Sonic os standard_3_9_administrators_guide

COMPREHENSIVE INTERNET SECURITY

SonicWALL Internet Security Appliances

SonicOS Standard 3.9
Administrator’s Guide

Chapter : Table of Contents

Table of Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iii
Copyright Notice. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii
Trademarks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii
Limited Warranty . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xiv
About this Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xv
Organization of this Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xvi
Guide Conventions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvii
Icons Used in this Manual . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvii
Obtaining Technical Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xviii
More Information on SonicWALL Products . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xviii

PART 1: Introduction

Chapter 1: Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .23
SonicWALL Management Interface. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Navigating the Management Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Status Bar. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Applying Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Navigating Tables. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Common Icons in the Management Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Getting Help . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Logging Out . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

Chapter 2: Basic SonicWALL Security Appliance Setup . . . . . . . . . . . . . . . .27
SonicWALL Security Appliance Configuration Steps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Collecting Required ISP Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Internet Service Provider (ISP) Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Other Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Accessing the SonicWALL Security Appliance Management Interface. . . . . . . . . . . . . . . . 29
Using the SonicWALL Setup Wizard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Configuring a Static IP Address Internet Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Configuring a DHCP Internet Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Configuring a PPPoE Internet Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Configuring PPTP Internet Connectivity. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Registering Your SonicWALL Security Appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Before You Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Creating a mysonicwall.com Account. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Registering Your SonicWALL Security Appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

PART 2: System

Chapter 3: Viewing the SonicWALL Security Dashboard . . . . . . . . . . . . . . .41
System > Security Dashboard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
SonicWALL Security Dashboard Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Using the SonicWALL Security Dashboard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
Related Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

SONICWALL SONICOS STANDARD 3.9 ADMINISTRATOR’S GUIDE iii

Table of Contents

Chapter 4: Viewing System Status Information . . . . . . . . . . . . . . . . . . . . . . 53
System > Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Wizards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
System Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
System Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
Security Services. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Latest Alerts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Network Interfaces. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56

Chapter 5: System > Licenses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
System > Licenses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
Node License Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
Currently Licensed Nodes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
Node License Exclusion List . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
Security Services Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
Manage Security Services Online . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
Manual Upgrade . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
Manual Upgrade for Closed Environments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60

Chapter 6: Using System Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
System > Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Firewall Name . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
Name/Password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
Login Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
Web Management Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
Advanced Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66

Chapter 7: Setting System Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
System > Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Set Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
NTP Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70

Chapter 8: Configuring System Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
System > Settings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
Firmware Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
SafeMode - Rebooting the SonicWALL Security Appliance . . . . . . . . . . . . . . . . . . . . . . 73

Chapter 9: Performing Diagnostic Tests. . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
System > Diagnostics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
Tech Support Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
Diagnostic Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
Active Connections Monitor. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
CPU Monitor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
DNS Name Lookup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Find Network Path . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Packet Trace . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Ping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
Process Monitor. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
Reverse Name Resolution. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
Trace Route. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
System > Restart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82

iv SONICWALL SONICOS STANDARD 3.9 ADMINISTRATOR’S GUIDE

PART 3: Network

Chapter 10:Configuring Network Settings . . . . . . . . . . . . . . . . . . . . . . . . . . .85
Network > Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
Setup Wizard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
DNS Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
Configuring the WAN Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
Configuring Transparent Mode. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
Configuring NAT Enabled. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
Configuring NAT with DHCP Client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
Configuring NAT with PPPoE Client. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
Configuring NAT with L2TP Client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
Configuring NAT with PPTP Client. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
Configuring Ethernet Settings in WAN Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
Configuring the LAN Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
Basic LAN Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
Configuring Multiple LAN Subnets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
Configuring Ethernet Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
Route Advertisement - DMZ. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
Configuring WLAN Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96

Chapter 11: Configuring One-to-One NAT . . . . . . . . . . . . . . . . . . . . . . . . . . .99
Network > One-to-One NAT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
One-to-One NAT Configuration Example. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100

Chapter 12:Configuring Web Proxy Settings . . . . . . . . . . . . . . . . . . . . . . . .103
Network > Web Proxy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
Configuring Automatic Web Proxy Forwarding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
Bypass Proxy Servers Upon Proxy Failure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104

Chapter 13:Configuring Intranet Settings . . . . . . . . . . . . . . . . . . . . . . . . . . .105
Network > Intranet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
Intranet Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106

Chapter 14:Configuring Static Routes . . . . . . . . . . . . . . . . . . . . . . . . . . . . .107
Network > Routing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
Static Routes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
Route Advertisement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
Routing Table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110
Route Advertisement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
Routing Table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112

Chapter 15:Configuring Address Resolution Protocol Settings . . . . . . . . . .115
Network > ARP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
Static ARP Entries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116
Secondary Subnets with Static ARP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116
Prohibit Dynamic ARP Entries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118
Navigating and Sorting the ARP Cache Table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
Flushing the ARP Cache . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119

SONICWALL SONICOS STANDARD 3.9 ADMINISTRATOR’S GUIDE v

Table of Contents

Chapter 16:Configuring the DHCP Server . . . . . . . . . . . . . . . . . . . . . . . . . 121
Network > DHCP Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121
DHCP Server Settings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121
DHCP Server Lease Scopes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122
Configuring DHCP Server for Dynamic Ranges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122
Configuring Static DHCP Entries. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123
Current DHCP Leases. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124

Chapter 17:Configuring Dynamic DNS . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125
Network > Dynamic DNS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125
Supported DDNS Providers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125
Configuring Dynamic DNS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126
Dynamic DNS Settings Table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128

PART 4: Wireless

Chapter 18:Using the Wireless Wizard and Monitoring Your WLAN. . . . . . 133
Considerations for Using Wireless Connections. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134
Optimal Wireless Performance Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
Adjusting the Wireless Antennas. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
Wireless Guest Services (WGS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
Wireless Node Count Enforcement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136
MAC Filter List . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136
WiFiSec Enforcement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136
Using the Wireless Wizard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137
Wireless > Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140
WLAN Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141
WLAN Statistics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142
Station Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142

Chapter 19:Configuring Wireless Settings . . . . . . . . . . . . . . . . . . . . . . . . . 145
Wireless > Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
Wireless Radio Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
Wireless Settings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146
Secure Wireless Bridging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
Configuring a Secure Wireless Bridge. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148

Chapter 20:Configuring WEP and WPA Encryption . . . . . . . . . . . . . . . . . . 153
Wireless > WEP/WPA Encryption. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153
Authentication Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153
WEP Encryption Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154
WEP Encryption Keys . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154
WPA Encryption Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155
WPA/WPA2 Encryption Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156

Chapter 21:Configuring Advanced Wireless Settings . . . . . . . . . . . . . . . . . 159
Wireless > Advanced . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159
Beaconing & SSID Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159
Wireless Client Communications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160
Advanced Radio Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160

Chapter 22:Configuring the MAC Filter List . . . . . . . . . . . . . . . . . . . . . . . . 163
Wireless > MAC Filter List . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163

vi SONICWALL SONICOS STANDARD 3.9 ADMINISTRATOR’S GUIDE

Chapter 23:Configuring Wireless IDS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .165
Wireless > IDS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165

PART 5: Wireless Guest Services

Chapter 24:Viewing Wireless Guest Services Status . . . . . . . . . . . . . . . . . .171
WGS > Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171

Chapter 25:Configuring Wireless Guest Services . . . . . . . . . . . . . . . . . . . .173
WGS > Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173
Bypass Guest Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174
Bypass Filters for Guest Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174
Enable Dynamic Address Translation (DAT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174
Enable SMTP Redirect. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175
Enable URL Allow List for Authenticated Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175
Enable IP Address Deny List for Authenticated Users . . . . . . . . . . . . . . . . . . . . . . . . . . 176
Customize Login Page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177
Custom Post Authentication Redirect Page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177
Maximum Concurrent Guests. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178
WGS Account Profiles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178

Chapter 26:Managing Wireless Guest Accounts . . . . . . . . . . . . . . . . . . . . .181
WGS > Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181
Working with Guest Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181
Automatically Generating Guest Accounts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181
Manually Configuring Wireless Guests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183
Flexible Default Route . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184
Secure Access Point with Wireless Guest Services. . . . . . . . . . . . . . . . . . . . . . . . . . . . 185

PART 6: Firewall

Chapter 27:Configuring Network Access Rules . . . . . . . . . . . . . . . . . . . . . .189
Network Access Rules Overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189
Using Bandwidth Management with Access Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190
Firewall > Access Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190
Restoring Default Network Access Rules. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191
Adding Rules using the Network Access Rule Wizard . . . . . . . . . . . . . . . . . . . . . . . . . . 191
Configuring a Public Server Rule . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191
Configuring a General Network Access Rule . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192
Configuring Rules Using the Add Rule Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194
Rule Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196

Chapter 28:Configuring Advanced Rule Options . . . . . . . . . . . . . . . . . . . . .199
Access Rules > Advanced. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199
Windows Networking (NetBIOS) Broadcast Pass Through . . . . . . . . . . . . . . . . . . . . . . 199
Detection Prevention . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200
Source Routed Packets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200
TCP Connection Inactivity Timeout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200
TCP Checksum Validation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200
Access Rule Service Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200

SONICWALL SONICOS STANDARD 3.9 ADMINISTRATOR’S GUIDE vii

Table of Contents

Chapter 29:Configuring Custom Services. . . . . . . . . . . . . . . . . . . . . . . . . . 201
Firewall > Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201
User Defined (Custom) Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201
Predefined Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202

Chapter 30:Configuring VoIP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203
Firewall > VoIP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203
VoIP Overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203
Configuring the VoIP Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210
VoIP Deployment Scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212

Chapter 31:Monitoring Active Firewall Connections . . . . . . . . . . . . . . . . . . 217
Firewall > Connections Monitor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217
Setting Filter Logic. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218
Using Group Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218

PART 7: VPN

Chapter 32:Configuring VPN Settings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221
SonicWALL VPN Options Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221
VPN > Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222
VPN Global Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222
VPN Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222
Currently Active VPN Tunnels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223
Configuring GroupVPN Policy on the SonicWALL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223
Configuring IKE Preshared Secret . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224
Configuring GroupVPN with IKE 3rd Party Certificates . . . . . . . . . . . . . . . . . . . . . . . . . 228
Export a GroupVPN Client Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233
Site-to-Site VPN Configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233
Site-to-Site VPN Deployments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233
VPN Planning Sheet for Site-to-Site VPN Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234
Configuring Site-to-Site VPN Policies Using the VPN Policy Wizard . . . . . . . . . . . . . . 235
Creating a Typical IKE Preshared Secret VPN Policy. . . . . . . . . . . . . . . . . . . . . . . . . . 236
Creating a Custom VPN Policy IKE with Preshared Secret . . . . . . . . . . . . . . . . . . . . . 237
Creating a Manual Key VPN Policy with the VPN Policy Wizard . . . . . . . . . . . . . . . . . 238
Configuring IKE 3rd Party Certificates with the VPN Policy Wizard . . . . . . . . . . . . . . . 239
Creating Site-to-Site VPN Policies Using the VPN Policy Window . . . . . . . . . . . . . . . . 240

Chapter 33:Configuring Advanced VPN Settings . . . . . . . . . . . . . . . . . . . . 249
VPN > Advanced . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249
Advanced VPN Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249
VPN User Authentication Settings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250
VPN Bandwidth Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251

Chapter 34:Configuring DHCP Over VPN. . . . . . . . . . . . . . . . . . . . . . . . . . 253
VPN > DHCP over VPN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253
DHCP Relay Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253
Configuring the Central Gateway for DHCP Over VPN. . . . . . . . . . . . . . . . . . . . . . . . . 254
Configuring DHCP over VPN Remote Gateway . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254
Device Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 256
Current DHCP over VPN Leases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 256

viii SONICWALL SONICOS STANDARD 3.9 ADMINISTRATOR’S GUIDE

Chapter 35:Configuring L2TP Server Settings . . . . . . . . . . . . . . . . . . . . . . .259
VPN > L2TP Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259
L2TP Server Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 260
IP Address Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 260
Adding L2TP Clients to the SonicWALL. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 260
Currently Active L2TP Sessions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261

Chapter 36:Managing Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .263
Digital Certificates Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263
SonicWALL Third-Party Digital Certificate Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263
VPN > Local Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264
Importing Certificate with Private Key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264
Certificate Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264
Generating a Certificate Signing Request . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265
VPN > CA Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267
Importing CA Certificates into the SonicWALL. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267
Certificate Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267
Certificate Revocation List (CRL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 268

PART 8: Users

Chapter 37:Viewing User Status and Configuring User Authentication . . . .271
User Level Authentication Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271
Users > Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271
Active User Sessions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 272
Users > Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 272
Authentication Method . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 272
Global User Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273
Internet Authentication Exclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273
Acceptable Use Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 274
Configuring RADIUS Authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275

Chapter 38:Configuring Local Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .279
Users > Local Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279
Adding a Local User . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279

PART 9: Security Services
Chapter 39:Managing SonicWALL Security Services . . . . . . . . . . . . . . . . .283
SonicWALL Security Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 283
mysonicwall.com . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 284
Activating Free Trials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 284
Security Services > Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285
Security Services Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285
Manage Licenses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285
If Your SonicWALL Security Appliance is Not Registered . . . . . . . . . . . . . . . . . . . . . . . 286
Security Services Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 286
Security Services Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 287

SONICWALL SONICOS STANDARD 3.9 ADMINISTRATOR’S GUIDE ix

Table of Contents

Chapter 40:Configuring SonicWALL Content Filtering Service . . . . . . . . . . 289
SonicWALL Content Filtering Service. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289
Security Services > Content Filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 290
Content Filter Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 290
Activating SonicWALL Content Filtering Service. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 290
Activating a SonicWALL Content Filtering Service FREE TRIAL . . . . . . . . . . . . . . . . . 291
Content Filter Type . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 291
Restrict Web Features. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 292
Trusted Domains . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 292
CFS Exclusion List . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 293
Message to Display when Blocking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 293
Configuring SonicWALL Filter Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 293
URL List. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294
CFS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 295
Custom List . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 295
Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 297
Consent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 297
Mandatory Filtered IP Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 298

Chapter 41:Managing SonicWALL Anti-Virus and E-Mail Filter Services . . 301
SonicWALL Client/Server Anti-Virus. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 301
Security Services > Client AV Enforcement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 302
Activating SonicWALL Client/Server Anti-Virus. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 302
Activating a SonicWALL Client/Server Anti-Virus FREE TRIAL . . . . . . . . . . . . . . . . . . 303
Security Services > E-Mail Filter. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 303
Configuring SonicWALL Network Anti-Virus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 304

Chapter 42:Managing SonicWALL Gateway Anti-Virus Service . . . . . . . . . 305
SonicWALL Gateway Anti-Virus Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 305
SonicWALL Gateway Anti-Virus/Intrusion Prevention Features . . . . . . . . . . . . . . . . . . 306
Registering SonicWALL Gateway Anti-Virus. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306
Activating SonicWALL Gateway Anti-Virus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 307
Activating the SonicWALL Gateway Anti-Virus FREE TRIAL . . . . . . . . . . . . . . . . . . . . 307
Configuring SonicWALL Gateway Anti-Virus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 308
Applying SonicWALL GAV Protection on Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . 308
Viewing SonicWALL GAV Status Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 308
Updating SonicWALL GAV Signatures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 309
Specifying Protocol Filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 309
Enabling Inbound Inspection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 310
Enabling Outbound SMTP Inspection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 310
Restricting File Transfers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 310
Configuring Gateway AV Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 311
Configuring Client Alerts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 311
Configuring HTTP Clientless Notification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 311
Configuring a SonicWALL GAV Exclusion List . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 312
Viewing SonicWALL GAV Signatures. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 313
Displaying Signatures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 313
Navigating the Gateway Anti-Virus Signatures Table . . . . . . . . . . . . . . . . . . . . . . . . . . 313
Searching the Gateway Anti-Virus Signature Database . . . . . . . . . . . . . . . . . . . . . . . . 314

x SONICWALL SONICOS STANDARD 3.9 ADMINISTRATOR’S GUIDE

Chapter 43:Managing SonicWALL Intrusion Prevention Service . . . . . . . . .315
SonicWALL Intrusion Prevention Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 315
SonicWALL IPS Features. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 315
SonicWALL Deep Packet Inspection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 316
How SonicWALL’s Deep Packet Inspection Architecture Works . . . . . . . . . . . . . . . . . . 317
Security Services > Intrusion Prevention. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 318
Activating SonicWALL IPS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 318
Activating the SonicWALL IPS FREE TRIAL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 318

Chapter 44:Activating SonicWALL Anti-Spyware . . . . . . . . . . . . . . . . . . . . .321
SonicWALL Anti-Spyware Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 321
The Spyware Threat. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 321
SonicWALL Anti-Spyware Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 322
SonicWALL’s Unified Threat Management Solution . . . . . . . . . . . . . . . . . . . . . . . . . . . 322
SonicWALL Gateway Anti-Virus, Anti-Spyware and IPS Services. . . . . . . . . . . . . . . . . 323
How SonicWALL’s Deep Packet Inspection Works . . . . . . . . . . . . . . . . . . . . . . . . . . . . 325
Inbound and Outbound Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 326
Activating the SonicWALL Anti-Spyware License . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 326
Creating a mysonicwall.com Account. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 327
Registering Your SonicWALL Security Appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 328
Activating the SonicWALL Gateway Anti-Virus, Anti-Spyware, and IPS License. . . . . . 329
Activating FREE TRIALs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 331
Setting Up SonicWALL Anti-Spyware Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 331
Enabling SonicWALL Anti-Spyware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 332
Specifying Spyware Danger Level Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 332

PART 10: Log

Chapter 45:Viewing Log Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .337
SonicOS Log Event Messages Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 337
Log > View. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 338
Navigating and Sorting Log View Table Entries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 338
SonicOS Log Entries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 339

Chapter 46:Specifying Log Categories . . . . . . . . . . . . . . . . . . . . . . . . . . . . .341
Log > Categories . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 341
Log Categories . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 341
Alerts & SNMP Traps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 342

Chapter 47:Configuring Log Automation . . . . . . . . . . . . . . . . . . . . . . . . . . .343
Log > Automation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 343
E-mail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 344
Syslog Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 344

Chapter 48:Configuring Name Resolution . . . . . . . . . . . . . . . . . . . . . . . . . .347
Log > Name Resolution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 347
Selecting Name Resolution Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 348
Specifying the DNS Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 348

SONICWALL SONICOS STANDARD 3.9 ADMINISTRATOR’S GUIDE xi

Table of Contents

Chapter 49:Generating and Viewing Log Reports. . . . . . . . . . . . . . . . . . . . 349
Log > Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 349
Data Collection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 349
View Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 350
Log > ViewPoint . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 350
SonicWALL ViewPoint. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 351

Appendix A:Resetting the SonicWALL Security Appliance Using SafeMode353
SonicWALL SafeMode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 353
Upgrading SonicOS Firmware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 355

Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 357

xii SONICWALL SONICOS STANDARD 3.9 ADMINISTRATOR’S GUIDE

Chapter : Preface

Copyright Notice
© 2008 SonicWALL, Inc.

All rights reserved.

Under the copyright laws, this manual or the software described within, can not be copied, in whole or
part, without the written consent of the manufacturer, except in the normal use of the software to
make a backup copy. The same proprietary and copyright notices must be affixed to any permitted
copies as were affixed to the original. This exception does not allow copies to be made for others,
whether or not sold, but all of the material purchased (with all backup copies) can be sold, given, or
loaned to another person. Under the law, copying includes translating into another language or
format.

Specifications and descriptions subject to change without notice.

Trademarks
SonicWALL is a registered trademark of SonicWALL, Inc.

Microsoft Windows 98, Windows NT, Windows 2000, Windows XP, Windows Server 2003, Windows
Vista, Internet Explorer, and Active Directory are trademarks or registered trademarks of Microsoft
Corporation.

Netscape is a registered trademark of Netscape Communications Corporation in the U.S. and other
countries. Netscape Navigator and Netscape Communicator are also trademarks of Netscape
Communications Corporation and may be registered outside the U.S.

Adobe, Acrobat, and Acrobat Reader are either registered trademarks or trademarks of Adobe
Systems Incorporated in the U.S. and/or other countries.

Other product and company names mentioned herein may be trademarks and/or registered
trademarks of their respective companies and are the sole property of their respective manufacturers.

SONICWALL SONICOS STANDARD 3.9 ADMINISTRATOR’S GUIDE xiii

Preface

Limited Warranty
SonicWALL, Inc. warrants that commencing from the delivery date to Customer (but in any case
commencing not more than ninety (90) days after the original shipment by SonicWALL), and
continuing for a period of twelve (12) months, that the product will be free from defects in materials
and workmanship under normal use. This Limited Warranty is not transferable and applies only to the
original end user of the product. SonicWALL and its suppliers' entire liability and Customer's sole and
exclusive remedy under this limited warranty will be shipment of a replacement product. At
SonicWALL's discretion the replacement product may be of equal or greater functionality and may be
of either new or like-new quality. SonicWALL's obligations under this warranty are contingent upon the
return of the defective product according to the terms of SonicWALL's then-current Support Services
policies.

This warranty does not apply if the product has been subjected to abnormal electrical stress,
damaged by accident, abuse, misuse or misapplication, or has been modified without the written
permission of SonicWALL.

DISCLAIMER OF WARRANTY. EXCEPT AS SPECIFIED IN THIS WARRANTY, ALL EXPRESS OR
IMPLIED CONDITIONS, REPRESENTATIONS, AND WARRANTIES INCLUDING, WITHOUT
LIMITATION, ANY IMPLIED WARRANTY OR CONDITION OF MERCHANTABILITY, FITNESS FOR
A PARTICULAR PURPOSE, NONINFRINGEMENT, SATISFACTORY QUALITY OR ARISING
FROM A COURSE OF DEALING, LAW, USAGE, OR TRADE PRACTICE, ARE HEREBY
EXCLUDED TO THE MAXIMUM EXTENT ALLOWED BY APPLICABLE LAW. TO THE EXTENT AN
IMPLIED WARRANTY CANNOT BE EXCLUDED, SUCH WARRANTY IS LIMITED IN DURATION
TO THE WARRANTY PERIOD. BECAUSE SOME STATES OR JURISDICTIONS DO NOT ALLOW
LIMITATIONS ON HOW LONG AN IMPLIED WARRANTY LASTS, THE ABOVE LIMITATION MAY
NOT APPLY TO YOU. THIS WARRANTY GIVES YOU SPECIFIC LEGAL RIGHTS, AND YOU MAY
ALSO HAVE OTHER RIGHTS WHICH VARY FROM JURISDICTION TO JURISDICTION. This
disclaimer and exclusion shall apply even if the express warranty set forth above fails of its essential
purpose.

