Network Access - SonicWALL VPN options

Question

Does the built-in VPN client connect to SonicWALL?

Answer 1

"The client side is set up in the usual fashion" - I've had different results due to Firewall Unique Identifier. At least on a Mac OS X 10.8 client.

The SonicWall configuration guide (Equinox document SonicOS_Standard-6-EN.pdf) clearly states a need for Firewall Unique Identifier. It's "Item 1" in things to write down and have users enter into the client software.

Firewall Unique Identifier appears to be a non-standard extension (its not discussed in RFC 2409). Fortunately, Equinox sells VPN Tracker Personal for $130. I believe that's known as Vendor Lock In.

Answer 2

While I cannot definitively say for every model of Sonicwall, it's unlikely. L2TP over IPSec is(and has been) available, I've never heard of Sonicwall being able to take advantage of that built-in configuration. You may know all of the following, but I'm throwing it out there anyway:

There have been three ways to connect to Sonicwall as VPN gateways in the past: the free IPSecuritas, the (paid) 3rd Party VPNTracker, or the (free) Java-based NetExtender SSL-VPN client that Sonicwall provides for some models that never was particularly optimized for a mac experience, but had basic functionality.

Answer 3

Yes you can set up the sonnicwall to work with the built in L2TP vpn client. You are a little short on config options but it works for most setups. You have to leave the WANGroup profile on the sonnicwall as standard for its ipsec setup. You need to make note of your shared secret for the WANGroup profile.

Then turn on the L2TP vpn section on the sonnicwall. Set up a local ip address range for the l2tp users and make them of a group that has access. (trusteed users is a good default) Next in the PPP tab of l2tp setup please make sure MSCHAPV2 is at the top of the lists.

The client side is set up in the usual fashion. Should work fine.

In the client console if you see that Phase1 is not connecting check your shared secret.

If you need to change the WANGroup profile to work with other ipsec clients then you will not be able to make it work. In that case you may be better working with the ipsecuritas software on the mac.

Hope that helps.