SonicWALL Internet Security Appliances manual Configuring a SonicWALL TELE3 in San Francisco

10.Select a VPN encryption method from the Phase 2 Encryption/Authentication menu. Since data throughput and security are the primary concern, select Encrypt and Authenticate (ESP 3DES HMAC SHA1).

11.Define a Shared Secret. Write down this key as it is required when configuring the San Francisco Office SonicWALL TELE3.

12.Click Add New Network... to open the VPN Destination Network window and enter the destination network addresses.

13.Enter the IP address and subnet mask of the destination network, the San Francisco office, in the Network and Subnet Mask fields. Since NAT is enabled at the San Francisco office, enter a private LAN IP address. In this example, enter "192.168.1.1" and subnet mask "255.255.255.0." Click OK to add the destination network address.

Alert The Destination Network Address must NOT be in the local network address range. Therefore, the San Francisco and Chicago offices must have different LAN IP address ranges.

14. Click Advanced Settings. Select the following boxes that apply to your SA:

•Enable Keep Alive - if you want to maintain the current connection by listening for traffic on the network segment between the two connections.

•Enable Windows Networking (NetBIOS) broadcast - if remote clients use Windows Network Neighborhood to browse remote networks.

•Apply NAT and firewall rules - to apply NAT and firewall rules to the SA or just firewall rules if in Standard mode.

•Forward packets to remote VPNs - if creating a “hub and spoke” network configuration

•Enable Perfect Forward Secrecy - if you want to add another layer of security by adding an ad- ditional Diffie-Hellman key exchange.

•Phase 2 DH Group - select the type of DH key exchange in Phase 2 for Perfect Forward Secrecy.

•Default LAN Gateway - if specifying the IP address of the default LAN route for incoming IPSec packets for this SA. This is used in conjunction with the Route all internet traffic through this SA check box.

•VPN Terminated at LAN, DMZ, or LAN/DMZ- select one of the three terminating points for the VPN tunnel.

15.Click Update to add the Security Association. Once the SonicWALL PRO 200 is updated, a message confirming the update is displayed at the bottom of the browser window.

Configuring a SonicWALL TELE3 in San Francisco

1.Enter the SonicWALL TELE3 Unique Firewall Identifier in the VPN Summary window, in this example, "San Francisco Office." Click Update.

2.Click Configure and select -Add New SA- from the Security Association menu.

3.Select IKE using pre-shared secret from the IPSec Keying Mode menu.

4.Enter the SonicWALL PRO 200 Unique Firewall Identifier in the SonicWALL TELE3 Name field, in this example, "Chicago Office."

5.Enter the SonicWALL PRO 200 WAN IP Address in the IPSec Gateway Address field. This address must be valid, and is the SonicWALL PRO 200 NAT Public Address, or "216.0.0.20."

Page 214 SonicWALL Internet Security Appliance Administrator’s Guide