 2008)?

  Please take a look at http://bit.ly/rkh9IM

  CIFS (or SMB) prior to the 2008 version is slow by definition as it can not cope with very good latency. Other protocols such as HTTP and FTP run much smoother.

  When you run Server 2008 (or better) combination with Windows Vista (or better) should solve some of your problems as it can using SMBv2.

  What actual speed is your order on the MPLS and what is the maximum transfer reached between server and workstation?

  Best regards, G.

• ISA570 Weighted Dual Wan & Failover

  So, we had a few problems here while we were both WITH link failover detection two ISPs for balancing.  Our problems seemed if go away once we have disabled the link failover.  What is happening is a wan link out randomly, it was not a particular wan link.  We could have one out one day and another on another day. I thought I would post to see if anyone knows or had problems with doing a 50-50 balanced weighted load scenario with the failover link light.  Now, with the recovery of disabled link, it seems that if a wan link goes down, computers are always sent on this bad wan link.

  I did a combination of the two in deployments. Most of them is connections of failover with low cost connection primary and secondary connections of 4 G of type variable cost. I have not had any problems with load balancing and failover work together, but I can not also think all instances where he arrived so I can't be certain that he would not fail. ;-) If please try DNS and let me know if you experience the same results. If If, I would open a TAC case if Cisco can try to locate the bug, assuming that there is one at this time. Please keep me dated with your results. Thank you.

  Sent by Cisco Support technique iPad App

• SonicWall VPN PIX - does not, could someone help?

  Hi all

  I'm trying to set up an a 506th PIX VPN tunnel (firmware 6.3 (2)), a firewall SonicWall Pro. It does not at the moment. Phase 1 is ok but the phase 2 is not, the VPN tunnel has not been established, and the security association is removed after a minute or two. I enclose below the PIX config and an attempt to create VPN tunnel debugging output (slightly modified and cut for reasons of confidentiality). The PIX already has other two VPN configured which work perfectly.

  I would be very grateful to anyone who could help me answer the following questions about this VPN configuration:

  1. to debug output, which means the next?

  ISAKMP (0): retransmission of the phase 2 (0/0)... mess_id 0xafc08a94

  crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

  ISAKMP: error msg not encrypted

  2. in the config, I don't know if the 3 static controls are necessary and how it might interact... What do you think?

  3. in what order things happen in the PIX when traffic is from the local network to remote network by VPN? What is NAT then treatment then setting up VPN to access list? or or treatment, then NAT and VPN to access list? or another possibility?

  4. How can I get it work?

  Thank you very much in advance for any help provided,

  A.G.

  ########### NAMING #################################

  vpnpix1 - is the local cisco PIX

  remotevpnpeer - is the Sonicwall firewall remote

  Intranet - is the local network behind PIX

  remotevpnLAN - is the remote network behind the SonicWall

  ################ CONFIG #############################

  6.3 (2) version PIX

  interface ethernet0 10full

  interface ethernet1 10full

  ethernet0 nameif outside security0

  nameif ethernet1 inside the security100

  .../...

  hostname vpnpix1

  .../...

  names of

  name A.B.C.D vpnpix1-e1

  name X.Y.Z.T vpnpix1-e0

  name E.F.G.H defaultgw

  intranet name 10.0.0.0

  name 192.168.250.0 nat-intranet

  name J.K.L.M internetgw

  name 10.M.N.P server1

  name Server2 10.M.N.Q

  name 10.M.N.R server3

  name 192.168.252.0 remotevpnLAN

  name 10.1.71.0 nat-remotevpnLAN

  .../...

  object-group network server-group

  description servers used by conencted to users remote LAN through a VPN tunnel

  network-host server1 object

  host Server2 network-object

  network-host server3 object

  .../...

  access allowed INCOMING tcp nat-remotevpnLAN 255.255.255.0 list object-group server-eq - ica citrix

  .../...

  OUTBOUND ip intranet 255.0.0.0 allowed access list nat-remotevpnLAN 255.255.255.0

  access list permits INTRANET-to-remotevpnLAN-VPN ip intranet 255.0.0.0 255.255.255.0 remotevpnLAN

  access-list SHEEP, remotevpnLAN permits intranet ip 255.0.0.0 255.255.255.0 nat-remotevpnLAN

  .../...