DISCLAIMER OF LIABILITY. SONICWALL'S SOLE LIABILITY IS THE SHIPMENT OF A
REPLACEMENT PRODUCT AS DESCRIBED IN THE ABOVE LIMITED WARRANTY. IN NO EVENT
SHALL SONICWALL OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER,
INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, BUSINESS
INTERRUPTION, LOSS OF INFORMATION, OR OTHER PECUNIARY LOSS ARISING OUT OF
THE USE OR INABILITY TO USE THE PRODUCT, OR FOR SPECIAL, INDIRECT,
CONSEQUENTIAL, INCIDENTAL, OR PUNITIVE DAMAGES HOWEVER CAUSED AND
REGARDLESS OF THE THEORY OF LIABILITY ARISING OUT OF THE USE OF OR INABILITY TO
USE HARDWARE OR SOFTWARE EVEN IF SONICWALL OR ITS SUPPLIERS HAVE BEEN
ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. In no event shall SonicWALL or its suppliers'
liability to Customer, whether in contract, tort (including negligence), or otherwise, exceed the price
paid by Customer. The foregoing limitations shall apply even if the above-stated warranty fails of its
essential purpose. BECAUSE SOME STATES OR JURISDICTIONS DO NOT ALLOW LIMITATION
OR EXCLUSION OF CONSEQUENTIAL OR INCIDENTAL DAMAGES, THE ABOVE LIMITATION
MAY NOT APPLY TO YOU.

xiv SONICWALL SONICOS STANDARD 3.9 ADMINISTRATOR’S GUIDE

About this Guide

About this Guide
Welcome to the SonicWALL SonicOS Standard 3.9 Administrator’s Guide. This manual provides the
information you need to successfully activate, configure, and administer SonicOS Standard 3.9 on the
following SonicWALL security appliances:
• SonicWALL TZ 150
• SonicWALL TZ 150 Wireless
• SonicWALL TZ 180
• SonicWALL TZ 180 Wireless
Note: For the latest version of this manual as well as other SonicWALL product documentation, refer
to http://www.sonicwall.com/us/Support.html.

Tip: The Getting Start Guide for your SonicWALL security appliance provides instructions for
installing and configuring your SonicWALL security appliance for connecting your network through the
SonicWALL security appliance for secure Internet connectivity.

SONICWALL SONICOS STANDARD 3.9 ADMINISTRATOR’S GUIDE xv

Preface

Organization of this Guide
The SonicOS Standard 3.9 Administrator’s Guide organization is structured into the following parts
that parallel the top-level menu items of SonicWALL Web-based management interface. Within these
parts, individual chapters correspond to the specific configuration pages listed as submenu items in
the management interface.

Part 1 Introduction
This part provides an overview of the SonicWALL management interface conventions, explains how
to get your network securely connected to the Internet with the SonicWALL security appliance using
the Setup Wizard, and registering your SonicWALL security appliance.

Part 2 System
This part covers the configuration of a variety of SonicWALL security appliance controls for managing
system status information, registering the SonicWALL security appliance, activating and managing
SonicWALL Security Services licenses, configuring SonicWALL security appliance local and remote
management options, managing firmware versions and preferences, and using included diagnostics
tools for troubleshooting.

Part 3 Network
This part provides instructions for configuring the SonicWALL security appliance for your network
environment. It explains configuring network interface settings manually, setting up a DHCP server,
configuring the Web proxy requests to a network proxy server, configuring static routes and ARP
settings, and configuring dynamic DNS.

Part 5 Wireless
This part explains how to set up the SonicWALL wireless security appliance for secure WiFiSec or
WEP/WPA Internet access, configure wireless intrusion detection settings, and configure wireless
clients for secure wireless and remote access by way of the SonicWALL Global VPN Client.

Part 6 Wireless Guest Services
This part explains how to configure wireless guest accounts for the SonicWALL wireless security
appliance to securely support wireless network guests.

Part 7 Firewall
This part explains how to configure and manage firewall access policies to deny or permit traffic, how
to configure Voice over IP (VoIP) traffic to pass through, and monitor active firewall connections.

Part 8 VPN
This part covers how to create VPN policies on the SonicWALL security appliance to support
SonicWALL Global VPN Clients for remote client access, site-to-site VPN policies for connecting
offices running SonicWALL security appliances, and interopability with 3rd party VPN devices.

Part 9 Users
This part explains how to create and manage a local user database on the SonicWALL security
appliance and how to integrate the SonicWALL security appliance with a RADIUS server for user
authentication.

xvi SONICWALL SONICOS STANDARD 3.9 ADMINISTRATOR’S GUIDE

About this Guide

Part 10 Security Services
This part includes an overview of optional SonicWALL security services. When combined with
network security features of the SonicWALL security appliance, these services provide
comprehensive protection against a wide range of threats, including viruses, worms, Trojans,
spyware, peer-to-peer and instant messaging application exploits, malicious code, and inappropriate
or unproductive web sites.

These subscription-based services include SonicWALL Content Filtering Service, SonicWALL
Network Anti-Virus, Gateway Anti-Virus, SonicWALL Intrusion Prevention Service, and SonicWALL
Global Security Client. FREE trials of many of these security service subscriptions are available after
you register your SonicWALL security appliance.

Part 11 Log
This part covers managing the SonicWALL security appliance’s enhanced logging, alerting, and
reporting features. The SonicWALL security appliance’s logging features provide a comprehensive
set of log categories for monitoring security and network activities.

Guide Conventions
The following Conventions used in this guide are as follows:

Convention Use

Bold Highlights items you can select on the SonicWALL
management interface.

Italic Highlights a value to enter into a field. For example, “type
192.168.168.168 in the IP Address field.”

Menu Item > Menu Item Indicates a multiple step management interface menu
choice. For example, Security Services > Content Filter
means select Security Services, then select Content
Filter.

Icons Used in this Manual
These special messages refer to noteworthy information, and include a symbol for quick identification:
Alert: Important information that cautions about features affecting firewall performance, security
features, or causing potential problems with your SonicWALL security appliance.

Tip: Useful information about security features and configurations on your SonicWALL security
appliance.

Note: Important information on a feature that requires callout for special attention.

Cross Reference: Pointer to related or more detailed information on the topic.

SONICWALL SONICOS STANDARD 3.9 ADMINISTRATOR’S GUIDE xvii

Preface

Obtaining Technical Support
If you require technical assistance for your SonicWALL security appliance for issues that this guide
does not cover, refer to the resources available online at SonicWALL’s North America support Web
site at:

http://www.sonicwall.com/us/Support.html

For international support Web sites, visit http://www.sonicwall.com and select the appropriate
region or country, then click Support on the top navigation bar.

Also available is SonicWALL’s interactive online Knowledge Portal.

More Information on SonicWALL Products
Contact SonicWALL, Inc. for information about SonicWALL products and services at:

Web: http://www.sonicwall.com

email: sales@sonicwall.com

Phone: (408) 745-9600

Fax: (408) 745-9300
Note: Visit http://www.sonicwall.com/us/support/contact.html for the latest technical support
telephone numbers.

Current Documentation
Check the SonicWALL documentation Web site for that latest versions of this
manual and all other SonicWALL product documentation.

xviii SONICWALL SONICOS STANDARD 3.9 ADMINISTRATOR’S GUIDE

PART

1
Introduction
Part 1

SONICWALL SONICOS STANDARD 3.9 ADMINISTRATOR’S GUIDE 19

20 SONICWALL SONICOS STANDARD 3.9 ADMINISTRATOR’S GUIDE

C H A P T E R

1
Chapter 1: Introduction

With integrated support for SonicWALL's Gateway Anti-Virus, Anti-Spyware and Intrusion Prevention
Service, the SonicWALL security appliances deliver powerful, yet easy-to-use protection against viruses,
spyware, worms, Trojans and other malicious threats. The SonicWALL security appliance also supports
SonicWALL's Content Filtering Service to provide enhanced productivity and network utilization.

SonicWALL Management Interface
The SonicWALL security appliance’s Web-based management interface provides an easy-to-use
graphical interface for configuring your SonicWALL security appliance. The following provides an
overview of the key management interface objects.

Navigating the Management Interface
Navigating the SonicWALL management interface includes a hierarchy of menu buttons on the
navigation bar (left side of your browser window).


CHAPTER 1: Introduction

When you click a menu button, related management functions are displayed as submenu items in the
navigation bar.

To navigate to a submenu page, click the link. When you click a menu button, the first submenu item
page is displayed. For example, when you click the Network button, the Network > Settings page is
displayed.

Status Bar
The Status bar at the bottom of the management interface window displays the status of actions
executed in the SonicWALL management interface.

Applying Changes
Click the Apply button at the top right corner of the SonicWALL management interface to save any
configuration changes you made on the page.



If the settings are contained in a secondary window within the management interface, when you click
OK, the settings are automatically applied to the SonicWALL security appliance.

Navigating Tables
Navigate tables in the management interface with large number of entries by using the navigation
buttons located on the upper right top corner of the table.

The table navigation bar includes buttons for moving through table pages.

Common Icons in the Management Interface
The following describe the functions of common icons used in the SonicWALL management interface:

Clicking on the edit icon displays a window for editing the settings.

Clicking on the delete icon deletes a table entry

Moving the pointer over the comment icon displays text from a Comment field entry.


CHAPTER 1: Introduction

Getting Help
Each SonicWALL security appliance includes Web-based on-line help available from the

Clicking the question mark ? button on the top-right corner of every page accesses the
context-sensitive help for the page.

Alert: Accessing the SonicWALL security appliance online help requires an active Internet
connection.

Logging Out
The Logout button at the bottom of the menu bar terminates the management interface session and
displays the authentication page for logging into the SonicWALL security appliance.


C H A P T E R

2
Chapter 2: Basic SonicWALL Security
Appliance Setup

SonicWALL Security Appliance
Configuration Steps
The chapter provides instructions for basic installation of the SonicWALL security appliance running
SonicOS Standard 3.9. After you complete this chapter, computers on your LAN will have secure Internet
access.
• “Collecting Required ISP Information” on page 25
• “Accessing the SonicWALL Security Appliance Management Interface” on page 27
• “Using the SonicWALL Setup Wizard” on page 27
• “Registering Your SonicWALL Security Appliance” on page 34

Collecting Required ISP Information
Before you configure your SonicWALL security appliance for Internet connectivity for your computers,
make sure you have any information required for your type of Internet connection available.

Internet Service Provider (ISP) Information
If You Have a Cable Modem
Your ISP is probably using DHCP to dynamically assign an address to your computer.

You do not need any Internet connection information.


CHAPTER 2: Basic SonicWALL Security Appliance Setup

If You Have DSL
Your ISP is probably using PPPoE to dynamically authenticate your login and assign an address to
your computer. You will need:

User Name:
Note: Your ISP may require your user name to include the “@” symbol and the domain name, for
example, “Joe@sonicwall.com”

Password:

If You Have a Static IP Address
Your ISP may have assigned you a static IP address for your computer. If so, the paperwork or e-mail
confirmation from your ISP should contain the following configuration information:

IP Address:

Subnet Mask:

Default Gateway:

Primary DNS:

Secondary DNS (optional):

If Your ISP Provided You With a Server IP Address, User Name, and Password
Your ISP may be using PPTP to establish a secure connection between your computer and a server.
You will need:

Server Address:

User Name:

Password:

If you are unsure what kind of connection you have, the paperwork or e-mail confirmation message
from your ISP should contain the information. If you cannot find the information, you can rely on the
SonicWALL security appliance to automatically detect the correct settings during setup.

Other Information
To access the SonicWALL security appliance Web-based management interface. These are the
default settings, which you can change:

User Name: admin

Password: password
Note: If you are not using one of the network configurations above, refer to Chapter 3, Configuring
Network Settings.


Accessing the SonicWALL Security Appliance Management Interface

Accessing the SonicWALL Security
Appliance Management Interface
To access the Web-based management interface of the SonicWALL security appliance:
1 On the computer you have connected to a network port, start your Web browser.
Alert: Your Web browser must support Java, Javascript, and you must disable pop-up blockers.
Internet Explorer 6.0 or higher or Mozilla Firefox 2.0 or higher are recommended.
2 Enter 192.168.168.168 in the Location or Address field. The first time you access the
SonicWALL management interface, the SonicWALL Setup Wizard launches and guides you
through the configuration and setup of your SonicWALL security appliance.
3 If the Setup Wizard does not display, the System > Status page is displayed. Click the Setup
Wizard button on the Network > Settings page.
4 Proceed to one of the following configuration options for your type of Internet connection:
• “Configuring a Static IP Address Internet Connection” on page 28
• “Configuring a DHCP Internet Connection” on page 30
• “Configuring a PPPoE Internet Connection” on page 30
• “Configuring PPTP Internet Connectivity” on page 31
Tip: If you do not know what kind of Internet connection you have, the SonicWALL Setup Wizard
will attempt to detect your connection settings.

Using the SonicWALL Setup Wizard
The SonicWALL Setup Wizard provides user-guided instructions for configuring your SonicWALL
security appliance. If the Setup Wizard does not launch when you access the management interface,
you can launch the Setup Wizard using one of the following methods:
• Select Wizards on the left-navigation bar. The SonicWALL Configuration Wizard is displayed.
Select Setup Wizard and click Next.
• Select the Network > Settings and then click on the Setup Wizard button.
Note: Make sure you have any required ISP information to complete the configuration before using
the Setup Wizard.

Tip: You can also configure all your WAN and network settings manually on the Network > Settings
page of the SonicWALL management interface.



To configure the SonicWALL Setup Wizard complete the following steps:
1 Click the Setup Wizard button on the Network > Settings page. The Welcome to the
SonicWALL Setup Wizard page is displayed. Click Next.

2 To set the password, enter a new password in the New Password and Confirm New Password
fields. Click Next.
Note: Remember your password. You will need it to access the SonicWALL security appliance
management interface after the initial configuration.
3 Select your local time zone from the Time Zone menu. Click Next.
Note: Set the time zone correctly before you register your SonicWALL security appliance.
4 Select the appropriate WAN Network Mode for your network environment. The following sections
describe how to configure the four WAN network modes:
• “Configuring a Static IP Address Internet Connection” on page 28
• “Configuring a DHCP Internet Connection” on page 30
• “Configuring a PPPoE Internet Connection” on page 30
• “Configuring PPTP Internet Connectivity” on page 31

Configuring a Static IP Address Internet Connection
If you are assigned a single IP address by your ISP, perform the instructions below.



Tip: Be sure to have your network information including your WAN IP address, subnet mask, and
: DNS settings ready. This information is obtained from your ISP.
1 Choose Static IP and click Next.

2 Enter the information provided by your ISP in the following fields: SonicWALL WAN IP Address,
WAN Subnet Mask, WAN Gateway (Router) Address, and DNS Server Addresses. Click Next.

3 The LAN Settings page allows the configuration of the SonicWALL LAN IP Addresses and the
LAN Subnet Mask. The SonicWALL LAN IP Addresses are the private IP address assigned to
the LAN port of the SonicWALL security appliance. The LAN Subnet Mask defines the range of IP
addresses on the LAN. The default values provided by the SonicWALL security appliance work for
most networks. If you do not use the default settings, enter your preferred private IP address and
subnet mask in the fields.
4 Click Next. The LAN DHCP Server page configures the SonicWALL security appliance DHCP
Server. If enabled, the SonicWALL security appliance automatically configures the IP settings of
computers on the LAN. To enable the DHCP server, select Enable DHCP Server, and specify the
range of IP addresses that are assigned to computers on the LAN.
If Disable DHCP Server is selected, you must configure each computer on your network with a
static IP address on your LAN. Click Next.
5 The Configuration Summary page displays the configuration defined using the Installation
Wizard. To modify the settings, click Back to return to a previous page. If the configuration is



correct, click Apply. The SonicWALL security appliance stores the network settings and then
displays the Setup Wizard Complete page.
Tip: The SonicWALL security appliance LAN IP address, displayed in the URL field of the Setup
Wizard Complete page, is used to log in and manage the SonicWALL security appliance.
6 Click Restart to restart the SonicWALL security appliance. The SonicWALL security appliance
takes approximately 90 seconds or longer to restart. During this time, the yellow Test LED is lit.

Configuring a DHCP Internet Connection
DHCP Internet connections are a common network configuration for customers with cable Internet
service. You are not assigned a specific IP address by your ISP.
1 Select DHCP. Click Next. A page is displayed describing a DHCP Internet connection.
2 Click Next.
3 The LAN Settings page allows the configuration of SonicWALL security appliance LAN IP
Addresses and Subnet Masks. SonicWALL security appliance LAN IP Addresses are the private
IP addresses assigned to the LAN of the SonicWALL security appliance. The LAN Subnet Mask
defines the range of IP addresses on the networks. The default values provided by the SonicWALL
security appliance are useful for most networks. Click Next.
4 The LAN DHCP Server window configures the SonicWALL security appliance DHCP Server. If
enabled, the SonicWALL automatically assigns IP settings to computers on the LAN. To enable
the DHCP server, select Enable DHCP Server, and specify the range of IP addresses assigned to
computers on the LAN.
If Disable DHCP Server is selected, the DHCP Server is disabled. Click Next to continue.
5 The Configuration Summary window displays the configuration defined using the Installation
Tip: The new SonicWALL security appliance LAN IP address, displayed in the URL field of the Setup
takes 90 seconds to restart. During this time, the yellow Test LED is lit.



Configuring a PPPoE Internet Connection
PPPoE is typically used for DSL Internet service using a DSL modem. The ISP requires a user name
and password to log into the remote server.
1 Select PPPoE. Click Next.
2 Enter the user name and password provided by your ISP into the User Name and Password
fields. Click Next.

Addresses and LAN Subnet Mask.The SonicWALL security appliance LAN IP Address is the
private IP address assigned to the LAN port of the SonicWALL security appliance. The LAN
Subnet Mask defines the range of IP addresses on the LAN. The default values provided by the
SonicWALL security appliance are useful for most networks. If you do not use the default settings,
enter your preferred IP addresses in the fields. Click Next.
enabled, the SonicWALL security appliance automatically assigns IP settings to computers on the
LAN. To enable the DHCP server, select Enable DHCP Server, and specify the range of IP
addresses that are assigned to computers on the LAN.



Configuring PPTP Internet Connectivity
PPTP is used to connect to a remote server by using an Internet connection. It supports older
Microsoft implementations requiring tunneling connectivity.

1 Select PPTP. Click Next.

2 Enter the PPTP server IP address in the PPTP Server IP Address field.
3 Enter the user name and password provided by your ISP into the PPTP User Name and PPTP
Password fields. Click Next.
Addresses and LAN Subnet Mask.The SonicWALL security appliance LAN IP Address is the
private IP address assigned to the LAN port of the SonicWALL security appliance. The LAN
Subnet Mask defines the range of IP addresses on the LAN. The default values provided by the
SonicWALL security appliance are useful for most networks. If you do not use the default settings,
enter your preferred IP addresses in the fields. Click Next.
enabled, the SonicWALL security appliance automatically assigns IP settings to computers on the
LAN. To enable the DHCP server, select Enable DHCP Server, and specify the range of IP
addresses that are assigned to computers on the LAN.

Configuring WAN Settings
If you selected Static IP address, you must have your IP address information from your ISP to fill in
the WAN Network Mode fields. Enter the public IP address provided by your ISP in the SonicWALL
WAN IP Address, then fill in the rest of the fields: WAN Subnet Mask, Gateway (Router) Address,
and the primary and secondary DNS Server Addresses. Click Next.


Configuring LAN Settings
Type a private IP address in the SonicWALL LAN IP Address field. The default private IP address is
acceptable for most configurations. Type the subnet in the Subnet Mask field. Microsoft uses
NetBIOS broadcasts to communicate, when you click the Enable Windows Networking Support
checkbox, common issues are resolved when systems are on the LAN and OPT ports. Click Next.

Configuring LAN DHCP Settings
If you want to use the SonicWALL security appliance’s DHCP Server, check the Enable DHCP
Server on LAN checkbox and enter a range of IP addresses to assign network devices in the LAN
Address Range fields. The default entries work for most network configurations. Click Next.

Configuring WLAN 802.11b/g Settings
The Service Set ID (SSID) identifies your wireless network. It can be up to 32 alphanumeric
characters long and is case-sensitive. Select the desired channel for your wireless port. Channel 11 is
selected by default and is the most commonly used channel. Select a radio mode from the Radio
Mode menu. The default 2.4GHz 802.11b/g Mixed option allows the SonicWALL Secure Anti-Virus
Router 80 Wireless to support b and g. Select United States - US or Canada - CA from the Country
Code menu. Use the default AutoChannel setting in the Channel menu. Click Next.

WLAN Security Settings
Choose the desired security setting for the SonicWALL wireless security appliance. WPA/WPA2
Mode provides strong security, but it requires that wireless computers and nodes have WPA support
in order to connect. Connectivity Mode provides wireless access to the appliance and the Internet
without any security enforced.
Note: WiFiSec requires that VPN be enabled. Therefore to avoid the possibility of blocking wireless
access by allowing users to configure WiFiSec without first enabling VPN, the WiFiSec option has
been removed from the wizard. To use WiFiSec, you must first enable VPN on the VPN > Settings
page.

WPA Mode Settings
If you selected WPA/WPA2 Mode, the WPA Mode Settings window displays. Select the appropriate
Authentication Type. The WPA2 - Auto settings attempt to connect using WPA2, and default to
WPA if WPA2 fails. The following encryption protocols are supported
Pre-Shared Key (PSK): PSK allows WPA to generate keys from a pre-shared passphrase that
you configure. The keys are updated periodically based on time or number of packets. Use
PSK in smaller deployments where you do not have a RADIUS server.
Extensible Authentication Protocol (EAP): EAP allows WPA to synchronize keys with an
external RADIUS server. The keys are updated periodically based on time or number of
packets. Use EAP in larger, enterprise-like deployments where you have an existing RADIUS
framework.

