TKWITS Community Legend ✭✭✭✭✭
Reactions
Comments
-
have you read this thread? https://community.sonicwall.com/technology-and-support/discussion/comment/10880
-
better start watching the traffic from the postage machine
-
Note the exclusion object option.
-
Without licensing, the processes that provide IPS, GAV/GAS, etc. are not allowed to be enabled, and thus are not running on the CPU. Leaving a checkbox checked in the Zone settings should have no effect since the underlying process is not running. Speed differences between DPI and SPI are noted elsewhere.
-
DPI is not a function of the security services, but helps them perform their function by inspecting the entire packet. Read more here: https://community.sonicwall.com/technology-and-support/discussion/1528/dpi-vs-spi Without a security services subscription your firewall is a firewall.
-
Consider what you are passing as routes to the client. If it's only a local private IP subnet, than thats all that will get passed. If you pass a public IP that means the GVC will attempt to send traffic destined to the public ip through the tunnel. Start there.
-
Start with a packet capture to make sure the traffic is leaving the firewall. Next try connecting directly to the problem link and see if the issue remains.
-
you have to change the management certificate in system settings (manage \ appliance \ base settings).
-
a simple test is changing the lifetimes to something much shorter and enabling dead peer detection (but i dont think you can using aggressive mode).
-
Clearly the responder doesn't like your IKE ID... Try changing it to the documented settings (you have them documented right?) or just your WAN IP address. Ask the third party to see what the firewall is sending as its IKE ID and what its expecting. Other wise follow Ajishals recommendation.
-
Start with reviewing the logs (you have to change the log redundancy filter to get more frequent results)...
-
I always use DistinguisedName which can be found in AD Users & Computers and looks like "CN=Administrator, CN=Users, DC=Contoso, DC=com". You should create an account strictly for Sonicwall LDAP queries, otherwise you'll lose LDAP authentication if (when) someone changes a domain admin account.
-
provide more details about your config please...
-
Have you read through this thread? https://community.sonicwall.com/technology-and-support/discussion/comment/10703
-
"We have a static route on the server where the Website is hosted which allows it to talk back to the VPN network." Is the web server located on the LAN interface of the Sonicwall? Why does the web server need a route to the VPN network?