4

My office network is 10.25.0.0/16. I have a VPC in Amazon that's 10.100.0.0/16, and I have a VPN established between the office and the VPC using Amazon's Virtual Private gateway. This connection works as expected - traffic to 10.100.0.0 connects fine.

I have a separate VPC (legacy stuff) in 10.30.0.0/16, and I've setup openswan between 10.100.0.0 and 10.30.0.0 so they can speak to each other, and that works (I can ssh between the two networks).

My problem is that I want to connect from the 10.25.0.0 network to 10.30.0.0 network THROUGH the 10.100 network. I've set all the appropriate routing rules in the office firewall (SonicWall NSA2400, SonicOS 5.9) but as far as I can tell traffic isn't leaving the SonicWall. When I do a packet capture on the sonicwall, packets destined for 10.30.x.x show as "Consumed" or "dropped" with zero "forwarded." I don't understand what "consumed" is either, but that's a separate issue.

I've tried everything I can think of - there are no ACLs or Firewall rules blocking traffic. Traffic to 10.100 and 10.33 are routed the exact same way (over the VPN interfaces) but traffic to 10.100 gets forwarded while traffic to 10.33 doesn't.

Here's what a packet capture for an SSH attempt to 10.100 shows:

--File Index : 1.--

--241 packets captured.--

-----Statistics------------
Number Of Bytes Failed To Report:        0
Number Of Packets Forwarded     :        53
Number Of Packets Generated     :        0
Number Of Packets Consumed      :        137
Number Of Packets DROPPED       :        51
Number Of Packets Status Unknown:        0

*Packet number: 1*

Here's what I get when I SSH to 10.33:

--58 packets captured.--

-----Statistics------------
Number Of Bytes Failed To Report:        0
Number Of Packets Forwarded     :        0
Number Of Packets Generated     :        0
Number Of Packets Consumed      :        13
Number Of Packets DROPPED       :        45
Number Of Packets Status Unknown:        0

What am I missing to allow it to forward traffic to 10.33.0.0 over the Office-AmazonVPC tunnel? According to everything I've read this should work but I appear to be missing something.

Edit #2: I followed this exact guide. As I said, it works for the 10.100 network but not the 10.30 network through the same interface: http://www.sonicwall.com/app/projects/file_downloader/document_lib.php?t=TN&id=339&dl=1

Edit #3: Traffic within the VPC is routing correctly, so if there's some magic incantation you need to do to let it route traffic from our office LAN I'd love to know what it is. We have a static route inside the VPC to tell it that the 10.25.0.0/16 traffic should go over the VPGW, and all the other routes for 10.30.0.0/16 are correctly forwarding to the OpenVPN instances.

Improve this question
15
  • 1
    What are the networks configured for your VPNs? Each VPN needs to be aware of the networks it will be connecting to. Your 'Destination Network' settings need to include the other networks so for instance on the 10.25.0.0 network the VPN destinations should include both the 10.100.0.0 network as well as the 10.30.0.0 network. The same is true of the 10.30.0.0 network having the 10.100.0.0 and 10.25.0.0 configured as destinations.
    – Mike Naylor
    Mar 3, 2014 at 18:17
  • What kind of Sonicwalls and OS version are they running? If it is SonicOS Enhanced I can provide more information.
    – Mike Naylor
    Mar 3, 2014 at 18:19
  • The office is an NSA2400 running SonicOS 5.9. The other end is an Amazon Virtual Private Gateway. The routing (Network -> Routing) is configured as follows: Source: Any Destination: 10.33.0.0/255.255.0.0 Service: Any Gateway: 0.0.0.0 (greyed out) Interface: AmazonVPC (the VPN tunnel interface) Metric: 1 Disable route when interface is disconnected: check Permit acceleration: unchecked Auto-add access rules: check
    – Evan
    Mar 3, 2014 at 18:47
  • Where did 10.33.0.0 come from?... I see the 10.30 network. Anyhow, your VPN for the Office should be setup as follows: Source: [local 10.25.0.0 network] Destination: 10.100.0.0 and 10.30.0.0 networks Gateway: 0.0.0.0 (local). The 10.100.0.0 side should look like this: Source: [local 10.100.0.0 network] Destination: 10.25.0.0 Gateway: 0.0.0.0 (local) This will tell your Office network that the 10.30.0.0 network is available through the VPN.
    – Mike Naylor
    Mar 3, 2014 at 19:36
  • @MikeNaylor Sorry, 10.33.0.0 was a typo. The config you describe is what I already have, which doesn't work. Here's a pic of what is currently in place: i.imgur.com/qg5bIZG.png . Rule 1&2 are the ones that don't work . 3 & 4 do work. I already tried changing "LAN Subnets" to "Any" and every other possible permutation and it just doesn't work. The routes are correct - the device isn't forwarding the traffic.
    – Evan
    Mar 3, 2014 at 21:04

1 Answer 1

Reset to default
2

I had this problem but after trial/error finally fixed it. Before I start, let me just say that sonicwall documentation and support has gotten so much worse since the acquisition by Dell that I am moving away from sonicwall to almost any other solution (hi cisco + pan) when our support contract is up.

So I followed the rev b document 'configuring sonicos for amazon vpc' also. I configured it with dynamic tunnels with bgp (just because) and it came up. Not that the config document helped because the cli commands don't match with the reality of sonicwall firmware 5.9 on an nsa3500.

After getting the tunnels up and running and the bgp routes advertised, I could not route traffic from our lan (192.168.0.0/16) to the subnet of our vpc on amazon (10.23.0.0/16). I was convinced it was firewall rules until I took another look at the sonicwall routing table.

Basically, I had to create in the gui rules that should have been declared in the bgp cli config, and were not at all mentioned in the rev b config doc.

The rules I created were

source: any
destination : amazon vpc subnet 10.23.0.0/16
service: any
tos: any
gateway: 0.0.0.0
interface: ti2

I did another rule exactly the same for the ti3 tunnel interface.

Suddenly I was able to ssh into the ec2 instances instead of just being able to ping them.

I'm so upset with at sonicwall / dell.

Hope this helps somebody. Conversely, if there are any thoughts on how to improve this I'm all ears.

Improve this answer
1
  • 1
    I'd like to create a rule for VPN routing on my SonicWall TZ300, but the UI doesn't let me .You say you're using interfaces "ti2" and "ti3", but my VPN doesn't have a selectable interface definition. I can "create a VPN tunnel interface", but when I do so it just gives me an error.
    – MikeB
    Apr 13, 2016 at 5:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.