en-US
search-icon

Knowledge Base

How do I configure a site-to-site VPN between a SonicWall firewall and Microsoft Azure?

Description

This article covers how to configure a site-to-site VPN between SonicWall and Azure.

Resolution

The following networks will be used for demonstration purposes during this article. You networks may be different.

Azure Side Resources

  1. Gateway subnet: 10.10.1.0/24
  2. LAN subnet: 10.10.2.0/24
  3. Public IP: 40.78.98.152

SonicWall Side Resources

  1. LAN subnet: 192.168.168.0/24
  2. Public IP: 60.78.112.45

Azure Configuration

  1. Login to the Azure portal at https://portal.azure.com.
  2. Navigate to Virtual Networks and click Add to create a new network scheme.
  3. In this scenario we've defined the following network. Once filled out click Create.
    Name: VNET-01
    Address space: 10.10.0.0/16
    Subnet name: LAN
    Subnet address range: 10.10.2.0/24
    Image
  4. Next, we'll define the gateway network inside of the virtual network we just created. In our case the virtual network is called "VNET-01". Click back into VNET-01, select Subnets | Gateway Subnet. Define the gateway subnet (in our case 10.10.1.0/24) and click Create.
    Image
    Image
  5. Next, we'll create a virtual network gateway. In the search bar at the top of the page start typing "gateway". Select Virtual network gateway:
    Image
  6. Create a new virtual network gateway. Give the gateway a name and define the VPN type. We'll select gateway type VPN and VPN type Route-based. Select the virtual network (in our case VNET-01) and create a new public IP address. We'll use this public IP address later on while configuring the VPN on the SonicWall. Click Create.

    NOTE: Provisioning a virtual network gateway may take up to 45 minutes.

  7. Click on the newly created virtual network gateway. Select Connections | Add.
    Image
  8. Give the connection a name. Under connection type select Site-to-site (IPsec). Create a new local network gateway. This will be the public IP of the SonicWall and the local network. In our case the local network of the SonicWall is the default SonicWall subnet 192.168.168.0/24.
    Image
  9. Provide a secure shared key. This will also be used on the SonicWall. Click OK.
    Image
  10. We'll grab the public IP of Azure and use it in the SonicWall. Navigate to Dashboard and select the Public IP address resource. Take a note of the public IP for the next steps.
    Image

SonicWall Configuration

  1. Login to the SonicWall firewall.
  2. Navigate to the VPN policy tab. We're using the latest SonicOS 6.5 firmware. Click Manage | VPN | Base Settings. Click Add to create a new VPN policy.
  3. Give the VPN policy a name. We're using IKE using Preshared Secret for the authentication type. Under IPsec Primary Gateway provide the Azure public IP. Under shared secret paste the key. Next click the Network tab.
    Image
  4. Under local networks select the appropriate address object. We're using the default SonicWall LAN subnet called X0 Subnet. For remote networks create a new VPN address object for the local Azure subnet. Our example network is 10.10.2.0/24.
    Image
    Image
  5. Select the Proposals tab. We'll use the defaults. Click OK to create the VPN policy.
    Image

It takes 5-7 minutes for the VPN policy to come up. Once the VPN policy is up we see a green indicator and a new entry under "Currently Active VPN Tunnels":
Image