SonicWall 6.5.4+ ikev2 (static)
Configuring SonicWall Next Generation Firewall
Version tested: SonicWall NSv Firewall version 6.5.4
In this section we will refer to the configuration file you can download from AWS as “template conf” and will explain how to use its contents for configuring SonicOSX 6.5.4
As a reference for this guide, you can find here the full AWS file: SonicWall 6.5.4+ ikev2 (static).txt
Create VPN Tunnels
To create the VPN Tunnels navigate to Manage > VPN > Base Settings and ensure that the option Enable VPN are enabled.
Click on Add to create a new IPSec Connection
Configure the tunnel as specified in the template conf #1: General Configuration
user@SerialNumber> configureconfig(SerialNumber)# address-object ipv4 AWSVPC network <vpc_subnet> <subnet-mask> zone VPNconfig(SerialNumber)# vpn policy tunnel-interface vpn-00727a2e3ce528681-0(add-tunnel-interface[AWSVPN])# gateway primary 3.125.75.35(add-tunnel-interface[AWSVPN])# bound-to interface X1(add-tunnel-interface[AWSVPN])# auth-method shared-secret(auth-method-shared-secret[AWSVPN])# shared-secret 6AtKhuHU54oU4Ek_o.d8u4jji6Jjymur(auth-method-shared-secret[AWSVPN])# ike-id local ip 52.59.206.183(auth-method-shared-secret[AWSVPN])# ike-id peer ip 3.125.75.35(auth-method-shared-secret[AWSVPN])# exit
** The Local IKE ID is the Firewall Identifier, it’s showed in Manage > VPN > Base Settings
and continue with #2: Internet Key Exchange (IKE) Configuration and #3: IPSec Configuration
(add-tunnel-interface[AWSVPN])# proposal ike exchange ikev2(add-tunnel-interface[AWSVPN])# proposal ike dh-group 2(add-tunnel-interface[AWSVPN])# proposal ike encryption aes-128(add-tunnel-interface[AWSVPN])# proposal ike authentication sha-1(add-tunnel-interface[AWSVPN])# proposal ike lifetime 28800(add-tunnel-interface[AWSVPN])# proposal ipsec protocol esp(add-tunnel-interface[AWSVPN])# proposal ipsec encryption aes-128(add-tunnel-interface[AWSVPN])# proposal ipsec authentication sha-1(add-tunnel-interface[AWSVPN])# proposal ipsec perfect-forward-secrecy dh-group 2(add-tunnel-interface[AWSVPN])# proposal ipsec lifetime 3600(add-tunnel-interface[AWSVPN])# Keep-alive(add-tunnel-interface[AWSVPN])# enable(add-tunnel-interface[AWSVPN])# commit(add-tunnel-interface[AWSVPN])# end
and let’s do the same also for the IPSec Tunnel #2
user@SerialNumber> configureconfig(SerialNumber)# address-object ipv4 AWSVPC network <vpc_subnet> <subnet-mask> zone VPNconfig(SerialNumber)# vpn policy tunnel-interface vpn-00727a2e3ce528681-1(add-tunnel-interface[AWSVPN])# gateway primary 52.58.65.250(add-tunnel-interface[AWSVPN])# bound-to interface X1(add-tunnel-interface[AWSVPN])# auth-method shared-secret(auth-method-shared-secret[AWSVPN])# shared-secret e.kQTZ2SvUmumlY4RUq7tFHOiu1tOa5k(auth-method-shared-secret[AWSVPN])# ike-id local ip 52.59.206.183(auth-method-shared-secret[AWSVPN])# ike-id peer ip 52.58.65.250(auth-method-shared-secret[AWSVPN])# exit
and
(add-tunnel-interface[AWSVPN])# proposal ike exchange ikev2(add-tunnel-interface[AWSVPN])# proposal ike dh-group 2(add-tunnel-interface[AWSVPN])# proposal ike encryption aes-128(add-tunnel-interface[AWSVPN])# proposal ike authentication sha-1(add-tunnel-interface[AWSVPN])# proposal ike lifetime 28800(add-tunnel-interface[AWSVPN])# proposal ipsec protocol esp(add-tunnel-interface[AWSVPN])# proposal ipsec encryption aes-128(add-tunnel-interface[AWSVPN])# proposal ipsec authentication sha-1(add-tunnel-interface[AWSVPN])# proposal ipsec perfect-forward-secrecy dh-group 2(add-tunnel-interface[AWSVPN])# proposal ipsec lifetime 3600(add-tunnel-interface[AWSVPN])# Keep-alive(add-tunnel-interface[AWSVPN])# enable(add-tunnel-interface[AWSVPN])# commit(add-tunnel-interface[AWSVPN])# end
Configure Tunnel Interfaces
A tunnel interface is configured to be the logical interface associated with the tunnel.
As defined in #5: Tunnel Interface Configuration we should configure the tunnel interface as specified in the template conf
config(SerialNumber)# tunnel-interface vpn T1(add-interface[T1])# asymmetric-route(add-interface[T1])# policy vpn-00727a2e3ce528681-0(add-interface[T1])# ip-assignment VPN static(add-VPN-static)# ip 169.254.214.90 netmask 255.255.255.252(add-VPN-static)# commit(edit-VPN-static)# end
Navigate to Manage > Network > Interfaces and from Add Interface drop-down choose VPN Tunnel Interface
.png)
do the same for the second interface:
config(SerialNumber)# tunnel-interface vpn T2(add-interface[T1])# asymmetric-route(add-interface[T1])# policy vpn-00727a2e3ce528681-1(add-interface[T1])# ip-assignment VPN static(add-VPN-static)# ip 169.254.60.142 netmask 255.255.255.252(add-VPN-static)# commit(edit-VPN-static)# end
Configure Static Routes
Configure static routes to route VPC network over the tunnel interfaces as specified in the template conf #6 Static Route Configuration
config(SerialNumber)# route-policy ipv4 interface T1 metric 1 source any destination name AWSVPC service any(add-route-policy)# commit
Go to Manage > Network > Routing > Route Policies and create:
and
config(SerialNumber)# route-policy ipv4 interface T2 metric 1 source any destination name AWSVPC service any(add-route-policy)# commit
.png)
Note:
Disable the option “Disable route when the interface is disconnected” to allow the simultaneous connection of both tunnels using the Network Monitoring
In this case the destination AWS1_VPC is the AWS VPC Network (10.148.0.0/16)
Testing
Going back Manage > VPN > Base Settings we should be able to see both tunnels up:
Increase the security in the VPN connection
Now, since AWS side VPN tunnels support better security, we can adjust SonicWall configuration accordingly.
So we can use:
AES-256 instead of AES-128
SHA512 instead of SHA1
Diffie-Hellman group 14 instead of DH 2, SonicWall supports DH14
IKEv2 whenever possible
Let’s adjust SonicWall configuration:
Manage > VPN > Base Settings > edit both tunnels with the new parameters:
Now the IPSec tunnels will be up and running with maximum security:
We have done!
For more information and support please contact our UCCS Onboarding Team