Dell Networking Wired, Wireless and Security Solutions Lab

Dell Enterprise User Forum: NHOL4
Dell Networking Wired, Wireless and
Security Solutions Lab

W-Series Instant Access Points SonicWALL TZ Series Firewalls
X-Series Smart Managed Switches
Dell Gear You will use in the Lab

Lab Setting
• Each of your Stations
– Represents an office or branch
within a larger business
› (or an individual office for a smaller
business)
– Guest & Employee at each
location
– Wireless, Wired, Firewall at
each location
Headquarters
Offices

Lab Agenda & Plan
• Administrator GUIs for
W-Instant, X-Series, and
SonicWALL
• Setup key interfaces and
features
• Test the resulting access
connectivity and
security set up in the lab

Lab Flow
Configure
•Configure X-Series switch
– VLANs for Employee and Guest
– Assign VLANs to ports
•Configure SonicWALL
– Interfaces and site-to-site VPN
•Configure Wireless Access Point
– Guest and Employee access
Test
•Test Guest access
– Access “internet”
– Blocked access to corporate data center
•Test Employee access
– Access “internet”
– Access corporate data center through VPN
•Enable App Control
– Test image files are identified by signature
and blocked

Notes
•Configurations are for demonstration purposes only
•Chrome is the default browser for all configuration tasks
•Wireless authentication used is WPA2-PSK (pre-shared key)
– W-Instant Access Points are capable of enterprise 802.1x authentication.
•Internet access is simulated
– Public internet is simulated with a single subnet, and a webserver hosting a custom
“public” website.
– Corporate Data Center is simulated with a separate webserver hosting a custom “private”
website.

Administrator network
• This lab can be fully configured through the admin
network
• Access through SSID: stationX_admin
• Click on WLAN icon in toolbar, select the admin
network according to your station number
• password “dell1234”
Lab stations are numbered 1 thru 8.
Several configuration settings use the lab station numbers
• example: Subnets 172.20.X.1 and 10.1.100.X
• Wireless SSIDs: E_TestX and G_TestX
Replace X with station
number (see lab guide)

Dell World User Forum: NHOL4 Session
Dell Networking Wired, Wireless and Security
Solutions Lab
Step-by-Step Lab Guide
Dell Network Solutions Engineering
October 2015

2
Revisions
Date Description Authors
October 2015 Initial release Colin King, Neal Beard
©2015 Dell Inc., All rights reserved.
Except as stated below, no part of this document may be reproduced, distributed or transmitted in any form or by any
means, without express permission of Dell.
You may distribute this document within your company or organization only, without alteration of its contents.
THIS DOCUMENT IS PROVIDED “AS-IS”, AND WITHOUT ANY WARRANTY, EXPRESS OR IMPLIED. IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE SPECIFICALLY DISCLAIMED.
PRODUCT WARRANTIES APPLICABLE TO THE DELL PRODUCTS DESCRIBED IN THIS DOCUMENT MAY BE FOUND
AT: http://www.dell.com/learn/us/en/vn/terms-of-sale-commercial-and-public-sector-warranties Performance of
network reference architectures discussed in this document may vary with differing deployment conditions, network
loads, and the like. Third party products may be included in reference architectures for the convenience of the reader.
Inclusion of such third party products does not necessarily constitute Dell’s recommendation of those products.
Please consult your Dell representative for additional information.
Trademarks used in this text:
Dell™, the Dell logo, Dell Boomi™, Dell Precision™ ,OptiPlex™, Latitude™, PowerEdge™, PowerVault™,
PowerConnect™, OpenManage™, EqualLogic™, Compellent™, KACE™, FlexAddress™, Force10™ and Vostro™ are
trademarks of Dell Inc. Other Dell trademarks may be used in this document. Cisco Nexus®, Cisco MDS®, Cisco NX-
0S®, and other Cisco Catalyst® are registered trademarks of Cisco System Inc. EMC VNX®, and EMC Unisphere® are
registered trademarks of EMC Corporation. Intel®, Pentium®, Xeon®, Core® and Celeron® are registered trademarks
of Intel Corporation in the U.S. and other countries. AMD® is a registered trademark and AMD Opteron™, AMD
Phenom™ and AMD Sempron™ are trademarks of Advanced Micro Devices, Inc. Microsoft®, Windows®, Windows
Server®, Internet Explorer®, MS-DOS®, Windows Vista® and Active Directory® are either trademarks or registered
trademarks of Microsoft Corporation in the United States and/or other countries. Red Hat® and Red Hat® Enterprise
Linux® are registered trademarks of Red Hat, Inc. in the United States and/or other countries. Novell® and SUSE® are
registered trademarks of Novell Inc. in the United States and other countries. Oracle® is a registered trademark of
Oracle Corporation and/or its affiliates. Citrix®, Xen®, XenServer® and XenMotion® are either registered trademarks
or trademarks of Citrix Systems, Inc. in the United States and/or other countries. VMware®, Virtual SMP®, vMotion®,
vCenter® and vSphere® are registered trademarks or trademarks of VMware, Inc. in the United States or other
countries. IBM® is a registered trademark of International Business Machines Corporation. Broadcom® and
NetXtreme® are registered trademarks of Broadcom Corporation. Qlogic is a registered trademark of QLogic
Corporation. Other trademarks and trade names may be used in this document to refer to either the entities claiming
the marks and/or names or their products and are the property of their respective owners. Dell disclaims proprietary
interest in the marks and names of others.

