1

We have a main office (M) with a Sonicwall TZ215, and a branch office (B) with a TZ210.

Computers in B access the server in M through a site-to-site VPN between the two Sonicwalls. Internet traffic from B goes straight out of the local router, but traffic from B (192.168.1.x) to the main office is NATted to the local network in M (192.168.0.x).

We have third party VOIP phones in M on their own subnet.

I would like to have a VOIP phone from the system in M in the branch office B, but to make it work, traffic from the VOIP phone n B must be routed to M and then routed the VOIP subnet, as the third party VOIP system (apparently) needs the traffic to transit through the router in M (probably some combination of specific public IP and private DNS).

Here is a very crude diagram of the setup.

  M  ISP                                          ISP       B
      |------------------------- VPN---------------|
   | router |--------|                         |router|-----|
        |            | X1                                   | X1
   |VOIP switch|   |sonicwall|                           |sonicwall|
      |   |--------|X3    X0 |                           |X0    X2 |  
| VOIP phones|          | LAN |                     | LAN | | VOIP phone|

a) Can this be done with the Sonicwalls?

b) What strategy can I use?

I have tried connecting the VOIP phone to X2 and creating a separate subnet in B for the VOIP phone (10.0.0.x). I can add that subnet to the VPN, as in these instructions but I have not found a way to force ALL traffic from that subnet over the VPN, while not forcing ALL traffic from the local network (192.168.1.x) through the VPN (not desirable). The idea is that once through the VPN I should be able to direct all traffic out of the specific gateway on the Sonicwall in M on X3.

I tried creating a second site-to-site VPN in B, but it seems to conflict with the first, as they share the same endpoint in M (public IP), in a similar way as described here.

Any suggestions welcome!

Improve this question

1 Answer 1

Reset to default
2

You should be able to do what you want by

  • Replacing your site-2site VPN with a "Tunnel Interface" (its an option when adding a VPN)
  • Giving the phones in B a new IP range (which you have done)
  • Adding a "Route" at B to Route traffic from those IP addresses down the VPN
Improve this answer
3
  • I left the previous VPN as "Site-to-site", and added a second "Tunnel interface". Both seem to work. Routing out also seems to work. Next step is routing the traffic correctly in site M, in and out of X3. Thanks!
    – simonpa71
    Jan 17, 2020 at 8:17
  • I configured source NAT on site M, and routed all traffic from the destination netork range out onto the X3 gateway. I am not 100% sure of the order in which NAT and routing take place. It would have been convenient to bridge X3 in M directly to the VPN, but have not found a simple way to do that. The SIP is working, but I am battling with one way audio at the moment.
    – simonpa71
    Jan 21, 2020 at 18:02
  • In general routing happens first to define the route through the firewall, then NATting is applied
    – Phil
    Jan 22, 2020 at 10:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.