Secure Mobile Access 12.5 Getting Started Guide for AWS
Table of Contents
Configuring an IPsec Site-to-Site VPN on SonicWall Firewall
If SiteToSiteVpn was set to true during CloudFormation deployment, AWS creates two IPsec VPN tunnels between the AWS Transit Gateway and the remote gateway device. Configure the remote gateway (for example, a SonicWall firewall) to establish the VPN connection from its side.
To view the VPN tunnels, navigate to VPC > Virtual Private Network (VPN) > Site-to-Site VPN Connections in the AWS Management Console.
AWS creates two VPN tunnels for redundancy. To enable automatic failover, configure both tunnels on the SonicWall firewall. If one tunnel becomes unavailable, traffic automatically switches to the other tunnel.
Architecture
On the AWS side, the CloudFormation template creates a Transit Gateway with a VPC attachment, a Customer Gateway that represents the remote device, and an IPsec VPN connection with two tunnels. Static routes on the Transit Gateway direct traffic to the appliance VPC CIDR and the static pool CIDR through the VPC attachment.
On the remote gateway side, configure IPsec VPN policies for both AWS tunnel endpoints. After the VPN connection is established, VPN clients receive IP addresses from the static address pool and can access resources on the remote network through the VPN tunnel.
Prerequisites
Collect the following values before configuring the remote gateway device. These values are from the CloudFormation stack Outputs tab or the parameters entered during deployment.
| Value | Where to Obtain |
|---|---|
| AWS VPN Tunnel 1 public IP | CloudFormation Outputs: SiteToSiteVpnTunnelPublicIp1 |
| AWS VPN Tunnel 2 public IP | CloudFormation Outputs: SiteToSiteVpnTunnelPublicIp2 |
| Pre-shared key | The value entered as SiteToSitePreSharedKey during deployment |
| Remote network CIDR | The value entered as SiteToSiteRemoteCidr during deployment |
| SMA appliance VPC CIDR | The value entered as ApplianceVpcCidr (default: 10.100.0.0/16) |
| SMA static pool CIDR | The value entered as StaticPoolCidr (default: 10.101.0.0/16) |
| Remote Gateway public IP | The public IP of the remote VPN gateway supplied as SiteToSiteRemoteGatewayPublicIp during deployment |