3
Table of contents
Revisions............................................................................................................................................................................................. 2
1 Dell Networking Wired, Wireless and Security Solutions Lab............................................................................................4
1.1 Dell Networking X-Series Smart Managed Switches................................................................................................4
1.2 Dell SonicWALL TZ300 Firewall....................................................................................................................................4
1.3 Dell Networking W-Series Instant Access Points, W-IAP205 ................................................................................. 5
1.4 Lab Description and Diagram ....................................................................................................................................... 5
2 Dell Networking X-Series Configuration ............................................................................................................................... 7
3 Dell Networking SonicWALL Firewall Configuration.........................................................................................................20
4 Dell Networking W-IAP205 Wireless Configuration..........................................................................................................27
5 Dell Networking Testing and Validation ..............................................................................................................................35
A Important Lab IP Address Information.................................................................................................................................46
B Lab Notes: .................................................................................................................................................................................47

4
1 Dell Networking Wired, Wireless and Security Solutions Lab
1.1 Dell Networking X-Series Smart Managed Switches
Dell Networking X-Series 1008 and 1018P
The Dell Networking X-Series is a family of smart managed 1GbE and 10GbE Ethernet switches designed
for those who need enterprise-class network control fused with consumer-like ease.
Features Demonstrated in this lab
 Managed mode with GUI
 Setup VLANs and interface IPs
 Trunk mode on interface to wireless access points
 DHCP server
 PoE/PoE+ interface powering for wireless access points
1.2 Dell SonicWALL TZ300 Firewall
Dell SonicWALL TZ300
Dell SonicWALL TZ series firewalls are high-performance, enterprise-grade network security solutions. Dell
SonicWALL products encompass enterprise grade network protection that includes anti-malware,
intrusion prevention, application control and content/URL filtering
Network Security with focus on:
 Application Control
 VPN – Site to Site

5
1.3 Dell Networking W-Series Instant Access Points, W-IAP205
Dell Networking W-IAP205
W-Series access points maximize mobile device performance in enterprise WiFi environments.
 Employee and Guest wireless access with policies
 Captive portal with authentication
1.4 Lab Description and Diagram
This lab demonstrates employee and guest wireless access with policies and content filtering. Each station
represents a remote site, incorporating security, switching, and wireless devices.
Lab attendees will start from a base configuration with some pre-configured settings to enable the
features highlighted in the preceding pages.
In this lab, attendees will become experts in:
 Experience with the administrator GUIs
 Setup key interfaces and features
 Tested connectivity and security

