SonicwallVPN路由.doc

SonicOS Enhanced HOW TO Hub and Spoke VPN (aka VPN Routing) Date created: 19 March 2004 Last updated: 19 March 2004 Objectives Branches can access headquarters and other branches’ resources GVC (Global VPN Client) can access headquarters and branches’ resources Headquarters can talk to GVCs Branches can talk to GVCs Firewall requirements SonicOS Enhanced or later SonicOS Enhanced or later SOHO3 firmware 6.4.x.x or later PC requirements Browser client, SMTP client, POP3 client, ping Background Hub-and-Spoke VPN allows a spoke to talk to another spoke via the central firewall It is also known as VPN Routing Hub is usually the main firewall (with VPN function) at the headquarters Spokes are branches or mobile users using GVC In many occasions, a meshed VPN network is impossible. In case of 2 branches using dynamic WAN IPs, VPN cannot be built if DDNS is not used. In this scenario, VPN routing helps Low end firewalls at branches may not have enough VPN SAs (Security Associations) to form a meshed VPN network. For example, TZ170/10 only has 2 VPN SAs. It cannot build a 10-node fully meshed VPN This example allows any spoke to talk to any other spokes and hub resources without filter. You may add firewall rules to restrict access at your will Diagram PRO4060 Configuration Network Configuration Go to Network ( Interfaces page. Click the Configure icons of LAN and WAN Setup LAN IP = 54 mask = Setup WAN IP = mask = 48, gateway = Address Objects Configuration We need to define remote LAN objects for VPN use Go to Network ( Address Objects page, click Add… button Add the following network for branch Hongkong Click OK button to finish Repeat step 6 for branch Shanghai Click OK button to finish Next we create 2 address groups Address group Non_Hongkong includes and Non_Hongkong address group is for PRO4060-to-TZ170 VPN tunnel use Click OK button to finish Address group Non_Shanghai includes and Non_Shanghai address group is for PRO4060-to-SOHO3 VPN tunnel use