For the Cipher Type setting, select TKIP when using WPA and AES when using WPA2. Select By
Timeout to generate a new group key after an interval specified in seconds. Select By Packet to
generate a new group key after a specific number of packets. Select Disabled to use a static key. If
you selected By Timeout, enter the number of seconds before WPA automatically generates a new
group key in the Interval field.

For PSK, enter the Passphrase. For EAP, enter Radius Server IP, Port number, and RADIUS
Server Secret for at least one RADIUS server.



Configuration Summary
The Configuration Summary page displays all of the settings configured using the Deployment
Scenario Wizard. To change any of the settings, click Back until you see the settings you want to
change. To use this configuration on the security appliance, click Apply.

Storing Configuration
Wait for the settings to take effect on the security appliance.

Congratulations
When the settings are applied to the security appliance, the Congratulations page is displayed. Click
Restart to complete the configuration.

Registering Your SonicWALL Security
Appliance
Once you have established your Internet connection, it is recommended you register your SonicWALL
security appliance. Registering your SonicWALL security appliance provides the following benefits:
• Try a FREE 30-day trial of SonicWALL Intrusion Prevention Service, SonicWALL Gateway
Anti-Virus, Content Filtering Service, and Network Anti-Virus.
• Activate SonicWALL security services and upgrades
• Access SonicOS firmware updates
• Get SonicWALL technical support

Before You Register
If your SonicWALL security appliance is not registered, the following message is displayed in the
Security Services folder on the System > Status page in the SonicWALL management interface:
Your SonicWALL is not registered. Click here to Register your SonicWALL. You need a
mysonicwall.com account to register the SonicWALL security appliance.

If your SonicWALL security appliance is connected to the Internet, you can create a mysonicwall.com
account and register your SonicWALL security appliance directly from the SonicWALL management
interface. If you already have a mysonicwall.com account, you can register the SonicWALL security
appliance directly from the management interface.

Your mysonicwall.com account is accessible from any Internet connection by pointing your Web
browser to https://www.mysonicwall.com. mysonicwall.com uses the HTTPS
(Hypertext Transfer Protocol Secure) protocol to protect your sensitive information.
Alert: Make sure the Time Zone and DNS settings on your SonicWALL security appliance are correct
when you register the device. See the SonicWALL Setup Wizard instructions for information on using
the Setup Wizard to set the Time Zone and DNS settings.
Note: mysonicwall.com registration information is not sold or shared with any other company.

You can also register your security appliance at the https://www.mysonicwall.com site by using the
Serial Number and Authentication Code displayed in the Security Services section. Click the
SonicWALL link to access your mysonicwall.com account. You will be given a registration code after
you have registered your security appliance. Enter the registration code in the field below the You will
be given a registration code, which you should enter below heading, then click Update.


Registering Your SonicWALL Security Appliance

Creating a mysonicwall.com Account
Creating a mysonicwall.com account is fast, simple, and FREE. Simply complete an online
registration form in the SonicWALL management interface.

To create a mysonicwall.com account from the SonicWALL management interface:
1 In the Security Services section on the System > Status page, click the Register link in Your
SonicWALL is not registered. Click here to Register your SonicWALL.

2 Click the here link in If you do not have a mysonicwall account, please click here to create
one on the mysonicwall Login page.

3 In the MySonicWALL Account page, enter in your information in the Account Information,
Personal Information and Preferences fields in the mysonicwall.com account form. All fields
marked with an * are required fields.
Note: Remember your username and password to access your mysonicwall.com account.
4 Click Submit after completing the MySonicWALL Account form.
5 When the mysonicwall.com server has finished processing your account, a page is displayed
confirming your account has been created. Click Continue.
6 Congratulations! Your mysonicwall.com account is activated. Now you need to log into
mysonicwall.com from the management appliance to register your SonicWALL security appliance.

If you already have a mysonicwall.com account, follow these steps to register your security appliance:
1 In the Security Services section on the System > Status page, click the Register link in Your
SonicWALL is not registered. Click here to Register your SonicWALL. The mysonicwall
Login page is displayed.



2 In the mysonicwall.com Login page, enter your mysonicwall.com username and password in the
User Name and Password fields and click Submit.
3 The next several pages inform you about free trials available to you for SonicWALL’s Security
Services:
• Gateway Anti-Virus - protects your entire network from viruses
• Network Anti-Virus - protects computers on your network from viruses
• Premium Content Filtering Service - protects your network and improves productivity by limiting
access to unproductive and inappropriate Web sites
• Intrusion Prevention Service - protects your network from Trojans, worms, and application layer
attacks.
Click Continue on each page.
4 At the top of the Product Survey page, enter a friendly name for your SonicWALL security
appliance in the Friendly name field, and complete the optional product survey.
5 Click Submit.
6 When the mysonicwall.com server has finished processing your registration, a page is displayed
confirming your SonicWALL security appliance is registered.
7 Click Continue. The Manage Services Online table on the System > Licenses page is
displayed.
Cross Reference: Refer to Part 7, Security Services for information on SonicWALL security services
and activating FREE trials.


PART

2
System
Part 2


System > Security Dashboard

C H A P T E R

3
Chapter 3: Viewing the SonicWALL Security
Dashboard

This chapter describes how to use the SonicWALL Security Dashboard feature on a SonicWALL
security appliance running SonicOS 3.8 firmware or later. This chapter contains the following
sections:
• “SonicWALL Security Dashboard Overview” on page 39
“What is the SonicWALL Security Dashboard?” on page 39
“Benefits” on page 41
“How Does the SonicWALL Security Dashboard Work?” on page 42
“Platforms” on page 42
• “Using the SonicWALL Security Dashboard” on page 42
“Administrator Prerequisites” on page 42
“Administrator Configuration Tasks” on page 42
• “Related Features” on page 50

SonicWALL Security Dashboard Overview
This section provides an introduction to the SonicWALL Security Dashboard feature. This section
contains the following subsections:
• “What is the SonicWALL Security Dashboard?” on page 39
• “Benefits” on page 41
• “How Does the SonicWALL Security Dashboard Work?” on page 42
• “Platforms” on page 42

After reading the SonicWALL Security Dashboard Overview section, you will be familiar with this
feature and its benefits.

What is the SonicWALL Security Dashboard?
The SonicWALL Security Dashboard provides reports of the latest threat protection data from a single
SonicWALL appliance and aggregated threat protection data from SonicWALL security appliances
deployed globally. The SonicWALL Security Dashboard displays automatically upon successful


CHAPTER 3: Viewing the SonicWALL Security Dashboard

authentication to a SonicWALL security appliance running SonicOS 3.8 firmware or later, and can be
viewed at any time by navigating to the System > Security Dashboard menu in the left-hand menu.
Reports in the Security Dashboard include:
• Viruses Blocked by SonicWALL Network
• Intrusions Prevented by SonicWALL Network
• Spyware Blocked by SonicWALL Network
• Multimedia (IM/P2P) Detected/Blocked by SonicWALL Network

Each report includes a graph of threats blocked over time and a table of the top blocked threats.
Reports, which are updated hourly, can be customized to display data for the last 12 hours, 14 days,
21 days, or 6 months. For easier viewing, SonicWALL Security Dashboard reports can be
transformed into a PDF file format with the click of a button.



Benefits
The SonicWALL Security Dashboard provides the latest threat protection information to keep you
informed about potential threats being blocked by SonicWALL security appliances. If you subscribe to
SonicWALL’s security services, including Gateway Anti-Virus, Gateway Anti-Spyware, Intrusion
Prevention Service (IPS), and Content Filtering Service, you are automatically protected from the
threats reported by the SonicWALL Security Dashboard. SonicWALL’s security services include
ongoing new signature updates to protect against the latest virus and spyware attacks. For
information about activating SonicWALL security services, refer to the “Purchasing Security Services”
on page 44.

The Security Dashboard provides insight into threats over time, and can be configured to display data
from multiple time periods. The SonicWALL Security Dashboard can be viewed easily in the System
> Security Dashboard page of the SonicWALL appliance management interface, or as a custom
generated PDF file.



How Does the SonicWALL Security Dashboard Work?
The SonicWALL Security Dashboard provides global and appliance-level threat protection statistics.
At the appliance level, threat protection data from your SonicWALL security appliance is displayed. At
the global level, the SonicWALL Security Dashboard is updated hourly from the SonicWALL backend
server with aggregated threat protection data from globally-deployed SonicWALL security appliances.
Data provided by the SonicWALL backend server is cached locally for reliable delivery.
Note: The SonicWALL security appliance must have Internet connectivity to receive the latest threat
protection statistics from the SonicWALL backend server, which reports aggregated data from
globally deployed SonicWALL security appliances. If you lose connectivity, cached data from the last
update will display, and the latest data will not be available until connectivity is restored.

Platforms
The SonicWALL Security Dashboard is available on the SonicWALL security appliances running
SonicOS 3.8 firmware and later.

Using the SonicWALL Security Dashboard
This section contains the following subsections:
• “Administrator Prerequisites” on page 42
• “Administrator Configuration Tasks” on page 42

Administrator Prerequisites
SonicWALL security appliances running SonicOS 3.8 firmware or later must be set up and registered
on mysonicwall.com. For registration instructions, refer to the SonicWALL Getting Started Guide for
your security appliance, available on the Web at: http://www.sonicwall.com/us/Support.html.
Note: The SonicWALL security appliance must be configured for Internet connectivity and be
connected to the Internet to display the latest reports.

Administrator Configuration Tasks
This section contains the following subsections:
• “SonicWALL Security Dashboard Configuration Overview” on page 42
• “Purchasing Security Services” on page 44

SonicWALL Security Dashboard Configuration Overview

The SonicWALL Security Dashboard can be configured to display global or appliance-level statistics,
to display statistics for different time periods, and to generate a custom PDF file. For information
about purchasing SonicWALL security services that protect against the threats reported in the
SonicWALL Security Dashboard, refer to “Purchasing Security Services” on page 44.



The SonicWALL Security Dashboard displays automatically upon successful login to a SonicWALL
security appliance. You can access the SonicWALL Security Dashboard at any time by navigating to
System > Security Dashboard in the left-hand menu. You may see the introductory screen shown
below before the dashboard displays.

This section provides the following subsections:
• “Switching to Global or Appliance-Level View” on page 43
• “Selecting Custom Time Interval” on page 43
• “Generating a Security Dashboard PDF” on page 44

Switching to Global or Appliance-Level View

To view SonicWALL Security Dashboard global reports, select the radio button next to Global in the
top of the System > Security Dashboard screen. To view appliance-level reports, select the radio
button next to the appliance serial number.

Selecting Custom Time Interval

The SonicWALL Security Dashboard reports default to “Last 14 Days,” providing an aggregate view of
threats blocked during that time period. You can configure each report to one of four optional time
periods. Each report can be configured to reflect a different time period. To change a report to reflect
a different time period, perform the following steps:
1 Select the report you want to change:
Viruses Blocked by SonicWALL Network
Intrusions Prevented by SonicWALL Network
Spyware Blocked by SonicWALL Network
Multimedia (IM/P2P) Detected/Blocked by SonicWALL Network.



2 Next to the title of the selected report, click the pull-down menu and select one of the following
options:
Last 12 Hours - The selected report will display threat information from the last 12 hours
Last 14 Days - The selected report will display threat information from the last 14 days
Last 21 Days - The selected report will display threat information from the last 21 days
Last 6 Months - The selected report will display threat information from the last 6 months

Generating a Security Dashboard PDF

To create a PDF version of the SonicWALL Security Dashboard, first select the desired view (global
or appliance-level) and the desired time period for each report (the last 12 hours, 14 days, 21 days, or
6 months). Click the button at the top of the page.

Purchasing Security Services

To be protected from the threats reported in the SonicWALL Security Dashboard, it is recommended
that you purchase SonicWALL security services. This section provides instructions for using the
SonicWALL Registration & License Wizard, accessible from the SonicWALL appliance management
interface, to purchase SonicWALL security services. SonicWALL security services include the
following real-time protection services:
• Gateway Anti-Virus - Protects against viruses, worms, Trojans and other threats
• Gateway Anti-Spyware - Protects against new and existing malicious spyware
• Intrusion Prevention Service - Protects against application-layer attacks
• Content Filtering Service - Enhances protection and productivity by limiting access to
objectionable Web content
• Dynamic Support 8x5 - Provides one year of telephone and Web support, including software and
firmware updates
• ViewPoint - Provides detailed and comprehensive reporting on network activity
Note: Your SonicWALL security appliance must be configured for Internet connectivity and must be
connected to the Internet to use the Registration & License Wizard.



To purchase SonicWALL security services using the SonicWALL Registration & License Wizard,
perform the following steps:
1 Log in to the SonicWALL appliance management interface.
2 In the left-navigation menu, click Wizards. The Configuration Wizard displays.

3 Select the radio button next to Registration & License Wizard and click Next.



4 The welcome screen displays. Click Next.

5 If you have a mysonicwall.com account, enter your username and password in the Username and
Password fields. If you do not have a mysonicwall.com account, select the radio button next to
Create a sonicwall.com account. Click Next.



6 If you selected Create a sonicwall.com account, the User Registration page displays. Provide
the information requested in order to create your account, then click Next.
Note: If you used an existing mysonicwall.com account by providing your username and password,
you will not see this page. Skip to the next step.

7 Select the checkbox next to the service you want to purchase and click Next.



8 A notice displays that a separate browser window will be launched. Click OK.

9 The mysonicwall.com page is launched in a separate browser window. Follow the on-screen
instructions to complete the purchase of SonicWALL security services.



10 After you have purchased the security services, return to the wizard window. The License
Synchronization window will synchronize the new security services with the SonicWALL security
appliance. Click Next to complete the synchronization.

11 The Congratulations page displays. You have successfully purchased and synchronized your
security services. Click Close to close the wizard.

To verify that the security services are licensed, navigate to Security Services > Summary in the
left-hand menu and verify that the status of the services is Licensed. For information on advanced
configuration for each service, refer to the SonicWALL Administrator’s Guides, available on the Web
at: http://www.sonicwall.com/us/Support.html.



Related Features
SonicWALL Registration & License Wizard - Use the SonicWALL Registration & License Wizard to
purchase SonicWALL security services directly from your SonicWALL security appliance

SonicWALL Security Services - SonicWALL provides a comprehensive offering of security services
that protect against the threats reported in the SonicWALL Security Dashboard. For a full list, visit the
SonicWALL website at http://www.sonicwall.com/us/Support.html.

Some of the Security Services include:
• Gateway Anti-Virus - Protects against viruses, worms, Trojans and other threats
• Gateway Anti-Spyware - Protects against new and existing malicious spyware
• Intrusion Prevention Service - Protects against application-layer attacks
• Content Filtering Service - Enhances protection and productivity by limiting access to
objectionable Web content
• Dynamic Support 8x5 - Provides one year of telephone and Web support, including software and
firmware updates
• ViewPoint - Provides detailed and comprehensive reporting on network activity


System > Status

C H A P T E R

4
Chapter 4: Viewing System Status
Information

System > Status
The Status page contains five sections: System Messages, System Information, Latest Alerts,
Security Services, and Network Interfaces.


CHAPTER 4: Viewing System Status Information

Wizards
The Wizards button on the System > Status page provides access to the SonicWALL
Configuration Wizard.

This wizard allows you to easily configure the SonicWALL security appliance using the following
wizards:
• Setup Wizard - This wizard helps you quickly configure the SonicWALL security appliance to
secure your Internet (WAN) and LAN connections.
• Network Access Rules Wizard - This wizard helps you quickly configure the SonicWALL security
appliance to provide public access to an internal server, such as a Web or E-mail server or create
a general firewall rule.
• VPN Wizard - This wizard helps you create a new site-to-site VPN Policy or configure the WAN
GroupVPN to accept VPN connections from SonicWALL Global VPN Clients.

System Messages
Any information relating to possible problems with configurations on the SonicWALL security
appliance such as password, log messages, and other important system events.

System Information
The following information is displayed in this section:
• Model - type of SonicWALL security appliance
• Serial Number - also the MAC address of the SonicWALL security appliance
• Authentication Code - the alphanumeric code used to authenticate the SonicWALL security
appliance on the registration database at https://www.mysonicwall.com
• Firmware Version - the firmware version loaded on the SonicWALL security appliance
• ROM Version - indicates the ROM version
• CPU - displays the percent usage and the type of the SonicWALL security appliance processor
• Total Memory - indicates the amount of RAM and flash memory
• Up Time - the length of time, in days, hours, minutes, and seconds the SonicWALL security
appliance is active
• Current Connections - the number of network connections currently existing on the
SonicWALL security appliance


System > Status

• Last Modified By - the IP address the administrator connected from and the time of the last
modification
• Registration Code - the registration code is generated when your SonicWALL security appliance
is registered at <https://www.mysonicwall.com>

Security Services
If your SonicWALL security appliance is not registered at mysonicwall.com, the following message is
displayed in the Security Services folder: Your SonicWALL security appliance is not registered.
Click here to Register your SonicWALL security appliance. You need a mysonicwall.com account
to register your SonicWALL security appliance or activate security services. You can create a
mysonicwall.com account directly from the SonicWALL management interface.

Cross Reference: Refer to Chapter 2, Basic SonicWALL Security Appliance Setup for complete
registration instructions.

If your SonicWALL security appliance is registered a list of available SonicWALL Security Services
are listed in this section with the status of Licensed or Not Licensed. If Licensed, the Status column
displays the number of licenses and the number of licenses in use. Clicking the Arrow icon displays
the System > Licenses page in the SonicWALL Web-based management interface. SonicWALL
Security Services and SonicWALL security appliance registration is managed by mysonicwall.com.

Cross Reference: Refer to Part 7, Security Services for more information on SonicWALL Security
Services and activating them on the SonicWALL security appliance.

Latest Alerts
Any messages relating to system errors or attacks are displayed in this section. Attack messages
include AV Alerts, forbidden e-mail attachments, port scans, log attempts with bad credentials, IP
spoofing, and smurf application attacks. System errors include WAN IP changes and encryption
errors. Clicking the blue arrow displays the Log > Log View page.


CHAPTER 4: Viewing System Status Information

Network Interfaces
The Network Interfaces displays the IP address and link information for interfaces on your SonicWALL
security appliance. The available interfaces displayed in this section depends on the SonicWALL
security appliance model. Clicking the arrow displays the Network > Settings page.

SonicWALL Security Appliance Model Interfaces

SonicWALL TZ 150 WAN, LAN

SonicWALL TZ 150 Wireless WAN, LAN, WLAN

SonicWALL TZ 180 WAN, LAN, OPT


Cross Reference: Refer to Chapter 10, Configuring Network Settings for more information on
configuring Network Interfaces.


System > Licenses

C H A P T E R

5
Chapter 5: System > Licenses

System > Licenses
The System > Licenses page provides links to activate, upgrade, or renew SonicWALL Security
Services and upgrades.

Node License Status


CHAPTER 5: System > Licenses

Node licensing can be monitored and controlled from the System > Licenses page. The Node
License Status section displays the number of licensed nodes, and the number of nodes currently in
use. To prevent nodes from consuming licenses (such as for network printers that do not require
Internet access) a facility is provided to construct an exclusion list.

If your SonicWALL security appliance supports an unlimited number of nodes, the Node License
Status section does not include Currently Licensed Nodes and Node License Exclusion List
settings.

Currently Licensed Nodes

On node restricted devices, node usage is calculated by the number of active hosts on local interfaces
attempting to traverse the WAN interface. After a 5 minute period of inactivity, hosts are no longer
considered active, and are removed from the Currently Licensed Nodes list. Subsequent activity will
add them back to the list.

When the node license limit has been reached, an over-limit host will be denied access to the WAN,
and if the traffic the host is attempting is HTTP, the host is redirected to the License Exceed page on
the SonicWALL security appliance.

Node License Exclusion List

IP Addresses can be added to the Node License Exclusion List by clicking the Add button. The
Add/Edit License Exclusion Node window is displayed.

Enter the node IP address in the Node IP Address field and an optional comment in the Comment
field.

You can click on the icon in the Exclude column of the Currently Licensed Nodes table to
automatically add the entry to the Node License Exclusion List. Clicking the icon displays an alert
explaining that the host to be excluded and added to the exclusion list, and the node will be prohibited
from accessing the WAN. Click OK. The Node License Exclusion List is updated to reflect the
change.

The delete icon can be used to remove entries from the list, and to restore WAN access to the
referenced host. The edit icon allows for a comment to be added or changed on the entry.


System > Licenses

The Node License Exclusion List table is also updated to reflect the change:

Clicking the Auto Firewall Access Rule redirects the management session to the Firewall > Access
Rules page, where the auto-created, non-editable rule can be viewed.

Security Services Summary

The Security Services Summary table lists the available and activated security services on the
SonicWALL security appliance. The Security Service column lists all the available SonicWALL
security services and upgrades available for the SonicWALL security appliance. The Status column
indicates if the security service is activated (Licensed), available for activation (Not Licensed), or no
longer active (Expired). The number of nodes/users allowed for the license is displayed in the Count
column.

The information listed in the Security Services Summary table is updated from your
mysonicwall.com account the next time the SonicWALL security appliance automatically
synchronizes with your mysonicwall.com account (once a day) or you can click the link in To
synchronize licenses with mysonicwall.com click here in the Manage Security Services Online
section.
Note: Refer to Chapter 8, Setting Up Security Services for more information on SonicWALL Security
Services and activating them on the SonicWALL security appliance.



Manage Security Services Online

To activate, upgrade, or renew services, click the link in To Activate, Upgrade, or Renew services,
click here. Click the link in To synchronize licenses with mysonicwall.com click here to
synchronize your mysonicwall.com account with the Security Services Summary table.

