4

I have an Adtran NetVanta 3448 and a Sonicwall NSA 3500 that at long last I have established a site-to-site IKE/IPSec VPN connection over. The tunnel shows as up from both ends.

From Site A (SonicWall), I can contact Site B (Adtran). I can NOT Contact Site A from Site B. Here's a quick look at how I'm set up:

  • Site A - 10.0.0.0 / 255.255.0.0 (LAN) --> X.X.131.90 (WAN)
  • Site B - 10.10.0.0 / 255.255.0.0 (LAN) --> X.X.58.218 (WAN)

Upon running a packet inspection from the SonicWall (Site A), it is showing that the packets from X.X.58.218 (Site B WAN) are being CONSUMED rather than FORWARDED.

Can anyone help to point me in the right direction on what might be causing traffic to only flow one way?

Improve this question
3
  • Consumed on SonicOS means that there is something in the config thats causing the packets not to be forwarded. Usually an ACL or no Route. Since its a L2L tunnel & sonicOS automatically creates the routes. Double check the ACL allow entries from Site B. Or your destination/local network list in the VPN tunnel config on the Sonicwall.
    – LucentMoon
    Aug 23, 2014 at 15:32
  • Lucient moon is incorrect. Dropped indicates that the packet did not reach it's destination or was blocked for some reason. When this occurs, SonicWall will tag the packet with a drop code and/or module ID. You can find out exactly what that means here, but "Consumed" is usually followed by a "forwarded". It may not show forwarded when going over the VPN tunnel though - my memory fails me on this point.
    – James Shewey
    Mar 9, 2015 at 4:45
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 10, 2017 at 15:03

1 Answer 1

Reset to default
2

This depends on the firewall rules you have. So, on SonicWall, if you enable source 10.0.0.0/24 to communicate with 10.10.0.0/24, but on the Adtran you didn't allow the same, the traffic will drop on the Adtran. But if the traffic is allowed on Adtran, then it will pass and response will pass as well .. This has to work both ways.

If the source is 10.10.0.0/24, then on both firewalls, you have to allow source 10.10.0.0/24 to communicate with 10.0.0.0/24

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.