Aviatrix Gateway to Sonicwall

This document describes how to build an IPsec tunnel based Site2Cloud connection between Aviatrix Gateway and Sonicwall.

The network setup is as follows:

VPC/VNet-AVX (with Aviatrix Gateway)

VPC/VNet CIDR: 10.0.0.0/16

On-Prem (with Sonicwall)

On-Prem Network CIDR: 10.16.100.0/24

Creating a Site2Cloud Connection at the Aviatrix Controller ======================================================

1. Go to Gateway > New Gateway to launch an Aviatrix Gateway at the subnet (public subnet in AWS, GCP, or OCI) of VPC/VNet-AVX. Collect Gateway's public IP addresses (35.161.77.0 in this example).
2. Go to the Site2Cloud page and click Add New to create a Site2Cloud connection.

Field	Value
VPC ID/VNet Name	Choose VPC/VNet ID of VPC-AVX
Connection Type	Unmapped
Connection Name	Arbitrary (e.g. avx-sonicwall-s2c)
Remote Gateway Type	Sonicwall
Tunnel Type	UDP
Algorithms	Unmark this checkbox
IKEv2	Unmark this checkbox
Encryption over DirectConnect	Unmark this checkbox
Enable HA	Unmark this checkbox
Primary Cloud Gateway	Select Aviatrix Gateway created above
Remote Gateway IP Address	Public IP of Sonicwall (66.7.242.225 in this example)
Pre-shared Key	Optional (auto-generated if not entered)
Remote Subnet	10.16.100.0/24 (On-Prem Network CIDR)
Local Subnet	10.0.0.0/16

Creating Address Objects for the VPN subnets ========================================

Navigate to Network > Address Objects > click Add.

Creating an Address Object for the Local Network

Field	Value
Name	Arbitrary e.g. Site2Cloud-local
Zone	LAN
Type	Network
Network	The LAN network range
Network Mask/Prefix	e.g. 255.255.255.0

Creating an Address Object for the Cloud Network

Field	Value
Name	Arbitrary e.g. site2cloud-cloud
Zone	WAN
Type	Network
Network	The Cloud network range
Network Mask/Prefix	e.g. 255.255.0.0

Configuring the VPN Tunnel

Navigate to VPN > Settings > click Add.

On the General tab fill in the following fields:

Field	Value
Policy Type	Site to site
Authentication Method	IKE using Preshared Secret
Name	Arbitrary (e.g. Aviatrix-GW)
IPsec Primary Gateway Address	The public IP of the Aviatrix Gateway
IPsec Secondary Gateway Address	The public IP of the Aviatrix HA Gateway if configured
Shared Secret	Arbitrary
Confirm Shared Secret	Re-enter Shared Secret
Local IKE ID	Leave blank
Peer IKE ID	Leave blank

Assigning the Local and Remote Address Objects to the Tunnel

Select the Network tab and select the Address objects created above.

Choose local network from list: e.g. Site2Cloud-local.

1. Select the Proposals tab and set the IKE and IPsec values.

Field	Value
Exchange	Main Mode
DH Group	Group2
Encryption	AES-256
Authentication	SHA1
Life Time (seconds)	28800

IPsec (Phase 2) Proposals

Field	Value
Protocol	ESP
Encryption	AES-256
Authentication	SHA1
Enable Perfect Forward Secrecy	Mark this checkbox
DH Group	Group 2
Life Time (seconds)	3600

• Note - If Secondary Peer IP is configured, then Peer IKE ID must be left blank or else failover will not work properly.

  

Advanced Settings

• Click the Advance tab.
• Mark the Enable Keep Alive checkbox.
• Click OK to save.