Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We have a Sonicwall TZ-210 configured for SSLVPN. We are using the NetExtender client on a completely different network (ISP and LAN subnets don't conflict). The NetExtender client connects, authenticates and completes perfectly. We can see the client route and traffic passing through the VPN.

The problem is that there is one machine, the server, on the Sonicwall side, that we cannot communicate with from the VPN client. Every other IP on the network is accessible, but this server. When we ping, we see the request go across the VPN, the server receives it and replies and that's when the Sonicwall drops the packet (according to the Sonicwall logs and trace). The log claims that the packet is spoofed. Looking closer, the source IP of the server is correct, but it's saying the interface is X1 (which is the WAN interface). So, the Sonicwall is correctly dropping the packet since it is seeing a LAN IP supposedly coming from the WAN subnet. What is wrong is that it's from the X1 interface, which makes no sense. When I go into diag.html and turn off IP Spoof Detection, communication between the server and SSLVPN client works fine. Clearly, we cannot leave that off, so I am at a loss as to why the firewall thinks it's coming from the WAN side.

  • The office network is 192.168.1.0/24.
  • The SSLVPN range is
  • 192.168.1.150 - .160.
  • There are no NAT rules for the server (or any machine for that matter).
  • There are no special routing rules.
  • We have checked the ACLs for the local users and groups multiple times and made sure the correct access networks are assigned to the user.
  • The server is pingable from the Sonicwall and there is no other security software on the server blocking access.

We get the same behavior when we originate (ping) from the server to the remote client's IP address. We also have an IPSEC VPN going to another network and we have no issues there.

In some cases when we tried the ping, we get a response on the first attempt, and then it drops after that.

Any help would be appreciated. I know it's going to be something simple, I just can't see it. Thanks.

share|improve this question
    
I don't have an answer and hate to redirect you but check if any of these solutions from SonicWall fix your specific issue. Try posting some screenshots also of the spoofs. fuzeqna.com/sonicwallkb/ext/kbdetail.aspx?kbid=8007 –  Travis Apr 3 at 16:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.