Secure Mobile Access 12.5 Getting Started Guide for AWS

Technical Documentation>  Automated Installation of SMA 8200v-Standalone Using CloudFormation on AWS>  Configuring an IPsec Site-to-Site VPN on SonicWall Firewall>  Configuring the SonicWall Firewall VPN Policies
Table of Contents

Configuring the SonicWall Firewall VPN Policies

To configure the SonicWall firewall VPN policies

In the SonicOS management interface,

  1. Navigate to the NETWORK | IPSec VPN > Rules and Settings > Policies page.
  2. Select IP version, and click + Add. The VPN Policy dialog is displayed.
  3. Create a Tunnel Interface VPN policy using the following parameters. For step-by-step VPN policy configuration instructions, refer to General VPN Configuration.
    1. General Tab:

      2. FieldsValue to Configure
      Policy TypeTunnel Interface
      Authentication MethodIKE using Pre-Shared Key
      IPsec Primary Gateway Name or AddressThe SiteToSiteVpnTunnelPublicIp1 value from the CloudFormation outputs
      Shared SecretThe value specified for SiteToSitePreSharedKey in the CloudFormation template
      Local IKE ID (IPv4 Address)The value specified for SiteToSiteRemoteGatewayPublicIp
      Peer IKE ID (IPv4 Address)The SiteToSiteVpnTunnelPublicIp1 value from the CloudFormation outputs

    2. Proposals Tab:

      3. FieldsValue to Configure
      IKE (Phase 1) Proposal
      ExchangeIKEv2 Mode (recommended) or IKEv1. AWS site-to-site VPN supports both.
      DH GroupGroup 14, or match the AWS default proposal set
      EncryptionAES-256
      AuthenticationSHA-256
      Life Time (seconds) 28800 seconds
      IPSEC (Phase 2) Proposal
      EncryptionAES-256
      AuthenticationSHA-256
      Life Time (seconds) 3600

    3. Advanced Tab:

      4. FieldsValue to Configure
      Enable Keep AliveToggled ON
      VPN Policy Bound toInterface X1 (or other WAN interface)

  4. Click Save.

  5. Similarly, create a second tunnel interface VPN policy using the following parameters:
    1. General Tab:
      2. FieldsValue to Configure
      Policy TypeTunnel Interface
      Authentication MethodIKE using Pre-Shared Key
      IPsec Primary Gateway Name or AddressThe SiteToSiteVpnTunnelPublicIp2 value from the CloudFormation outputs
      Shared SecretThe value specified for SiteToSitePreSharedKey in the CloudFormation template
      Local IKE ID (IPv4 Address)The value specified for SiteToSiteRemoteGatewayPublicIp
      Peer IKE ID (IPv4 Address)The SiteToSiteVpnTunnelPublicIp2 value from the CloudFormation outputs

    2. Proposals Tab:

      FieldsValue to Configure
      IKE (Phase 1) Proposal
      ExchangeIKEv2 Mode (recommended) or IKEv1. AWS site-to-site VPN supports both.
      DH GroupGroup 14, or match the AWS default proposal set
      EncryptionAES-256
      AuthenticationSHA-256
      Life Time (seconds) 28800 seconds
      IPSEC (Phase 2) Proposal
      EncryptionAES-256
      AuthenticationSHA-256
      Life Time (seconds) 3600
    3. Advanced Tab:

      4. FieldsValue to Configure
      Enable Keep AliveToggled ON
      VPN Policy Bound toInterface X1 (or other WAN interface)

  6. Click Save.

  7. After creating the tunnels, navigate to Active Tunnels and verify that both tunnels are connected.