By looking at SonicWall Knowledge Base article Key exchange (DH) Groups Supported - Site to Site VPN:
It appears that our firewall supports DH group 25, and 26. Almost everywhere I've seen, they've recommended DH group 20-24 (we don't have DH group 24).
Should we use these groups? I don't understand how the ID of the DH group could be higher - using the same elliptical curve primitive - but use a 224-bit algorithm compared to our current 521-bit algorithm for DH group 21.
DH group 21 is also "only" a 512 bit algorithm compared to DH group 14, which is a 2048 bit algorithm. However I read that DH group 21 is still better than 14, because it uses elliptical curve.
EDIT: I've had a technical response vs a mathematical one below. It's appreciated, but a technical one helps me understand more given that we're configuring firewalls. The response is
"This group number is decided or is given by the IANA (Internet Assigned Numbers Authority).
The reason for these lower bit ECP groups to have the higher DH group number is that, the practical implementation (using a software code or a hardware chip) of the key creation and exchange mechanism was only available (or working) for 256, 384, 521 bit sizes. and that's why they were implemented first (in-order group 19, 20 and 21).
with improvements in technology and the methods with which we write the software code or create hardware chips, it allowed us to have working models for 192 and 224 bit Random ECP DH group and hence these were assigned a DH group number later.
Security wise, the 521 bit Random ECP group (DH Group-21) would still be on a higher side compared to 192 or 224 bit ECP group."