SMA1000 - AWS Deployment of SMA8200v Using CloudFormation
Description
SonicWall provides an AWS CloudFormation template (CFT) that automates the deployment of the SMA 8200v virtual appliance on Amazon Web Services. The template provisions all required networking infrastructure and appliance configuration in a single operation, eliminating the manual steps required when deploying via the EC2 console directly.
The template creates the SMA 8200v appliance instance, a dedicated VPC with appropriate routing, and a static IP pool for Connect Tunnel clients. An optional IPsec site-to-site VPN connection to a remote gateway device can also be provisioned as part of the same deployment.
Prerequisites
Before deploying the template, confirm the following:
- Active AWS account with permissions to create EC2 instances, VPCs, security groups, transit gateways, IAM roles, and CloudFormation stacks.
- An EC2 key pair in the target AWS region - this key pair is used for SSH access to the appliance CLI.
- A MySonicWall.com account for post-deployment registration and licensing.
- A valid SMA 8200v license: serial number and authentication code.
- If enabling site-to-site VPN: the public IP address of the remote gateway its BGP ASN, the remote network CIDR, proposal settings and a pre-shared key.
Resolution
Accessing the Template
Architecture documentation and a web-based launch interface are available at:
https://sma1000-aws-reference-deployment.d1m0j8oa81mj8a.amplifyapp.com/
What the Template Deploys
The template provisions three nested CloudFormation stacks. The following AWS resources are created:
Appliance VPC Stack
- A dedicated Amazon VPC with a customizable CIDR (default: 10.100.0.0/16) and subnet (default: 10.100.1.0/24).
- An internet gateway and route table entries directing static pool traffic through the SMA 8200v instance ENI.
- If RedirectAll is enabled: an AWS NAT Gateway for redirect-all tunnel mode. This option is not compatible with IPv6.
- If site-to-site VPN is enabled: a transit gateway attachment to the appliance VPC, with static routes to the appliance VPC CIDR and the static pool CIDR.
Appliance Instance Stack
- An EC2 instance running the SMA 8200v AMI, placed in the appliance subnet with an elastic IP for consistent public access.
- A security group permitting TCP 22 (SSH), 443 (HTTPS/Connect Tunnel), and 8443 (admin console).
- The instance is initialized with the static pool CIDR, redirect-all setting, and VPN parameters supplied at deploy time.
Site-to-Site VPN Stack (optional)
When SitetoSiteVpn is set to true, provisions the following:
- An AWS Transit Gateway.
- A Customer Gateway resource representing the remote gateway device, configured with its public IP and BGP ASN.
- An IPsec VPN connection between the transit gateway and the customer gateway using the specified pre-shared key.
- Two VPN tunnels with separate public IP addresses available as CloudFormation outputs; AWS recommends configuring both on the remote gateway for redundancy.
- An SMA access policy automatically created, granting the tunnel user access to the remote network CIDR.
Template Parameters
|
Parameter |
Description |
Default |
Required When |
|
KeyPair |
EC2 key pair for SSH access to the appliance. |
(none) |
Always |
|
ApplianceVpcCidr |
IPv4 CIDR for the appliance VPC. |
10.100.0.0/16 |
Always |
|
ApplianceSubnetCidr |
IPv4 CIDR for the appliance subnet. |
10.100.1.0/24 |
Always |
|
RedirectAll |
Enable redirect-all tunnel mode via AWS NAT Gateway. Incompatible with IPv6. |
false |
Optional |
|
Ipv6 |
Enable IPv6. Incompatible with RedirectAll. |
false |
Optional |
|
StaticPoolCidr |
IPv4 CIDR for Connect Tunnel static IP pool. Must not overlap VPC or remote CIDRs. |
10.101.0.0/16 |
Always |
|
StaticPoolV6Cidr |
IPv6 CIDR for static pool. Required when IPv6 is enabled. |
(none) |
If IPv6=true |
|
SiteToSiteVpn |
Create IPsec site-to-site VPN connection to a remote gateway. |
false |
Optional |
|
SiteToSiteRemoteGatewayPublicIp |
Public IP of the remote gateway device (NSv or other). |
(none) |
If VPN=true |
|
SiteToSiteRemoteGatewayBgpAsn |
BGP ASN of the remote gateway device. |
65000 |
If VPN=true |
|
SiteToSitePreSharedKey |
IPsec pre-shared key. 8-64 alphanumeric characters, periods, underscores. Cannot start with zero. |
(none) |
If VPN=true |
|
SiteToSiteRemoteCidr |
IPv4 CIDR of the remote network. Traffic to this CIDR routes through the VPN tunnel. |
(none) |
If VPN=true |
NOTE: RedirectAll and Ipv6 cannot both be enabled. AWS NAT Gateways do not support outbound IPv6 traffic.