7
2 Dell Networking X-Series Configuration
Dell Networking X-Series 1008 and 1018P
Objectives:
Configure employee VLAN 20
o Assign vlan to ports 7 and 8
o Assign vlan interface an IP address
 Configure guest VLAN 30
o Assign vlan to ports 5 and 6
o Assign vlan interface an IP address
 Define a static default route to the employee interface on the SonicWALL
Step 1
Connect to the wireless network for your station number SSID: “stationX_admin” (X is the station
number). Password: dell1234
Launch the Chrome browser and type in 192.168.2.1 to browse to the X-Series login page. Login with
username and password of admin/admin and hit enter.

8
Step 2
In the X-Series Dell Networking Administrator GUI Dashboard view, click on the VLAN radio button under
the Configure menu on the right hand side of the screen. This will launch the VLAN wizard and allow the
Guest and Employee VLANs to be configured.
Step 3
In the VLAN wizard, choose Configure VLAN and click Next.
Step 4
Click on the +Add button to add the Employee VLAN 20

9
Step 5
Enter 20 in the VLAN ID field and Employee in the VLAN Name field and click Ok.
Step 6
Click the +Add button to add the Guest VLAN 30
Step 7
Enter 30 in the VLAN ID field and Guest in the VLAN Name field and click Ok.

10
Step 8
After creating VLAN’s 20 and 30 for the Employee and Guest networks, click Next to review the VLANs
created.
Step 9
After confirming that the VLAN numbering and names are correct click Apply to assign ports to the VLANs

11
Step 10
After clicking the Apply button in Step. 9, the assign ports to VLAN wizards is launched. Click Yes to
confirm that assigning ports to VLANS is the next task.
Step 11
Click on ports 7 and 8 (highlights blue), click on Vlan ID 20 then choose Next.

12
Step 12
Review that the correct ports are assigned to the correct Vlan ID then click Apply.
Step 13
In the X-Series Dell Networking Administrator GUI Dashboard view, click on the VLAN radio button under
the Configure menu on the right hand side of the screen. This will launch the VLAN wizard and allow ports
5 and 6 to be assigned to the Employee Vlan 30.

13
Step 14
Select Configure and Assign Ports to VLAN and click Next
Step 15
Click on ports 5 and 6, click on Vlan ID 30 then choose Next.

14
Step 16
Review that the correct ports are assigned to the correct Vlan ID then click Apply.
Now that the Guest and Employee VLANs have been created and ports have been assigned the next step is
to assign an IP address to each Vlan interface.
Step 17
From the X-Series Dashboard main menu click on Switch Management then click on IPv4 Addressing. In
the IPv4 Addressing menu VLAN1 is assigned the current management IP address, click on the Edit icon on
the right hand side of the screen to start assigning IP addresses to the Guest and Employee VLANs.

15
Step 18
Click on the +Add button
Step 19
In the Add IPv4 Addressings page for the Employee Vlan 20:
 Interface Type: VLAN
 Interface: 20
 IP Address Source: Static
 IP address: 172.20.X.1 (X is station number)
 Address Class: Prefix Length
 Prefix Length: 24
Finally in the Apply to: field use the drop down arrow and pick Running and Startup Configuration then
click on Ok.

16
Step 20
Click on Edit again, then +Add icon to add the IP interface to Guest Vlan 30
Step 21
In the Add IPv4 Addressings page for the Guest Vlan 30:
 Interface Type: VLAN
 Interface: 30
 IP Address Source: Static
 IP address: 172.30.X.1 (X is station number)
 Address Class: Prefix Length
 Prefix Length: 24
click on Ok.

