Point to point LAN using two sonicwalls at seperate locations

Question

We have a two-location business with our head quarters in Arlington, and a remote office in Dallas. Currently, both of our offices are running a sonicwall NSA 2600 and hold a VPN tunnel between each other (using the sonicwalls). We recently purchased a point-to-point connection from our ISP between the two locations. Essentially each modem has a port that is a direct link to the other with a dedicated 100mb pipe.

I'm wanting to replace the VPN tunnel with what I assume would be an additional LAN interface on each sonicwall pointing towards the other networks subnet. Arlington: 10.74.1.1/24 Dallas: 10.74.2.1/24

Here's an example:

               +-----------+ X0 ---- LAN 10.74.1.1/24
               |           |
WAN_IP ---- X1 | SonicWall |
               | Arlington |
               +-----------+ X2 -------- X2  +-----------+ X0 ---- 10.74.2.1/24
                                    ^        |           |
                                    |        | Sonicwall | X1 ---- WAN_IP
                                    |        |  Dallas   |
                                    |        +-----------+
                                    |
                           This X2 would traverse
                           the point-to-point connection
                           between each of my ISP's modems 

My question would be, how do I configure each X2 interface? My thought would be for example:

Configuring the X2 interface on the Arlington sonicwall as: LAN, Address of 10.74.2.1, mask of 255.255.255.0. And configuring the X2 interface on the Dallas sonicwall as: LAN, address of 10.74.1.1, mask of 255.255.255.0. Also, can I test the LAN interfaces configured like this WHILE the VPN tunnel is still alive? Or would that cause some issues with routing between the two networks?

We need these networks to communicate the same way as they do over the VPN tunnel right now.

Any advice would be appreciated!

Answer 1

As others have said you can't use IPs that are already in use. You should use a separate subnet that you can route through (to the other network).

I would suggest using something larger than a /30 block (in case you ever add additional locations) -- a /29 would allow you to expand to 6 locations for example.

I would use something separate from your existing networks (so it stands out) but not adjacent (in case you expand). I would suggest something like 10.99.9.0/29.

If you want to be able to test then you should convert your existing VPN to Tunnel based VPNs first: https://support.software.dell.com/kb/sw7902 OR: https://support.software.dell.com/kb/sw11606

This has the advantage that you can then more easily make routes to test than Policy based IPsec VPNs. Do this during a period of downtime as the VPN will be down while you switch to a Tunnel interface in the VPN and then create the routes.

Then configure X2 on each router with 1 IP from your Point-to-Point range:

Arlington X2 = 10.99.9.1 /29
Dallas X2 = 10.99.9.2 /29

Both in the LAN zone, both in Static IP mode. Connect X2 to the PtP interfaces of your ISP's device (eg. the MPLS). This assumes the link is just a Layer 2 link, no routing is being done by the ISP.

You should then be able to use the Diagnostic Ping (or CLI ping) commands from each router to ping the other router's X2 interface (eg. Arlington should be able to ping 10.99.9.2.

If things are working then you can create a Routing policy to test: So on the Arlington router:

Source: Some 10.74.1.x test IP in Arlington
Destination: Some 10.74.2.x test IP in Dallas
Service: Any
Gateway: 10.99.9.2 (Dallas' X2 IP -- the other side)
Interface: X2 (the interface Arlington needs to use)
Metric: make lower than whatever you used for your Tunnel VPN metric.

Make a similar route on Dallas router (but swap all the IPs, so from a Dallas IP to the Arlington IP, the Gateway will be 10.99.9.1 this time).

I would suggest using something like LAN Speed Test (even the free version): http://www.totusoft.com/lanspeed.html

To test the speed to/from your test machines over the VPN first and then again after putting the routes in. You should see a speed difference as the traffic goes over the MPLS.

If that works then change the routes so the: Source is: Any And the Destination is: The network on the other side (instead of just an IP) -- so from Arlington the Destination would be: 10.74.2.0/24. Metric: still lower than the VPN Tunnel route.

All the traffic will go over the MPLS for everybody. This can be done lunch time as the interruption is very minimal.

As long as the Zones for X2 are the same as your X0 networks then no Firewall rules should be needed if you have Interface Trust enabled for the LAN Zone. I don't believe you will need to make any changes to NAT as everything will be routed (with respect to the internal networks).

You could then disable the VPN, or leave it and configure Probes on the routes, so that the MPLS' routes are disabled if the probe fails (allowing it to fall back to the VPN. Less useful if it's the same ISP in both cases...)

And yes: backup your configs FIRST, and again after :)

Answer 2

That won't work, because both 10.74.1.0/24 and 10.74.2.0/24 are both in use. Not only that, a PtP connection requires a mutual prefix.

Use a different IP range, and a smaller one. Put 10.75.0.1/30 (255.255.255.252) on Arlington X2, and 10.75.0.2/30 (255.255.255.252) on the Dallas X2.

Then on Arlington, add a route: 10.74.2.0/24 -> 10.75.0.2 and on Dallas: 10.74.1.0/24 -> 10.75.0.1.

I've never used a SonicWall before, so I don't know if the VPN will take precedence over the newly installed routes or not. How I would test this is take a single IP from each side's LAN, and route those over the new PtP.

So, on a laptop set as 10.74.2.10 on one side, and 10.74.1.10 on the other, on Arlington, route 10.74.2.10/32 -> 10.75.0.2 and in Dallas, route 10.74.1.10 -> 10.75.0.1. Again, I don't know if the Sonicwalls will bypass the crypto to route these over the ptp, but it might be worth a try. You could also set up a new temporary prefix at each side, and route that before going live.

Lastly, after EOB, set up the routes, see what happens, disable the VPN, and see what happens. If it works, you're done. If not, you've got a documented ordered list of what was done. Backtrack until you get original status-quo working again, and go from there.

Answer 3

If you don't manage your routing appliances directly, you need to sort this thing with your ISP and configure additional routing and interfaces not only on your Sonicwalls but also in routers.

Define two more networks:

172.16.100.0/30 Dallas-to-Arlington 172.16.101.0/30 Arlington-to-Dallas Assign:

Dallas X2: 172.16.100.1/30 Dallas Router Fe(0/1) : 172.16.100.2/30 Arlington X2: 172.16.101.1/30 Arlington Router Fe(0/1) : 172.16.101.2/30

On your Dallas Router: route 10.74.2.0/24 gateway 172.16.100.1 (traffic from A. to D. routed to Sonicwall) route 10.74.1.0/24 gateway your MPLS

On Arlington route 10.74.1.0/24 gateway 172.16.101.1 (traffic from D. to A. routed to Sonicwall) route 10.74.2.0/24 gateway your MPLS

On sonicwall you also need to disable destination NAT.

As always, backup, backup, backup! :)