- Products
- Network Security
Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
Security ServicesComprehensive security for your network security solution
Network Security ManagerModern Security Management for today’s security landscape
- Advanced Threat Protection
Capture ATPMulti-engine advanced threat detection
Capture Security applianceAdvanced Threat Protection for modern threat landscape
- Access Security
Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
Secure Mobile AccessRemote, best-in-class, secure access
Wireless Access PointsEasy to manage, fast and secure Wi-FI
SwitchesHigh-speed network switching for business connectivity
- Email Security
Email SecurityProtect against today’s advanced email threats
- Cloud Security
Cloud App SecurityVisibility and security for Cloud Apps
Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
- Endpoint Security
Capture ClientStop advanced threats and rollback the damage caused by malware
Content Filtering ClientControl access to unwanted and unsecure web content
- Product Widgets
- Product Menu Right Image
-
- Network Security
- Solutions
- Solutions Widgets
- Solutions Image Widgets
-
- Solutions Widgets
- Partners
- Partner Widgets
- Partners Image Widgets
-
- Partner Widgets
- Support
- Support Widget
- Support Image Widgets
-
- Support Widget
- Products
- Network Security
- Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
- Security ServicesComprehensive security for your network security solution
- Network Security ManagerModern Security Management for today’s security landscape
- Advanced Threat Protection
- Capture ATPMulti-engine advanced threat detection
- Capture Security applianceAdvanced Threat Protection for modern threat landscape
- Access Security
- Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
- Secure Mobile AccessRemote, best-in-class, secure access
- Wireless Access PointsEasy to manage, fast and secure Wi-FI
- SwitchesHigh-speed network switching for business connectivity
- Email Security
- Email SecurityProtect against today’s advanced email threats
- Cloud Security
- Cloud App SecurityVisibility and security for Cloud Apps
- Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
- Endpoint Security
- Capture ClientStop advanced threats and rollback the damage caused by malware
- Content Filtering ClientControl access to unwanted and unsecure web content
- Product Widgets
- Product Menu Right Image
-
- Network Security
- Solutions
- Solutions Widgets
- Solutions Image Widgets
-
- Solutions Widgets
- Partners
- Partner Widgets
- Partners Image Widgets
-
- Partner Widgets
- Support
- Support Widget
- Support Image Widgets
-
- Support Widget
What VPN settings have been automated or simplified?
03/26/2020 
9 People found this article helpful
97,733 Views
Description
What VPN settings have been automated or simplified?
Resolution
- A single field defines the policy lifetime for Phase 1 and Phase 2 in 6.6.x and older firmware; the maximum policy lifetime for a SonicWall is 9,999,999 seconds, and the minimum policy lifetime is 120 seconds. Older manuals and docs regarding SA lifetime may be incorrect (they state 2,500,000 as the max).
- SonicWall uses time-based policy lifetimes. Other Firewall/VPN vendors implement data-based SA lifetimes as well as time-based policy lifetimes.
- The lifetime negotiation may differ depending on the value the remote peer gateway proposes. If the lifetime proposed by the remote peer gateway is lower than what the SonicWall policy is set to, the SonicWall will negotiate the VPN tunnel with the lower of the two values.
- IKE Identity is automatically set depending upon the mode in 6.6.x and SonicOS Standard. Sonic OS Enhanced firmware gives the user the option of setting the IKE Identity. Please refer to the next page for a full explanation of this topic.
- SonicWall Firmware 6.6.x and SonicOS Standard do not have a configuration option for setting the
- Phase 2 ID type – it’s automatically set to ‘subnet’. For interoperability, the peer VPN gateway must also be configured to use subnet ID as the Phase 2 ID type.
- Using "Apply NAT & Firewall rules" will cause SonicWall security appliances running firmware 6.x to send the SonicWall’s WAN IP address with a 32-bit subnet mask as Phase 2 ID for the SonicWall security appliance.
- As IKE Responder, SonicWall can accept Diffie-Hellman 1, 2, or 5 (DH1, DH2, and DH5) - this is critical to remember when setting up a tunnel with a third-party security appliance.
- SonicWalls support only ‘tunnel' mode and not ‘transport’ mode for site-to-site VPN connections - ‘tunnel’ mode is used for both ESP and for AH – although ‘transport’ mode is used for L2TP client connections.
- Replay Detection is automatically on for all IPsec traffic that uses IKE. Each IPsec packet has a Sequence Number that increases monotonically. The SonicWall keeps a counter for IPsec packets on each VPN tunnel, and if it detects a packet that it has seen before, it is discarded. When a replayed packet is detected, the following message will appear in the log: "IPSEC Replay Detected". If attacks are checked under the ‘Alerts’ section in the log settings page, the SonicWall will not do anything besides discarding the packet and incrementing an error counter that is usable for debugging.
- In firmware 6.2.0.0 and older, the mode (Aggressive or Main) is automatically negotiated by the
- SonicWall security appliance during a VPN tunnel negotiation, depending on whether the peer gateway is explicitly specified or is absent (will negotiate in Aggressive if absent).
- In firmware 6.3.0.0 and newer, and in all versions of SonicOS Standard and SonicOS Enhanced, the administrator can explicitly set the mode (Aggressive or Main) for each policy.
Related Articles
- L2TP user to access the network across site to site vpn.
- Global VPN Client slowing down the internet speed
- App Control fails by schema error when editing VPN category
Categories
- Firewalls > TZ Series
- Firewalls > SonicWall SuperMassive E10000 Series
- Firewalls > SonicWall SuperMassive 9000 Series
- Firewalls > SonicWall NSA Series
YES
NO