How to Configure a Site-to-Site IPsec VPN on SonicWall

Learn how to configure a Site-to-Site IPsec VPN tunnel on a SonicWall appliance, from creating address objects to setting IKE proposals and keep alive.

April 20, 2026 By Anthony Yorks

Setting up a Site-to-Site IPsec VPN on a SonicWall firewall involves creating an address object for the remote network, defining the VPN policy, and configuring encryption and authentication protocols. Follow these steps to build and configure your secure VPN tunnel.

Step 1: Log in to your SonicWall

Step #1: Enter your username and log in to the SonicOS web management interface — Enter your username and log in to the SonicOS web management interface

.

Step 2: Create a Remote Address Object

Before you create the VPN policy, define an Address Object representing the remote network.

Step #2: Click OBJECT in the top navigation bar — Click **OBJECT** in the top navigation bar

. 2.

Step #3: Select Addresses from the left-hand sidebar — Select **Addresses** from the left-hand sidebar

. 3.

Step #4: Click + Add to create a new address object — Click **+ Add** to create a new address object

. 4.

Step #5: Type a familiar name — Type a familiar name

for the remote network (e.g., "Vendor_LAN"). 5.

Step #7: Select Network — Select **Network**

from the Type dropdown. 6.

Step #8: Enter the network IP address — Enter the network IP address

of the remote side. 7.

Step #9: Provide the correct subnet mask — Provide the correct subnet mask

. 8.

to store the object.

Step 3: Configure VPN General Settings

Step #13: Click NETWORK in the top navigation bar — Click **NETWORK** in the top navigation bar

. 2.

Step #14: Navigate to IPsec VPN > Rules and Settings — Navigate to **IPsec VPN** > **Rules and Settings**

. 3.

Step #15: Click + Add to establish a new VPN policy — Click **+ Add** to establish a new VPN policy

. 4. In the General tab,

Step #17: enter a recognizable name — enter a recognizable name

for the VPN policy. 5.

Step #18: Type in the remote ISP's public IP — Type in the remote ISP's public IP

into the IPsec Primary Gateway field. 6.

Step #21: Enter your Pre-shared Secret — Enter your Pre-shared Secret

(the password used to authenticate both ends of the tunnel).

Step 4: Define Local and Remote Networks

Now, define which networks are allowed to communicate across the tunnel.

Step #22: Switch to the Network tab — Switch to the **Network** tab

within the policy configuration. 2.

Step #25: Select your local network — Select your local network

(for instance, the X0 subnet) from the local network dropdown list. 3. In the Remote Networks section,

Step #28: select the address object you created earlier — select the address object you created earlier

as the destination network.

Step 5: Configure IKE and IPsec Proposals

The Proposal settings dictate the encryption and hashing methods used by the tunnel. These parameters must match exactly on both firewalls, or the tunnel will fail to connect.

Step #29: Click the Proposals tab — Click the **Proposals** tab

. 2. Under the IKE (Phase 1) Proposal section: *

Step #32: Set the DH Group to Group 14 — Set the DH Group to **Group 14**

. *

Step #35: Select SHA384 for Authentication — Select **SHA384** for Authentication

(or according to your vendor's specifications). 3. Under the IPsec (Phase 2) Proposal section: *

Step #39: Set the Encryption protocol to AES - 256 — Set the Encryption protocol to **AES - 256**

. *

Step #41: Select SHA256 for Authentication — Select **SHA256** for Authentication

. *

Step #45: Set the DH Group to Group 14 — Set the DH Group to **Group 14**

.

Step 6: Enable Keep Alive and Save

Step #46: Switch over to the Advanced tab — Switch over to the **Advanced** tab

. 2.

Step #47: Toggle on Enable Keep Alive — Toggle on **Enable Keep Alive**

to ensure the tunnel attempts to reconnect automatically if there are network drops. 3.

to finalize your configuration.

You have now created the VPN policy. Once the customer, vendor, or remote office successfully matches these settings on their end, the tunnel will connect and display a green indicator next to the policy in your IPsec VPN table.