VPN:Configuring Site to Site VPN between two SonicWalls on same WAN subnet with same default gateway

10/14/2021 1,211 People found this article helpful 106,173 Views

Download

Print

Share

• LinkedIn
• Twitter
• Facebook
• Email
• Copy URL The link has been copied to clipboard

Description

When an attempt to establish a VPN tunnel between two firewalls using the same gateway IP address and subnet fails, logs in both units may show an error indicating that the remote peer does not respond to phase 1 IKE requests or no negotiation attempts at all.This happens when the upstream gateway is not configured to handle the ARP requests properly. The issue is usually observed when both firewalls are connected through the same ISP over a DSL connection when the ISP is using RFC1483 bridging mode. Static routing is used to successfully work around this problem.

EXAMPLE: Replace the example IP addresses with those from your real working environment:

• Site A
  • Wan IP: 172.16.25.7
  • Subnet Mask: 255.255.255.0
  • Gateway: 172.16.25.1
• Site B
  • Wan IP: 172.16.25.8
  • Subnet Mask: 255.255.255.0
  • Wan Gateway: 172.16.25.1

Resolution

Resolution for SonicOS 7.X

This release includes significant user interface changes and many new features that are different from the SonicOS 6.5 and earlier firmware. The below resolution is for customers using SonicOS 7.X firmware.

Site A

1. Navigate to Policy|Rules and Policies |Routing Rules.
2. Click Add. Create the following new route policy.
   • Source: ANY
   • Destination: Create new address object, Navigate to Object|Match Object |Addresses: 
     • Name the object Site B
     • Zone: WAN
     • Type: Host 
     • Network: 172.16.25.8 (site B wan IP address)
     • Subnet Mask: 255.255.255.255
     • Click OK.
       
       
       
       
   • Service: Any
   • Gateway: 172.16.25.1
   • Interface: WAN
     
     
3. Click OK.
   
   
    
   
   
   

Site B

1. Navigate to Policy|Rules and Policies |Routing Rules
2. Click Add. Create the following new route policy.
   • Source: ANY
   • Destination: Create new address object, Navigate to Object|Match Object |Addresses:
     • Name the object Site A
     • Zone: WAN
     • Type: Host
     • Network: 172.16.25.7 (site A wan IP address)
     • Subnet Mask: 255.255.255.255
     • Click OK
       
       
       
       
   • Gateway: 172.16.25.1
   • Interface: WAN
     
     
3. Click OK.
   
      
   
   

Resolution for SonicOS 6.5

This release includes significant user interface changes and many new features that are different from the SonicOS 6.2 and earlier firmware. The below resolution is for customers using SonicOS 6.5 firmware.

Site A

1. Navigate to  Manage|Network |Routing.
2. Click Add. Create the following new route policy.
   • Source: ANY
   • Destination: Create new address object
     • Name the object Site B
     • Zone: WAN
     • Type: Network
     • Network: 172.16.25.8 (site B wan IP address)
     • Subnet Mask: 255.255.255.255
     • Click OK.
   • Service: Any
   • Gateway: 172.16.25.1
   • Interface: WAN
3. Click OK.
   
   

Site B

1. Navigate to  Manage|Network |Routing.
2. Click Add. Create the following new route policy.
   • Source: ANY
   • Destination: Create new address object
     • Name the object Site A
     • Zone: WAN
     • Type: Network
     • Network: 172.16.25.7 (site A wan IP address)
     • Subnet Mask: 255.255.255.255
     • Click OK
   • Gateway: 172.16.25.1
   • Interface: WAN
3. Click OK.
   
   

Related Articles

• How to configure SSLVPN Tunnel all mode for one or more particular users (Local or Domain users)
• How to disable TOTP for a Local User with admin privileges via CLI.
• Parserror on Event logs.

Categories

• Firewalls > NSa Series > VPN
• Firewalls > TZ Series > VPN
• Firewalls > NSv Series > VPN