17
Step 22
In the IPv4 Addressing page confirm that the correct IP addresses have been assigned to the correct VLAN
interfaces. To exit this menu click on the Menu > navigation link then click on the Dashboard navigation
link.
Step 23
Now that the Vlans have had an IP address assigned to them the final step in the X-Series configuration is
to assign a default static route that will allow a public address to route through the SonicWALL TZ300. In
order to navigate to the IPv4 Route Settings, from the main Dashboard menu click on Network
Administration, then click on Route Settings, then click on IPv4 Route Settings. In order to set a default
station route click on the Edit icon. (IPv4 routes list is shown below, hit down arrow to reveal if desired)

18
Step 24
In the Add IPv4 Routes Table page:
 Destination IPv4 Prefix: 0.0.0.0
 Network Mask: 0.0.0.0
 Route Type: Remote
 Next Hop: 172.20.X.2 (X is station number)
click on Ok.
Step 25
In the Edit IPv4 Routes Table page confirm that the static default route is input correctly, then click on the
X to exit this menu.

19
Step 26
The final step in the X-Series lab configuration will be to save all the switch settings to the Startup
Configuration. Click on the Gear Icon in the upper right corner and then click on Save to Startup
Configuration.

20
3 Dell Networking SonicWALL Firewall Configuration
Dell Networking SonicWALL TZ300
Objectives:
 Configure the X3 interface
o Assign a Employee ip address
o Assign this interface to a VPN
 Configure the X4 interface
o Assign a Guest ip address
 Set the VPN to allow the X3 interface
Step 1.
Launch the Chrome browser and type in 192.168.2.2 to browse to the SonicWALL login page. Login with
username and password of admin/password and hit enter.
Note: If the Chrome browser flashes the warning: “Your connection is not private”. Click on the
Advanced link and then click on Proceed to 192.168.2.2 (unsafe).

21
Step 2
In the SonicWALL browser interface, click on Network then click on Interfaces. In the Interfaces section
click on the Configure icon to the far right of the X3 interface.
Step 3
In the Edit Interface applet window, Under the General Tab click on the Unassigned field across from
Zone: and choose LAN

22
Step 4
Once LAN is chosen for the Zone, the next menu choices are:
 Mode / IP Assignment: Static IP Mode
 IP Address: 172.20.X.2 (X is station number)
 Subnet Mask: 255.255.255.0
 Management: HTTPS and Ping
Once all the values are entered click Ok, this will return you back to the Interfaces section.

23
Step 5
In the SonicWALL browser interface, click on Network then click on Interfaces. In the Interfaces section
click on the Configure icon to the far right of the X4 interface.
Step 6
In the Edit Interface applet window, Under the General Tab click on the Unassigned field across from
Zone: and choose LAN. (see picture in Step 3 above)
Step 7
Once LAN is chosen for the Zone, the next menu choices are:
 Mode / IP Assignment: Static IP Mode
 IP Address: 172.30.X.2 (X is station number)
 Subnet Mask: 255.255.255.0
 Management: HTTPS and Ping
Once all the values are entered click Ok, this will return you back to the Interfaces section.

24
Step 8
Next go down the menu to VPN and click on the Add button.
Step 9
In the General tab under Security Policy enter the following values:
 Policy type: Site to Site
 Authentication Method: IKE using Preshared Secret
 Name: To_Corporate
 IPsec Primary Gateway Name or Address: 10.1.100.200
In the IKE Authentication section enter the following values:
 Shared Secret: dell
 Confirm Shared Secret: dell
 Local IKE ID: 10.1.100.X (X is station number)
 Peer IKE ID: 10.1.100.200
Do not click OK, Continue with Step 10.

25
Step 10
Once all the values have been entered on the General tab, click on the Network tab.
Local Networks section: Choose local network from list: X3 Subnet
Remote Networks section: Choose destination network from list: click on the Select Remote Network
drop down arrow and select create new address object
Step 11
When create new address object is selected this generates a new applet window. In this applet window
enter:
 Name: Corporate
 Zone Assignment: LAN
 Type: Network
 Network: 172.20.100.0
 Netmask/Prefix Length:
255.255.255.0
Once these values have been entered click Ok

26
Step 12
Once the values have been properly entered in the Network tab section (Do not click Ok), click on the
Advanced tab and check the box next to Enable Keep Alive. Click Ok.
Step 13
Once the VPN values have been entered and you have clicked Ok in the Advanced tab, the SonicWall GUI
will return to the main VPN interface. In the main VPN interface we can see that VPN Policy is green or
healthy. In the Currently Active VPN Tunnels section, we can see that the VPN policy To_Corporate is
listed.