You can also get free trial subscriptions to SonicWALL Content Filter Service and Network Anti-Virus
by clicking the For Free Trials click here link. When you click these links, the mysonicwall.com
Login page is displayed. Enter your mysonicwall.com account username and password in the User
Name and Password fields and click Submit. The Manage Services Online page is displayed with
licensing information from your mysonicwall.com account.

Manual Upgrade

Manual Upgrade allows you to activate your services by typing the service activation key supplied
with the service subscription not activated on mysonicwall.com. Type the activation key from the
product into the Enter upgrade key field and click Submit.
Tip: You must have a mysonicwall.com account to upgrade and activate services through the
SonicWALL security appliance.

Manual Upgrade for Closed Environments
If your SonicWALL security appliance is deployed in a high security environment that does not allow
direct Internet connectivity from the SonicWALL security appliance, you can enter the encrypted
license key information from http://www.mysonicwall.com manually on the System > Licenses page
in the SonicWALL management interface.
Note: Manual upgrade of the encrypted License Keyset is only for closed environments. If your
SonicWALL security appliance is connected to the Internet, it is recommended you use the automatic
registration and Security Services upgrade features of your SonicWALL security appliance.

From a Computer Connected to the Internet
1 Make sure you have an account at http://www.mysonicwall.com and your SonicWALL security
appliance is registered to the account before proceeding.
2 After logging into http://www.mysonicwall.com, click on your registered SonicWALL security
appliance listed in Registered SonicWALL Products.


System > Licenses

3 Click the View License Keyset link. The scrambled text displayed in the text box is the License
Keyset for the selected SonicWALL security appliance and activated Security Services. Copy the
Keyset text for pasting into the System > Licenses page or print the page if you plan to manually
type in the Keyset into the SonicWALL security appliance.

From the Management Interface of the SonicWALL Security Appliance
4 Make sure your SonicWALL security appliance is running SonicOS Standard or Enhanced 2.1 (or
higher).
5 Paste (or type) the Keyset (from the step 3) into the Keyset field in the Manual Upgrade section of
the System > Licenses page (SonicOS).
6 Click the Submit or the Apply button to update your SonicWALL security appliance. The status
field at the bottom of the page displays The configuration has been updated.
7 You can generate the System > Diagnostics > Tech Support Report to verify the upgrade
details.
Alert: After the manual upgrade, the System > Licenses page does not contain any registration and
upgrade information. The warning message SonicWALL Registration Update Needed. Please
update your registration information remains on the System > Status page after you have
registered your SonicWALL security appliance. Ignore this message.


System > Administration

C H A P T E R

6
Chapter 6: Using System Administration

The System > Administration page provides settings for the configuration of SonicWALL security
appliance for secure and remote management. You can manage the SonicWALL security appliance
using a variety of methods, including HTTPS or SonicWALL Global Management System
(SonicWALL GMS).


CHAPTER 6: Using System Administration

Firewall Name
The Firewall Name uniquely identifies the SonicWALL security appliance and defaults to the serial
number of the SonicWALL security appliance. The serial number is also the MAC address of the unit.
The Firewall Name is mainly used in e-mailed log files. To change the Firewall Name, enter a unique
alphanumeric name in the Firewall Name field. It must be at least 8 characters in length.

Name/Password
Administrator Name
The Administrator Name can be changed from the default setting of admin to any word using
alphanumeric characters up to 32 characters in length. To create a new administrator name, enter the
new name in the Administrator Name field. Click Apply for the changes to take effect on the

Changing the Administrator Password
To set the password, enter the old password in the Old Password field, and the new password in the
New Password field. Enter the new password again in the Confirm New Password field and click
Apply. Once the SonicWALL security appliance has been updated, a message confirming the update
is displayed at the bottom of the browser window.

Login Security
The Log out the Administrator after inactivity of (minutes) setting allows you to set the length of
inactivity time that elapses before you are automatically logged out of the management interface. By
default, the SonicWALL security appliance logs out the administrator after 5 minutes of inactivity.
Tip: If the Administrator Inactivity Timeout is extended beyond 5 minutes, you should end every
management session by clicking Logout to prevent unauthorized access to the SonicWALL Web

Enter the desired number of minutes in the Log out the Administrator after inactivity of (minutes)
setting and click Apply. The time range can be from 1 to 9999 minutes. Click Apply, and a message
confirming the update is displayed at the bottom of the browser window.

Enable Administrator/User Lockout
You can configure the SonicWALL security appliance to lockout an administrator or a user if the login
credentials are incorrect. Select the Enable Administrator/User Lockout check box to prevent users
from attempting to log into the SonicWALL security appliance without proper authentication
credentials. Enter the number of failed attempts before the user is locked out in the Failed login
attempts per minute before lockout field. Enter the length of time that must elapse before the user
attempts to log into the SonicWALL security appliance again in the Lockout Period (minutes) field.
Alert: If the administrator and a user are logging into the SonicWALL security appliance using the
same source IP address, the administrator is also locked out of the SonicWALL security appliance.
The lockout is based on the source IP address of the user or administrator.



Web Management Settings

The SonicWALL security appliance can be managed using HTTP or HTTPS and a Web browser.
Both HTTP and HTTPS are enabled by default. The default port for HTTP is port 80, but you can
configure access through another port. Enter the number of the desired port in the Port field, and click
Update. However, if you configure another port for HTTP management, you must include the port
number when you use the IP address to log into the SonicWALL security appliance. For example, if
you configure the port to be 76, then you must enter <LAN IP Address>:76 into the Web browser, for
example
<http://192.168.168.1:76>

The default port for HTTPS management is 443, the standard port. You can add another layer of
security for logging into the SonicWALL security appliance by changing the default port. To configure
another port for HTTPS management, enter the preferred port number into the Port field, and click
Update. For example, if you configure the HTTPS Management Port to be 700, then you must log into
the SonicWALL security appliance using the port number as well as the IP address, for example,
<https://192.168.168.1:700> to access the SonicWALL security appliance.

The Certificate Selection menu allows you to use a self-signed certificate (Use Self-signed
Certificate), which allows you to continue using a certificate without downloading a new one each
time you log into the SonicWALL security appliance. You can also choose Import Certificate to
select an imported certificate from the VPN > Local Certificates page to use for authentication to the

The Enable Ping from LAN to management interface setting allows a LAN user to ping the
SonicWALL to verify it is online.

Changing the Default Size for SonicWALL Management Interface Tables
The SonicWALL management interface allows you to control the display of large tables of information
across all tables in the management Interface; for example the table on the Firewall > Access Rules
page.

You can change the default table page size in all tables displayed in the SonicWALL management
interface from the default 50 items per page to any size ranging from 1 to 5,000 items.

To change the default table size:
1 Enter the maximum table size number in the Table Size field.
2 Click Apply.



Advanced Management

Enable SNMP
SNMP (Simple Network Management Protocol) is a network protocol used over User Datagram
Protocol (UDP) that allows network administrators to monitor the status of the SonicWALL security
appliance and receive notification of critical events as they occur on the network. The SonicWALL
security appliance supports SNMP v1/v2c and all relevant Management Information Base II (MIB)
groups except egp and at. The SonicWALL security appliance replies to SNMP Get commands for
MIBII over any interface and supports a custom SonicWALL MIB for generating trap messages. The
custom SonicWALL MIB is available for download from the SonicWALL Web site and can be loaded
into third-party SNMP management software such as HP Openview, Tivoli, or SNMPC.

To enable SNMP on the SonicWALL security appliance, select the Enable SNMP check box, and
then click Configure in the System > Administration page.
Note: v1 traps are not supported on the SonicWALL security appliance.
1 Enter the host name of the SonicWALL security appliance in the System Name field.
2 Enter the network administrator’s name in the System Contact field.
3 Enter an e-mail address, telephone number, or pager number in the System Location field.
4 Enter a name for a group or community of administrators who can view SNMP data in the Get
Community Name field.
5 Enter a name for a group or community of administrators who can view SNMP traps in the Trap
Community Name field.
6 Enter the IP address or host name of the SNMP management system receiving SNMP traps in the
Host 1 through Host 4 fields. You must configure at least one IP address or host name, but up to
four addresses or host names can be used.
7 Click OK.

Trap messages are generated only for the alert message categories normally sent by the SonicWALL
security appliance. For example, attacks, system errors, or blocked Web sites generate trap
messages. If none of the categories are selected on the Log > Settings page, then no trap messages
are generated.

By default, the SonicWALL security appliance responds only to Get SNMP messages received on its
LAN interface. Appropriate rules must be configured to allow SNMP traffic to and from the WAN
interface. SNMP trap messages can be sent over the LAN or WAN.
Note: Refer to Chapter 4, Configuring Firewall Settings for instructions on adding services and rules
to the SonicWALL security appliance.

If your SNMP management system supports discovery, the SonicWALL agent automatically discovers
the SonicWALL security appliance on the network. Otherwise, you must add the SonicWALL security
appliance to the list of SNMP-managed devices on the SNMP management system.



Enable Management Using SonicWALL GMS
To enable the SonicWALL security appliance to be managed by SonicWALL Global Management
System (GMS), select the Enable Management using GMS checkbox, then click Configure. The
Configure GMS Settings window is displayed.

To configure the SonicWALL security appliance for GMS management:
1 Enter the host name or IP address of the GMS Console in the GMS Host Name or IP Address
field.
2 Enter the port in the GMS Syslog Server Port field. The default value is 514.
3 Select Send Heartbeat Status Messages Only to send only heartbeat status instead of log
messages.
4 Select GMS behind NAT Device if the GMS Console is placed behind a device using NAT on the
network. Type the IP address of the NAT device in the NAT Device IP Address field.
5 Select one of the following GMS modes from the Management Mode menu.
IPSEC Management Tunnel - Use the IPSec management tunnel included with the SonicWALL
security appliance. The default IPSec VPN settings are displayed.
Existing Tunnel - Use an existing tunnel for GMS management of the SonicWALL security
appliance.
HTTPS - Use HTTPS for GMS management of the SonicWALL security appliance. The following
configuration settings for HTTPS management mode are displayed:
Send Syslog Messages to a Distributed GMS Reporting Server - Sends Syslog Messages
to a GMS Reporting Server separated from the GMS management server.
GMS Reporting Server IP Address - Enter the IP address of the GMS Reporting Server, if the
server is separate from the GMS management server.
GMS Reporting Server Port - Enter the port for the GMS Reporting Server. The default value
is 514
6 Click OK.


System > Time

C H A P T E R

7
Chapter 7: Setting System Time

System > Time
The System > Time page defines the time and date settings to time stamp log events, to
automatically update SonicWALL Security Services, and for other internal purposes.

Set Time
The SonicWALL security appliance uses the time and date settings to time stamp log events, to
automatically update filtering subscription services, and for other internal purposes. By default, the
SonicWALL security appliance uses an internal list of public NTP servers to automatically update the
time. Network Time Protocol (NTP) is a protocol used to synchronize computer clock times in a
network of computers.

Setting the SonicWALL Security Appliance Time
To select your time zone and automatically update the time, choose the time zone from the Time
Zone menu. The Set time automatically using NTP setting is activated by default to use the NTP
(Network Time Protocol) to set time automatically. If you want to set your time manually, uncheck this
setting. Select the time in the 24-hour format using the Time (hh:mm:ss) menus and the date from


CHAPTER 7: Setting System Time

the Date menus. Automatically adjust clock for daylight saving changes is activated by default to
enable automatic adjustments for daylight savings time.

Selecting Display UTC in logs (instead of local time) specifies the use of universal time (UTC)
rather than local time for log events.

Selecting Display time in International format displays the date in International format, with the day
preceding the month.

After selecting your system time settings, click Apply.

NTP Settings
Network Time Protocol (NTP) is a protocol used to synchronize computer clock times in a network of
computers. The SonicWALL security appliance uses an internal list of NTP servers so manually
entering a NTP server is optional.

Select Use NTP to set time automatically to enable NTP. You can also configure Update Interval
(minutes) for the NTP server to update the SonicWALL security appliance. The default value is 60
minutes.
Tip: SonicWALL recommends using a local NTP server when possible to ensure that the SonicWALL
security appliance remains time synchronized in case of WAN connectivity problems.

To add an NTP server to the SonicWALL security appliance configuration, click Add. The Add NTP
Server window is displayed. Type the IP address of an NTP server in the NTP Server field. Click Ok.
Then click Apply on the System > Time page to update the SonicWALL security appliance. To delete
an NTP server, highlight the IP address and click Delete. Or, click Delete All to delete all servers.


System > Settings

C H A P T E R

8
Chapter 8: Configuring System Settings

System > Settings
The System > Settings page includes features for managing the SonicWALL security appliance
firmware and your custom preferences.

Settings
Import Settings
To import a previously saved preferences file into the SonicWALL security appliance, follow these
instructions:
1 Click Import Settings to import a previously exported preferences file into the SonicWALL
security appliance. The Import Settings window is displayed.
2 Click Browse to locate the file which has a *.exp file name extension.
3 Select the preferences file.
4 Click Import, and restart the firewall.


CHAPTER 8: Configuring System Settings

Export Settings
To export configuration settings from the SonicWALL security appliance, use the instructions below:
1 Click Export Settings.
2 Click Export.
3 Click Save, and then select a location to save the file. The file is named “sonicwall.exp” but can be
renamed.
4 Click Save. This process can take up to a minute. The exported preferences file can be imported
into the SonicWALL security appliance if it is necessary to reset the firmware.

Send TSR and Preference file to Support Backend
To send the Tech Support Report (TSR) and your preferences file directly to SonicWALL’s backend
server, click the Send TSR/Prefs button. The TSR and Prefs files are used by SonicWALL's
Technical Support to resolve issues as rapidly as possible. TSR and Prefs files can be sent manually
from the System > Settings page or they can be scheduled to be sent automatically at regular
intervals from the System > Diagnostics page. See “System > Diagnostics” on page 73 for more
information.

Firmware Management
The Firmware Management section provides settings that allow for easy firmware upgrade and
preferences management. The Firmware Management section allows you to:
• Upload and download firmware images and system settings.
• Boot to your choice of firmware and system settings.
• Manage system backups.
• Return your SonicWALL security appliance to the previous system state.
Note: SonicWALL security appliance SafeMode, which uses the same settings used in the Firmware
Management section, provides quick recovery from uncertain states.

New Firmware
To receive automatic notification of new firmware, select the Notify me when new firmware is
available check box. If you enable this feature, the SonicWALL security appliance sends a status
message to the SonicWALL security appliance firmware server daily with the following information:
• SonicWALL Serial Number
• Product Type
• Current Firmware Version
• Language
• Currently Available Memory
• ROM Version
• Options and Upgrades
Alert: After the initial 90 days from purchase, firmware updates are available only to registered users
with a valid support contract. You must register your SonicWALL security appliance at
<https://www.mysonicwall.com>.

Updating Firmware Manually
Click Upload New Firmware to load new firmware in the SonicWALL security appliance. A dialogue
box is displayed warning you that your current firmware version is overwritten by the uploaded
version. You should export your current SonicWALL security appliance settings to a preferences file
before uploading new firmware. Click Browse to locate the new firmware version. Once you locate
the file, click Upload to load the new firmware onto the SonicWALL security appliance.


System > Settings

Firmware Management Settings
The Firmware Management table has the following columns:
• Firmware Image - In this column, types of firmware images are listed:
Current Firmware, firmware currently loaded on the SonicWALL security appliance.
Current Firmware with Factory Default Settings, rebooting using this firmware image resets
the SonicWALL security appliance to its default IP addresses, user name, and password
Current Firmware with Backup Settings, a firmware image created by clicking Create
Backup Settings. This only displays after you create a backup image.
Uploaded Firmware, the last version uploaded from mysonicwall.com. This only displays after
you upload new firmware.
Uploaded Firmware with Factory Default Settings, rebooting using this firmware image
resets the SonicWALL security appliance to its default IP addresses, user name, and
password. This only displays after you upload new firmware.
Uploaded Firmware with Backup Settings, a firmware image created by clicking Create
Backup Settings. This only displays if you upload new firmware after you create a backup
image.
• Version - The firmware version is listed in this column.
• Date - The day, date, and time of downloading the firmware.
• Size - The size of the firmware file in Megabytes (MB).
• Download - Clicking the icon saves the firmware file to a new location on your
computer or network. Only uploaded firmware can be saved to a different location.
• Boot - Clicking the icon reboots the SonicWALL security appliance with the firmware version listed
in the same row.
Alert: When uploading firmware to the SonicWALL security appliance, you must not interrupt the Web
browser by closing the browser, clicking a link, or loading a new page. If the browser is interrupted,
the firmware may become corrupted.
Note: Clicking Boot next to any firmware image overwrites the existing current firmware image
making it the Current Firmware image. On the PRO 5060, the uploaded firmware images are
removed from the table after rebooting the SonicWALL security appliance.

SafeMode - Rebooting the SonicWALL Security Appliance
SafeMode allows easy firmware and preferences management as well as quick recovery from
uncertain configuration states.SafeMode allows you to select the firmware version to load and reboot
the SonicWALL security appliance.

To access the SonicWALL security appliance using SafeMode, use a narrow, straight object (such as
a straightened paper clip or a toothpick) to press and hold the reset button on the back of the security
appliance for more than twenty seconds. The reset button is in a small hole next to the console port or
next to the power supply:

After the SonicWALL security appliance reboots, open your Web browser and enter the current IP
address of the SonicWALL security appliance or the default IP address: 192.168.168.168. The
SafeMode page displays.
Note: Holding the reset button for two seconds will take a diagnostic snapshot to the console. Holding
the reset button for six to eight seconds will reboot the appliance in regular mode.


CHAPTER 8: Configuring System Settings

SafeMode allows you to do any of the following:
• Upload and download firmware images to the SonicWALL security appliance.
• Upload and download system settings to the SonicWALL security appliance.
• Boot to your choice of firmware options.
• Create a system backup file.
• Return your SonicWALL security appliance to a previous system state.

System Information
System Information for the SonicWALL security appliance is retained and displayed in this section.

Firmware Management
The Firmware Management table has the following columns:
• Firmware Image - In this column, five types of firmware images are listed:
Current Firmware, firmware currently loaded on the SonicWALL security appliance
Current Firmware with Factory Default Settings, rebooting using this firmware image resets
the SonicWALL security appliance to its default IP addresses, user name, and password
Current Firmware with Backup Settings, a firmware image created by clicking Create
Uploaded Firmware, the last version uploaded from mysonicwall.com
Uploaded Firmware with Factory Default Settings, rebooting using this firmware image
resets the SonicWALL security appliance to its default IP addresses, user name, and password
Uploaded Firmware with Backup Settings, a firmware image created by clicking Create
• Version - The firmware version is listed in this column.
• Size - The size of the firmware file in Megabytes (MB).
• Download - Clicking the icon saves the firmware file to a new location on your
computer or network. Only uploaded firmware can be saved to a different location.
• Boot - Clicking the icon reboots the SonicWALL security appliance with the firmware version listed
in the same row.
Note: Clicking Boot next to any firmware image overwrites the existing current firmware image
making it the Current Firmware image.

Click Boot in the firmware row of your choice to restart the SonicWALL security appliance.


System > Diagnostics

C H A P T E R

9
Chapter 9: Performing Diagnostic Tests

The System > Diagnostics page provides several diagnostic tools that help troubleshoot network
problems, as well as CPU and Process Monitors.


CHAPTER 9: Performing Diagnostic Tests

Tech Support Report
The Tech Support Report generates a detailed report of the SonicWALL security appliance
configuration and status, and saves it to the local hard disk using the Download Report button. This
file can then be e-mailed to SonicWALL Technical Support to help assist with a problem.
Alert: You must register your SonicWALL security appliance on mysonicwall.com to receive technical
support.

Before e-mailing the Tech Support Report to the SonicWALL Technical Support team, complete a
Tech Support Request Form at <https://www.mysonicwall.com>. After the form is submitted, a unique
case number is returned. Include this case number in all correspondence, as it allows SonicWALL
Technical Support to provide you with better service.

Generating a Tech Support Report

1 In the Tech Support Report section, select any of the following four report options:
VPN Keys - saves shared secrets, encryption, and authentication keys to the report.
ARP Cache - saves a table relating IP addresses to the corresponding MAC or physical
addresses.
DHCP Bindings - saves entries from the SonicWALL security appliance DHCP server.
IKE Info - saves current information about active IKE configurations.
2 Click Download Report to save the file to your system. When you click Download Report, a
warning message is displayed.
3 Click OK to save the file. Attach the report to your Tech Support Request e-mail.



You can also send a Tech Support Report (TSR) and your preferences file directly to SonicWALL’s
backend server. Click the Send TSR/Prefs button to do so. The TSR and Prefs files are used by
SonicWALL's Technical Support to resolve issues as rapidly as possible. This option is intended to be
used when working with SonicWALL Technical Support.

The Enable Periodic Secure Backup of TSR/Settings to MySonicwall option will automatically
send the TSR and Prefs file to the SonicWALL backend server. Again, this is intended to be used
when working with SonicWALL Technical Support. Enter the time interval specified by your support
staff.

The Console Status Level pulldown menu specifies the level of output
• Disabled - No unsolicited console output.
• Activity Indicator (Dots) - Dot’s are displayed on the console on a periodic basis to provide a
visual indication the system is running and operational. In addition, depressing the reset button for
2 to 4 seconds and then releasing it will cause system status and information regarding the
currently running task or process to be displayed on the console.
• Verbose - Similar to Dots except additional system status information is displayed when
depressing and releasing the reset button.
• Uptime/Verbose - Similar to Verbose except that instead of dots being displayed, system
congestion status is displayed. This is similar to the Linux Uptime command.



Diagnostic Tools
You select the diagnostic tool from the Diagnostic Tools menu in the Diagnostic Tool section of the
System > Diagnostics page. The following diagnostic tools are available:
• “Active Connections Monitor” on page 76
• “CPU Monitor” on page 77
• “DNS Name Lookup” on page 78
• “Find Network Path” on page 78
• “Packet Trace” on page 78
• “Ping” on page 80
• “Process Monitor” on page 80
• “Reverse Name Resolution” on page 80
• “Trace Route” on page 81

Active Connections Monitor
The Active Connections Monitor displays real-time, exportable (plain text or CSV), filterable views
of all connections to and through the SonicWALL security appliance.

