Source
r/sysadmin•
buggg

Sonicwall VPN only works for one user... Help!

I'm working with a sonicwall VPN with a really strange problem. There are two local (ie no ldap) users that configured identically. They both can connect. However, only one of the two accounts can resolve DNS lookups (and therefore do anything on the network) successfully. I've created additional users, but the one that already works is the only user who can do anything.

It's using global VPN client enterprise with 2000 count and unlimited nodes.

Any ideas? We've tried both split tunnel and pushing all traffic through the VPN (disabling and enabling the sonicwall as default gateway where appropriate).

Edit: It's not even possible to ping the DNS servers or anything other than the gateway (the sonicwall box) as a non-working user.

Edit2: In split tunnel mode, the Internet works because requests will go through the local DNS server. Still can't access any internal stuff including pinging the internal DNS server.

Posted Mar 27, 2015, 6:10 PM UTC · edited

020
toomuchFUDManual Database Seeder•

Groups tab, make sure the second use has access to the subnets.

And no I dont mean in routes, I mean you have to make sure the second user is in the right group. I spent 3 hours doing the same exact shit you are doing once. Literally 1 check box. I'll go see if I can pull a screenshot for you.

Edit: http://i.imgur.com/G6s2GBP.png

This crap make sure hes in the right group and the group has access.

3
bugggOP•

That'd be a huge help, thanks!

1
toomuchFUDManual Database Seeder•

Edited the post.

1
bugggOP•

No change =-( checked both and they're identical in those places. Also, for what it's worth, they're using the standard VPN, not the one that's listed as SSL VPN

1
toomuchFUDManual Database Seeder•

Did you full release the sessions between the changes? Try changing the vpn settings so that it kicks all sessions. Could be something not taking a new configs.

1
inaddrarpaIT Manager•

Are you doing this from multiple computers or from a single machine?

1
bugggOP•

Both, I've seen the same results of the one user working and all others not from two different computers on two different internet connections!

1
EntireInternet•

Double check the VPN or group tab in the settings of the nonworking user. It sounds like the working user might have extra address objects in their VPN tab or be a member of a group that the nonworking user is not.

1
bugggOP•

Nope, they're identical... That's what's frustrating about this!

1
TheStealthJack of All Trades•

What about the IP pool you have allocated to the VPN? Do you have enough IP's allocated for clients?

1
bugggOP•

About 100... Both test devices are getting IPs from the sonicwall. Ipconfig /all looks good too

1
OtisB•

Check your sonicwall logs for errors when the non-working one connects.

Also, are you getting DHCP from the internal domain? What's the output of ipconfig /all look like? Compare the two machines there.

I have to assume that if the sonicwall shows that the non-working client is connected AND it's getting an IP from the sonicall, maybe there's something else interfering with that process.

1
bugggOP•

The logs for the non-working user look exactly like the working user logs! It's really puzzling... Dhcp is pushing the ip config down properly

Ipconfig /all results look the same except for the different ip for each machine. The thing is that it's doing the same behavior where the one user works and the other doesn't on a single machine.

1
OtisB•

Is one a local admin and the other not?

1
bugggOP•

They're both in:

Everyone

Sonicwall administrators

Trusted users

VPN users (custom group, doesn't seem to do anything... And it was created after posting this problem)

1
OtisB•

From the non working user, try to ping the DNS server while connected. Monitor the sonicwall log and look for ICMP entries matching the source IP of the non-working user's computer.

You may want to adjust your categories and make sure it's capturing all ICMP data to see what's actually happening. If it's being blocked by a firewall or NAT policy it would become apparent there.

1
painjiujitsu•

I occasionally have the same issue; a reboot of the SonicWALL fixes it every single time. (Just in case you haven't tried that.) Also, under the VPN Access tab - as shown in toomuchFUD's screenshot - does it show "LAN Subnets"?

1
bugggOP•

Yeah, it shows it in both group access and user access... We tried the reboot too.

This is weird because it really looks like it should work!

1