Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have two networks connected with a site-to-site VPN:

  • Network "A" is 10.0.100.0/24 with a Sonicwall TZ-170 at 10.0.100.1
  • Network "B" is 10.0.103.0/24 with a Sonicwall Pro1260 at 10.0.103.1
  • Everything in "A" can ping everything in "B", and everything in "B" can ping everything in "A"

With one Exception: Nothing from network "A" has access to anything on the "B" sonicwall (no HTTP, HTTPS, SNMP, ICMP, etc.).

Additionally, sonicwall "B" can't ping it's own lan address. I've been over the VPN config, and the NAT and firewall rules on both sonicwalls. Everything seems fine, but clearly I'm missing something.

Anyone have any ideas? So far, the Sonicwall support team hasn't been able to resolve the problem.

Update: Access to the "B" device's LAN IP spontaneously started working last night, exactly when our "A" TZ170 spontaneously rebooted itself. I'm starting to think we have some faulty equipment.

share|improve this question

2 Answers 2

up vote 0 down vote accepted

You or support probably checked this already, but is the "Enable Ping from LAN to Management Interface" checkbox on the System->Administration page set?

Not sure about not being able to reach the management page remotely.

share|improve this answer
    
Yes - when it's off, the "B" network stops being able to ping the sonicwall. When it's on, the "B" network can ping it. But in both cases the "A" network can't ping it. –  Seth Nov 14 '09 at 19:32

In addition to the "Enable Ping from LAN to Management Interface" already answered... You need to enable "Management via this SA" in the VPN properties. I believe this is off by default.

  1. Login to the firewall
  2. Go to VPN -> Setttings
  3. Click the pencil next to the Tunnel in question
  4. Click the Advanced tab.
  5. Check the boxes next to the items you want to enable (HTTP, HTTPS, SSH)

That should take care of the rest of it. You need to do this on both firewalls if you want to manage from either end.

share|improve this answer
    
That had been checked as well. However, it seems like it's "fixed" itself, see update above. –  Seth Nov 16 '09 at 20:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.