Active Connections Monitor Settings

You can filter the results to display only connections matching certain criteria. You can filter by
Source IP, Destination IP, Destination Port, Protocol, Src Interface, and Dst Interface. Enter your
filter criteria in the Active Connections Monitor Settings table.

The fields you enter values into are combined into a search string with a logical AND. For example, if
you enter values for Source IP and Destination IP, the search string will look for connections
matching:
Source IP AND Destination IP



Check the Group box next to two or more criteria to combine them with a logical OR. For example, if
you enter values for Source IP, Destination IP, and Protocol, and check Group next to Source IP
and Destination IP, the search string will look for connections matching:
(Source IP OR Destination IP) AND Protocol

Click Apply Filter to apply the filter immediately to the Active Connections Monitor table. Click
Reset Filters to clear the filter and display the unfiltered results again.

You can export the list of active connections to a file. Click Export Results, and select if you want the
results exported to a plain text file, or a Comma Separated Value (CSV) file for importing to a
spreadsheet, reporting tool, or database. If you are prompted to Open or Save the file, select Save.
Then enter a filename and path and click OK.

The connections are listed in the Active Connections Monitor table. The table lists:
• Source IP
• Source Port
• Destination IP
• Destination Port
• Protocol
• Tx Bytes
• Rx Bytes

Click on a column heading to sort by that column.

CPU Monitor
The CPU Monitor diagnostic tool shows real-time CPU utilization in second, minute, hour, and day
intervals (historical data does not persist across reboots).

Note: High CPU utilization is normal during Web-management page rendering, and while saving
preferences to flash. Utilization by these tasks is an indication that available resources are being
efficiently used rather than sitting idle. Traffic handling and other critical, performance-oriented and
system tasks are always prioritized by the scheduler over management tasks like page rendering and
saving preferences.



DNS Name Lookup
The SonicWALL security appliance has a DNS lookup tool that returns the IP address of a domain
name. Or, if you enter an IP address, it returns the domain name for that address.
1 Enter the host name or IP address in the Look up name field. Do not add http to the host name.
2 The SonicWALL security appliance queries the DNS Server and displays the result in the Result
section. It also displays the IP address of the DNS Server used to perform the query.

The DNS Name Lookup section also displays the IP addresses of the DNS Servers configured on the
SonicWALL security appliance. If there is no IP address or IP addresses in the DNS Server fields, you
must configure them on the Network > Settings page.

Find Network Path
Find Network Path indicates if an IP host is located on the LAN or WAN ports. This can diagnose a
network configuration problem on the SonicWALL security appliance. For example, if the SonicWALL
security appliance indicates that a computer on the Internet is located on the LAN, then the network or
Intranet settings may be misconfigured.

Find Network Path can be used to determine if a target device is located behind a network router and
the Ethernet address of the target device. It also displays the gateway the device is using and helps
isolate configuration problems.

Packet Trace
The Packet Trace tool tracks the status of a communications stream as it moves from source to
destination. This is a useful tool to determine if a communications stream is being stopped at the
SonicWALL security appliance, or is lost on the Internet.



To interpret this tool, it is necessary to understand the three-way handshake that occurs for every
TCP connection. The following displays a typical three-way handshake initiated by a host on the
SonicWALL security appliance LAN to a remote host on the WAN.
1 TCP received on LAN [SYN]
From 192.168.168.158 / 1282 (00:a0:4b:05:96:4a)
To 204.71.200.74 / 80 (02:00:cf:58:d3:6a)

The SonicWALL security appliance receives SYN from LAN client.
2 TCP sent on WAN [SYN]
From 207.88.211.116 / 1937 (00:40:10:0c:01:4e)
To 204.71.200.74 / 80 (02:00:cf:58:d3:6a)

The SonicWALL security appliance forwards SYN from LAN client to remote host.
3 TCP received on WAN [SYN,ACK]
From 204.71.200.74 / 80 (02:00:cf:58:d3:6a)
To 207.88.211.116 / 1937 (00:40:10:0c:01:4e)

The SonicWALL security appliance receives SYN,ACK from remote host.
4 TCP sent on LAN [SYN,ACK]
From 204.71.200.74 / 80 (02:00:cf:58:d3:6a)
To 192.168.168.158 / 1282 (00:a0:4b:05:96:4a)

The SonicWALL security appliance forwards SYN,ACK to LAN client.
5 TCP received on LAN [ACK]
From 192.168.168.158 / 1282 (00:a0:4b:05:96:4a)
To 204.71.200.74 / 80 (02:00:cf:58:d3:6a)

Client sends a final ACK, and waits for start of data transfer.
6 TCP sent on WAN [ACK]
From 207.88.211.116 / 1937 (00:40:10:0c:01:4e
To 204.71.200.74 / 80 (02:00:cf:58:d3:6a)

The SonicWALL security appliance forwards the client ACK to the remote host and waits for the data
transfer to begin.

When using packet traces to isolate network connectivity problems, look for the location where the
three-way handshake is breaking down. This helps to determine if the problem resides with the
SonicWALL security appliance configuration, or if there is a problem on the Internet.

Select Packet Trace from the Diagnostic tool menu.
Tip: Packet Trace requires an IP address. The SonicWALL security appliance DNS Name Lookup
tool can be used to find the IP address of a host.
7 Enter the IP address of the remote host in the Trace on IP address field, and click Start. You
must enter an IP address in the Trace on IP address field; do not enter a host name, such as
“www.yahoo.com”. The Trace is off turns from red to green with Trace Active displayed.
8 Contact the remote host using an IP application such as Web, FTP, or Telnet.
9 Click Refresh and the packet trace information is displayed.
10 Click Stop to terminate the packet trace, and Reset to clear the results.



The Captured Packets table displays the packet number and the content of the packet, for instance,
ARP Request send on WAN 42 bytes.

Select a packet in the Captured Packets table to display packet details. Packet details include the
packet number, time, content, source of the IP address, and the IP address destination.

Ping
The Ping test bounces a packet off a machine on the Internet and returns it to the sender. This test
shows if the SonicWALL security appliance is able to contact the remote host. If users on the LAN are
having problems accessing services on the Internet, try pinging the DNS server, or another machine
at the ISP location. If the test is unsuccessful, try pinging devices outside the ISP. If you can ping
devices outside of the ISP, then the problem lies with the ISP connection.
1 Select Ping from the Diagnostic Tool menu.
2 Enter the IP address or host name of the target device and click Go.
3 If the test is successful, the SonicWALL security appliance returns a message saying the IP
address is alive and the time to return in milliseconds (ms).

Process Monitor
Process Monitor shows individual system processes, their CPU utilization, and their system time.

Reverse Name Resolution
The Reverse Name Resolution tool is similar to the DNS name lookup tool, except that it looks up a
server name, given an IP address.

Enter an IP address in the Reverse Lookup the IP Address field, and it checks all DNS servers
configured for your security appliance to resolve the IP address into a server name.


System > Restart

Trace Route
Trace Route is a diagnostic utility to assist in diagnosing and troubleshooting router connections on
the Internet. By using Internet Connect Message Protocol (ICMP) echo packets similar to Ping
packets, Trace Route can test interconnectivity with routers and other hosts that are farther and
farther along the network path until the connection fails or until the remote host responds.

To use Trace Route, type the IP address or domain name of the destination host. For example, type
yahoo.com and click Go. A second window is displayed with each hop to the destination host. By
following the route, you can diagnose where the connection fails between the SonicWALL security
appliance and the destination.

System > Restart
Click Restart to display the System > Restart page.

The SonicWALL security appliance can be restarted from the Web Management interface. Click
Restart SonicWALL and then click Yes to confirm the restart.

The SonicWALL security appliance takes approximately 2 to 3 minutes to restart, and the yellow Test
light is lit during the restart. During the restart time, Internet access is momentarily interrupted on the
LAN.


PART

3
Network
Part 3


Network > Settings

C H A P T E R

10
Chapter 10: Configuring Network Settings

Network > Settings
The Network > Settings page allows you to configure your network and Internet connectivity settings
in the Interface table.


CHAPTER 10: Configuring Network Settings

Setup Wizard

The Setup Wizard button accesses the SonicWALL Setup Wizard, which offers an easy-to-use
method for configuring your SonicWALL security appliance for the most common Internet connectivity
options. If you are unsure about configuring network settings manually, use SonicWALL Setup
Wizard.

Interfaces
The Interfaces section displays the available network interfaces for your SonicWALL security
appliance model. The Interfaces table lists the following information about the interfaces:
• Name - the name of the interface
• Mode - the network addressing mode (the WAN) interface
• IP Address - IP address assigned to the interface or whether ranges are defined for the Opt
interface in Transparent mode.
• Subnet Mask - the network mask assigned to the subnet
• Status - the link status and speed
• Configure - click the edit icon to display the properties window for configuring the interface.


Configuring the WAN Interface

Interface Options by SonicWALL Security Appliance

SonicWALL Security Appliance Model Interfaces

SonicWALL TZ 180 WAN, LAN, OPT


DNS Settings
Tip: Entering correct DNS information is critical to the proper functioning of your SonicWALL security
appliance as well as the users and systems behind it.

DNS (Domain Name System) is a hierarchical system for identifying hosts on the Internet or on a
private, corporate TCP/IP internetwork. It is a method for identifying hosts with friendly names instead
of IP addresses as well as a method for locating hosts. Hosts are located by resolving their names
into their associated IP addresses so network communication can be initiated with the host computer.

The DNS Settings setting information is automatically entered when you configure your WAN
interface settings. Although, you can enter up to three IP addresses in the DNS Settings section if
your WAN Internet connection using static IP addressing. However, at least one IP address of a DNS
Server is required to resolve host names to IP addresses or IP addresses to host names.
Note: It is strongly recommended to have at least two DNS IP addresses configured on the
SonicWALL security appliance. This provides redundancy in the event one DNS server is unavailable.
1 Enter the IP address in the DNS Server 1 field.
2 Enter the second IP address in the DNS Server 2 field.
3 Click Apply for the changes to take effect on the SonicWALL security appliance.

To pass DNS settings to computers on the LAN, you must enable the SonicWALL security appliance
DHCP server on the Network > DHCP Server page.


The Mode menu in the Interfaces table for the WAN interface determines the network address
scheme of your SonicWALL security appliance. It includes six options:



• Transparent Mode enables the SonicWALL security appliance to bridge the WAN subnet onto the
LAN interface. It requires valid IP addresses for all computers on your network, but allows remote
access to authenticated users. Your public WAN IP address is visible to the Internet.
Note: Transparent Mode is not available on SonicWALL wireless security appliances: TZ 50 Wireless,
TZ 150 Wireless, TZ 170 Wireless, and the TZ 180 Wireless.
• NAT Enabled mode translates the private IP addresses on the network to the single, valid IP
address of the SonicWALL security appliance. Select NAT Enabled if your ISP assigned you only
one or two valid IP addresses.
• NAT with DHCP Client mode configures the SonicWALL security appliance to request IP settings
from a DHCP server on the Internet. NAT with DHCP Client is a typical network addressing mode
for cable and DSL customers.
• NAT with PPPoE mode uses PPPoE to connect to the Internet. If desktop software and a user
name and password is required by your ISP, select NAT with PPPoE.
• NAT with L2TP Client mode uses IPSec to connect a L2TP server and encrypts all data
transmitted from the client to the server. However, it does not encrypt network traffic to other
destinations.
• NAT with PPTP Client mode uses Point-to-Point Tunneling Protocol (PPTP) to connect to a
remote server. It supports older Microsoft implementations requiring tunneling connectivity.

Configuring Transparent Mode
Transparent Mode requires valid IP addresses for all computers on your network, and allows remote
access to authenticated users. Your public WAN IP address is visible to the Internet. To enable
Transparent Mode, select Transparent Mode from the Mode menu. The WAN and LAN IP addresses
are now identical. To complete the configuration, click Intranet in the Network menu list.
Note: Transparent Mode is not available on SonicWALL wireless security appliances: TZ 50 Wireless,
TZ 150 Wireless, TZ 170 Wireless, and the TZ 180 Wireless.
1 Select Specified address ranges are attached to the LAN link.
2 Click Add in the From Address table.
3 Enter the range of network IP addresses on the LAN.
4 Click OK and then click Apply.
5 Click Restart in the Status bar of the management interface. The SonicWALL security appliance
restarts and updates the configuration.



Configuration Example
Your ISP has given you a public IP address of 66.217.71.191 and a range of public IP address from
66.217.71.192 to 66.217.71.200. To configure the SonicWALL security appliance in Transparent
Mode, select Transparent Mode from the Mode menu. Then follow these steps:
1 Click the icon in the Configure column to display the WAN Settings window.
2 Enter your IP address, 66.217.71.191, in the WAN IP Address field. Complete the rest of the
fields in the WAN Settings window using information provided by the ISP.
3 Click OK.
4 Click Intranet in the Network menu list.
5 Select Specified address ranges are attached to the LAN link.
6 Click Add in the LAN/WAN Client Address Ranges table.
7 Enter your IP address, 66.217.71.192, in the IP Address From field.
8 Enter the IP address, 66.217.71.200, in the IP Address To field and click OK.
9 Click Apply, and then Restart in the Status bar. The SonicWALL security appliance restarts and
updates the configuration.
Note: Transparent Mode is not available on SonicWALL wireless security appliances: TZ 50
Wireless, TZ 150 Wireless, TZ 170 Wireless, and the TZ 180 Wireless.



Configuring NAT Enabled
If your ISP provides a static IP address for your Internet connection, use the NAT Enabled.
1 Select NAT Enabled from the drop-down menu in the Mode column of the Interfaces table.
2 Click on the edit icon in the Configure column of the WAN interface. The WAN Properties
window is displayed.

3 In the WAN Settings section, enter a valid public IP address in the SonicWALL WAN IP (NAT
Public) Address field.
4 Enter the subnet mask in the WAN Subnet Mask field.
5 Enter the IP address of the router in the WAN Gateway (Router) Address field.
6 Click OK.

Configuring NAT with DHCP Client
If your ISP did not provide you with a public IP address, the SonicWALL security appliance can obtain
an IP address from a DHCP server at the ISP. NAT with DHCP Client is typically used with cable and
DSL connections. To configure NAT with DHCP Client, log into the SonicWALL security appliance
and click Network.
1 Select NAT with DHCP Client from the drop-down menu in the Mode column of the Interfaces
table.
2 Click the edit icon in the WAN entry of the Interfaces table. The WAN Properties window is
displayed.
3 Enter the host name assigned to you by your ISP in the Host Name field. (Optional)
4 Click Renew to obtain new IP address settings for the SonicWALL security appliance.
5 Click Release to remove the IP address settings from the SonicWALL security appliance. Click
Refresh to reload the current settings into the SonicWALL security appliance.
6 Click OK.
Note: DNS Settings are obtained automatically when the SonicWALL security appliance receives its
IP address information from the DHCP Server.



Configuring NAT with PPPoE Client
The SonicWALL security appliance can use Point-to-Point Protocol over Ethernet to connect to the
Internet. If your ISP requires the installation of desktop software as well as a user name and
password to access the Internet, enable NAT with PPPoE Client.
1 Select NAT with PPPoE Client from the drop-down menu in the Mode column of the Interfaces
table.
displayed.
3 Select Obtain an IP Address Automatically if you do not have a public IP address from your ISP.
If you have an IP address from your ISP, select Use the following Address, and enter the IP
address in the IP address field.
4 Click the PPPoE tab.
5 Enter your user name and password provided by your ISP in the User Name and User Password
fields.
6 Select Inactivity Disconnect (minutes) to end the connection after a specified time of inactivity.
10 minutes is the default value.
7 Click OK.

Configuring NAT with L2TP Client
If your Internet connection is provided through a L2TP server, you must configure the SonicWALL
security appliance to use NAT with L2TP Client. L2TP (Layer 2 Tunneling Protocol) provides
interoperability between VPN vendors that protocols such as Point-to-Point Tunneling Protocol
(PPTP) and Layer 2 Forwarding (L2F) do not have.
1 Log into the SonicWALL security appliance, and click Network.
2 Select NAT with L2TP Client from the Network Addressing Mode menu.
displayed.
4 Obtain an IP Address Automatically is selected by default. Enter your host name in the Host
Name field. Click Renew to obtain new IP addressing information. Click Release to discard IP
addressing information. Click Refresh to reload the IP addressing information.
5 If you have IP addressing information, select Use the following IP Address.
6 Enter your public IP address in the SonicWALL WAN IP (NAT Public) Address field.
7 Enter the WAN Subnet information in the WAN Subnet Mask field.
8 Enter the WAN Gateway IP address in the WAN Gateway (Router) Address field.
9 Click on the L2TP tab.
10 Enter your user name in the User Name field.
11 Enter your password in the User Password field.
12 Enter the IP address of the L2TP Server in the L2TP Server IP Address field.
13 Enter the host name of the L2TP Server in the L2TP Host Name field.
15 Once a connection is established, the SonicWALL security appliance WAN IP address, the
Gateway address and the DNS Server IP addresses are displayed in the Settings Acquired via
L2TP section.
16 Click OK.



Configuring NAT with PPTP Client
If your Internet connection is provided through a PPTP server, you must configure the SonicWALL
security appliance to use NAT with PPTP Client.

Log into the SonicWALL security appliance, and click Network.
1 Select NAT with PPTP Client from the Network Addressing Mode menu.
displayed.
3 Obtain an IP Address Automatically is selected by default. Enter your host name in the Host
Name field. Click Renew to obtain new IP addressing information. Click Release to discard IP
addressing information. Click Refresh to reload the IP addressing information.
4 If you have IP addressing information, select Use the following IP Address.
5 Enter the WAN IP address in the SonicWALL WAN IP (NAT Public) Address field.
6 Enter the WAN Subnet information in the WAN Subnet Mask field.
7 Enter the WAN Gateway IP address in the WAN Gateway (Router) Address field.
8 Click on the PPTP tab.
9 Enter your user name in the User Name field.
10 Enter your password in the User Password field.
11 Enter the IP address of the PPTP Server in the PPTP Server IP Address field.
12 Enter the host name of the PPTP Client in the PPTP (Client) Host Name field.
14 Once a connection is established, the SonicWALL security appliance WAN IP address, the
Gateway address and the DNS Server IP addresses are displayed in the Settings Acquired via
PPTP section.
15 Click OK.

Configuring Ethernet Settings in WAN Properties
The Ethernet tab in the WAN Properties window allows you to manage the Ethernet settings of the
WAN interface. For most networks, you do not need to make any changes on this page.



The WAN Interface Settings information at the top of the Ethernet page is the Ethernet address of
the WAN interface on the SonicWALL security appliance.

Auto Negotiate is selected by default because the Ethernet links automatically negotiate the speed
and duplex mode of the Ethernet connection. If you select Force, you must force the connection
speed and duplex from the Ethernet card to the SonicWALL security appliance as well.

If you select Force, an information dialog is displayed with the following message:

Disabling Auto Negotiate on this interface will also disable AutoMDIX on this interface. You may need
to switch from a straight-through Ethernet cable to a cross over Ethernet cable, or vice-versa. Click
OK to proceed.

Select Proxy management workstation Ethernet address on WAN if you are managing the
Ethernet connection from the LAN side of your network. The SonicWALL security appliance takes the
Ethernet address of the computer managing the SonicWALL security appliance and proxies that
address onto the WAN port of the SonicWALL security appliance. For instance, if your ISP is using
the MAC address of your network card for identification, you can proxy the MAC address of your
network card onto the SonicWALL WAN port.
Tip: If you are not managing the Ethernet connection from the LAN, the SonicWALL security
appliance looks for a random computer on the network creating a lengthy search process.

Note: If you enable this feature, it may take the SonicWALL a lengthy period of time to locate the
management station.

Fragment non-VPN outbound packets larger than WAN MTU is selected by default with a default
WAN MTU value of 1500 based on the Ethernet standard MTU. Specifies all non-VPN outbound
packets larger than this Interface’s MTU be fragmented. The minimum value is 68. Decreasing the
packet size can improve network performance as large packets require more network transmissions
when a router cannot handle the packet size. Specifying the fragmenting of VPN outbound packets is
set in the VPN > Advanced page.

Ignore Don’t Fragment (DF) Bit - Overrides DF bits in packets.

Select Enable Bandwidth Management to allocate bandwidth resources to critical applications on
your network. Enter the total bandwidth available in the Available WAN Bandwidth (Kbps) field.

20.00 Kbps is the default available WAN bandwidth.
Alert: Bandwidth management is only available on outbound network traffic.



Configuring the LAN Interface
Basic LAN Configuration
1 Click on the edit icon in the Configure column of the LAN information. The LAN Properties

2 In the General Settings section, enter a valid private IP address in the SonicWALL LAN IP field.
3 Enter the subnet mask in the LAN Subnet Mask field.
4 Click OK.

Configuring Multiple LAN Subnets
This multiple LAN subnet feature supports legacy networks incorporating the SonicWALL security
appliance, as well as enable you to add more nodes if the original subnet is full. To configure this
feature, you must have an additional IP address assigned to the SonicWALL security appliance. All
users on the subnet must use this address as their default router/gateway address.
1 Click on the edit icon in the Configure column of the LAN information. The LAN Properties
2 Click Add. The Add LAN Subnet Entry window is displayed.

3 Enter the additional LAN IP address in the IP Address field.
4 Enter the subnet in the Subnet Mask field. You can edit or delete any LAN subnet entries.
Select an entry and click Edit to change the information.
Select an entry and click Delete to remove the entry from the table.
Click Delete All to remove all the entries in the table.
5 Click OK.


Configuring the LAN Interface

Configuring Ethernet Settings
The Ethernet tab in the LAN Properties window allows you to manage the Ethernet settings of the
LAN interface. For most networks, you do not need to make any changes on this page.

The LAN Interface Settings information at the top of the Ethernet page is the Ethernet address of
the LAN interface on the SonicWALL security appliance.

Auto Negotiate is selected by default because the Ethernet links automatically negotiate the speed
and duplex mode of the Ethernet connection. If you select Force, you must force the connection
speed and duplex from the Ethernet card to the SonicWALL security appliance as well.

