Cloud Edge Secure Access Getting Started Guide

IBM Cloud

This article describes how to establish a Site-To-Site IPSec VPN connection between your IBM server and the SonicWall Cloud Edge network.

Please follow the steps below:

Open to the VPC section in the IBM Cloud Console. Go to VPNs (under the Network tab).
Open the IKE Policies tab, then select New IKE Policy.
Choose a Name, the Region in which the appropriate VPC lies, define the Resource group, then select Create IKE policy.
Once the policy has been created, select the three-dotted menu (...) and select Edit.
Fill in the following information:
- IKE Version: 1
- DH Group: 2
- Authentication: sha256
- Key Lifetime: 28800
- Encryption: aes256

Select Save IKE policy.
Open the IPSecPolicies tab, then select New IPSec Policy.
Choose an indicative Name, the Region in which the appropriate VPC lies and define the Resource group, then select Create IPSec policy.
Once the policy has been created, select the three-dotted menu (...) and select Edit.
Fill in the following information:
- Check: PFS
- DH Group: 2
- Authentication: sha256
- Key Lifetime: 3600
- Encryption: aes256
Select Save IPSec policy.
Open the VPN gateways tab, then select New VPN gateway.
Fill in the following information:
- Name: Enter a name of your choice
- Virtual private cloud: Choose the desired cloud
- Resource group: Choose the resource group
- Subnet: Choose the appropriate subnet
Check New VPN Connection for VPC.
Fill in the following information:
- Connection name: Set a name
- Peer gateway address: Insert your SonicWall Cloud Edge gateway IP
- Preshared key: Insert an 8 character (at least) string containing upper-case letters, upper-case letters, and numbers
- Local subnet: Specify one or more subnets in the VPC you want to connect
- Peer subnet: Unless you have custom configurations or multiple tunnels to the same gateway insert 10.255.0.0/16
- Dead peer detection action: Restart
- Interval: 10 seconds
- Timeout: 30 seconds
- IKE policy: Choose the policy that was earlier
- IPSec policy: Choose the policy that was earlier

Enter the SonicWall Cloud Edge Management Platform. Under the Networks tab in the left menu, select the name of the network in which you'd like to set the tunnel.
Locate the desired gateway, select the three-dotted menu (...), select Add Tunnel, and then IPSec Site-2-Site Tunnel.
Fill in the General Settings:
- Name: Specify a name
- Public IP: Insert the IP of the VPN Gateway you have just defined
- Remote ID: Identical to Remote IP
- Shared Secret: Insert the same preshared key you chose before
- SonicWall Cloud Edge Gateway Proposal Subnets: 10.255.0.0/16 or according to what you defined in the IBM Cloud portal
- Remote Gateway Proposal Subnets: Specify one or more subnets in the VPC you want to connect
Fill in the Advanced Settings:
- IKE Version: 1
- IKE Lifetime: 8h
- Tunnel Lifetime: 1h
- Dead Peer Detection Delay: 10s
- Dead Peer Detection Timeout: 30s
- Encryption (Phase 1): aes256
- Encryption (Phase 2): aes256
- Integrity (Phase 1): sha256
- Integrity (Phase 2): sha256
- Diffie-Hellman Groups (Phase 1): 2
- Diffie-Hellman Groups (Phase 2): 2

Under the VPN gateways tab select the name of the VPN Gateway that is associated with the tunnel.
Scroll down and select View all connections.
You'll be able to see the status of the tunnel. If for some reason the tunnel is down please make sure you configured all the fields according to this article. At any point, our support team will be happy to assist or troubleshoot.