  IP address outside the vpnpix1-e0 255.255.255.240

  IP address inside the vpnpix1-e1 255.255.252.0

  .../...

  Global 192.168.250.1 1 (outside)

  NAT (inside) 0 access-list SHEEP-to-remotevpnLAN

  NAT (inside) 1 intranet 255.0.0.0 0 0

  .../...

  static (inside, outside) server1 server1 netmask 255.255.255.255 0 0

  public static server2 (indoor, outdoor) server2 netmask 255.255.255.255 0 0

  public static server3 (indoor, outdoor) server3 netmask 255.255.255.255 0 0

  static (exterior, Interior) nat-remotevpnLAN remotevpnLAN netmask 255.255.255.0 0 0

  .../...

  Access-group ENTERING into the interface outside

  Access-group OUTGOING in the interface inside

  Route outside 0.0.0.0 0.0.0.0 internetgw 1

  Route inside the intranet 255.0.0.0 defaultgw 1

  .../...

  Permitted connection ipsec sysopt

  .../...

  Crypto ipsec transform-set esp-3des esp-md5-hmac VPN - TS1

  .../...

  map BusinessPartners 30 ipsec-isakmp crypto

  card crypto BusinessPartners 30 matches the INTRANET-to-remotevpnLAN-VPN address

  card crypto BusinessPartners 30 set peer remotevpnpeer

  card crypto BusinessPartners 30 game of transformation-VPN-TS1

  BusinessPartners outside crypto map interface

  ISAKMP allows outside

  .../...

  ISAKMP key * address remotevpnpeer netmask 255.255.255.255

  ISAKMP identity address

  part of pre authentication ISAKMP policy 10

  ISAKMP policy 10 3des encryption

  ISAKMP policy 10 md5 hash

  10 2 ISAKMP policy group

  ISAKMP life duration strategy 10 28800

  part of pre authentication ISAKMP policy 20

  ISAKMP policy 20 3des encryption

  ISAKMP policy 20 chopping sha

  20 2 ISAKMP policy group

  ISAKMP duration strategy of life 20 28800

  part of pre authentication ISAKMP policy 30

  ISAKMP policy 30 3des encryption

  ISAKMP policy 30 md5 hash

  30 1 ISAKMP policy group

  ISAKMP duration strategy of life 30 28800

  .../...

  : end

  ################## DEBUG ############################

  vpnpix1 # debug crypto isakmp

  vpnpix1 #.

  ISAKMP (0): early changes of Main Mode

  crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

  Exchange OAK_MM

  ISAKMP (0): treatment ITS payload. Message ID = 0

  ISAKMP (0): audit ISAKMP transform 1 against the policy of priority 10

  ISAKMP: 3DES-CBC encryption

  ISAKMP: MD5 hash

  ISAKMP: default group 2

  ISAKMP: preshared auth

  ISAKMP: type of life in seconds

  ISAKMP: duration of life (basic) of 28800

  ISAKMP (0): atts are acceptable. Next payload is 0

  ISAKMP (0): ITS been pre-shared key, using id ID_IPV4_ADDR type authentication

  to return to the State is IKMP_NO_ERROR

  crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

  Exchange OAK_MM

  ISAKMP (0): processing KE payload. Message ID = 0

  ISAKMP (0): processing NONCE payload. Message ID = 0

  ISAKMP (0): load useful treatment vendor id

  ISAKMP (0): ID payload

  next payload: 8

  type: 1

  Protocol: 17

  Port: 500

  Length: 8

  ISAKMP (0): the total payload length: 12

  to return to the State is IKMP_NO_ERROR

  crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

  Exchange OAK_MM

  ISAKMP (0): processing ID payload. Message ID = 0

  ISAKMP (0): HASH payload processing. Message ID = 0

  ISAKMP (0): SA has been authenticated.

