Configure Secure Access with Sonicwall Firewall

Available Languages

Download Options

  • PDF     (2.3 MB)
    View with Adobe Reader on a variety of devices
  • ePub     (2.5 MB)
    View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
  • Mobi (Kindle)     (2.0 MB)
    View on Kindle device or Kindle app on multiple devices
Updated:December 19, 2025
Document ID:225404

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

    Introduction

    This document describes how to configure an IPsec VTI tunnel between Secure Access to Sonicwall firewall using static routing.

    Prerequisites

    Requirements

    Cisco recommends that you have knowledge of these topics:

    • Sonicwall  ( NSv270 - SonicOSX 7.0.1 ) firewall 
    • Secure Access
    • Cisco Secure Client - VPN
    • Cisco Secure Client - ZTNA
    • Clientless ZTNA

    Components Used

    The information in this document is based on: 

    • Sonicwall  ( NSv270 - SonicOSX 7.0.1 ) firewall 
    • Secure Access
    • Cisco Secure Client - VPN
    • Cisco Secure Client - ZTNA

    The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

    Background Information

    Network Diagram

    jaiyadav_0-1751648321630

    Network Diagram

    Configure

    Configure Network Tunnel Group (VPN) on Secure Access 

    In order to configure VPN tunnel between Secure Access and Sonicwall

    jaiyadav_5-1751644368989

    Secure Access - Main Page

    • Click on Connect > Network Connections

    jaiyadav_6-1751644602145

    Secure Access - Network Connections

    • Under Network Tunnel Groups click on + Add 

    jaiyadav_5-1751649192525

    Secure Access - Network Tunnel Groups

    • Configure Tunel Group Name , Region and Device Typ
    • Click Next

    jaiyadav_3-1751648958050

    Secure Access - Netwrok Tunnel Group - General Settings

    note-icon

    Note: Choose the region nearest to the location of your firewall.

    • Configure the Tunnel ID Fromat and Passphrase
    • Click Next

    jaiyadav_4-1751649004622

    Secure Access - Tunnel ID and Passphrase

    • Configure the IP address ranges, hosts or subnets that you have configured on your network and want to pass the traffic through Secure Acess 
    • Click Add
    • Click Save

    jaiyadav_6-1751649421997

    Secure Access - Tunnel Groups - Routing Options

    After you click on Save , the information about the tunnel gets displayed. Please save that information for next configuration step

    jaiyadav_7-1751649933792

    Secure Access - Data for Tunnel Setup

    Configure the Tunnel on Sonicwall

    Configure the Tunnel - Rules and Settings 

    Navigate to the Sonicwall Dashboard.

    •  Network  >  IPsec VPN > Rules and Settings
    • Click on + Add

    jaiyadav_2-1751811452903

    Sonicwall - IPSec VPN  - Rules and Settings 

    jaiyadav_9-1751813005156

    jaiyadav_5-1751811845933

    jaiyadav_7-1751812169597

    • Click on Save

    Add VPN Tunnel Interface

    Navigate to the Sonicwall Dashboard.

    • Network  > System  > Interface
    • Click on + Add Interface
    • Select VPN Tunnel Interface

    jaiyadav_10-1751813174619

    Sonicwall - Interfaces

    jaiyadav_0-1751816664786

    • Click  OK

    jaiyadav_1-1751816693820

    Sonicwall - Interfaces - VPN Tunnel Interface

    Add Network Object and Groups 

    Navigate to the Sonicwall Dashboard.

    •  Object  >  Match Objects >Addresses
    • Address Objects
    • Click on +Add

    jaiyadav_3-1751817085641

    Sonicwall - Object- Address Objects

    jaiyadav_11-1751817758943

    • Click Save

    jaiyadav_4-1751817192825

    • Click Save

    jaiyadav_5-1751817242442

    • Click Save
    • Create Address Groups
    • Click on +Add
    • Select the Address Object and add them into Address Groups

    jaiyadav_6-1751817341448

    Sonicwall - Object- Address Groups

    jaiyadav_7-1751817395341

    • Click Save

    Add Route

    Navigate to the Sonicwall Dashboard.

    • Policy > Rules and Policies > Routing Rules
    • Click on + Add 

    jaiyadav_2-1751816869720

    Sonicwall - Routing Rules

    • Add Routing rule 

    jaiyadav_0-1751820225973

    jaiyadav_9-1751817498989

    • Click on + Add

    jaiyadav_13-1751817890250

    Sonicwall - Routing Rules

    Add Access Rules

    Navigate to the Sonicwall Dashboard.

    • Policy > Rules and Policies > Access Rules
    • Click on + Add 

    jaiyadav_10-1751817624288

    Sonicwall - Access Rules

    jaiyadav_1-1751820509097

    • Click on +Add

    jaiyadav_16-1751818378251

    Sonicwall - Access Rules

    Verify

    • Tunnel Status on Secure Access

    jaiyadav_17-1751818687848

    Secure Access - Network Tunnel Group - VPN status

    • Tunnel Status on Sonicwall firewall

    jaiyadav_18-1751818774863

    Sonicwall - IPSec VPN status 

    You can do the same process to configure tunnel between Secure Access Secondary datacenter and Sonicwall

    Now , the tunnel is UP on Secure Access and Sonicwall, you can contiue configuring the access to the private resources via  RA-VPN , Broswer-Based ZTA, or Client Based ZTA on Secure Access Dashboard

    Troubleshoot

    User PC

    • Verify User is able to Connect/Enroll to RAVPN/ZTNA successfully or not. If not , troubleshoot further why control plane connection is failing.
    • Verify the Network that user is trying to access is supposed to go via RAVPN tunnel or ZTNA . If not , verify configuration on headend .

    Secure Access 

    •  Verify traffic steering configuration on RAVPN connection profile to confirm Destination network is configured to send over the tunnel to Secure Access.
    • Verify Private Resource is defined with valid protocol/ports and ZTNA/RAVPN connection mechanisms are checked.
    • Verify Access-policy is configured to allow RAVPN/ZTNA user to access Private Resource Network and its placed in an order that no other rule is taking precedence to block the traffic.
    • Verify IPSec tunnel is UP and Secure Access showing valid Client Routes via static routing which covers Private Resource that user is trying to access.

    Sonicwall

    • Verify IPSec tunnel is UP or not ( IKE & IPSec SA) .
    • Verify client route or routes are properly advertised.
    • Verify traffic sources from RAVPN/ZTNA user destined to private resource behind Sonicwall is reaching Sonicwall firewall through tunnel by taking packet capture on Sonicwall.
    • Verify traffic reached private resource and responding back to RAVPN/ZTNA client or not. If yes, verify those packets are  reaching Sonicall X0 (LAN)  interface.
    • Verify Sonicwall is forwarding the return traffic through IPSec tunnel towards Secure Access.

    Related Information

    Revision History

    Revision Publish Date Comments
    1.0
    19-Dec-2025
    Initial Release
    TAC Authored

    Contributed by Cisco Engineers

    • Jaikishan Yadav
      Technical Consulting Engineer

    Was this Document Helpful?

    FeedbackFeedback

    Contact Cisco

    This Document Applies to These Products