en-US
search-icon

Knowledge Base

How do I configure a VPN between a SonicWall firewall and Microsoft Azure

Description

This article covers how to configure a VPN between a SonicWall firewall and Microsoft Azure.

Resolution

The following networks will be used for demonstration purposes during this article. Your networks may be different.

Azure Side Resources

  1. Gateway subnet: 10.10.1.0/24
  2. LAN subnet: 10.10.2.0/24
  3. Public IP: 40.78.98.152

SonicWall Side Resources

  1. LAN subnet: 192.168.168.0/24
  2. Public IP: 60.78.112.45

Azure Configuration

  1. Login to the Azure portal at https://portal.azure.com.
  2. Navigate to Virtual Networks and click Add to create a new network scheme.
  3. In this scenario we've defined the following network. Once filled out click Create.
    Name: VNET-01
    Address space: 10.10.0.0/16
    Subnet name: LAN
    Subnet address range: 10.10.2.0/24
    Image
  4. Next, we'll define the gateway network inside of the virtual network we just created. In our case the virtual network is called "VNET-01". Click back into VNET-01, select Subnets | Gateway Subnet. Define the gateway subnet (in our case 10.10.1.0/24) and click Create.
    Image
    Image
  5. Next, we'll create a virtual network gateway. In the search bar at the top of the page start typing "gateway". Select Virtual network gateway:
    Image
  6. Create a new virtual network gateway. Give the gateway a name and define the VPN type. We'll select gateway type VPN and VPN type Route-based. Select the virtual network (in our case VNET-01) and create a new public IP address. We'll use this public IP address later on while configuring the VPN on the SonicWall. Click Create.

    NOTE: Provisioning a virtual network gateway may take up to 45 minutes.

  7. Click on the newly created virtual network gateway. Select Connections | Add.
    Image
  8. Give the connection a name. Under connection type select Site-to-site (IPsec). Create a new local network gateway. This will be the public IP of the SonicWall and the local network. In our case the local network of the SonicWall is the default SonicWall subnet 192.168.168.0/24.
    Image
  9. Provide a secure shared key. This will also be used on the SonicWall. Click OK.
    Image
  10. We'll grab the public IP of Azure and use it in the SonicWall. Navigate to Dashboard and select the Public IP address resource. Take a note of the public IP for the next steps.
    Image

SonicWall Configuration

  1. Login to the SonicWall firewall.
  2. Navigate to the VPN policy tab. We're using the latest SonicOS 6.5 firmware. Click Manage | VPN | Base Settings. Click Add to create a new VPN policy.
  3. Give the VPN policy a name. We'll use the following settings:
    Policy Type: Tunnel Interface
    Authentication Method: IKE using Preshared Secret
    Next click the Proposals tab.
    Image
  4. Under Proposals select:
    IKE (Phase 1) Proposal: Exchange - IKEv2 Mode, DH Group - 2, Encryption - AES-256, Authentication - SHA1, Life Time - 28800.
    IKE (Phase 2) Proposal: Protocol - ESP, Encryption - 3DES, Authentication - SHA1, Life Time - 27000.
    Image
  5. Select the Advanced tab. Select Enable Keep Alive. Deselect Enable Windows Networking. Select Do not send trigger packet during IKE SA negotiation.
    Image
  6. Next, navigate to Manage | Network | Routing. Select Route Policies and create a new policy. Set the destination for the Azure network and select the Azure interface.
    Image

It takes 5-7 minutes for the VPN policy to come up. Once the VPN policy is up we see a green indicator and a new entry under "Currently Active VPN Tunnels".