  ISAKMP (0): start Quick Mode Exchange, M - ID - 1346336108:afc08a94

  to return to the State is IKMP_NO_ERROR

  ISAKMP (0): send to notify INITIAL_CONTACT

  ISAKMP (0): sending message 24578 NOTIFY 1 protocol

  Peer VPN: ISAKMP: approved new addition: ip:remotevpnpeer / 500 Total VPN peer: 3

  Peer VPN: ISAKMP: Peer ip:remotevpnpeer / 500 Ref cnt incremented: 1 Total VPN peer: 3

  crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

  ISAKMP (0): processing NOTIFY payload Protocol 14 1

  SPI 0, message ID = 476084314

  to return to the State is IKMP_NO_ERR_NO_TRANS

  ISAKMP (0): retransmission of the phase 2 (0/0)... mess_id 0xafc08a94

  crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

  ISAKMP: error msg not encrypted

  ISAKMP (0): start Quick Mode Exchange, M - ID 1919346690:7266e802

  crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

  ISAKMP: error msg not encrypted

  ISAKMP (0): retransmission of the phase 2 (1: 1)... mess_id 0xafc08a94

  crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

  ISAKMP: error msg not encrypted

  ISAKMP (0): retransmission of the phase 2 (0/2)... mess_id 0x7266e802

  crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

  ISAKMP: error msg not encrypted

  ISAKMP (0): retransmission of the phase 2 (2/3)... mess_id 0xafc08a94

  crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

  ISAKMP: error msg not encrypted

  ISAKMP (0): retransmission of the phase 2 (1/4)... mess_id 0x7266e802

  crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

  ISAKMP: error msg not encrypted

  ISAKMP (0): start Quick Mode Exchange, M - ID - 1475513565:a80d7323

  ISAKMP (0): delete SA: CBC vpnpix1-e0, dst remotevpnpeer

  crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

  ISAKMP: drop msg deleted his

  ISADB: Reaper checking HIS 0x10ff1ac, id_conn = 0 DELETE IT!

  Peer VPN: ISAKMP: Peer ip:remotevpnpeer / 500 Ref cnt decremented for: 0 Total of VPN peer: 3

  Peer VPN: ISAKMP: deleted peer: ip:remotevpnpeer / 500 Total VPN peers: 2

  ISADB: Reaper checking HIS 0 x 1100984, id_conn = 0

  ISADB: Reaper checking HIS 0x10fcddc, id_conn = 0

  crypto_isakmp_process_block:src:remotevpnpeer, dest:vpnpix1 - dpt:500 e0 spt:500

  ISAKMP: its not located for ike msg

  #####################################################

  Get rid of:

  static (exterior, Interior) nat-remotevpnLAN remotevpnLAN netmask 255.255.255.0 0 0

  You don't need it. Change:

  OUTBOUND ip intranet 255.0.0.0 allowed access list nat-remotevpnLAN 255.255.255.0

  access-list SHEEP, remotevpnLAN permits intranet ip 255.0.0.0 255.255.255.0 nat-remotevpnLAN

  TO:

  access list permits OUTGOING ip intranet 255.0.0.0 255.255.255.0 remotevpnLAN

  access-list SHEEP, remotevpnLAN permits intranet ip 255.0.0.0 255.255.255.0 remotevpnLAN

  This indicates the PIX not NAT IPSec traffic. NAT happens BEFORE IPSec in the PIX, so if you the traffic IPSec nat it will never match your crypto access list and will not be encrypted.

  This, however, should not stop the tunnel of Phase 2 of the course of construction, they would stop flowing above the tunnel, traffic, so you still have a problem somewhere. What I'm guessing, is that the Sonicwall (SW) has a different encryption-defined list access, it must be the EXACT OPPOSITE of what is configured on the PIX. In other words, the SW should be encrypting the traffic of "remotevpnLAN-24" "intranet/8", make sure that the subnet mask ar ETHE same too. "

  To answer your questions:

  1. it simply means that the PIX has not received a response and is to retransmit the last ISAKMP packet. The process_block simply means that the PIX has dropped a package that was to be encrypted because the IPSec tunnel has not been built. If you get the tunnel built, these messages will disappear.

  2. the 3 first static does not appear to be linked to the tunnel IPSec, if they are simply to access a server inside, then they will not affect this VPN tunnel. The last of them should be deleted, as I already said.

  3. for traffic initiated from inside the PIX, the order is incoming ACL, then NAT, IPSec processing. That's why your OUTGOING ACL must allow traffic first, then your NAT 0 statement refuses to be NAT had, then the encryption function is the traffic and the number.

