I am looking to do the following setup found here but I want to make sure the hardware I am looking to purchase will be compatible. The requirements of the hardware are listed here and the device I am looking at is the SonicWall TZ SOHO.

My first guess would be that they are but I have never done a VPN before.

  • Questions about product recommendations are off topic here. The AWS requirements are fairly standard of any device that supports IPSEC VPNs. It's always best to ask your vendor. – jwbensley May 28 '15 at 10:26
  • @jwbensley My apologies, this seemed like a good place for this post. I will ask my vendor next time I have a call with them. – Tom May 28 '15 at 13:33

It should work. The new TZ SOHO is in the same class as the TZ 105/205/100/200 range of products. SonicWALL has a technote detailing how to create a STATIC VPN tunnel for an Amazon VPC (Virtual Private Cloud) on AWS: https://support.software.dell.com/kb/sw10169

(points to a PDF to download, latest release is "D", which mentions the TZ 10x/20x line). It also mentions needing SonicOS 5.8, 5.9, 6.1 or 6.2, of certain sub-revisions, the SOHO will be either 5.9 or a 6.x SonicOS I believe. A new device will allow at least 90 days to download firmware updates.

Because the TZ series doesn't support BGP it will only be a Static IPSec VPN tunnel (must be in Tunnel not Policy mode). In your second link select "Example: Generic Customer Gateway (without BGP)" on the left as that is what you will be configuring to get an overview. Amazon will request some IP info from your side and then provide you with the specifics you will use. Then follow the PDF in the above link which shows how to configure the SonicWALL (see the section under "Configuring Amazon VPC with a Policy-Based VPN").

Others have done this, see: https://forums.aws.amazon.com/thread.jspa?messageID=381356#381356

If you have never configured VPNs before then I would suggest setting up a basic site-to-site VPN (between a SonicWALL and another SonicWALL perhaps) just to become familiar with what needs to be done (preferably in routed tunnel mode). The PDF has many screen shots and should be fairly easy to follow if you have configured a VPN on a SonicWALL before or if you're at least somewhat familiar with SonicWALL management and willing to try.

If you wanted a Dynamic BGP VPC to AWS you would either need a higher end SonicWALL or a different device (a Juniper/NetScreen SSG-5 is low-end but still supports BGP and works with Amazon for example).

  • Thank you for this response, it is very helpful. Just to clarify, what I want to do (vpn connection without the EC2 instance having internet) is possible? – Tom May 27 '15 at 19:27
  • Forgot to tag you in the above comment. – Tom May 28 '15 at 13:34
  • @Tom, I believe VPC and your EC2 instance in AWS are separate in that just because you can connect to VPC (a VPN over the internet) doesn't mean your EC2 instances can connect to the internet -- AWS has firewall controls for that (allowing traffic in/out, etc). [I have had EC2 VMs that had no internet access but I could access over a VPC VPN connection] – PSaul May 28 '15 at 15:51

You are going to want a virtual router (or a pair) such as Cisco CSR 1000v on the AWS side and a physical router (or a pair, sized here) on the remote office side.

Not the answer you're looking for? Browse other questions tagged or ask your own question.