Allied Telesis AlliedWare NetScreen Routers Installation and maintenance instructions

C613-16098-00 REV E www.alliedtelesis.com

AlliedWareTM OS

How To |

Today’s network managers often need to incorporate other vendors’ equipment into their

networks, as companies change and grow. To support this challenge, Allied Telesis routers are

designed to inter-operate with a wide range of equipment.

This How To Note details one of the inter-operation solutions from Allied Telesis: creating

virtual private networks between Allied Telesis and SonicWALL routers. It shows you how to

configure a VPN between a local Allied Telesis router and a remote SonicWALL router, step-

by-step. On the Allied Telesis router, it uses the Site-To-Site VPN wizard for the VPN

configuration.

The wizard runs on selected AR400 Allied Telesis routers from the router’s web-based GUI

(graphical user interface). It asks you to enter a few details and from those it configures the

following settings:

zencryption to protect traffic over the VPN

zISAKMP with a pre-shared key to manage the VPN

zthe firewall, to protect the LANs and to allow traffic to use the VPN

zNetwork Address Translation (NAT), so that you can access the Internet from the private

LAN through a single public IP address. This Internet access does not interfere with the

VPN solution

z(in this example) NAT-Traversal because one end of the VPN tunnel is behind a separate

NAT device

Create a VPN between an Allied Telesis and a

SonicWALL Router, with NAT-T

Page 2 | AlliedWare™ OS How To Note: VPNs with SonicWALL routers

What information will you find in this document?

This How To Note begins with the following information:

z"Related How To Notes" on page 2

z"Which products and software version does it apply to?" on page 2

Then it describes the configuration, in the following sections:

z"The network" on page 3

z"How to configure the Allied Telesis router" on page 4

z"How to configure the SonicWALL router" on page 12

z"How to test the tunnel" on page 29

z"How to use the CLI instead of the GUI" on page 30

Related How To Notes

Allied Telesis offers How To Notes with a wide range of VPN solutions, from quick and

simple solutions for connecting home and remote offices, to advanced multi-feature setups.

Notes also describe how to create a VPN between an Allied Telesis router and equipment

from a number of other vendors.

For a complete list of VPN How To Notes, see the Overview of VPN Solutions in How To Notes

in the How To Library at www.alliedtelesis.com/resources/literature/howto.aspx.

Which products and software version does it apply to?

The VPN wizard is available on the following Allied Telesis routers, running Software Version

2.9.

or later:

zAR4

zAR440S, AR44

S, AR442S

You can use the command line to set up an equivalent configuration on AR700 and other

AR400 Series routers. See "How to use the CLI instead of the GUI" on page 30 for the

necessary commands.

We created this example with a SonicWALL TZ

70, running SonicOS Enhanced 2.5.

-65e.

SonicOS Standard does not support NAT-T draft 3, so this solution requires SonicOS

Enhanced.

The screenshots in this Note are from an Internet Explorer 6.0 browser running on

Windows XP.

Page 3 | AlliedWare™ OS How To Note: VPNs with SonicWALL routers

The network

This example illustrates a NAT-T solution, which you need when one or both of the routers

are behind a NAT device such as some xDSL and cable modems. In this example, an Allied

Te l e s i s A R 4

5S router is behind a NAT device. The following diagram shows the LANs and

their interfaces and addresses.

Note: You can still use this example if you have no NAT device between the Allied Telesis

router and the Internet, or if you have a NAT device between the SonicWALL router and the

Internet, with slight alterations. See "Appendix: Using this example if you don’t have a NAT

device in the same position" on page 31 for details.

