Generally this is pretty intuitive. Make sure your encryption and authentication types and groups match. It worked properly in IKE shared-secret mode.
The one place I got bit was that I had a Filter Set applied to the WAN interface. My set was attached to the Input stream only, and had a general all/DENY rule. This eats inbound VPN packets (although, oddly enough, not the negotiation part. I could establish a VPN tunnel, pass packets down it, but replies up to me got eaten).
The answer is to make sure that there is a ALL protocol ACCEPT rule with the IP address of the SS3.
This describes configuring an IKE shared-secret VPN between an R910 and a SonicWall firewall, which is the ancestor of the SuperStack3 firewall. It's stronger in some ways (uses Agressive Mode instead of Main Mode) but less so in others (it only does Group 1 encryption).