Template Outputs
After the stack reaches CREATE_COMPLETE status, the following values are available on the Outputs tab of the parent stack in the CloudFormation console.
|
Output Key |
Description |
Availability |
|
AppliancePublicIp |
Public IP of the SMA 8200v instance. Use this to reach the admin console and for Connect Tunnel client configuration. |
Always |
|
ApplianceInstanceId |
EC2 Instance ID of the SMA 8200v. This is also the default password for both the admin and tunnel users. |
Always |
|
SiteToSiteVpnTunnelPublicIp1 |
Public IP of AWS VPN Tunnel 1. Configure this address on the remote gateway device as a VPN peer. |
If VPN=true |
|
SiteToSiteVpnTunnelPublicIp2 |
Public IP of AWS VPN Tunnel 2. Configure this on the remote gateway for redundancy. Only one tunnel must be active. |
If VPN=true |
Deploying the Template
- Sign in to the AWS Management Console and confirm you are in the correct AWS region.
- Open the one-click launch URL from Section 3, or navigate to CloudFormation > Create Stack and provide the template S3 URL.
- On the Specify stack details page, enter a stack name (the default is Sma1000AwsReferenceDeployment).
- Under Authentication, select your EC2 key pair from the KeyPair drop-down.
- Under Appliance VPC, confirm or modify the VPC and subnet CIDRs. Set RedirectAll or Ipv6 to true if required for your deployment.
- Under Static Pool, confirm or modify the StaticPoolCidr. Ensure it does not overlap with your VPC CIDR or any remote network CIDR.
- Under Site-to-Site VPN, set SiteToSiteVpn to true if a VPN connection is required. If enabled, provide the remote gateway public IP, BGP ASN, pre-shared key, and remote network CIDR.
- On the Configure stack options page, no changes are required. Click Next.
- On the Review page, acknowledge the IAM capability checkbox and click Submit.
- Monitor the stack creation. Three nested stacks are created in addition to the parent stack. Wait for all stacks to reach CREATE_COMPLETE. Deployment typically takes 5 to 10 minutes.
- On the Outputs tab of the parent stack, record AppliancePublicIp and ApplianceInstanceId. If VPN was enabled, also record SiteToSiteVpnTunnelPublicIp1 and SiteToSiteVpnTunnelPublicIp2.
Post-Deployment Access and Configuration
Admin Console (AMC)
Access the SMA 8200v management interface over HTTPS on port 8443:
https://<AppliancePublicIp>:8443/
Default credentials:
- Username: admin
- Password: <ApplianceInstanceId> (the EC2 Instance ID from the CloudFormation Outputs tab)
NOTE: Change the admin password immediately after first login. Navigate to System Configuration > General Settings > Administrator to update credentials.
Connect Tunnel Access
Connect Tunnel access is pre-configured and available immediately. Clients connect to the appliance public IP address. Default Connect Tunnel credentials:
- Username: tunnel
- Password: <ApplianceInstanceId>
Configure appropriate authentication policies and change the default password before distributing client access.
Registration
The appliance must be registered with MySonicWall before full functionality is available:
- In the AMC, navigate to System Configuration > General Settings > Licensing and click Edit.
- Click Register under the Online Licensing section.
- Enter your MySonicWall credentials, serial number, authentication code, and a friendly name.
- Click OK to complete registration.
Site-to-Site VPN Access Policies
If the VPN connection was enabled during deployment, an SMA access policy is automatically created granting the tunnel user access to the remote network CIDR specified in SiteToSiteRemoteCidr. To grant access to additional resources or apply more restrictive policies, modify the configuration in the AMC. Refer to the SMA 1000 Administration Guide for access policy details.