If you select Force, an information dialog is displayed with the following message:
Note: Disabling Auto Negotiate on this interface will also disable AutoMDIX on this interface. You
may need to switch from a straight-through Ethernet cable to a cross over Ethernet cable, or vice-
versa. Click OK to proceed.

Route Advertisement - DMZ
The SonicWALL security appliance uses RIPv1 or RIPv2 to advertise its static and dynamic routes to
other routers on the network. Choose between RIPv1 or RIPv2 based on your router’s capabilities or
configuration. RIPv1 is an earlier version of the protocol that has fewer features, and it also sends
packets via broadcast instead of multicast. RIPv2 packets are backwards-compatible and can be
accepted by some RIPv1 implementations that provide an option of listening for multicast packets.
The RIPv2 Enabled (broadcast) selection broadcasts packets instead of multicasting packets is for
heterogeneous networks with a mixture of RIPv1 and RIPv2 routers.

Route Advertisement Configuration
To enable Route Advertisement for an Interface, follow these steps:
1 Click the edit icon in the Configure column for the interface. The Route Advertisement
Configuration window is displayed.
2 Select one of the following types of RIP Advertisements:
RIPv1 Enabled - RIPv1 is the first version of Routing Information Protocol.
RIPv2 Enabled (multicast) - to send route advertisements using multicasting (a single data
packet to specific notes on the network).


RIPv2 Enabled (broadcast) - to send route advertisements using broadcasting (a single data
packet to all nodes on the network).
3 Enable Advertise Static Routes if you have static routes configured on the SonicWALL security
appliance, enable this feature to exclude them from Route Advertisement.
4 Enter a value in seconds between advertisements broadcasted over a network in the Route
Change Damp Time (seconds) field. The default value is 30 seconds. A lower value corresponds
with a higher volume of broadcast traffic over the network. The Route Change Damp Time
(seconds) setting defines the delay between the time a VPN tunnel changes state (up or down)
and the time the change is advertised with RIP. The delay, in seconds, prevents ambiguous route
advertisements sent as a result of temporary change in the VPN tunnel status.
5 Enter the number of advertisements that a deleted route broadcasts until it stops in the Deleted
Route Advertisements (0-99) field. The default value is 1.
6 Enter a value from 1 to 15 in the Route Metric (1-15) field. This is the number of times a packet
touches a router from the source IP address to the destination IP address.
7 If RIPv2 is selected from the Route Advertisements menu, you can enter a value for the route tag
in the RIPv2 Route Tag (4 HEX Digits) field. This value is implementation-dependent and
provides a mechanism for routers to classify the originators of RIPv2 advertisements. This field is
optional.
8 If you wan to enable RIPv2 authentication, select one of the following options from the RIPv2
Authentication menu:
User defined - Enter 4 hex digits in the Authentication Type (4 hex digits) field. Enter 32 hex
digits in the Authentication Data (32 Hex Digits) field.
Cleartext Password - Enter a password in the Authentication Password (Max 16 Chars) field.
A maximum of 16 characters can be used to define a password.
MD5 Digest - Enter a numerical value from 0-255 in the Authentication Key-Id (0-255) field.
Enter a 32 hex digit value for the Authentication Key (32 hex digits) field, or use the generated
key.
9 Click OK.

Configuring the OPT Interface
You can configure the OPT interface in either Transparent Mode or NAT Mode:
• Transparent Mode enables the SonicWALL security appliance to bridge the OPT subnet onto the
WAN interface. It requires valid IP addresses for all computers connected to the OPT interface on
your network, but allows remote access to authenticated users. You can use the OPT interface in
Transparent mode for public servers and devices with static IP addresses you want visible outside
your SonicWALL security appliance-protected network.
• NAT Mode translates the private IP addresses of devices connected to the OPT interface to a sin-
gle, static IP address. By default, the OPT interface is configured in NAT Mode.


Configuring the OPT Interface

access to authenticated users.
Note: Transparent Modes are not available on SonicWALL wireless security appliances: TZ 50
Wireless, TZ 150 Wireless, TZ 170 Wireless, and TZ 180 Wireless.

To enable Transparent Mode:
1 Click the Edit Icon in the line for the OPT interface in the Interfaces table. The OPT Properties
window displays.

2 Select OPT in Transparent Mode. The OPT and WAN IP addresses are now identical.
3 To add an address or range of addresses, click Add below the address range list. The
Add Opt Entry dialog box displays.

4 Enter a single IP address or the beginning of a range of IP addresses in the IP Address From
field.
Note: The address or range of addresses must be within the available range of IP addresses for your
WAN interface.
5 For a range of IP addresses, enter the ending address in the IP Address To field.



Configuring NAT Mode
NAT Enabled mode gives the OPT interface a single IP address and a subnet of available IP
address. The IP addresses of devices connecting to the OPT interface are translated to the single
OPT interface IP address.
1 Click the Edit Icon in the line for the OPT interface in the Interfaces table. The OPT Properties
window displays.

2 Select OPT in NAT Mode.
3 Enter an IP address in the OPT Private Address field.
4 Enter the subnet mask in the OPT Subnet Mask field.
5 If you want to use the OPT interface as a DMZ, enter a publicly visible IP address in the
DMZ NAT Many-to-One Public Address field. This address will be visible to the internet for
public servers in your network.
6 Click OK.

dmzprops

Configuring the DMZ Interface
You can configure the DMZ interface in either Transparent Mode or NAT Mode:
• Transparent Mode enables the SonicWALL security appliance to bridge the DMZ subnet onto the
WAN interface. It requires valid IP addresses for all computers connected to the DMZ interface on
your network, but allows remote access to authenticated users. You can use the DMZ interface in
Transparent mode for public servers and devices with static IP addresses you want visible outside
your SonicWALL security appliance-protected network.
• NAT Mode translates the private IP addresses of devices connected to the DMZ interface to a sin-
gle, static IP address.


Configuring the DMZ Interface

access to authenticated users.

To enable Transparent Mode:
1 Click the Edit Icon in the line for the DMZ interface in the Interfaces table. The DMZ
Properties window displays.

2 Select DMZ in Transparent Mode. The OPT and WAN IP addresses are now identical.
3 To add an address or range of addresses, click Add below the address range list. The Add DMZ
Entry dialog box displays.

4 Enter a single IP address or the beginning of a range of IP addresses in the IP Address From
field.
Note: The address or range of addresses must be within the available range of IP addresses for your
WAN interface.
5 For a range of IP addresses, enter the ending address in the IP Address To field.



Configuring NAT Mode
NAT Mode gives the DMZ interface a single IP address and a subnet of available IP address. The IP
addresses of devices connecting to the DMZ interface are translated to the single DMZ interface IP
address.
1 Click the edit icon in the line for the DMZ interface in the Interfaces table. The DMZ
Properties window displays.

2 Select DMZ in NAT Mode.
3 Enter an IP address in the DMZ Private Address field.
4 Enter the subnet mask in the DMZ Subnet Mask field.
5 To use the DMZ interface as a DMZ, enter a publicly visible IP address in the DMZ NAT Many-to-
One Public Address field. This address will be visible to the Internet for public servers in your
network.
6 Click OK.

Configuring WLAN Properties
The SonicWALL TZ 50 Wireless, TZ 150 Wireless, TZ 170 Wireless, and TZ 180 Wireless security
appliances includes the WLAN interface in the Interfaces table on the Network>Settings page.

Clicking the Edit icon for the WLAN interface displays the WLAN Settings window for configuring the
WLAN properties.

• The Enable WLAN setting is checked by default to activate the WLAN interface on the
• Select WiFiSec Enforcement to require that all traffic that enters into the WLAN interface be
either IPSec traffic, WPA traffic, or both. With WiFiSec Enforcement enabled, all non-guest wire-
less clients are required to use the strong security of IPSec. The VPN connection inherent in


Configuring WLAN Properties

WiFiSec terminates at the GroupVPN Policy, which you can configure on the VPN > Settings
page.
• If you have not selected WiFiSec Enforcement, you can select Require WiFiSec for Site-to-Site
VPN Tunnel Traversal to require WiFiSec security for all wireless connections through the WLAN
zone that are part of a site-to-site VPN.
• Click Trust WPA traffic to accept WPA as an allowable alternative to IPSec. The SonicWALL
wireless security appliance supports both WPA-PSK (Pre-shared key) and WPA-EAP (Extensible
Authentication Protocol using an external 802.1x/EAP capable RADIUS server).
• WLAN IP Address: The IP address of the SonicWALL wireless security appliance WLAN inter-
face.
• WLAN Subnet Mask: The subnet of the SonicWALL wireless security appliance WLAN interface.
• SSID: Enter a recognizable string for the SSID for the wireless security appliance. This is the
name that will appear in clients’ lists of available wireless connections.
• Radio Mode: The default 2.4GHZ 802.11b/g mixed enables the SonicWALL wireless security
appliance to support both 802.11b and 802.11g wireless card clients.
• Country Code: Select the country where you are operating the SonicWALL wireless security
appliance. The country code determines which Regulatory Domain the radio operation falls
under.
• Channel: Select the channel the radio will operate on. The default is AutoChannel, which auto-
matically selects the channel with the least interference. Use AutoChannel unless you have a
specific reason to use or avoid specific channels.


Network > One-to-One NAT

C H A P T E R

11
Chapter 11: Configuring One-to-One NAT

One-to-One NAT maps valid, external addresses to private addresses hidden by NAT. Computers on
your private LAN or OPT interface are accessed on the Internet at the corresponding public IP
addresses.

You can create a relationship between internal and external addresses by defining internal and
external address ranges. Once the relationship is defined, the computer with the first IP address of
the private address range is accessible at the first IP address of the external address range, the
second computer at the second external IP address, etc.

To configure One-to-One NAT, select the Network > One-to-One NAT page.

To configure One-to-One NAT, complete the following instructions.
1 Select the Enable One-to-One NAT check box.
2 Click Add. The Add NAT Entry window is displayed.

3 Enter the beginning IP address of the private address range being mapped in the Private Range
Start field. This is the IP address of the first machine that is accessible from the Internet.


CHAPTER 11: Configuring One-to-One NAT

4 Enter the beginning IP address of the valid address range being mapped in the Public Range
Begin field. This address should be assigned by your ISP and be in the same logical subnet as the
NAT public IP address.
Alert: Do not include the SonicWALL security appliance WAN IP (NAT Public) Address or the WAN
Gateway (Router) Address in this range.
5 Enter the number of public IP addresses that should be mapped to private addresses in the Range
Length field. The range length can not exceed the number of valid IP addresses. Up to 64 ranges
can be added. To map a single address, enter a Range Length of 1.
6 Click OK.
7 Click Apply. Once the SonicWALL security appliance has been updated, a message confirming
the update is displayed at the bottom of the browser window.
Alert: One-to-One NAT maps valid, public IP addresses to private LAN or OPT IP addresses. It does
not allow traffic from the Internet to the private LAN.

Tip: After One-to-One NAT is configured, create an Allow rule to permit traffic from the Internet to the
private IP address(es) on the LAN or OPT.

To edit an existing entry in the One-to-One Network Address Translation (NAT) Ranges, click the edit
icon. To delete an entry, click the delete icon. To delete all entries, click Delete All.

One-to-One NAT Configuration Example
This example assumes that you have a SonicWALL security appliance running in the NAT-enabled
mode, with IP addresses on the LAN in the range 192.168.1.1 - 192.168.1.254, and a WAN IP
address of 208.1.2.2. Also, you own the IP addresses in the range 208.1.2.1 - 208.1.2.6.
Alert: If you have only one IP address from your ISP, you cannot use One-to-One NAT.

You have three web servers on the LAN with the IP addresses of 192.168.1.10, 192.168.1.11, and
192.168.1.12. Each of the servers must have a default gateway pointing to 192.168.1.1, the
SonicWALL security appliance LAN IP address.

You also have three additional IP addresses from your ISP, 208.1.2.4, 208.1.2.5, and 208.1.2.6, that
you want to use for three additional web servers. Use the following steps to configure One-to-One
NAT:
1 Select Enable One-to-One NAT.
2 Click Add. The Add NAT Entry window is displayed
3 Enter in the IP address, 192.168.1.10, in the Private Range Begin field.
4 Enter in the IP address, 208.1.2.4, in the Public Range Begin field.
5 Enter in 3 in the Range Length field.
Tip: You can configure the IP addresses individually, but it is easier to configure them in a range.
However, the IP addresses on both the private and public sides must be consecutive to configure a
range of addresses.
6 Click OK.
7 Click Apply.
8 Click Firewall, then Access Rules.
9 Click Add.



10 Configure the following settings:
• Allow
• Service - HTTP
• Source - WAN
• Destination - LAN 192.168.1.10 - 192.168.1.12

In the Options tab, select always from the Apply this Rule menu.
11 Click OK.

Requests for <http://208.1.2.4> are answered by the server at 192.168.1.10. Requests for
<http://208.1.2.5> are answered by the server at 192.168.1.11, and requests for <http://208.1.2.6>
are answered by the server at 192.168.1.12. From the LAN, the servers can only be accessed using
the private IP addresses (192.168.1.x), not the public IP addresses or domain names. For example,
from the LAN, you must use URLs like <http://192.168.1.10> to reach the web servers. An IP address,
such as 192.168.1.10, on the LAN cannot be used in both public LAN server configurations and in
public LAN server One-to-One NAT configurations.


CHAPTER 11: Configuring One-to-One NAT


Network > Web Proxy

C H A P T E R

12
Chapter 12: Configuring Web Proxy Settings

Network > Web Proxy

A Web proxy server intercepts HTTP requests and determines if it has stored copies of the requested
Web pages. If it does not, the proxy completes the request to the server on the Internet, returning the
requested information to the user and also saving it locally for future requests.

Setting up a Web proxy server on a network can be cumbersome, because each computer on the
network must be configured to direct Web requests to the server.

If you have a proxy server on your network, instead of configuring each computer’s Web browser to
point to the proxy server, you can move the server to the WAN and enable Web Proxy Forwarding.
The SonicWALL security appliance automatically forwards all Web proxy requests to the proxy server
without requiring all the computers on the network to be configured.

Configuring Automatic Web Proxy Forwarding
Alert: The proxy server must be located on the WAN; it can not be located on the LAN.

To configure a Proxy Web sever, select the Network > Web Proxy page.
1 Connect your Web proxy server to a hub, and connect the hub to the SonicWALL security
appliance WAN port.
2 Enter the name or IP address of the proxy server in the Proxy Web Server (name or IP address)
field.
3 Enter the proxy IP port in the Proxy Web Server Port field.
4 Click Apply. Once the SonicWALL security appliance has been updated, a message confirming


CHAPTER 12: Configuring Web Proxy Settings

Bypass Proxy Servers Upon Proxy Failure
If a Web proxy server is specified on the Network > Web Proxy page, selecting the Bypass Proxy
Servers Upon Proxy Server Failure check box allows clients behind the SonicWALL security
appliance to bypass the Web proxy server in the event it becomes unavailable. Instead, the client’s
browser accesses the Internet directly as if a Web proxy server is not specified.

Click Apply. Once the SonicWALL security appliance has been updated, a message confirming the
update is displayed at the bottom of the browser window.

Forward OPT/DMZ/WLAN Client Requests to Proxy Server
By default, client requests coming in through the OPT interface are not forwarded to the Proxy Server.
To send OPT/DMZ/WLAN client requests as well as LAN client requests, check the Forward OPT/
DMZ/WLAN Client Requests to Proxy Server checkbox.


Network > Intranet

C H A P T E R

13
Chapter 13: Configuring Intranet Settings

Network > Intranet
The SonicWALL security appliance can be configured as an Intranet firewall to prevent network users
from accessing sensitive servers. By default, users on your LAN can access the Internet router, but
not devices connected to the WAN port of the SonicWALL security appliance. To enable access to the
area between the SonicWALL security appliance WAN port and the Internet, you must configure the
Intranet settings on the SonicWALL security appliance on the Network > Intranet page.

Intranet firewalling is achieved by connecting the SonicWALL security appliance between an
unprotected and a protected segment.

Installation
1 Connect the LAN Ethernet port on the back of the SonicWALL security appliance to the network
segment to be protected against unauthorized access.
Alert: Devices connected to the WAN port do not have firewall protection. It is recommended that you
use another SonicWALL security appliance to protect computers on the WAN.
2 Connect the SonicWALL security appliance to a power outlet and make sure the SonicWALL
security appliance is powered on.

To enable an Intranet firewall, you must specify which machines are located on the LAN, or you must
specify which machines are located on the WAN.

It is best to select the network area with the least number of machines. For example, if only one or two
machines are connected to the WAN, select Specified address ranges are attached to the WAN


CHAPTER 13: Configuring Intranet Settings

link. That way, you only have to enter one or two IP addresses in the Add Range section. Specify the
IP addresses individually or as a range.

Intranet Settings
1 In the left-navigation menu, select Network and then Intranet.
2 Select one of the following options:
• SonicWALL WAN link is connected directly to the Internet router
Select this option if the SonicWALL security appliance is protecting your entire network. This is the
default setting.
• Specified address ranges are attached to the LAN link
Select this option if it is easier to specify the devices on your LAN. Then enter your LAN IP address
range(s). If you do not include all computers on your LAN, the computers not included will be
unable to send or receive data through the SonicWALL security appliance.
• Specified address ranges are attached to the WAN link
Select this option if it is easier to specify the devices on your WAN. Then enter your WAN IP
address range(s). Computers connected to the WAN port that are not included are inaccessible to
users on your LAN.
3 Click Add to add a specific range of IP addresses on your LAN or OPT interfaces to include in your
Intranet. Clicking Add displays the Add Address Range window. To add a range of addresses,
such as “199.2.23.50” to “199.2.23.54”, enter the starting address in the From Address field and
the ending address in the To Address field. An individual IP address should be entered in the
From Address field only.

Tip: Up to 64 address ranges can be entered.
4 Click Update. Once the SonicWALL security appliance has been updated, a message confirming


Network > Routing

C H A P T E R

14
Chapter 14: Configuring Static Routes

Network > Routing
If you have routers on your LAN or WAN, you can configure static routes on the SonicWALL security
appliance using the settings on the Network > Routing page.

Static routing means configuring the SonicWALL security appliance to route network traffic to a
specific, predefined destination. Static routes must be defined if the LAN or WAN are segmented into
subnets, either for size or practical considerations. For example, a subnet can be created to isolate a
section of a company, such as finance, from network traffic on the rest of the LAN or WAN.


CHAPTER 14: Configuring Static Routes

Static Routes
Static Routes are configured when network traffic is directed to subnets located behind routers on
your network. For instance, you have a router on your network with the IP address of
192.168.168.254, and there is another subnet on your network with IP address range of 10.0.5.0 -
10.0.5.254 with a subnet mask of 255.255.255.0. You can configure static routes on the LAN, WAN,
DMZ, and WLAN interfaces.

To configure a static route to the 10.0.5.0 subnet, follow these instructions:
1 Click Network, then Routing.
2 Click Add in the Static Routes section. The Add Static Route window is displayed.

3 Enter 10.0.5.0 in the Destination Network field.
4 Enter 255.255.255.0 in the Subnet Mask field.
5 Enter 192.168.168.254 in the Default Gateway field. This is the IP address of the router.
6 Select LAN from the Interface menu.
7 Click OK.
Tip: You can configure up to 256 routes on the SonicWALL security appliance.

Static Route Configuration Example
Static Route configurations allow for multiple subnets separated by an internal (LAN) router to be
supported behind the SonicWALL security appliance LAN. This option is only to be used when the
secondary subnet is accessed through an internal (LAN) router that is between it and the SonicWALL
security appliance LAN port. Once static routes are configured, network traffic can be directed to
these subnets.

Key terms:
• Destination Network: the network IP address of the remote subnet. The address usually ends in
0, i.e 10.0.5.0.
• Subnet Mask: the subnet mask of the remote network (for example 255.255.255.0)
• Gateway: the IP address of the internal (LAN) router that is local to the SonicWALL security
appliance.

For example:

SonicWALL LAN IP Address: 192.168.168.1
Subnet mask: 255.255.255.0
Router IP Address: 192.168.168.254
Secondary Subnet: 10.0.5.0
Subnet mask: 255.255.255.0


Network > Routing

If you have an internal (LAN) router on your network with the IP address of 192.168.168.254, and
there is another subnet on your network with IP address range of 10.0.5.0 - 10.0.5.254 with a subnet
mask of 255.255.255.0. To configure a static route to the 10.0.5.0 subnet, follow these instructions:

Click Network, and then Routing.
1 Click Add in the Static Routes section.
2 Enter 10.0.5.0 in the Destination Network field.
3 Enter 255.255.255.0 in the Subnet Mask field.
4 Enter 192.168.168.254 in the Default Gateway field. This is the IP address of the internal (LAN)
router that is local to the SonicWALL security appliance.
5 Select LAN from the Interface menu.
6 Click OK.
Tip: Be sure the internal (LAN) router is configured as follows: If the SonicWALL security appliance is
in NAT Enabled mode, the internal (LAN) router needs to have a route of last resort (for example
gateway address) that is the SonicWALL security appliance LAN IP address.

Route Advertisement
packets by way of broadcast instead of multicast. RIPv2 packets are backwards-compatible and can
be accepted by some RIPv1 implementations that provide an option of listening for multicast packets.
The RIPv2 Enabled (broadcast) selection broadcasts packets instead of multicasting packets for




packet to specific nodes on the network).
optional.
8 If you want to enable RIPv2 authentication, select one of the following options from the RIPv2
Cleartext Password - Enter a password in the Authentication Password (Max 16 Chars)
field. A maximum of 16 characters can be used to define a password.
Enter a 32 hex digit value for the Authentication Key (32 hex digits) field, or use the
generated key.
9 Click OK.

Routing Table

The Routing Table is a list of destinations that the IP software maintains on each host and router.

The network IP address, subnet mask, gateway address, and the corresponding link are displayed.

Most of the entries are the result of configuring LAN, WAN, and WLAN network settings. The
SonicWALL security appliance LAN, WAN, and WLAN IP addresses are displayed as permanently
published at all times.


