Wifi – Tunnel into Sonicwall VPN while on Sonicwall wifi

We have several IPSec VPNs with our partners and customers and occasionally run into IP conflicts with their network. The solution in our case is to do either source-NAT or destination-NAT over the VPN. We are using Juniper Netscreen and SSG products, but I assume this can be handled by most higher-end IPSec VPN devices.

This will definitely be dependent on the VPN client you use.

At our site we use 2003 server with RRAS for VPN connections and I had similar issues that I resolved by making a custom VPN "connectoid" using the microsoft CMAK (connection manager administration kit)

I used this guide while creating the client http://www.isaserver.org/tutorials/work-around-VPN-clients-split-DNS.html It helped me to get clients to connect, use DNS servers at the office for name resolution but also allows all internet destined traffic to use the local gateway properly.

Your issues, if they are like mine, have to do with 2 things.

1. VPN connections are low on the bind order for DNS in windows by default. This means that it will favor your local LAN DNS servers over your VPN connections servers unless you tell windows to favor your VPN connection over the others.

2. Dns resolution isn't working properly because no DNS suffix is specified for the VPN connection. Even if you are looking at the right DNS servers, if no search suffix is configured for that link the machine will fail to convert the name "server" to "server.domain.com" when performing a lookup. unless you reference everything using fqdn, which I have never seen in practice, this could be a show-stopper as well.

Hopefully the guide for the 2003 CMAK kit and this information will help you to get the nortel client working in your environment.

HOWEVER, another option for these networks is to use a gateway that can do IPsec with your main site so that users aren't required to connect using individual VPN connections while they are at any of your sites. PFsense is a great BSD based firewall/router distro that has done an amazing job for me in the past. I've used PFsense in production to pipe 150+ users over an IPsec connection with a cisco device on the other end and it didn't even bat an eye.

Get back with more information if you think I have mis-understood your issue!