---
title: "Setting up site-to-site on SonicWall"
slug: "site-to-site-sonicwall"
description: "Site-to-Site creation is required to create a new VPN policy.If your device/service supports SHA256 and DH group 14, it is recommended to use these settings instead."
status: "update"
updated: 2026-09-08T13:09:05Z
published: 2026-09-08T13:09:05Z
canonical: "help.nordlayer.com/site-to-site-sonicwall"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.nordlayer.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Setting up site-to-site on SonicWall

**Note**: If your device/service supports SHA256 and DH group 14, it is recommended to use these settings instead.

## Creating objects in SonicWall

1. Go to Objects in SonicWall
2. Go to Address Object
3. Select Add
4. Add the IP of your NordLayer server with a dedicated IP

![SonicWall address object configuration showing NordLayer VPN zone with host type and IP address fields](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/01%20Setting%20up%20site-to-site%20on%20SonicWall(1).png)

- **Name**: Give the object a name "NordLayer-Gateway"
- **Zone Assignment**: VPN
- **Type**: Host
- **IP Address**: Put the IP of your NordLayer server with a dedicated IP

1. Add NordLayer Subnet Network (10.6.0.0)

![SonicWall address object creation showing NordLayer VPN network type with subnet and netmask configuration](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/02%20Setting%20up%20site-to-site%20on%20SonicWall(1).png)

- **Name**: Give the object a name: "NordLayer-Network"
- **Zone Assignment**: VPN
- **Type**: Network
- **Network**: put 10.6.0.0
- **Netmask/Prefix Length**: put 255.255.240.0

## Access Rule

1. Go to Policy:-> Rules
2. Select Add
3. First Rule to add: VPN to WAN

![SonicWall firewall rule settings showing VPN to WAN allow policy with source and destination configuration](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/03%20Setting%20up%20site-to-site%20on%20SonicWall(1).png)

- **Policy Name**: NordLayer-WAN
- **Action**: Allow
- **From**: VPN
- **To**: WAN
- **Source Port**: Any
- **Service**: Any
- **Source**: NordLayer-Gateway object
- **Destination**: Your external internet interface object
- Select **Add**.

## Second Rule: VPN to LAN

![SonicWall firewall rule settings showing VPN to LAN allow policy with network and user configuration](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/04%20Setting%20up%20site-to-site%20on%20SonicWall(1).png)

- **Policy Name**: NordLayer-LAN
- **Action**: Allow
- **From**: VPN
- **To**: LAN
- **Source** Port: Any
- **Service**: Any
- **Source**: NordLayer: Network object
- **Destination**: Your internal subnet object
- Select **Add**.

## Site-to-Site creation

1. Go to VPN
2. Under Base Settings add VPN Policy; Open General Tab:

![SonicWall site-to-site VPN general settings showing IKE authentication with pre-shared key configuration](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/05%20Setting%20up%20site-to-site%20on%20SonicWall(1)(1).png)

### Security Policy

- **Policy Type**: Site to Site
- **Authentication Method**: IKE using Preshared Secret
- **Name**: Give it name ex. "NordLayer-Office"
- **IPsec Primary Gateway Name or Address**: put your NordLayer gateway address
- **IPsec Secondary Gateway Name or Address**: leave blank

### IKE Authentication

- **Shared Secret**: generate a key (we will also need this value on our end)
- **Confirm Secret**: put the secret again
- **Local IKE ID**: "IPv4 Address: put your public office IP address
- **Peer IKE ID**: "IPv4 Address:" put the IP of your NordLayer server with a dedicated IP

## Network Tab

![SonicWall VPN network settings showing local and remote network selection dropdown menus](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/06%20Setting%20up%20site-to-site%20on%20SonicWall(1).png)

### Local Networks

- Select a local network from the list: choose your local network object

### Remote Networks

- Select the destination network from the list: choose NordLayer-Network object

## Proposals Tab

![SonicWall VPN proposals tab showing IKE Phase 1 and IPsec Phase 2 encryption configuration](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/07%20Setting%20up%20site-to-site%20on%20SonicWall%20copy(1).png)

### IKE (Phase 1) Proposal

- **Exchange**: Main Mode
- **DH Group**: Group 2 (Group 14 recommended if your device supports it)
- **Encryption**: AES-256
- **Authentication**: SHA1 (SHA256 recommended if your device supports it)
- **Life Time (seconds)**: 28800

### IPsec (Phase 2) Proposal

- **Protocol**: ESP
- **Encryption**: AES-256
- **Authentication**: SHA1 (SHA256 recommended if your device supports it)
- Mark **v** for "Enable Perfect Forward Security"
- **DH Group**: Group 2 (Group 14 recommended if your device supports it)
- **Life Time (seconds)**: 3600

## Advanced Tab

![SonicWall VPN advanced settings showing management protocols, gateway options, and WAN zone binding configuration](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/08%20Setting%20up%20site-to-site%20on%20SonicWall(1).png)

### Advanced Setting

1. Mark v in Enable Keep Alive.
2. Select OK to create the new VPN Policy

![SonicWall VPN policies page showing two GroupVPN entries enabled with active tunnels status displayed](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/09%20Setting%20up%20site-to-site%20on%20SonicWall(1).png)

Make sure the new Policy you created is enabled. You can select the play button right to the Currently Active VPN Tunnels and you should see that your new tunnel is up. If the tunnel won't start you should go to Event Logs and look for errors regarding the new VPN policy you created.

## Ending note:

In order to finalize the site-to-site tunnel, please create a setup in [Sites tab of the NordLayer Control Panel](/v1/docs/site-to-site).

- Pre-shared key - you can generate it or we can provide it
- Encryption  details (AES, SHA and DH group) - AES256, SHA256 and DH group 14 are recommended (also must support [IKEv2](https://nordlayer.com/learn/vpn/ikev2/))
- Remote gateway/router public IP (must be reachable while connected to the server with a dedicated IP)
- Remote subnet and mask (the subnet is used in your local network)

---

**Note**: In case you have any questions or issues, press '**Chat with support**' at the bottom of the page.