Cloud Edge Secure Access Getting Started Guide
- Cloud Edge Secure Access
- Welcome to SonicWall Cloud Edge!
- Prerequisites
- Installation
- Networks
- Groups and Members
- Securing the Platform
- Monitoring
- Compliance
- SonicWall Support
AWS Transit Gateway
This article describes how to connect multiple VPCs using a single Site-to-Site connection like AWS Transit Gateway (unlike the AWS Virtual Gateway which requires one Site-to-Site connection per VPC). Inter-region Transit Gateway peering is available in US East (N. Virginia), US East (Ohio), US West (Oregon), EU (Ireland), and EU (Frankfurt) while currently in other regions TG is restricted to a single region.
The choice between Transit Gateway or a simple Virtual Gateway depends on your AWS architecture. If you are not sure, we encourage you to visit AWS's official documentation.
Please follow the steps below:
-
Create the Transit Gateway & Transit Gateway attachments
- Configuring the tunnel in the AWS Console
-
Configuring the tunnel on the SonicWallCloud Edge web platform
-
Configuring the routing in the AWS Console
-
Configuring the routing on the SonicWallCloud Edge web platform
Create the Transit Gateway & Transit Gateway attachments
Create the Transit Gateway
-
Go to the VPC section in the AWS Console.
-
Under the left panel, click on Transit Gateways
-
On the top pane, click on Create transit gateway
-
Fill in the following information:
-
Name tag - Insert the name of the Transit Gateway
-
You can keep the default parameters for the rest of the attributes
-
-
Click on Create transit gateway.
Create the Transit Gateway attachments
Create the Transit Gateway VPC attachments
-
On the left pane, click on Transit Gateway Attachments
-
On the top pane, click on Create transit gateway attachment
-
Fill in the following information and click on Create transit gateway attachment:
- Name Tag - Insert the name of the Transit Gateway Attachment
- Transit gateway ID - Pick the newly created Transit gateway
- Attachment Type - VPC
- VPC ID - Select the relevant VPC
- You can keep the default parameters for the rest of the attributes
Repeat the above process for each of the VPCs that you would like to gain access to.
Create the Transit Gateway VPN attachment
-
On the top pane, click on Create transit gateway attachment.
-
Fill in the following information and click on Create transit gateway attachment:
- Transit gateway ID - Pick the newly created Transit gateway
- Attachment Type - VPN
- Customer Gateway - New
- IP address - This should be obtained within the SonicWall Cloud Edge Panel, under the relevant Gateway Name
-
BGP ASN: Leave default values
-
Routing Options: Static
-
Keep the default values for the rest of the attributes
-
Click on Create transit gateway attachment
This may take several minutes.
In case you have 2 VPCs, this is how your Transit gateway attachments section should look like
Configuring the tunnel in the AWS Console
-
On the left pane, under Virtual Private Network (VPN), click on Site-to-Site VPN Connections
- Pick the newly created Transit Gateway VPN connection record
-
On the top pane, click on Download Configuration
-
A pop-up will appear, choose the following and click on Download
-
Vendor - Strongswan
-
Platform - Ubuntu 16.04
-
Software - Strongswan 5.5.1+
-
Ike Version - Ikev1
-
-
Open the configuration file that you have downloaded and copy the following attributes.
-
Endpoint - Copy the 2nd IP (marked in red)
-
PSK - Marked in yellow, remember to omit the quotation marks
-
Configuring the tunnel in the platform
- Navigate to your SonicWall Cloud Edge web platform.
-
On the left pane, click on Networks and select the name of the network in which you'd like to set the tunnel.
-
Locate the desired gateway, select the three-dotted menu (...), select Add Tunnel
-
A pop-up will appear, choose IPSec Site-2-Site Tunnel and click on Continue
-
Fill in the following information and click on Add Tunnel:
- Name - Enter the name of the tunnel
- Shared Secret - Paste the PSK value from the downloaded file (marked in yellow)
-
Public IP & Remote ID - Paste the 2nd IP from the downloaded file (marked in red)
-
SonicWall Cloud Edge Gateway Proposal Subnets: by default, this should be set to 10.255.0.0/16.
-
Remote Gateway Proposal Subnets: 0.0.0.0/0 or specify according to your customized settings.
-
At the Advanced Settings section fill in the following information:
- IKE Version: V1
- IKE Lifetime: 8h
- Tunnel Lifetime: 1h
- Dead Peer Detection Delay: 10s
- Dead Peer Detection Timeout: 30s
- Encryption(Phase 1): aes128
- Encryption(Phase 2): aes128
- Integrity (Phase 1): sha1
- Integrity (Phase 2): sha1
- Diffie-Hellman Groups (Phase 1): 2
- Diffie-Hellman Groups (Phase 2): 2
This may take several minutes, you can move on to the next step.
Configuring the routing on AWS
-
Go to the VPC section in the AWS Console. Under Transit Gateways, select Transit Gateway Route Tables.
-
Select the relevant Transit Gateway Route Table record
-
On the bottom, click on Propagations
-
Verify that all of the Transit Gateway Attachments are included, if you have 2 VPCs, this is how it should look like -
In case one of the Transit Gateway Attachments is missing, click on "Create propagation" and add the missing record
-
On the bottom, click on Associations
-
Verify that all of the Transit Gateway Attachments are included (same as step #4)
-
On the bottom, near the Propagations tab, click on Routes
-
Click on Create static route and fill in the following:
-
CIDR - Insert your SonicWall Cloud Edge subnet, to find your SonicWall Cloud Edge network subnet perform the following:
- Open your SonicWall Cloud Edge web platform
- On the left pane click on "Networks" --> "Networks"
- Select your network
- Select the three-dotted menu (...) next to the Network
- Click on "Edit Network"
-
Choose attachment - Choose the VPN attachment
If you have 2 VPCs, this is how it should look like
-
-
On the left pane, under Virtual Private Cloud, click on "Route Tables"
-
Select the Route Table for one of the attached VPCs
-
On the bottom, click on Routes
-
Click on Edit Routes, a new window will appear, click on Add route and fill in the following:
-
Destination= Your SonicWall Cloud Edge network subnet
-
The value in the above screenshot it's just an example, to find your SonicWall Cloud Edge network subnet perform the following:
-
Open your SonicWall Cloud Edge web platform
-
On the left pane click on "Networks" --> "Networks"
-
Select your network
-
Select the three-dotted menu (...) next to the Network
-
Click on "Edit Network"
-
-
-
Target = Choose Transit Gateway & pick the relevant Transit Gateway
-
- Click on Save changes
- Repeat steps 10-12 for other attached VPCs
Configuring the routing on SonicWall Cloud Edge
- Open your SonicWall Cloud Edge web platform
- On the left pane click on "Networks" --> "Networks"
- Select your network
- Select the three-dotted menu (...) next to the Network
-
Click on Route Table
- On the top right corner, click on Add Route
- A pop-up will appear, fill in the following and click on Apply Configuration:
-
Tunnel - Choose the relevant tunnel
-
Subnet - Add the CIDRs of the attached VPCs (The VPCs to which you'd like to gain access)
Was This Article Helpful?
Help us to improve our support portal