Routing issue for SonicWall VPN client

Question

We presently have two sites connected via a nailed-up VPN connection. Site 1 (corporate office) has a SonicWall Pro 2040 Enhanced, and site 2 (a data center) has a SonicWall NSA 2400. The IP scheme at site 1 is 10.0.0.0/255.255.255.0, and at site 2 is 10.0.1.0/255.255.255.0.

The problem I'm having is that we have remote users that connect to site 1 via a GlobalVPN client, but because of how that VPN connection's routing is set up they can't access resources on the 10.0.1.0 network. I've tried manually adding static routes, but it appears that the SonicWall is preventing that VPN connection from making the jump to the other device.

One option is to duplicate the remote VPN users and settings at site 2, but that would require that we manually sync those users and that remote users make two separate VPN connections -- not ideal.

Do any SonicWall gurus out there know how I can configure the VPN connections to allow access to those site 2 resources?

Solution

I don't know about the Pro's, but when connecting to an NSA with the the Global VPN client, you have to specify which networks that user has access to (either individually or by the groups they belong to). For instance, I created an address group object (REMOTE_USER_ACCESS) containing all of the networks I want my VPN users to be able to access (Our setup is the exact same as yours.. an office and data center with a site-to-site VPN tunnel done by an NSA3500 on each side.. user's connect to VPN on site A but access resources from private network at site B). Then, I either go to the individual user's account (Users > Local Users) or the group (Users > Local Groups), edit the user, click on the VPN Access tab and add the REMOTE_USER_ACCESS object. The VPN user can now access any networks I've specified in that address object.

Like I said, that's for the NSA, but I'm guessing the Pro isn't going to be too much different.

Comments

[David Mackintosh]

You might also snoop traffic at a target at site 2 to ensure that the traffic is even getting there. Also it occurs to me you might check your (client) VPN configuration to ensure that traffic bound for site 2 would even be tunnelled -- either explicitly through a rule (sometimes called split-tunnelling), or implicitly by capturing all outbound traffic from the client via the VPN.

[Josh Anderson]

I'll give that a try and report back