- Products
- Network Security
- Threat Protection
- Secure Access Service Edge (SASE)
- Cloud Security
- Endpoint Security
- Email Security
- Secure Access
-
Wi-Fi 6 Access Points
SonicWall SonicWave 600 series access points provide always-on, always-secure connectivity for complex, multi-device environments.
Read More
- Solutions
- Industries
- Use Cases
- Solutions Widgets
- Solutions Content Widgets
Federal
Protect Federal Agencies and Networks with scalable, purpose-built cybersecurity solutions
- Solutions Image Widgets
-
- Partners
- SonicWall Partners
- Partner Resources
- Partner Widgets
- Custom HTML : Partners Content WIdgets
Partner Portal
Access to deal registration, MDF, sales and marketing tools, training and more
- Partners Image Widgets
-
- Support
- Support
- Resources
- Capture Labs
- Support Widget
- Custom HTML : Support Content WIdgets
Support Portal
Find answers to your questions by searching across our knowledge base, community, technical documentation and video tutorials
- Support Image Widgets
-
- COMPANY
- PROMOTIONS
- MANAGED SERVICES
- Contact Sales
-
- Menu
- Solutions
- Solutions Widgets
- Solutions Image Widgets
-
- Solutions Widgets
- Partners
- Partner Widgets
- Partners Image Widgets
-
- Partner Widgets
- Support
- Support Widget
- Support Image Widgets
-
- Support Widget
- Solutions
- Solutions Widgets
- Solutions Image Widgets
-
- Solutions Widgets
- Partners
- Partner Widgets
- Partners Image Widgets
-
- Partner Widgets
- Support
- Support Widget
- Support Image Widgets
-
- Support Widget
Configuring Tunnel Interface (static route-based) VPN using Enterprise Command Line
03/26/2020 
11 People found this article helpful
197,765 Views
Description
SonicOS 5.9 introduces a new, more robust, enterprise-level Command Line Interface (E-CLI). This articles describes how to create a static route-based Tunnel-Interface VPN policy using E-CLI.
Resolution
Global System Commands
The following system commands are global and can be executed from anywhere in the config module.
| Command | Description | Command | Description |
| Tab key | Tab key aids in completing a command. Displays useful information such as the next option in the command. | end | Exit current mode and return to global configuration mode without saving changes made in the current mode. |
| ? key | The ? key lists the next command or commands with a short description of each command. For certain commands, the ? key even displays examples of using the given command. | exit | Exit current mode without saving changes made in the current mode |
| q key | The 'q' key breaks listing of commands or information. Useful when the output of a command like Show current-config needs to be stopped. | export | Export system status or configuration |
| cancel | Exit from the mode without saving changes. | help | Display command help |
| clear | Reset functions. | no | Negate a command or set its defaults. |
| commit | Save configuration changes. The command commit best-effort will save only valid changes | show | Show system status or configuration. |
| diag | Diagnostic functions. |
For the purpose of this article, we use an NSA 220 and an NSA 4500 with the following IP addresses as examples to demonstrate the VPN configuration.
NSA 220
WAN (X1):192.168.170.31
LAN (X0): 10.10.10.0/24
NSA 4500
WAN (X1): 192.168.170.51
LAN (X0): 172.27.24.0/24
WAN (X1):192.168.170.31
LAN (X0): 10.10.10.0/24
NSA 4500
WAN (X1): 192.168.170.51
LAN (X0): 172.27.24.0/24
Note: One of the benefits of E-CLI is that commands can be copied and pasted into the CLI. Therefore, users can copy and paste the commands below directly into each SonicWall's CLI, substituting your IP addresses, names etc. for ones shown below.
| NSA 220 Configuration | NSA 4500 Configuration | ||||
| Create an address object for the remote networks | |||||
| config address-object ipv4 "NSA 4500 LAN" network 172.27.24.0 /24 zone VPN | config address-object ipv4 "NSA 220 LAN" network 10.10.10.0 /24 zone VPN | ||||
| |||||
| Tunnel-Interface VPN Configuration - IKEv2 Mode | |||||
| vpn policy tunnel-interface "To Remote Site" | vpn policy tunnel-interface "To Central Site" | ||||
| The proposal ipsec commands (for Phase II) need not be included if using default parameters. If proposal ipsec is not explicitly specified, the default parameters of esp,triple-des,sha1,none,28800 is configured. | |||||
| Other (optional) commands | |||||
| netbios //Enable Windows Networking (NetBIOS) Broadcast multicast //Enable Multicast management snmp //Enable SNMP via this SA user-login http //Enable user login via this SA over HTTP user-login https //Enable user login via this SA over HTTPS tcp-acceleration //Enable acceleration | |||||
| Create a static bound to a tunnel-interface | |||||
| Once a tunnel-interface VPN policy is created, a numbered tunnel-Interface is auto-created. To view tunnel-interfaces, press the Tab key after after the command policy interface. This will display all the interfaces. To create a static route, follow these steps: routing policy interface TI2 metric 1 source any destination name "NSA 4500 LAN" service any gateway default commit exit | |||||
| Edit VPN policies | |||||
| To edit and change a VPN policy, follow these steps: //as already mentioned, at each command, pressing "?" would list usage with example/s; pressing the Tab key would either auto-complete half-way through a command or list suggestions of next commands or values to type. For example:
config vpn policy tunnel-interface "To Remote Site" Pressing the "?" or the Tab key would list the commands available within this module.
| |||||
| Delete a VPN policy | |||||
| To delete a VPN policy enter the following command. Must be entered at the config prompt. config | |||||
| Display VPN policies and VPN Tunnel information | |||||
| The show command is global and can be executed from any module. Enter this command to show a specific VPN policy by name show vpn policy "To Remote Site" Enter this command to show all VPN policies :show vpn policies show vpn tunnel "To Remote Site" To display information on all active VPN tunnels, enter this command:show vpn tunnels | |||||
| Display VPN Logs | |||||
| To display VPN logs, enter the following command: show log view category "VPN" The view can be further filtered using the following options:
| |||||
Related Articles
- Bandwidth usage and tracking in SonicWall
- How to force an update of the Security Services Signatures from the Firewall GUI
- Configure Guest VLAN in the TZ firewall, for guest users to access Internet only.
Categories
- Firewalls > TZ Series
- Firewalls > SonicWall SuperMassive E10000 Series
- Firewalls > SonicWall SuperMassive 9000 Series
- Firewalls > SonicWall NSA Series
YES
NO