SonicWALL Internet Security Appliances - Manual (Page 213)

Page 214 SonicWALL Internet Security Appliance Administrator’s Guide
10. Select a VPN encryption method from the Phase 2 Encryption/Authentication menu. Since data
throughput and security are the primary concern, select Encrypt and Authenticate (ESP 3DES
HMAC SHA1).
11. Define a Shared Secret. Write down this key as it is required when configuring the San Francisco
Office SonicWALL TELE3.
12. Click Add New Network... to open the VPN Destination Network window and enter the
destination network addresses.
13. Enter the IP address and subnet mask of the destination network, the San Francisco office, in
the Network and Subnet Mask fields. Since NAT is enabled at the San Francisco office, enter a
private LAN IP address. In this example, enter "192.168.1.1" and subnet mask
"255.255.255.0." Click OK to add the destination network address.
Alert The Destination Network Address must NOT be in the local network address range. Therefore,
the San Francisco and Chicago offices must have different LAN IP address ranges.
14. Click Advanced Settings. Select the following boxes that apply to your SA:
•
Enable Keep Alive - if you want to maintain the current connection by listening for traffic on the
network segment between the two connections.
• Enable Windows Networking (NetBIOS) broadcast - if remote clients use Windows Network
Neighborhood to browse remote networks.
• Apply NAT and firewall rules - to apply NAT and firewall rules to the SA or just firewall rules if in
Standard mode.
• Forward packets to remote VPNs - if creating a “hub and spoke” network configuration
• Enable Perfect Forward Secrecy - if you want to add another layer of security by adding an ad-
ditional Diffie-Hellman key exchange.
• Phase 2 DH Group - select the type of DH key exchange in Phase 2 for Perfect Forward Secrecy.
• Default LAN Gateway - if specifying the IP address of the default LAN route for incoming IPSec
packets for this SA. This is used in conjunction with the Route all internet traffic through this SA
check box.
• VPN Terminated at LAN, DMZ, or LAN/DMZ- select one of the three terminating points for the
VPN tunnel.
15. Click Update to add the Security Association. Once the SonicWALL PRO 200 is updated, a
message confirming the update is displayed at the bottom of the browser window.
Configuring a SonicWALL TELE3 in San Francisco
1. Enter the SonicWALL TELE3 Unique Firewall Identifier in the VPN Summary window, in this
example, "San Francisco Office." Click Update.
2. Click Configure and select -Add New SA- from the Security Association menu.
3. Select IKE using pre-shared secret from the IPSec Keying Mode menu.
4. Enter the SonicWALL PRO 200 Unique Firewall Identifier in the SonicWALL TELE3 Name field,
in this example, "Chicago Office."
5. Enter the SonicWALL PRO 200 WAN IP Address in the IPSec Gateway Address field. This address
must be valid, and is the SonicWALL PRO 200 NAT Public Address, or "216.0.0.20."