  4 do what I said above :-)

  If you still have no luck, re - run debugs, but initiate traffic behind the Sonicwall, in this way the Sonicwall will try and debug of build that the tunnel and you will get more information on the PIX. Mainly, we'll see what traffic model the SonicWall is configured to encrypt (you don't see if the PIX initiates the tunnel).

• Determine the IP address assigned to the laptop using SONICWALL VPN to connect to the network

  Hello

  How can I determine assigned by DHCP IP address internal LAP assigned to a laptop computer after that it connects to our network. We use the client VPN Sonicwall.

  For example, our model of IP network is 10.11.12.x. I guess that any VPN client PC Gets a 10.11.12.x address once the connection is established.

  Thank you!

  Click Start (or press the Windows key) and type cmd , and then press Ctrl_Shift + enter together. This will launch a prompt with high privileges. Acknowledge the UAC warning and provide credentials if necessary. Once you have the command prompt window use this command at the command prompt.

  IPCONFIG/ALL

  If you don't have administrator access on your computer, use cmd with just Enter and this simple command at the prompt window.

  IPCONFIG

  You get your address IP LAN, just not all the information available.

• ASA5510 + Sonicwall VPN site-to site does not

  We tried to connect VPN of Sonicwall PRO2040 to an ASA5510 without success. I get the following errors on the ASA:

  / * Style definitions * / table. MsoNormalTable {mso-style-name : « Table Normal » ; mso-tstyle-rowband-taille : 0 ; mso-tstyle-colband-taille : 0 ; mso-style-noshow:yes ; mso-style-priorité : 99 ; mso-style-qformat:yes ; mso-style-parent : » « ;" mso-rembourrage-alt : 0 à 5.4pt 0 à 5.4pt ; mso-para-marge-top : 0 ; mso-para-marge-droit : 0 ; mso-para-marge-bas : 10.0pt ; mso-para-marge-left : 0 ; ligne-hauteur : 115 % ; mso-pagination : widow-orphelin ; police-taille : 11.0pt ; famille de police : « Calibri », « sans-serif » ; mso-ascii-font-family : Calibri ; mso-ascii-theme-font : minor-latin ; mso-fareast-font-family : « Times New Roman » ; mso-fareast-theme-font : minor-fareast ; mso-hansi-font-family : Calibri ; mso-hansi-theme-font : minor-latin ; mso-bidi-font-family : « Times New Roman » ; mso-bidi-theme-font : minor-bidi ;}

  where x.x.x.x is the IP address of the Sonicwall, y.y.y.y is the ASA

  6 March 19, 2010 15:44:06 302015 x.x.x.x y.y.y.y 500 500 built inbound connection UDP 48318039 for outside:x.x.x.x/500 (x.x.x.x 500) at identity:y.y.y.y/500 (y.y.y.y 500)

  4 March 19, 2010 15:44:29 713903 IP = x.x.x.x, Invalid Cookie message received on HIS non-existent

  4 March 19, 2010 15:44:29 113019 group = x.x.x.x, Username = x.x.x.x, IP = x.x.x.x, disconnected Session. Session type: IKE, duration: 0 h: 00 m: 23s, xmt bytes: 0, RRs bytes: 0, right: Service lost

  3, 19 March 2010 15:44:29 713123 group = x.x.x.x, IP = x.x.x.x, IKE has lost contact with the remote peer, removal of connection (type keepalive: DPD)

  4 March 19, 2010 15:44:27 group 713903 = x.x.x.x, IP = x.x.x.x, treatment of the Information Exchange has failed

  5 March 19, 2010 15:44:27 group 713904 = x.x.x.x, IP = x.x.x.x, received a unencrypted INVALID_COOKIE notify message, drop

  4 March 19, 2010 15:44:25 group 713903 = x.x.x.x, IP = x.x.x.x, treatment of the Information Exchange has failed

  5 March 19, 2010 15:44:25 713904 = x.x.x.x, IP = x.x.x.x group, received a unencrypted INVALID_COOKIE notify message, drop

  4 March 19, 2010 15:44:23 group 713903 = x.x.x.x, IP = x.x.x.x, treatment of the Information Exchange has failed

  5 March 19, 2010 15:44:23 group 713904 = x.x.x.x, IP = x.x.x.x, received a unencrypted INVALID_COOKIE notify message, drop