27
4 Dell Networking W-IAP205 Wireless Configuration
Dell Networking W-Series W-IAP205
Objectives:
 Configure the Employee WLAN
 Configure the Guest WLAN
 Set the VPN
Step 1
Launch the Chrome browser and type in 192.168.2.10X (X is station number) to browse to the W-IAP205
login page. Login with username and password of admin/admin and hit enter.

28
Note: If the Chrome browser flashes a warning “Your connection is not private”. Click on the Advanced
link and then click on Proceed to 192.168.2.2 (unsafe).
Step 2
In the W-IAP205 main page under the Network menu click on New

29
Step 3
In this step the Employee wireless network will be created. After clicking on New, a New WLAN window
will be launched. In this New WLAN window enter in the name or SSID of the Employee network. For each
assigned station the name will be E_TestX (X will be replaced with the assigned station number). Once the
name has been entered click Next.

30
Step 4
Under Client IP and VLAN Assignment:
 Client IP assignment: Network assigned
 Client VLAN assignment: Static
 VLAN ID: 20
Click Next to go to the Security section.
Step 5
In the Security section enter:
 Passphrase: dell1234 Retype: dell1234
Click Next

31
Step 6
Click Finish to return to the main menu.
Step 7
In the W-IAP205 main page under the Network menu click on New

32
Step 8
In this step the Guest wireless network will be created. After clicking on New, a New WLAN window will be
launched. In this New WLAN window enter in the name or SSID of the Guest network. For each assigned
station the name will be G_TestX (X will be replaced with the assigned station number). Once the name
has been entered go to Primary Usage and choose Guest click Next to continue.
Step 9
In the VLAN section under Client VLAN assignment choose Custom. In the drop down menu next to
Custom choose guest (vlan:30). Click Next to continue.

33
Step 10.
In the Security section choose:
 Encryption: Enabled
 Key management: WPA-2 Personal (default setting)
 Passphrase: dell1234
 Retype: dell1234
 Redirect URL: http://10.1.100.101
Click Next to continue.

34
Step 11
In the final Access Rules section click Finish.
Step 12.
In the main W-Series Instant IAP page we can see that both WLAN networks have been successfully
configured.

35
5 Dell Networking Testing and Validation
Now that the networking equipment has been configured to allow guest and employee access to their
online resources, we will test and validate the areas of concern.
Step 1
Connect to the G_TestX (X is station number) WLAN in Windows Network and Sharing Center. Once you
have connected, open chrome and enter the ip address 1.1.1.1 (or any other ip address). This demonstrates
the fact that the IAP will redirect the guest user to the IAP captive portal splash page on any access
attempt. Click on Accept and you will be redirected to the public internet site of the Guest network.

36
Step 2
By accessing this website, this proves that the Guest network on the IAP can reach the internet through
the X-Series switch and the SonicWALL firewall. The ip address 10.1.100.101 in the Chrome url bar is the
same ip address entered in for the URL Redirect on the Security tab for step 10 during the IAP Guest
network configuration. This setting can also be used to direct to an internal home page.

37
Step 3
In the Chrome browser enter the ip address 172.20.100.100. This is the corporate data center web server
for the Employee network, accessed through the VPN. This webpage will not be accessible by the Guest
user due to the topology of this lab configuration. Administrators can further protect their network by
implementing policies and zones within the firewall.

38
Step 4
Disconnect from the Guest network (G_TestX) WLAN and connect to the Employee network (E_TestX)
WLAN. Open the chrome browser, enter the ip address 172.20.100.100 if it is not already there. This ip
address allows employee to access to the internal data center web server.

