Secure Mobile Access 12.5 Getting Started Guide for AWS

Technical Documentation>  Automated Installation of SMA 8200v-Standalone Using CloudFormation on AWS>  Configuring an IPsec Site-to-Site VPN on SonicWall Firewall>  Configuring Routing on the SonicWall Firewall
Table of Contents

Configuring Routing on the SonicWall Firewall

After creating the VPN policies, configure static routes on the SonicWall NSv firewall to route traffic destined for the SMA networks through the VPN tunnels.

Step 1 Create Network Objects

  1. Navigate to Object | Match Objects > Addresses > Address Objects.

  2. Create a network object named ApplianceVpcCidr. For step-by-step instructions, refer to Adding Address Objects.

  3. Enter the SMA appliance VPC CIDR subnet information.

  4. Click Save.

  5. Create another network object named StaticPoolCidr.

  6. Enter the SMA static pool CIDR subnet information.

  7. Click Save.

Step 2 Configure Static Routes for the SMA Appliance VPC

Add static routes for the SMA appliance VPC CIDR (ApplianceVpcCidr) through each VPN tunnel interface. Assign a lower metric to the preferred tunnel interface.

  1. Navigate to POLICY | Rules and Policies > Routing Rules.

  2. Click + Add to create a new static route.

  3. Configure the following settings:

    • Name
    • Destination: ApplianceVpcCidr
    • Interface: Select the preferred VPN tunnel interface.
    • Metric: Assign the lower metric value.

  4. Save the route.

  5. Create a second static route for the same destination:

    • Name
    • Destination: ApplianceVpcCidr
    • Interface: Select the second VPN tunnel interface.
    • Metric: Assign a higher metric value than the preferred tunnel.

  6. Save the route.

Step 3 Configure Static Routes for the SMA Static Pool

Add static routes for the SMA static pool CIDR (StaticPoolCidr) through each VPN tunnel interface. Assign a lower metric to the preferred tunnel interface.

  1. Navigate to POLICY | Rules and Policies > Routing Rules.

  2. Click + Add to create a new static route.

  3. Configure the following settings:

    • Name
    • Destination: StaticPoolCidr
    • Interface: Select the preferred VPN tunnel interface.
    • Metric: Assign the lower metric value.

  4. Save the route.

  5. Create a second static route for the same destination:

    • Name
    • Destination: StaticPoolCidr
    • Interface: Select the second VPN tunnel interface.
    • Metric: Assign a higher metric value than the preferred tunnel.

  6. Save the route.

If BGP is configured on the NSv using the ASN specified in SiteToSiteRemoteGatewayBgpAsn, the AWS Transit Gateway automatically advertises the applicable routes, reducing the need for manual route configuration.