  5 March 19, 2010 15:44:06 group 713068 = x.x.x.x, IP = x.x.x.x, no routine received Notify message: info ID not valid (18)

  5 March 19, 2010 15:44:06 group 713119 = x.x.x.x, IP = x.x.x.x, PHASE 1 COMPLETED

  6 March 19, 2010 15:44:06 113009 AAA retrieved by default group policy (DfltGrpPolicy) to the user = x.x.x.x

  6 March 19, 2010 15:44:06 302015 x.x.x.x y.y.y.y 500 500 built connection UDP incoming 48318039 for outside:x.x.x.x/500 (x.x.x.x/500) to the identity: y.y.y.y 500 (500 y.y.y.y)

  and here's the conf on the ASA:

  / * Style definitions * / table. MsoNormalTable {mso-style-name : « Table Normal » ; mso-tstyle-rowband-taille : 0 ; mso-tstyle-colband-taille : 0 ; mso-style-noshow:yes ; mso-style-priorité : 99 ; mso-style-qformat:yes ; mso-style-parent : » « ;" mso-rembourrage-alt : 0 à 5.4pt 0 à 5.4pt ; mso-para-margin : 0 ; mso-para-marge-bottom : .0001pt ; mso-pagination : widow-orphelin ; police-taille : 11.0pt ; famille de police : « Calibri », « sans-serif » ; mso-ascii-font-family : Calibri ; mso-ascii-theme-font : minor-latin ; mso-fareast-font-family : « Times New Roman » ; mso-fareast-theme-font : minor-fareast ; mso-hansi-font-family : Calibri ; mso-hansi-theme-font : minor-latin ; mso-bidi-font-family : « Times New Roman » ; mso-bidi-theme-font : minor-bidi ;}

  Dynamic crypto map SYSTEM_DEFAULT_CRYPTO_MAP 65535 define security association lifetime 28800 seconds

  cryptographic kilobytes 4608000 life of the set - the association of security of the 65535 SYSTEM_DEFAULT_CRYPTO_MAP of the dynamic-map

  card crypto outside_map 2 match address outside_cryptomap

  card crypto outside_map 2 peers set x.x.x.x

  card crypto outside_map 2 game of transformation-ESP-AES-256-SHA

  map outside_map 65535-isakmp ipsec crypto dynamic outside_dyn_map

  outside_map interface card crypto outside

  ISAKMP crypto identity hostname

  crypto ISAKMP allow outside

  crypto ISAKMP allow inside

  crypto ISAKMP policy 10

  preshared authentication

  aes-256 encryption

  sha hash

  Group 2

  life 86400

  tunnel-group x.x.x.x type ipsec-l2l

  tunnel-group ipsec-attributes x.x.x.x

  pre-shared-key *.

  !

  Can anyone help please? We checked on the Sonicwall and it seems that everything is appropriate.

  As you use the ip address, you must configure "isakmp crypto identity address" instead of "crypto isakmp identity hostname.

  Please share debug output while trying to establish VPN:

  -debug crypto isakmp

  -debug crypto ipsec

  See also, the exit after:

  -show crypto isa his

  -show crypto ipsec his

  If you can share the ASA configuration that would be great. Thank you.

• SonicWALL VPN SRA 1600, impossible to use bookmarks

  I'm trying to understand what is wrong with our VPN SRA 1600 device.  When you use the netextender application, everything works fine. Connect no problem and have access to everything on the field is great.

  When you try to use the bookmarks is where the shoe pinches. When you click on a bookmark for the terminal server, I get the following error:

  If I use activex or java is not serious, he also any server, I'm trying to connect to.

  I'm not sure where the rub, is there something wrong with the installation of VPN, is he an SDR issue, is there something else?  All the stuff I've done research on this issue has not helped.

  Thank you

  I am pleased that the HTML5 solution works for you.

  Its much simpler and less constraints than the Active X or Java favorite operating system/browser.