Network > Routing

Route Advertisement
packets by way of broadcast instead of multicast. RIPv2 packets are backwards-compatible and can
be accepted by some RIPv1 implementations that provide an option of listening for multicast packets.
The RIPv2 Enabled (broadcast) selection broadcasts packets instead of multicasting packets is for




packet to specific notes on the network).
optional.
8 If you wan to enable RIPv2 authentication, select one of the following options from the RIPv2
Cleartext Password - Enter a password in the Authentication Password (Max 16 Chars) field.
A maximum of 16 characters can be used to define a password.
Enter a 32 hex digit value for the Authentication Key (32 hex digits) field, or use the generated
key.
9 Click OK.

Routing Table

The Routing Table is a list of destinations that the IP software maintains on each host and router.

The network IP address, subnet mask, gateway address, and the corresponding link are displayed.

Most of the entries are the result of configuring LAN, WAN, and WLAN network settings. The
SonicWALL security appliance LAN, WAN, and WLAN IP addresses are displayed as permanently
published at all times.


Network > Routing


Network > ARP

C H A P T E R

15
Chapter 15: Configuring Address Resolution
Protocol Settings

Network > ARP

The ARP (Address Resolution Protocol) Cache stores IP or logical addresses received from ARP
replies in order to minimize the number of ARP broadcasts on a network. ARP broadcasts can
degrade network performance if too many broadcast requests are sent over the network. Once the
ARP request is stored, the host does not have to send out ARP requests for the same IP datagram.


CHAPTER 15: Configuring Address Resolution Protocol Settings

Static ARP Entries
The Static ARP feature allows for static mappings to be created between layer 2 MAC addresses and
layer 3 IP addresses, but also provides the following capabilities:

• Publish Entry - Enabling the Publish Entry option in the Add Static ARP window causes the
SonicWALL device to respond to ARP queries for the specified IP address with the specified MAC
address. This can be used, for example, to have the SonicWALL device reply for a secondary IP
address on a particular interface by adding the MAC address of the SonicWALL. See the
Secondary Subnet section that follows.
• Bind MAC Address - Enabling the Bind MAC Address option in the Add Static ARP window
binds the MAC address specified to the designated IP address and interface. This can be used to
ensure that a particular workstation (as recognized by the network card's unique MAC address)
can only be used on a specified interface on the SonicWALL. Once the MAC address is bound to
an interface, the SonicWALL will not respond to that MAC address on any other interface. It will
also remove any dynamically cached references to that MAC address that might have been
present, and it will prohibit additional (non-unique) static mappings of that MAC address.
• Update IP Address Dynamically - The Update IP Address Dynamically setting in the Add Static
ARP window is a sub-feature of the Bind MAC Address option. This allows for a MAC address to
be bound to an interface when DHCP is being used to dynamically allocate IP addressing.
Enabling this option will blur the IP Address field, and will populate the ARP Cache with the IP
Address allocated by the SonicWALL's internal DHCP server, or by the external DHCP server if IP
Helper is in use.

Secondary Subnets with Static ARP
SonicOS Standard already supports secondary subnets on the LAN using the Network Gateway
feature on LAN Properties window from the Network > Settings page, but the Static ARP feature
allows for secondary subnets to be added on other interfaces, and without the addition of automatic
NAT rules.
Note: It is not possible to create firewall access rules between primary and secondary subnets, when
they are created using the static ARP method.

Adding a Secondary Subnet using the Static ARP Method
1 Add a 'published' static ARP entry for the gateway address that will be used for the secondary
subnet, assigning it the MAC address of the SonicWALL interface to which it will be connected.
2 Add a static route for that subnet, so that the SonicWALL regards it as valid traffic, and knows to
which interface to route that subnet's traffic.
3 Add Access Rules to allow traffic destined for that subnet to traverse the correct network interface.
4 Optional: Add a static route on upstream device(s) so that they know which gateway IP to use to
reach the secondary subnet.


Network > ARP

Consider the following network example:

With SonicOS Standard, although it is not possible to create a NAT rule for a secondary subnet on the
DMZ (or OPT) interface, it is possible to support the secondary subnet in a routed configuration. To
support the above configuration, first create a published static ARP entry for 192.168.50.1, the
address which will serve as the gateway for the secondary subnet, and associate it with the DMZ/OPT
interface. From the Network > ARP page, select the Add button in the Static ARP Entries section,
and add the following entry:

The entry will appear in the table as follows:



Navigate to the Network > Routing page, and add a static route for the 192.168.50.0/24 network as
follows:

The entry will appear in the table as follows:

To allow the traffic to reach the 192.168.50.0/24 subnet, and to allow the 192.168.50.0/24 subnet to
reach the hosts on the LAN, navigate to the Firewall > Access Rules page, and add the following
Access Rule:

Prohibit Dynamic ARP Entries
SonicOS Standard provides the ability to prohibit dynamic ARP entries on a per-interface basis.
Enabling this feature on an interface will prevent that interface from dynamically adding ARP entries.
This is offered as a security mechanism to statically and strictly define the MAC addresses of hosts
that will be permitted to operate on a particular interface.

Alert: Misconfiguration of this feature can render the SonicWALL inaccessible and recoverable only
by restoring factory defaults. Be certain to understand the behavior of this feature, and to have
properly configured static ARP entries for allowed hosts prior to applying any 'prohibit dynamic ARP
entry' settings.

A typical use for this feature would be prohibiting dynamic ARP on the WAN interface, after adding a
static ARP entry for the upstream router. This will help to ensure that the router will be the only host
allowed on the WAN interface.


Network > ARP

After adding the static ARP entry for the router, mark the checkbox next to the WAN interface in the
'Prohibit dynamic ARP entries' area. Click the OK button in the alert dialog to proceed. The setting will
not take effect until the Apply button at the top of the page is selected.

Navigating and Sorting the ARP Cache Table
The ARP Cache table provides easy pagination for viewing a large number of ARP entries. You can
navigate a large number of ARP entries listed in the ARP Cache table by using the navigation control
bar located at the top right of the ARP Cache table.

The navigation control bar includes four buttons. The far left button displays the first page of the table.
The far right button displays the last page. The inside left and right arrow buttons navigate to the
previous or next page respectively.

You can enter the policy number (the number listed before the policy name in the # Name column) in
the Items field to move to a specific ARP entry. The default table configuration displays 50 entries per
page. You can change this default number of entries for tables on the System > Administration
page.

You can sort the entries in the table by clicking on the column header. The entries are sorted by
ascending or descending order. The arrow to the right of the column entry indicates the sorting status.
A down arrow means ascending order. An up arrow indicates a descending order.

Flushing the ARP Cache
It is sometimes necessary to flush the ARP cache if the IP address has changed for a device on the
network. Since the IP address is linked to a physical address, the IP address can change but still be
associated with the physical address in the ARP Cache. Flushing the ARP Cache allows new
information to be gathered and stored in the ARP Cache. Click Flush ARP Cache to clear the
information.

To configure a specific length of time for the entry to time out, enter a value in minutes in the ARP
Cache entry time out (minutes) field. The default is 10 minutes.


Network > DHCP Server

C H A P T E R

16
Chapter 16: Configuring the DHCP Server

The SonicWALL security appliance DHCP Server distributes IP addresses, subnet masks, gateway
addresses, and DNS server addresses to the computers on your network. You can use the
SonicWALL DHCP server or another DHCP server on your network.

DHCP Server Settings
To enable the DHCP server feature on the SonicWALL security appliance, select Enable DHCP
Server.

To use another DHCP server on your network, uncheck Enable DHCP Server.

Select Allow DHCP Pass Through if you are using another DHCP server on your network.


CHAPTER 16: Configuring the DHCP Server

DHCP Server Lease Scopes
The DHCP Server Lease Scopes table displays the currently configured DHCP IP ranges. The table
shows:
• Type: Dynamic or Static
• Lease Scope: The IP address range, for example 172.16.31.2 - 172.16.31.254
• Interface: The Interface the range is assigned to LAN, OPT, DMZ, WLAN or WAN
• Details: Detailed information about the lease, displayed as a tool tip when you hover the mouse
pointer over the details icon

• Enable: Check the box in the Enable column to enable the DHCP range. Uncheck it to disable the
range
• Configure: Click the edit icon to configure the DHCP range or the delete icon to delete
the scope

Configuring DHCP Server for Dynamic Ranges
1 Click the Add Dynamic button. The Dynamic Range Configuration window is displayed.

2 Make sure the Enable this DHCP Scope is checked if you want this DHCP scope enabled after
you click OK.
3 Select the interface from the Interface menu. The IP addresses are in the same private subnet as
the SonicWALL security appliance LAN.
4 Enter the beginning IP address in the Range Start field. The default IP address is appropriate for
most networks.
5 Enter the last IP address in the Range End field. If there are more than 25 computers on your
network, enter the appropriate ending IP address in the Range End field.
6 Enter the number of minutes an IP address is used before it is issued another IP address in the
Lease Time (minutes) field. 1440 minutes is the default value.
7 Select the gateway from the Gateway Preferences menu. The LAN IP address is the default
value, but you can select Other and enter a different IP address for the gateway.
8 If you select the SonicWALL security appliance LAN IP address from the Gateway Preferences
menu, the Default Gateway and Subnet Mask fields are unavailable. If you select Other, the
fields are available for you to enter the Default Gateway and Subnet Mask information into the
fields.
9 Select Allow BOOTP Clients to use Range if you have BOOTP Clients on your network.



10 Click the DNS/WINS tab to continue configuring the DHCP server.

11 If you have a domain name for the DNS Server, enter it in the Domain Name field.
12 Inherit DNS Settings Dynamically from the SonicWALL’s DNS Settings is selected by default.
When selected, the DNS Server IP fields are unavailable.
13 If you do not want to use the SonicWALL security appliance network settings, select Specify
Manually, and enter the IP address of your DNS Server in the DNS Server fields.
14 If you have WINS running on your network, enter the WINS server IP address(es) in the WINS
Server fields.
15 Click OK to add the settings to the SonicWALL security appliance. Then click Apply for the
settings to take effect on the SonicWALL security appliance.

Configuring Static DHCP Entries
1 Click the Add Static button. The Static Entry Configuration window is displayed.

2 Make sure the Enable this DHCP Scope is checked if you want this DHCP scope enabled after
you click OK.
3 Select the interface from the Interface menu. The IP addresses are in the same private subnet as
the SonicWALL security appliance LAN.


CHAPTER 16: Configuring the DHCP Server

4 Enter the device IP address in the Static IP Address field.
5 Enter the device Ethernet (MAC) address in the Ethernet Address field.
6 Enter the number of minutes an IP address is used before it is issued another IP address in the
Lease Time (minutes) field. 1440 minutes is the default value.
7 Select the gateway from the Gateway Preferences menu. The LAN IP address is the default
value, but you can select Other and enter a different IP address for the gateway.
8 If you select the SonicWALL security appliance LAN IP address from the Gateway Preferences
menu, the Default Gateway and Subnet Mask fields are unavailable. If you select Other, the
fields are available for you to enter the Default Gateway and Subnet Mask information into the
fields.
9 Select Allow BOOTP Clients to use Range if you have BOOTP Clients on your network.
10 Click the DNS/WINS tab to continue configuring the DHCP server.

11 If you have a domain name for the DNS Server, enter it in the Domain Name field.
12 Inherit DNS Settings Dynamically from the SonicWALL’s DNS Settings is selected by default.
When selected, the DNS Server IP fields are unavailable.
13 If you do not want to use the SonicWALL security appliance network settings, select Specify
Manually, and enter the IP address of your DNS Server in the DNS Server fields. You must
specify at least one DNS server.
14 If you have WINS running on your network, enter the WINS server IP address(es) in the WINS
Server fields.
15 Click OK to add the settings to the SonicWALL security appliance. Then click Apply for the
settings to take effect on the SonicWALL security appliance.
Tip: The SonicWALL security appliance DHCP server can assign a total of 254 dynamic and static IP
addresses.

Current DHCP Leases
The current DHCP lease information is displayed in the Current DHCP Leases table. Each binding
displays the IP address and the Ethernet address along with the type of binding, Dynamic, Dynamic
BOOTP, or Static BOOTP. To delete a binding, which frees the IP address on the DHCP server, click
the Trashcan icon next to the entry. To edit an entry, click the edit icon next to the entry.


Network > Dynamic DNS

C H A P T E R

17
Chapter 17: Configuring Dynamic DNS

Dynamic DNS (DDNS) is a service provided by various companies and organizations that allows for
dynamic changing IP addresses to automatically update DNS records without manual intervention.
This service allows for network access using domain names rather than IP addresses, even when the
target’s IP addresses change. For example, if a user has a DSL connection with a dynamically
assigned IP address from the ISP, the user can use DDNS to register the IP address, and any
subsequent address changes, with a DDNS service provider so that external hosts can reach it using
an unchanging domain name.

Dynamic DNS implementations change from one service provider to another. There is no strict
standard for the method of communication, for the types of records that can be registered, or for the
types of services that can be offered. Some providers offer premium versions of their services, as
well, for a fee. As such, supporting a particular DDNS provider requires explicit interoperability with
that provider's specific implementation.

Most providers strongly prefer that DDNS records only be updated when IP address changes occur.
Frequent updates, particularly when the registered IP address is unchanged, may be considered
abuse by providers, and could result in your DDNS account getting locked out. Please refer to the use
policies posted on the provider's pages, and abide by the guidelines. SonicWALL does not provide
technical support for DDNS providers - the providers themselves must be contacted.

Supported DDNS Providers
Not all services and features from all providers are supported, and the list of supported providers is
subject to change. SonicOS currently supports the following services from four Dynamic DNS
providers:
• Dyndns.org <http://www.dyndns.org> - SonicOS requires a username, password, Mail Exchanger,
and Backup MX to configure DDNS from Dyndns.org.
• Changeip.com <http://www.changeip.com> - A single, traditional Dynamic DNS service requiring
only username, password, and domain name for SonicOS configuration.
• No-ip.com <http://www.no-ip.com> - Dynamic DNS service requiring only username, password,
and domain name for SonicOS configuration. Also supports hostname grouping.
• Yi.org <http://www.yi.org> - Dynamic DNS service requiring only username, password, and
domain name for SonicOS configuration. Requires that an RR record be created on the yi.org
administrative page for dynamic updates to occur properly.


CHAPTER 17: Configuring Dynamic DNS

Additional Services offered by Dynamic DNS Providers
Some common additional services offered by Dynamic DNS providers include:
• Wildcards - allows for wildcard references to sub-domains. For example, if you register
yourdomain.dyndns.org, your site would be reachable at *.yourdomain.dyndyn.org, for example,
server.yourdomain.dyndyn.org, www.yourdomain.dyndyn.org, or ftp.yourdomain.dyndyn.org.
• Mail Exchangers - Creates MX record entries for your domain so that SMTP servers can locate it
over DNS and send mail. Note: inbound SMTP is frequently blocked by ISPs - please check with
your provider before attempting to host a mail server.
• Backup MX (offered by dyndns.org, yi.org) - Allows for the specification of an alternative IP
address for the MX record in the event that the primary IP address is inactive.
• Groups - Allows for the grouping of hosts so that an update can be performed once at the group
level, rather than multiple times for each member.
• Off-Line IP Address - Allows for the specification of an alternative address for your registered
hostnames in the event that the primary registered IP is offline.

Configuring Dynamic DNS
Using any Dynamic DNS service begins with setting up an account with the DDNS service provider
(or providers) of your choice. It is possible to use multiple providers simultaneously. Refer to the links
for the various providers listed above. The registration process normally involves a confirmation email
from the provider, with a final acknowledgment performed by visiting a unique URL embedded in the
confirmation email.

After logging in to the selected provider's page, you should visit the administrative link (typically 'add'
or 'manage'), and create your host entries. This must be performed prior to attempting to use the
dynamic DNS client on SonicOS.
1 From the Network > Dynamic DNS page, click the Add button. The Add DDNS Profile window is
displayed.

2 If Enable this DDNS Profile is checked, the profile is administratively enabled, and the
SonicWALL security appliance takes the actions defined in the Online Settings section on the
Advanced tab.
3 If Use Online Settings is checked, the profile is administratively online.



4 Enter a name to assign to the DDNS entry in the Profile Name field. This can be any value used to
identify the entry in the Dynamic DNS Settings table.
5 In the Profile page, select the Provider from the drop-down list at the top of the page.
DynDNS.org and changeip.com use HTTPS, while yi.org and no-ip.com use HTTP. This example
uses DynDNS.org. Dyndns.org requires the selection of a service. This example assumes you
have created a dynamic service record with dyndns.org.
6 Enter your dyndns.org username and password in the User Name and Password fields.
7 Enter the fully qualified domain name (FQDN) of the hostname you registered with dyndns.org.
Make sure you provide the same hostname and domain as you configured.
8 When using DynDNS.org, select the Service Type from the drop-down list that corresponds to
your type of service through DynDNS.org. The options are:
Dynamic - A free Dynamic DNS service.
Custom - A managed primary DNS solution that provides a unified primary/secondary DNS
service and a web-based interface. Supports both dynamic and static IP addresses.
Static - A free DNS service for static IP addresses.
9 When using DynDNS.org, you may optionally select Enable Wildcard and/or configure an MX
entry in the Mail Exchanger field. Check Backup MX if this is the backup mail exchanger.
10 Click the Advanced tab. You can typically leave the default settings on this page.

11 The Online Settings section provides control over what address is registered with the dynamic
DNS provider. The options are:
Let the server detect IP Address - The dynamic DNS provider determines the IP address based
upon the source address of the connection. This is the most common setting.
Automatically set IP Address to the Primary WAN Interface IP Address - This will cause the
SonicWALL device to assert its WAN IP address as the registered IP address, overriding auto-
detection by the dynamic DNS server. Useful if detection is not working correctly.
Specify IP Address manually - Allows for the IP address to be registered to be manually
specified and asserted.
12 The Off-line Settings section controls what IP Address is registered with the dynamic DNS
service provider if the dynamic DNS entry is taken off-line locally (disabled) on the SonicWALL.
The options are:
Do nothing - the default setting. This allows the previously registered address to remain current
with the dynamic DNS provider.



Use the Off-Line IP Address previously configured at Providers site - If your provider supports
manual configuration of Off-Line Settings, you can select this option to use those settings when
this profile is taken administratively offline.
Make Host Unknown - De-registers the entry altogether. This action may take time to propagate
through the DNS system.
Specify IP Address manually - Allows for an alternative address to be registered in the event that
the entry is taken off-line.
13 Click OK.

Dynamic DNS Settings Table
The Dynamic DNS Settings table provides a table view of configured DDNS profiles.

Dynamic DNS Settings table includes the following columns:
• Profile Name - The name assigned to the DDNS entry during its creation. This can be any value,
and is used only for identification.
• Domain - The fully qualified domain name (FQDN) of the DDNS entry.
• Provider - The DDNS provider with whom the entry is registered.
• Status - The last reported/current status of the DDNS entry. Possible states are:
Online - The DDNS entry is administratively online. The current IP setting for this entry is
shown with a timestamp.
Taken Offline Locally - The DDNS entry is administratively offline. If the entry is Enabled, the
action configured in the Offline Settings section of the Advanced tab is taken.
Abuse - The DDNS provider has considered the type or frequency of updates to be abusive.
Please check with the DDNS provider's guidelines to determine what is considered abuse.
No IP change - abuse possible - A forced update without an IP address change is considered
by some DDNS providers to be abusive. Automatic updates will only occur when address or
state changes occur. Manual or forced should only be made when absolutely necessary, such
as when registered information is incorrect.
Disabled - The account has been disabled because of a configuration error or a policy
violation. Check the profile's settings, and verify the DDNS account status with the provider.
Invalid Account - The account information provided is not valid. Check the profile's settings,
and verify the DDNS account status with the provider.
Network Error - Unable to communicate with the DDNS provider due to a suspected network
error. Verify that the provider is reachable and online. Try the action again later.
Provider Error - The DDNS provider is unable to perform the requested action at this time.
Check the profile's settings, and verify the DDNS account status with the provider. Try the
action again later.
Not Donator Account - Certain functions provided from certain providers (such as offline
address settings) are only available to paying or donating subscribers. Please check with the
provider for more details on which services may require payment or donation.
• Enabled - When selected, this profile is administratively enabled, and the SonicWALL will take the
Online Settings action that is configured on the Advanced tab. This setting can also be controlled
using the Enable this DDNS Profile checkbox in the entry's Profile tab. Deselecting this
checkbox will disable the profile, and no communications with the DDNS provider will occur for this
profile until the profile is again enabled.



• Online - When selected, this profile is administratively online. The setting can also be controlled
using the Use Online Settings checkbox on the entry's Profile tab. Deselecting this checkbox
while the profile is enabled will take the profile offline, and the SonicWALL will take the
Offline Settings action that is configured on the Advanced tab.
• Configure - Includes the edit icon for configuring the DDNS profile settings, and the

delete icon for deleting the DDNS profile entry.


PART

4
Wireless
Part 4


C H A P T E R

18
Using the Wireless Wizard
Chapter 18:

and Monitoring Your WLAN

SonicWALL wireless security appliances support two wireless protocols called IEEE 802.11b and
802.11g, commonly known as Wi-Fi, and sends data over radio transmissions. SonicWALL wireless
security appliances combines three networking components to offer a fully secure wireless firewall: an
Access Point, a secure wireless gateway, and a stateful firewall with flexible NAT and VPN
termination and initiation capabilities. With this combination, SonicWALL wireless security appliances
offer the flexibility of wireless without compromising network security.

Typically, the SonicWALL wireless security appliance is the access point for your wireless LAN and
serves as the central access point for computers on your LAN. In addition, it shares a single
broadband connection with the computers on your network. Because the SonicWALL wireless
security appliance also provides firewall protection, intruders from the Internet cannot access the
computers or files on your network. This is especially important for an “always-on” connection such as
a DSL or T1 line that is shared by computers on a network.

