6.5.13 SonicWall

Enable the SonicOS API and target the correct VPN service or policy

CertKit provides SonicOS 7.x templates for SSL VPN and certificate-authenticated IPsec VPN policies. Both import a password-protected PFX through the SonicOS API and commit the change.

Requirements

  • Enable API access on the SonicWall.
  • Use a SonicWall administrator account with API access.
  • Allow HTTPS management access from the agent host.
  • Include the management port in SonicWall management IP/hostname when it is not 443, for example 192.168.1.1:4443.

SSL VPN

The SonicWall Firewall: SSL VPN template imports the PFX, selects it as the SSL VPN certificate, and commits the configuration. It does not change certificates used by unrelated management or VPN services.

IPsec VPN

The SonicWall Firewall: IPSec VPN template requires an existing VPN policy that already uses certificate authentication.

Set:

  • IPSec VPN policy / Security Association name to the exact existing policy name.
  • IPSec VPN policy type to site-to-site or tunnel-interface, matching the existing policy.

The template does not convert a preshared-key policy to certificate authentication and does not create a missing VPN policy.

Common problems

  • API authentication fails: confirm API access is enabled for the appliance and administrator.
  • Policy not found: verify both the policy name and policy type.
  • Certificate imports but VPN still uses the old certificate: confirm the deployment used the template for that VPN type and targeted the active policy.
  • Management connection fails: verify the custom management port and access rules from the agent host.

For a product overview, see certificate automation for SonicWall.