1

I'm not a real network engineer (just something I must dabble in from time to time), so hopefully I will provide enough detail and use the right terminology here.

We have a site-to-site VPN requirement with a data partner. We have a NSA 2600 and they have a Cisco ASR1004. They require that our "Encryption Domain" (in sonicwall terms "Local Network") be a public IP address.

We currently use all of our available public IP addresses for incoming and outgoing traffic of various types, so, for the first pass, we randomly chose one to give it. Lets call it "Fiber19" (that is what our address object is called) and their "remote encryption domain" (aka "Destination Network") is called "Incomm IP - Test" and is a public IP of theirs that they are using within the tunnel. Note that "Fiber19" is not the first IP address in our WAN block, it is the second. Although the WAN interface is using "Fiber18" as its IP, it still accepts traffic for "Fiber19" for various services (I'm not sure exactly how this works, but we're glad that it does).

The "Interesting traffic" that we want to travel over this tunnel is requests originating from a specific subnet of ours on a single service (port) that will not overlap with any other services. All requests will originate from our network, but must NAT to appear that they are from that "Fiber19" address. It will all go to a single IP on their end.

Now, the questions I have are as follows:

  1. Will having that public IP assigned to the tunnel cause any issues with routing, NAT, etc.? Should we just poach some foreign ISPs DHCP IP to use in this tunnel, to avoid promiscuity or any other IP overlap?
  2. How can I set up NAT to send all of this single port traffic through this tunnel to their endpoint? I've looked at using "Apply NAT Policies" in the VPN advanced settings, but it doesn't seem like a good fit for this application, or at least i don't know how to configure it to do this.

Note: we currently have the VPN connected, and I'm not seeing any IP issues, currently, but I don't know what will happen once I figure out how to route traffic to it.

Thanks in advance for any advice, and I hope this all makes sense to someone.

--mobrien118

  • You really do not want to NAT unless you must. You will need to NAT if you have overlapping addresses with the other network. – Ron Maupin Feb 14 '18 at 17:10
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Feb 21 '18 at 18:06
1

I haven't worked too extensively with Sonicwall VPN setups but it sounds like you're pretty close to having it set up.

  1. Assigning that IP to the tunnel shouldn't cause any problems. To confirm what you mentioned, Sonicwall handles multiple IPs (and keeping them separate) on a single physical port just fine.
  2. You're most likely going to need to go to Network > NAT Policies and define a rule to take the desired traffic and send it through the tunnel (and the reverse). You can create a service object for your specific port and set the rule to take any traffic with that Original Service and send it out the tunnel. Or you could set it so any traffic with the Destination of the data partner's network be sent out the tunnel. Basically there are a few options for how to configure it.

    It's more intuitive than it looks at first so if you watch a couple videos on similar configs like port forwarding on a Sonicwall you should be able to figure it out.

  3. If you have any current support from Sonicwall their support can be great at working through stuff like this with you. You'll spend a lot of time on hold and might need to take it slow explaining to their tech but they've been reliable the several times I've used them.

  • Thanks, LostWander, I'm a little bit ahead of that. I guess I should have included that orifginally, I was using a "Tunnel Interface" VPN, and that is how I had it set up. I'm pretty sure that would have worked, but the remote partner has a requirement that it must be a "Site-to-site" VPN (essentially implementing Layer 3, instead of Layer 2) so i can't create a NAT to go to it because there is no "Interface" to bind the traffic to. That is the specific part where I'm hung up. I should have been more specific and added that the next issue I need to solve is how to NAT the traffic to the tunl. – mobrien118 Feb 16 '18 at 1:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.