Initiating the

tunnel from

either end

In this example, you can only initiate the tunnel from the Allied Telesis end, not the

SonicWALL end. If you want to let the SonicWALL initiate the VPN too, you have to

configure your NAT device to allow it. To do this, set up pinholes (allow rules) on the NAT

device to allow through UDP traffic on ports 500 and 4500.

vlan1:

192.168.1.1

eth0:

192.168.254.1/30

Allied Telesis

router

192.168.254.2/30

100.100.100.1/30

NAT device

SonicWALL

router

Internet

WAN:

200.200.200.1/30

workstation:

192.168.1.100 by

automatic address

assignment

VLAN:

192.168.2.1

workstation:

192.168.2.100 by

automatic address

assignment

VPN

tunnel

200.200.200.2/30

100.100.100.2/30

at-sonic.eps

Page 4 | AlliedWare™ OS How To Note: VPNs with SonicWALL routers

How to configure the Allied Telesis router

Before you

start

1. Install and configure the NAT device.

2. Access the router via its GUI.

3. Customise the router and set up vlan

as the LAN interface. The site-to-site VPN wizard

always uses vlan

as the local LAN for the VPN connection, so you must make sure an IP

interface is configured on vlan

before running the wizard.

4. Create a security officer. If you use the Basic Setup wizard to customise the router, this

creates one security officer, with a username of “secoff”.

5. Set up the WAN interface. This example uses a fixed IP address on the WAN interface—

modify it to use an appropriate interface for your network.

The router setup of steps 2-5 is described in How To Use the Allied Telesis GUI to Customise the

Router and Set Up An Internet Connection, which is available from www.alliedtelesis.com/

resources/literature/howto.aspx.

In this example, the Allied Telesis router has the following settings:

The NAT device has the following settings:

Interface Address Mask

Allied Telesis router LAN vlan

92.

68.

255.255.255.0

Allied Telesis router WAN eth0

92.

68.254.

255.255.255.252

Remote site’s WAN settings 200.200.200.

Remote site’s LAN settings

92.

68.2.

255.255.255.0

Interface Address Mask

Private interface (towards the router) eth

92.

68.254.2 255.255.255.252

Public interface (towards the Internet) eth0

00.

255.255.255.252

Page 5 | AlliedWare™ OS How To Note: VPNs with SonicWALL routers

Create the

VPN tunnel

changes to secure mode when you finish the VPN wizard and at that stage prompts you to

The Site-To-Site VPN wizard is one of the options on the Configuration Wizards page. Make

sure your browser’s pop-up blocker is disabled—the wizard needs to open pop-ups. If you

access the Internet through a proxy server, make sure your browser bypasses the proxy for

this address.

The GUI opens at this page the first time you configure your router. After initial configuration

it may open at the System Status page instead. If so, click on the Wizards button in the left-

hand menu to open the Configuration Wizards page.

1. Open the Configuration Wizards page

Page 6 | AlliedWare™ OS How To Note: VPNs with SonicWALL routers

Click on the Site-to-Site VPN button.

The wizard starts by displaying a

welcome message.

Click the Next button.

Enter an appropriate VPN connection

name.

Click the Next button. If you have

multiple possible WAN interfaces

configured on the router, the wizard

next lets you select the appropriate

interface. In this example there is only

one WAN interface, so the wizard

selects it automatically and moves

directly to the remote site settings.

2. Start the Site-to-Site VPN wizard

3. Name the VPN connection

Page 7 | AlliedWare™ OS How To Note: VPNs with SonicWALL routers

Enter the public IP address of the other

end of the tunnel. In this example, this

is 200.200.200.

, which is the IP

address of the SonicWALL WAN

interface.

Note that you can use the Tab key to

move between fields when entering the

address, but should not use the . key

(the period).

Click the Next button.

Enter the SonicWALL router’s LAN

subnet address and mask. In this

example, this is

92.

68.2.0 and a mask

of 255.255.255.0.

Click the Next button.

4. Enter the remote site’s WAN IP address

5. Enter the remote site’s LAN IP address

Page 8 | AlliedWare™ OS How To Note: VPNs with SonicWALL routers

Enter the secret key, which is an

alphanumeric string between 2 and 64

characters long. Both routers must use

the same secret key. On the

SonicWALL router, this is the Site-to-

Site Policy’s preshared key.

Click the Next button.

