SonicWall Site-to-site VPN with WAN IP endpoint

Question

I'm not a real network engineer (just something I must dabble in from time to time), so hopefully I will provide enough detail and use the right terminology here.

We have a site-to-site VPN requirement with a data partner. We have a NSA 2600 and they have a Cisco ASR1004. They require that our "Encryption Domain" (in sonicwall terms "Local Network") be a public IP address.

We currently use all of our available public IP addresses for incoming and outgoing traffic of various types, so, for the first pass, we randomly chose one to give it. Lets call it "Fiber19" (that is what our address object is called) and their "remote encryption domain" (aka "Destination Network") is called "Incomm IP - Test" and is a public IP of theirs that they are using within the tunnel. Note that "Fiber19" is not the first IP address in our WAN block, it is the second. Although the WAN interface is using "Fiber18" as its IP, it still accepts traffic for "Fiber19" for various services (I'm not sure exactly how this works, but we're glad that it does).

The "Interesting traffic" that we want to travel over this tunnel is requests originating from a specific subnet of ours on a single service (port) that will not overlap with any other services. All requests will originate from our network, but must NAT to appear that they are from that "Fiber19" address. It will all go to a single IP on their end.

Now, the questions I have are as follows:

1. Will having that public IP assigned to the tunnel cause any issues with routing, NAT, etc.? Should we just poach some foreign ISPs DHCP IP to use in this tunnel, to avoid promiscuity or any other IP overlap?
2. How can I set up NAT to send all of this single port traffic through this tunnel to their endpoint? I've looked at using "Apply NAT Policies" in the VPN advanced settings, but it doesn't seem like a good fit for this application, or at least i don't know how to configure it to do this.

Note: we currently have the VPN connected, and I'm not seeing any IP issues, currently, but I don't know what will happen once I figure out how to route traffic to it.

Thanks in advance for any advice, and I hope this all makes sense to someone.

--mobrien118

Answer 1

I haven't worked too extensively with Sonicwall VPN setups but it sounds like you're pretty close to having it set up.

1. Assigning that IP to the tunnel shouldn't cause any problems. To confirm what you mentioned, Sonicwall handles multiple IPs (and keeping them separate) on a single physical port just fine.

2. You're most likely going to need to go to Network > NAT Policies and define a rule to take the desired traffic and send it through the tunnel (and the reverse). You can create a service object for your specific port and set the rule to take any traffic with that Original Service and send it out the tunnel. Or you could set it so any traffic with the Destination of the data partner's network be sent out the tunnel. Basically there are a few options for how to configure it.

   It's more intuitive than it looks at first so if you watch a couple videos on similar configs like port forwarding on a Sonicwall you should be able to figure it out.

3. If you have any current support from Sonicwall their support can be great at working through stuff like this with you. You'll spend a lot of time on hold and might need to take it slow explaining to their tech but they've been reliable the several times I've used them.