I've been using the SonicWall devices for a little while now. I started getting into them after a recommendation from a friend and the TZ series has proven to be a good solution for small to medium sized businesses.

You can find more information about SonicWalls and the TZ series here but I'm going to go over how to setup an IPSEC VPN between two tz180's using the Standard SonicOS firmware. If you have the enhanced SonicOS, the steps are almost the same.

Overview:

• set the unique names of each device
• configure subnet, dhcp, etc
• create a VPN policy to connect to the other

NOTE: I'm not talking about setting passwords or security here - it's assumed that you've already setup the environment.

Set the Unique Name on each device:

1. log into the first device's web interface
2. click on VPN on the left side
3. under "Unique Firewall Identifier" create a name logical name like "USNY1"
4. log into the second device's web interface
5. click on VPN
6. under "Unique Firewall Identifier" create another name like "USNY2"

Configure Subnets for DHCP:

1. log into the first device's web interface
2. click Network > LAN
3. set the SonicWall LAN IP to something like 10.0.1.1
4. set the subnet mask to whatever is appropriate for your network like 255.255.255.0
5. repeat the sames steps for device 2 except make the ip and subnet different like 10.0.2.1 and 10.0.2.0/255.255.255.0

Setup VPN Policy:

Assuming you have the following configuration we can create the VPN policy:

Site 1
Device Name: USNY1
Subnet: 10.0.1.0/24

Site 2
Device Name: USNY2
Subnet: 10.0.2.0/24

Setup Device 1

1. On device 1 click on VPN > Settings
2. click Add under VPN Policies
3. Fill out the information as shown below:
   IPSec Keyring Mode: IKE using Shared Secret
   Name: USNY2 [name of your device 2]
   IPSec Primary Gateway Name or Address: the public IP address of device 2
   IPSec Secondary Gateway or Name or Address: left blank in most cases
   Shared Secret: Since you will only be typing it in twice and this is the basis of the tunnel's security, you should set it to be very strong. [https://www.grc.com/passwords.htm] Write it down!
4. click the Specify destination networks below and click Add
5. type in the subnet that device 2 is controlling - in this example 10.0.2.0/24
6. click OK

Setup Device 2 [Almost same as above]

1. On device 1 click on VPN > Settings
2. click Add under VPN Policies
3. Fill out the information as shown below:
   IPSec Keyring Mode: IKE using Shared Secret
   Name: USNY1 [name of your device 1]
   IPSec Primary Gateway Name or Address: the public IP address of device 1
   IPSec Secondary Gateway or Name or Address: left blank in most cases
   Shared Secret: same as the password you generated above
   - click the Specify destination networks below and click Add
   - type in the subnet that device 1 is controlling - in this example http://10.0.1.0/24
   - click OK
   
   

Check The logs:

If you've configured everything correctly, you should be able to watch the VPN tunnel negotiation process from the event logs.

1. click on Log > Categories
2. check "Log all categories" - this will record VPN functions
3. under Log click "View"
4. review the logs for the following events:
   SENDING>>>> ISAKMP OAK INFO (InitCookie 0x69c45089cc845af4, MsgID: 0x26D85F88) *(HASH, NOTIFY:DPD_ACK)
   RECEIVED<<< ISAKMP OAK INFO (InitCookie 0x69c45089cc845af4, MsgID: 0x3AAF690F) *(HASH, NOTIFY:DPD_REQUEST)
   
   

Troubleshooting:

Phase 2 or Algorithm's Don't Match
If you see a log with this kind of message it is most likely caused by different encryption under the Phase 2 settings. Go back and make sure they match exactly.

IKE Initiator: Proposed IKE ID mismatch
This message is most likely caused by the firewall names being mismatched.  Make sure that under VPN settings, the name is set to something unique and the VPN policy on each device has each other's appropriate name.

Dynamic IP's
If you're connecting two sites with dynamic IP addresses, I've read that you need to check the "Aggressive Mode" type of VPN but maybe someone can confirm that.

1. click VPN and click configure on the tunnel you created
2. under proposals change "Exchange" to Aggressive mode
3. click the Advanced tab
4. click Enable Keep Alive and Try to bring up all possible Tunnels
5. click OK

Other
If you're getting anything else check out the log events reference guide here -
http://www.sonicwall.com/downloads/Log_Event_Reference_Guide.pdf.

External Links:

Sonicwall.com - Had to put a link to this
http://www.sonicwall.com/downloads/Log_Event_Reference_Guide.pdf - great guide for easy event log decoding
https://www.grc.com/passwords.htm - a good strong online password generator for one time passwords

Clearing out the last logged on user from the login screen is is a very simple task that I like to set on my domains and as the local policies for workgroup computers. It helps out in two different ways: first as a matter of security because an attacker walking up to the computer doesn't necessarily know a user name to log in with and second it helps to teach the user what their user name is because we all know if we don't type it in every day, we forget it. [see saved passwords]

Overview

For those of you that know mostly what you're doing and just need a reminder, here it is. The policy setting you need to change is located under:

• Computer Configuration > Windows Settings > and Security Settings > Local Policies >Security Options
• Edit the "Interactive Logon: Do not display last user name in logon screen" entry and check "define this setting" and "enabled."

On a Windows Domain Controller

1. Under Administrative Tools open the Group Policy Management
2. Find the group policy you want to change select it, right click, and choose "Edit".
3. Expand Computer Configuration, Windows Settings, and Security Settings
4. Expand Local Policies node, and then click Security Options.
5. Edit the "Interactive Logon: Do not display last user name in logon screen" entry and check "define this setting" and "enabled."
6. The setting will take affect on the next time the clients reboots. As a reminder, it can take varying amounts of time for group policies to be applied.

On a Local Vista Machine

1. In the Control Panel, click System and Maintenance and open the Administrative Tools
2. Open the Local Security Policy .
3. Expand Computer Configuration, Windows Settings, and Security Settings
4. Expand Local Policies node, and then click Security Options.
5. Edit the "Interactive Logon: Do not display last user name in logon screen" entry and check "define this setting" and "enabled."

External Links:

http://support.microsoft.com/kb/310125 - Link to the MS KB article