• SonicWALL VPN Client does not connect

  I use Windows 10 Pro.  I can install the NEW Client VPN (4.9.0.2012) very well.  When I put in information that works very well.  It will even connected, the first time, when you have completed the installation.  Here's the crazy part.  I can't disable the VPN client.  When I try to ACTIVATE the connection he wants to use a telephone line.  I can uninstall the client software and tell him NOT to keep data.  I can reinstall the client and it will connect the first time.  After that it will not.  I have already told him to use LAN ONLY entered in the network settings.  Only, it crashes and then trying to acquire IP.

  Norman

  I think you are talking about the Global VPN Client. You must uninstall this version of CVM and install the most recent of 4.9.4.0306 which has been validated to run on Windows 10.

  #Iwork4Dell

• Double VPN? SonicWall & Windows Server?

  We were using Sonicwall Global VPN and easy of use and installation, we want to be able to use the standard Windows VPN.  Can be used or the firewall must be configured for one or the other.  I have configure the NAT of the PPTP service between public sector and our internal Windows Server 2012 but I get error 800 on the Windows VPN and politics journal watch SonicWall VPN IKEv2 not found.

  This Forum is made for the SRA/SMA devices and not firewalls.

  Please report these question in the forum "network security".

  But to answer the question, yes you can do both because they use different ports/protocols.

• Failover with VPN concentrator

  Hi all

  We have unique VPN concentrator which is the single point of failure, so need your help to mitigate the same

  The topology diagram is attached

  Site A and Site B.

  Site B has internet gateways where we have existing VPN.

  The intention to introduce the site A & Concentrator VPN gateway VPN is set as well

  Our design is provided for in

  Connectivity between the two locations & other office is managed by BGP.

  Default route is pointing at the Internet gateway.

  Info by the Internet Segment.

  ·         We have the SP independent IP range

  ·         Switching between 2 SP to site B is obtained by using the iBGP and eBGP

  Challenge: VPN concentrator single Point of failure (the Cisco VPN concentrator 3000)

  Here are the design goals

  ·         Implement internet gateways to the Site - A which will have redundancy level of Portal Site

  ·         Place on the VPN concentrator, which will act as a switch between site

  o If the concentrator vpn site B is out of box A VPN site must support all traffic.

  Concentrator VPN active o replica of Site B

  Is it possible to achieve the objectives of design.

  Please help about the VPN concentrator... How I can set VPN concentrator in failover mode... Just as we do firewalls?

  Help, please

  Hi yogesh,

  Concentrator VPN supports failover through VRRP. Please find the following for your reference document:

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2284/products_tech_note09186a0080094490.shtml

  As for the addition of failover for VPN concentrator, you happen to have a spare hub VPN to run VRRP?

  Don't know if you know, however, VPN concentrator comes end of life and the last delivery date was November 2007, as a result, you will not be able to buy VPN concentrator more.

  Here's the EOL notificatin for your reference:

  http://www.Cisco.com/en/us/prod/collateral/vpndevc/ps5743/ps5749/ps2284/prod_end-of-life_notice0900aecd805cd5a0.html

• Sheep VPN on 2811

  Hello

  I had a SonicWALL, SonicWALL VPN upward and running for a few years, with network 192.168.5.x to my office able to access 192.168.6.x and 192.168.70.x in my data center.  Now he must replace the SonicWALL to my office with a 2811, and I need to keep the VPN tunnel and work.

  My 2811 is currently NAT and I have the VPN tunnel to the top, but no traffic passes.  I think I have troubleshoot-carried out down to a problem of sheep, and I do not know how to solve with ACL, although I used to know how to do on PIX.

  What lines of code do I need enable my office network (192.168.5.x) access to the network of data centre (192.168.6.x and 70.x)?  There are currently only no ACLs not applied to the WAN interface at all, and I don't have that one static IP address.

  Hi Eric,.

   access-list 111 deny ip 192.168.5.0 0.0.0.255 192.168.6.0 0.0.0.255 

   access-list 111 deny ip 192.168.5.0 0.0.0.255 192.168.70.0 0.0.0.255

   access-list 111 permit ip 192.168.5.0 0.0.0.255 any route-map nonat permit 10 match ip address 111

  !

   ip nat inside source route-map nonat interface  overload

  So that means all who refused in road - map ACL will be denied NATing when it corresponds to the specific rule and it goes as it is...

  Concerning

  Knockaert