MustafaA SonicWall Employee
Reactions
Comments
-
"IKE Initiator: Remote party Timeout - Retransmitting IKE Request." This means that the VPN initiator is sending the IKE traffic to the peer gateway, and does not get any response back. This is usually an indication of an ISP issue. The best next step is probably to trace the UDP500/4500 traffic with Packet Monitor. This…
-
@mimiz , have you changed the Peer Gateway Address config for the site to site VPN, unless it is domain name based?
-
Hi @iPAK_35 , have you reviewed the following KB article? How can I enable port forwarding and allow access to a server through the SonicWall? https://www.sonicwall.com/support/knowledge-base/how-can-i-enable-port-forwarding-and-allow-access-to-a-server-through-the-sonicwall/170503477349850/
-
@Anytech. Likely your source packets are not tagged with the respective VLAN ID. Use the Packet Monitor tool on the firewall, and capture the traffic based on destination IP address. For instance, your computer is on X0:25 subnet and you are pinging a.b.c.d and your Packet Monitor should be filtered based on ICMP and the…
-
For Gen7 firewalls this issue (GEN7-39385) is included in the Maintenance Release 7.0.1-5119 (Ref. Release Notes Page 6).
-
Hi @floteccon Have you added 192.168.10.0/24 to the SSLVPN Client Route settings?
-
Hi @Darshil , when you access the websites in question on your Iphone, do you see the SonicWall DPI-SSL certificate? What cert do you see?
-
What is the Core 0 utilization of the firewall at the time you are performing rsync/scp?
-
To add clarity, the KB article will be updated, highlighting that DPI-SSL is required for HTTPS domains.
-
@techuser , to block TLDs as described in the following KB article with App Rule/Match Object, DPI-SSL is required for HTTPS domains. https://www.sonicwall.com/support/knowledge-base/how-to-block-http-access-to-top-level-domains-using-application-firewall/170505597962739/#Resolution1
-
With the App Rule/Match Object combination I was also not able to block img.zip URI. This needs further investigation. As an alternative you can create an FQDN Address Object for *.zip and create a Deny Access Rule using that as destination. I've tested this and it works as expected.
-
@jdarling , which API endpoint are you using?
-
@TCooper , please factory default the unit and enable the build-in wireless to check if SSID is broadcasted. You can use inSSIDer application (or any other useful tool) to see the wireless spectrum of transmissions. Otherwise, you can contact SonicWall Technical Support.
-
Based on your explanation, the NSa2650 is trying to initiate IPsec VPN connection with NSa4650 which does not have a corresponding IPsec VPN policy for that request.