39
Step 5
Enter the ip address 10.1.100.101. This is the same public internet site that the Guest users were able to
access.
Step 6
Login to the SonicWALL TZ300 admin page at the ip address 172.20.X.2 (X is station number)
Reminder> username:admin password:password
On the menu click on Firewall, then go to App Control Advanced. Under App Control Global Settings
 Check Enable App Control
 Check Enable Logging For All Apps
Click Accept.
Note: the ip management interface was enabled for all three interfaces, admin, employee, and guest.

40
Step 7
TIME CHECK- The app control policy has already been configured for you. If you have time, follow steps
7, 8, and 9 to discover what the policy settings look like. If you’re limited on time, skip to step 10.
In the App Control Page, scroll down to App Control Advanced and click on the Category drop down
menu. Choose FILETYPE-DETECTION, click on the Configure icon for Image.

41
Step 8
In the Image configuration settings:
 Block: Enable
 Log: Enable
 Included Users/Groups: All (Admin, Employee, and Guest)
 Included IP Address Range: All
Click Cancel when you are finished reviewing the settings.

42
Step 9
Under the App Control Advanced section, in View Style: click on the Application drop down menu and
choose Image, next click on the Viewed By: drop down menu and choose Signature. We can now see
what image file types the advanced app control is filtering or blocking.

43
Step 10
Logout of the SonicWALL. Open a new browser window. In the Chrome browser click on the Clear Cache
button on the bookmark bar then click on the Clear browsing data button.

44
Step 11
In the Chrome URL field enter the ip address 10.1.100.101. With the SonicWALL firewall image app control
enabled the .gif and .jpg images on the public internet web page are being blocked.

45
Step 12.
Log back in to the SonicWall firewall. In the SonicWALL menu scroll down to Log, click on it to expand its
sub-menu choices and then click on Log Monitor. In the Log Monitor entries, there will be two
Application Control Firewall Alerts for GIF and JPEG HTTP download attempts.

46
A Important Lab IP Address Information
X-Series Switch SonicWALL W-Series Instant
X-1008P/1018P TZ300 W-IAP205
Management
IP address
Management
IP address
Management
IP address
Station 1 192.168.2.1 192.168.2.2 192.168.2.101
Station 2 192.168.2.1 192.168.2.2 192.168.2.102
Station 3 192.168.2.1 192.168.2.2 192.168.2.103
Station 4 192.168.2.1 192.168.2.2 192.168.2.104
Station 5 192.168.2.1 192.168.2.2 192.168.2.105
Station 6 192.168.2.1 192.168.2.2 192.168.2.106
Station 7 192.168.2.1 192.168.2.2 192.168.2.107
Station 8 192.168.2.1 192.168.2.2 192.168.2.108
X-Series Switch SonicWALL
X-1008P/1018P TZ300
Employee
VLAN 20 interface
IP address
Employee
VLAN 20 interface
IP address
Station 1 172.20.1.1 172.20.1.2
Station 2 172.20.2.1 172.20.2.2
Station 3 172.20.3.1 172.20.3.2
Station 4 172.20.4.1 172.20.4.2
Station 5 172.20.5.1 172.20.5.2
Station 6 172.20.6.1 172.20.6.2
Station 7 172.20.7.1 172.20.7.2
Station 8 172.20.8.1 172.20.8.2
X-Series Switch SonicWALL
X-1008P/1018P TZ300
Guest
VLAN 30 interface
IP address
Guest
VLAN 30 interface
IP address
Station 1 172.30.1.1 172.30.1.2
Station 2 172.30.2.1 172.30.2.2
Station 3 172.30.3.1 172.30.3.2
Station 4 172.30.4.1 172.30.4.2
Station 5 172.30.5.1 172.30.5.2
Station 6 172.30.6.1 172.30.6.2
Station 7 172.30.7.1 172.30.7.2
Station 8 172.30.8.1 172.30.8.2

Dell Networking Wired, Wireless and Security Solutions Lab

More Related Content

What's hot (20)

Viewers also liked (14)

Similar to Dell Networking Wired, Wireless and Security Solutions Lab (20)

More from Dell World (20)

Recently uploaded (20)

Dell Networking Wired, Wireless and Security Solutions Lab