#USING IPSECURITAS WITH SONICWALL HOW TO#
#USING IPSECURITAS WITH SONICWALL PDF#
#USING IPSECURITAS WITH SONICWALL INSTALL#
#USING IPSECURITAS WITH SONICWALL FULL#

A future post will cover the other two steps. In this post I’ll describe step 1 in detail.

#USING IPSECURITAS WITH SONICWALL INSTALL#

Install the same certificate on the SonicWALL Global VPN Client (GVC) on each client machine.

On the SonicWALL router, reconfigure the WAN GroupVPN (under VPN | Settings) to use IKE Using 3 rd Party Certificates instead of IKE Using Preshared Secret (another term for pre-shared key).

I enlisted the help of a local IT consultant, who was able to get to grips with SonicWALL’s convoluted documentation to do this.

Install our wildcard SSL certificate on the SonicWALL.

Making this work was a three-step process: On balance, therefore, we decided we had to bite the bullet and make our SonicWALL VPN behave. And when your remote office staff tell you that the IPSec VPN works better for them, you need to take notice. Our experience with the “portal” concept of SSL VPN has been disappointing (i.e., applications responding very slowly or not working at all). Sure enough, articles from Cisco or Barracuda, for example, highlight the advantages of SSL VPN. Surely SSL VPN is the preferred way these days?

#USING IPSECURITAS WITH SONICWALL FULL#

After all, it needs special client software and gives the computers that connect full access to the LAN as if they were right there in the building. I read it and didn’t understand it.īefore expending effort to fix this problem I first wanted to satisfy myself that a “traditional” VPN is still a good choice.

#USING IPSECURITAS WITH SONICWALL PDF#

They sent me a wonderful out-of-date SonicWALL PDF document on using certificates. The only alternative to Pre-Shared Key authentication is to use certificates.That didn’t help me as I’m not running site-to-site. “Aggressive Mode” can only be disabled for a site-to-site VPN (which can run in “ Main Mode“).Why does the SonicWALL even allow such a vulnerable configuration? When I logged the problem with SonicWALL, they didn’t answer that question but they did tell me: What didn’t make me smile, however, was the fact that this vulnerability has been known for over 10 years (that’s what the CVE number tells you). I smiled at the advice to “use very strong keys” because the security scan is automated and will fail on this issue no matter how strong the key is. – If possible, do not allow VPN connections from any IP addresses. – If using Pre-Shared key cannot be avoided, use very strong keys. – Do not use Pre-Shared key for authentication if possible. Such configuration could allow an attacker to capture and crack the PSK of a VPN gateway and gain unauthorized access to private networks. Impact: The remote Internet Key Exchange (IKE) version 1 service seems to support Aggressive Mode with Pre-Shared key (PSK) authentication. Synopsis: The remote IKEv1 service supports Aggressive Mode with Pre-Shared key. To begin with, what’s the problem? The PCI DSS scan reported this: The problem was that solving the scan failure looked horrendously complicated. The users testing it out had found it faster and more reliable than the SSL VPN, so I really wanted to keep it. The second problem was with the IPSec VPN (sometimes referred to as a “normal” or “traditional” VPN to distinguish it from Secure Sockets Layer, or SSL, VPN) on our SonicWALL router. Although we’re still running that box, its days are numbered. In one case, the SSL VPN appliance, there was no solution with the existing hardware. In my previous post on passing Payment Card Industry Data Security Standard (PCI DSS) external vulnerability scans I mentioned two unresolved scan failures, both connected with VPN access.

#USING IPSECURITAS WITH SONICWALL HOW TO#

Here's how to switch to using certificates on the router and the VPN client to pass the scan. Fixing a PCI DSS scan failure on the SonicWALL IPSec VPN, part oneĪn IPSec VPN using pre-shared secret for authentication will fail PCI DSS security scans.

Using ipsecuritas with sonicwall