Check the summary. If necessary, use

the wizard’s Back button to return and

correct any settings you want to

change.

Once you are happy with the settings,

click the Advanced Settings button to

modify Peer ID settings.

6. Enter the shared secret key

7. Check the settings

Page 9 | AlliedWare™ OS How To Note: VPNs with SonicWALL routers

Peer IDs enable the routers to identify

each other when they exchange secret

key information. By default, the Peer

IDs are the router IP addresses. This

does not work when one (or both)

routers are behind a separate NAT

device, because the NAT device

changes the IP addresses.

Towards the bottom of the Advanced

Settings page, enter a local ID (to

identify this router) and a remote ID

(to identify the router at the other end

of the link). It does not matter what

text you use as the IDs, so long as each

ID is different.

Then click the OK button.

8. Specify Peer IDs

Page 10 | AlliedWare™ OS How To Note: VPNs with SonicWALL routers

Check the summary. It now includes

the Peer ID settings. If necessary,

correct any settings you want to

change.

When all the settings are correct, click

the Apply button.

Security

officer

If you are logged in as the security

officer, the GUI displays a completion

message. Click the Finish button to

finish the Wizard and save the VPN

settings.

9. Check the settings again

10. Finish the wizard

This manual suits for next models

Table of contents

Other Allied Telesis Network Router manuals

Allied Telesis

Allied Telesis AT-GS950/8POE User manual

Allied Telesis

Allied Telesis AT-x230-10GT User manual

Allied Telesis

Allied Telesis AT-8550/SP Series User manual

Allied Telesis

Allied Telesis IS230-10GP User manual

Allied Telesis

Allied Telesis AT-8000S/24 User manual

Allied Telesis

Allied Telesis AR750S Installation and operating manual

Allied Telesis

Allied Telesis AR400 Series Installation and operating manual

Allied Telesis

Allied Telesis 210 User manual

Allied Telesis

Allied Telesis AT-AR3050S User manual

Allied Telesis

Allied Telesis AR450S User manual

Allied Telesis

Allied Telesis AT-FS705L User manual

Allied Telesis

Allied Telesis AT-8000GS/24 User manual

Allied Telesis

Allied Telesis AT-AR221E User manual

Allied Telesis

Allied Telesis AT-FS202 Series User manual

Allied Telesis

Allied Telesis AT-GS950/16 User manual

Allied Telesis

Allied Telesis AT-8000GS/24POE User manual

Allied Telesis

Allied Telesis AT-8000GS/24POE User manual

Allied Telesis

Allied Telesis AR410 User manual

Allied Telesis

Allied Telesis WebSmart AT-FS750/16 User manual

Allied Telesis

Allied Telesis Formula 8200 User manual

Allied Telesis

Allied Telesis AT-8000C Reference guide

Allied Telesis

Allied Telesis AR400 Series User manual

Allied Telesis

Allied Telesis AT-GS950/16 User manual

Allied Telesis

Allied Telesis AR415S Installation and operating manual

Popular Network Router manuals by other brands

Allnet

Allnet ALL0333AU user guide

HomeSeer

HomeSeer HT-SEL Getting started guide

Sercomm

Sercomm Genesis OC3505D Quick installation guide

Billion

Billion BIPAC 5102 Series user manual

TP-Link

TP-Link TD-8817 QIG

Motorola

Motorola MR1900 user guide

Digi

Digi IX14 user guide

Cisco

Cisco NCS 540 Hardware installation guide

XAVi

XAVi X8821e user manual

BEC

BEC 6200WZL Quick installation guide

MikroTik

MikroTik hAP ac3 Series quick start

Korenix

Korenix JetNet 5428G Series user manual

NETGEAR

NETGEAR FS526T - Switch installation guide

Korenix

Korenix JetNet 5710G Series user manual

Automated Logic

Automated Logic ZN551 Technical instructions

Cisco

Cisco ASR 1000 Series Installation and configuration guide

EnGenius

EnGenius ESR-9710 quick start guide

Cisco

Cisco 805 Series Product overview