However, wireless LANs are vulnerable to “eavesdropping” by other wireless networks which means
you should establish a wireless security policy for your wireless LAN. On the SonicWALL wireless
security appliance, wireless clients connect to the Access Point layer of the firewall. Instead of
bridging the connection directly to the wired network, wireless traffic is first passed to the Secure
Wireless Gateway layer where the client is required to be authenticated using User Level
Authentication. Access to Wireless Guest Services (WGS) and MAC Filter Lists are managed by the
SonicWALL wireless security appliance. It is also at this layer that the SonicWALL wireless security
appliance has the capability of enforcing WiFiSec, an IPSec-based VPN overlay for wireless
networking. As wireless network traffic successfully passes through these layers, it is then passed to
the VPN-NAT-Stateful firewall layer where WiFiSec termination, address translation, and access rules
are applied. If all of the security criteria is met, then wireless network traffic can then pass using one
of the following Distribution Systems (DS):
• LAN
• WAN
• Wireless Client on the WLAN
• VPN tunnel


CHAPTER 18: Using the Wireless Wizard and Monitoring Your WLAN

The Wireless > Status page displays the following information.

Considerations for Using Wireless
Connections
• Mobility - if the majority of your network is laptop computers, wireless is more portable than wired
connections.
• Convenience - wireless networks do not require cabling of individual computers or opening
computer cases to install network cards.
• Speed - if network speed is important to you, you may want to consider using Ethernet
connections rather than wireless connections.
• Range and Coverage - if your network environment contains numerous physical barriers or
interference factors, wireless networking may not be suitable for your network.
• Security - wireless networks have inherent security issues due to the unrestricted nature of the
wireless transmissions. However, the SonicWALL wireless security appliance is a firewall and has
NAT capabilities which provides security, and you can use WiFiSec to secure data transmissions.


Optimal Wireless Performance Recommendations

Optimal Wireless Performance
Recommendations
• Place the SonicWALL wireless security appliance near the center of your intended network. This
can also reduce the possibility of eavesdropping by neighboring wireless networks.
• Minimize the number of walls or ceilings between the SonicWALL wireless security appliance and
the receiving points such as PCs or laptops.
• Try to place the SonicWALL wireless security appliance in a direct line with other wireless
components. Best performance is achieved when wireless components are in direct line of sight
with each other.
• Building construction can make a difference on wireless performance. Avoid placing the
SonicWALL wireless security appliance near walls, fireplaces, or other large solid objects. Placing
the SonicWALL wireless security appliance near metal objects such as computer cases, monitors,
and appliances can affect performance of the unit.
• Metal framing, UV window film, concrete or masonry walls, and metallic paint can reduce signal
strength if the SonicWALL wireless security appliance is installed near these types of materials.
• Installing the SonicWALL wireless security appliance in a high place can help avoid obstacles and
improve performance for upper stories of a building.
• Neighboring wireless networks and devices can affect signal strength, speed, and range of the
SonicWALL wireless security appliance. Also, devices such as cordless phones, radios,
microwave ovens, and televisions may cause interference on the SonicWALL wireless security
appliance.

Adjusting the Wireless Antennas
The antennas on the SonicWALL wireless security appliance can be adjusted for the best radio
reception. Begin with the antennas pointing straight up, and then adjust as necessary. Note that
certain areas, such as the area directly below the SonicWALL wireless security appliance, get
relatively poor reception. Pointing the antenna directly at another wireless device does not improve
reception. Do not place the antennas next to metal doors or walls as this can cause interference.

Wireless Guest Services (WGS)
With your SonicWALL wireless security appliance, you can provide wireless guest services to
wireless-equipped users who are not part of your corporate network, for example, a consultant or a
sales person. You can offer authenticated wireless users access to the Internet through your
SonicWALL wireless security appliance while preventing access to your corporate LAN, or allowing
them access to specific resources on the LAN and unencrypted access to the Internet.

When WGS is active, wireless clients can authenticate and associate with the Access Layer of the
SonicWALL. When a Web browser is launched, the wireless user is prompted to provide a user name
and password to gain access to WGS. The browser is redirected to the HTTP (unencrypted)
management address of the SonicWALL wireless security appliance, but the user name and
password is not transmitted. Instead, a secure hash is transmitted rendering the information useless
to anyone “eavesdropping” on the network. After authentication, users are tracked and controlled by
the client MAC address as well as Account and Session lifetimes.

In order to take advantage of Wireless Guest Services, you must provide a guest with a user name
and password which they use to authenticate themselves using HTTP and a Web browser, creating a
secure HTTP session.



Wireless Node Count Enforcement
Users on the WLAN are not counted towards the node enforcement on the SonicWALL. Only users on
the LAN are counted towards the node limit.

MAC Filter List
The SonicWALL wireless security appliance networking protocol provides native MAC address
filtering capabilities. When MAC address filtering occurs at the 802.11 layer, wireless clients are
prevented from authenticating and associating with the wireless access point. Since data
communications cannot occur without authentication and association, access to the network cannot
be granted until the client has given the network administrator the MAC address of their wireless
network card.

The SonicWALL wireless security appliance uses WGS to overcome this limitation by moving MAC
address filtering to the Secure Wireless Gateway layer. This allows wireless users to authenticate and
associate with the Access Point layer of the SonicWALL, and be redirected to the WGS by the Secure
Wireless Gateway where the user authenticates and obtains WLAN to WAN access.

Easy WGS MAC Filtering is an extension of WGS that simplifies the administrative burden of
manually adding MAC addresses to the MAC Filter List. Users can add themselves to the MAC Filter
List by providing a user name and password assigned to them by the SonicWALL administrator. WGS
must be enabled on the SonicWALL wireless security appliance before Easy MAC Filter List can be
implemented.

WiFiSec Enforcement
Enabling WiFiSec Enforcement on the SonicWALL enforces the use of IPSec-based VPN for access
from the WLAN to the WAN or LAN, and provides access from the WLAN to the WAN independent of
WGS. Access from one wireless client to another is configured on the Wireless>Advanced page
where you can disable or enable access between wireless clients.

WiFiSec uses the easy provisioning capabilities of the SonicWALL Global VPN client making it easy
for experienced and inexperienced administrators to implement on the network. The level of
interaction between the Global VPN Client and the user depends on the WiFiSec options selected by
the administrator. WiFiSec IPSec terminates on the WLAN/LAN port, and is configured using the
Group VPN Security Policy including noneditable parameters specifically for wireless access.



You can use the Wireless Wizard to quickly and easily set up your wireless network. Log into the
SonicWALL wireless security appliance, and click Wireless on the menu bar. Click Wireless Wizard
to launch the wizard and begin the configuration process. Or click Wizards, and select Wireless
Wizard.

Welcome to the SonicWALL Wireless Configuration Wizard

1 When the Wireless Wizard launches, the Welcome page is displayed. Click Next to continue
configuration.

WLAN Network Settings

2 Select the Enable WLAN check box to activate the wireless feature of the SonicWALL wireless
security appliance. Use the default IP address for the WLAN or choose a different private IP
address. The default value works for most networks.
3 Select the Enable Windows Networking Support between LAN and WLAN to allow wireless
clients to access your Windows network resources, such as shared folders and printers.
4 Click Next to continue.
Alert: You cannot use the same private IP address range as the LAN port of the SonicWALL wireless
security appliance.



WLAN 802.11b/g Settings

5 Type a unique identifier for the SonicWALL wireless security appliance in the SSID field. It can be
up to 32 alphanumeric characters in length and is case-sensitive. The default value is sonicwall.

WLAN Security Settings

6 Choose the desired security setting for the SonicWALL wireless security appliance. WPA/WPA2
Mode provides strong security, but it requires that wireless computers and nodes have WPA
support in order to connect. Connectivity Mode provides wireless access to the appliance and the
Internet without any security enforced.
Note: WiFiSec requires that VPN be enabled. Therefore to avoid the possibility of blocking wireless
access by allowing users to configure WiFiSec without first enabling VPN, the WiFiSec option has
been removed from the wizard. To use WiFiSec, you must first enable VPN on the VPN > Settings
page.

WPA Mode Settings
If you selected WPA/WPA2 Mode, the WPA Mode Settings window displays.
7 Select the appropriate Authentication Type. The WPA2 - Auto settings attempt to connect using
WPA2, and default to WPA if WPA2 fails. The following encryption protocols are supported
Pre-Shared Key (PSK): PSK allows WPA to generate keys from a pre-shared passphrase that
you configure. The keys are updated periodically based on time or number of packets. Use
PSK in smaller deployments where you do not have a RADIUS server.



Extensible Authentication Protocol (EAP): EAP allows WPA to synchronize keys with an
external RADIUS server. The keys are updated periodically based on time or number of
packets. Use EAP in larger, enterprise-like deployments where you have an existing RADIUS
framework.
8 For the Cipher Type setting, select TKIP when using WPA and AES when using WPA2.
9 Select By Timeout to generate a new group key after an interval specified in seconds. Select By
Packet to generate a new group key after a specific number of packets. Select Disabled to use a
static key. If you selected By Timeout, enter the number of seconds before WPA automatically
generates a new group key in the Interval field.
10 For PSK, enter the Passphrase.
11 For EAP, enter Radius Server IP, Port number, and RADIUS Server Secret for at least one
RADIUS server.

Wireless Configuration Summary

12 Review your wireless settings for accuracy. If you want to make changes, click Back until the
settings are displayed. Then click Next until you reach the Summary page. When you are
satisfied with the configuration, click Apply.

Updating the SonicWALL wireless security appliance

13 The SonicWALL wireless security appliance is now updating the wireless configuration with your
settings.



Congratulations

14 Congratulations! You have successfully completed configuration of your wireless settings. Click
Finish to exit the Wizard. If it is necessary to restart the appliance, the Restart button will display.

Configuring Additional Wireless Features
The SonicWALL wireless security appliance has the following features available:
• WiFiSec Enforcement - an IPSec-based VPN overlay for wireless networking
• WEP Encryption - configure Wired Equivalent Privacy (WEP) Encryption
• Beaconing and SSID Controls - manage transmission of the wireless signal.
• Wireless Client Communications - configure wireless client settings.
• Advanced Radio Settings - fine-tune wireless broadcasting.
• MAC Filtering - use MAC addresses for allowing access or blocking access.

Wireless > Status
The Wireless > Status page provides status information for wireless network, including WLAN
Settings, WLAN Statistics, and Station Status.


Wireless > Status

WLAN Settings
In addition to providing different status views for Access Point and Wireless Bridge modes, two new
functions have been added to the Wireless > Status page:

Hyperlinked WLAN Settings - All configurable WLAN settings are now hyperlinked to their
respective pages for configuration. (This is present in both Access Point and Wireless Bridge modes.)
Enabled features are displayed in green, and disabled features are displayed in red.

Automated Station Blocking - Previously, the Station Status view allowed for stations to be added
to the MAC allow list, or disassociated from the SonicWALL wireless security appliance. The
disassociated station, however, could easily re-associate unless other prohibitive actions were taken.
This functionality has been enhanced by adding the Block icon. Clicking this icon disassociates the
station and adds the station to the MAC block list.To begin configuring advanced features on the
SonicWALL wireless security appliance, log into the management interface, and click Wireless. The
Status page is displayed and contains information relating to the WLAN connection.

Access Point Status

WLAN Settings Value

WLAN: Enabled or Disabled

WiFiSec: Enabled or Disabled

SSID: Network Identification Information

MAC Address (BSSID): Basic Service Set IDentifier (BSSID) of the SonicWALL wireless
security appliance. This is the MAC address of the access point.

WLAN IP Address: IP address of the WLAN port

WLAN Subnet Mask: Subnet information

Regulatory Domain FCC - North America for domestic appliances ETSI - Europe for
international appliances

Channel Channel Number selected for transmitting wireless signal

Radio Tx Rate Network speed in Mbps

Radio Tx Power the current power level of the radio signal transmission

Authentication Type the type of WEP or PSK authentication or Disabled

MAC Filter List Enabled or Disabled

Wireless Guest Services Enabled or Disabled

Wireless Firmware: Firmware versions on the radio card

Associated Stations: Number of clients associated with the SonicWALL wireless security
appliance

Radio Mode Radio Frequency and 802.11 mode: 2.4GHz 802.11b/g Mixed,
2.4GHz 802.11g Only, or 2.4GHz 802.11b Only



WLAN Statistics

802.11 Frame Statistics Rx/TX
Unicast Frames Number of frames received and transmitted
Multicast Frames Total number of frames received and transmitted as broadcast or
multicast. Typically a lower number than Unicast frames.
Fragments Total number of fragmented frames received and sent. This is a general
indication of activity at this wireless device.
Total Packets Total number of packets received and transmitted
Total Bytes Total number of bytes received and transmitted
Errors Total number of receive and transmit errors
Single Retry Frames Number of messages retransmitted a single time being acknowledged
by the receiving device. Retransmission is normal for 802.11b to quickly
recover from lost messages.
Multiple Retry Frames Number of messages retransmitted multiple times before
acknowledgement by the receiving device. A relatively high value can
indicate interference or a heavy wireless data load.
Retry Limit Exceeded Number of messages undelivered after the maximum number of
transmissions. Along with Discards, it can indicate a wireless network
under heavy interference or excessive load of wireless data traffic.
Discards Number of messages untransmitted due to congestion. Normally, the
messages are temporarily stored in an internal buffer until transmitted.
When the buffer is full, frames are discarded until the buffer is cleared.
When the number is high, it may indicate a wireless network with a
heavy load of traffic.
Discards: Bad WEP Key Number of times a received message was discarded because it could
not be decrypted. This could indicate mismatched keys or one device
does not support encryption or does not have encryption enabled.
FCS Errors Number of received frames or frame parts containing an erroneous
checksum requiring deletion. Messages are recovered using ACK and
retransmitted by the sending device.
Frames Received Total number of data frames received.
Frames Aborted Total number of frames dropped.
Frames Aborted Phy Total number of frames aborted.
Duplicate Frames Number of duplicate frames received.

Station Status
The Station Status table displays information about wireless connections associated with the
SonicWALL wireless security appliance.

• Station - The name of the connection used by the MAC address.
• MAC Address - The wireless network card MAC address.
• Authenticated - Status of 802.11b authentication.


Wireless > Status

• Associated - Status of 802.11b association.
• AID - The Association Identifier, which is assigned by the SonicWALL.
• Signal- Throughput in Mbps.
• Timeout - Number of seconds left on the session.
• Delete - Click the trashcan icon to disassociate the station from the SonicWALL wireless security
appliance.


Wireless > Settings

C H A P T E R

19
Chapter 19: Configuring Wireless Settings

Wireless > Settings
The Wireless > Settings page allows you to configure your wireless settings.
Note: The SonicWALL TZ 50 Wireless and TZ 150 Wireless do not support wireless bridging mode.

On the Wireless>Settings page, you can enable or disable the WLAN port by selecting or clearing
the Enable WLAN check box.

Wireless Radio Mode
Select either Access Point to configure the SonicWALL as the default gateway on your network or
select Wireless Bridge from the Radio Role menu to configure the SonicWALL to act as an
intermediary wireless device.


CHAPTER 19: Configuring Wireless Settings

Note: WPA support is only available in Access Point Mode. WPA support is not available in Bridge
Mode.

Wireless Settings
Enable WLAN Radio: Enable the SonicWALL wireless security appliance radio for wireless
connections.

Use Time Constraints: Only enable the radio during the times you specify.

SSL-VPN Enforcement: Redirects all traffic entering the Wireless Zone to a defined SonicWALL
SSL-VPN appliance. This allows all wireless traffic to be authenticated and encrypted by the SSL-
VPN, using, for example, NetExtender to tunnel all traffic. Note: Wireless traffic that is tunneled
through an SSL-VPN will appear to originate from the SSL-VPN rather than from the Wireless Zone.
• Sever Address - Enter the IP address of the SSL-VPN appliance to which you wish to redirect
wireless traffic.
• Server Port - The Service Object representing the SSL-VPN service. This is typically HTTPS.

WiFiSec Enforcement: Select this setting to provide IPSec-based VPN on a WLAN. If selected,
wireless clients must download a copy of the Global VPN Client software to install on their computer.
You must also configure and enable the Group VPN Security Association. When the Require
WiFiSec for Site-to-Site VPN Tunnel Traversal setting is enabled, any wireless traffic destined for a
remote network with a VPN tunnel is secured by WiFiSec. The Require WiFiSec for Site-to-Site
VPN Tunnel Traversal check box is enabled by default.
Note: WiFiSec requires that VPN be enabled on the SonicWALL wireless security appliance. If VPN
is not enabled, a warning message displays when clicking on the WiFiSec Enforcement checkbox
informing you that you must first enable VPN.

When the Enable WiFiSec Service Exception List setting is enabled, serrvices you specify in the
WiFiSec exception list do not require WiFiSec to connect. To configure the WiFiSec exception list:
1 Click Configure next to Enable WiFiSec Service Exception List.

2 In the WiFiSec Service Exception List window, select the services you want to exclude in the
Services column.
3 Click the button to move the services into the WiFiSec Service Exception List
column.
4 When you have the list elements you want, click OK.


Wireless > Settings

Trust WPA/WPA2 traffic as WiFiSec: Allows WPA or WPA2 to be used as an alternative to
WiFiSec.

WLAN IP Address/WLAN Subnet Mask: You can configure a different IP address for the WLAN by
typing another private IP address in the WLAN IP Address field. Type the subnet in the WLAN
Subnet Mask field. Click Apply for the changes to take effect on the SonicWALL.

SSID: The default value, sonicwall, for the SSID can be changed to any alphanumeric value with a
maximum of 32 characters.

Radio Mode: Select your preferred radio mode from the Radio Mode menu. The SonicWALL
wireless security appliance supports the following modes:
• 2.4GHz 802.11b/g Mixed - Supports 802.11b and 802.11g clients simultaneously. If your wireless
network comprises both types of clients, select this mode.
• 802.11g Only - If your wireless network consists only of 802.11g clients, you may select this mode
for increased 802.11g performance. You may also select this mode if you wish to prevent 802.11b
clients from associating.
• 802.11b Only - Select this mode if only 802.11b clients access your wireless network.

Channel: Select the channel for transmitting the wireless signal from the Channel menu. An
AutoChannel setting allows the SonicWALL wireless security appliance to automatically detect and
set the optimal channel for wireless operation based upon signal strength and integrity. AutoChannel
is the default channel setting, and it displays the selected channel of operation to the right.
Alternatively, an operating channel within the range of your regulatory domain can be explicitly
defined.

Secure Wireless Bridging
Wireless Bridging is a feature that allows two or more physically separated networks to be joined over
a wireless connection. The SonicWALL wireless security appliance provides this capability by shifting
the radio mode at remote networks from Access Point mode to Wireless Bridge mode. Operating in
Wireless Bridge mode, the SonicWALL wireless security appliance connects to another SonicWALL
wireless security appliance acting as an access point, and allows communications between the
connected networks over the wireless bridge.

Secure Wireless Bridging employs a WiFiSec VPN policy, providing security to all communications
between the wireless networks. Previous bridging solutions offered no encryption, or at best, WEP
encryption.



Configuring a Secure Wireless Bridge
When switching from Access Point mode to Wireless Bridge mode, all clients are disconnected,
and the navigation panel on the left changes to reflect the new mode of operation.

To configure a secure wireless bridge, follow these steps:
1 Navigate to the Wireless > Settings page.
2 In the Wireless Radio Mode section, select Wireless Bridge from the Radio Role menu. The
SonicWALL wireless security appliance updates the interface.
3 Click Status. Any available access point is displayed at the bottom of the Status page. Click
Connect to establish a wireless bridge to another SonicWALL wireless security appliance.
4 Click Settings. Configure the WLAN settings for the wireless connection as follows:
a Configure the WLAN IP Address. The WLAN IP address must be within the same subnet for
all SonicWALL wireless security appliance devices.
b Configure the WLAN Subnet Mask. The default setting is 255.255.255.0.
Note: While the WLAN IP address must be within the same subnet for all Secure Anti-Virus Router 80
devices, the LAN IP address for all SonicWALL wireless security appliance appliances must be on
different subnets.
c Configure the SSID on all SonicWALL wireless security appliance appliances to the SSID of the
Access Point.
d Choose Flexible, Strict or None for 802.11d compliance.

For example, in the previous network diagram, the three SonicWALL wireless security appliance
appliances are configured as follows:
• SSID on all three SonicWALL wireless security appliance appliances are set to myWLAN.
• WLAN addressing for all the SonicWALL wireless security appliance appliances connected over
the Wireless Bridge must place the WLAN interfaces on the same subnet: 172.16.31.1 for wireless
appliance 1, 172.16.31.2 for wireless appliance 2, and 172.16.31.3 for wireless appliance 3.
• Wireless appliance 4 must have a different subnet on the WLAN, such as 172.16.32.X/24.
• LAN addressing for all wireless appliances connected over the Wireless Bridge must place the
LAN interfaces on different subnets: 10.10.10.x/24 for wireless appliance 1, 10.20.20.x/24 for
wireless appliance 2, and 10.30.30.x/24 for wireless appliance 3.
• LAN addressing for wireless appliance 4 must be the same as wireless appliance 3.
• To facilitate Virtual Adapter addressing, the wireless appliance 4 can be set to forward DHCP
requests to wireless appliance 3.


Wireless > Settings

• When a wireless appliance is in Wireless Bridge mode, the channel cannot be configured. wireless
appliance 2 and wireless appliance 3 operate on the channel of the connecting Access Point. For
example, wireless appliance is on channel 1.
• A Bridge Mode wireless appliance cannot simultaneously support wireless client connections.
Access Point services at Remote Site B are provided by a second wireless appliance (4). The
channel of operation is set 5 apart from the channel inherited by the wireless appliance 3. For
example, the Access Point wireless appliance 1 is set to channel 1, then the Bridge Mode wireless
appliance 3 inherits channel 1. The Access Point wireless appliance 4 should be set to channel 6.

Network Settings for the Example Network
Device Mode SSID Channel LAN IP Address WLAN IP
Address

wireless appliance 1 Access Point myWLAN 1 10.10.10.254/24 172.16.31.1/24

wireless appliance 2 Wireless Bridge myWLAN 1 (auto) 10.20.20.254/24 172.16.31.2/24

wireless appliance 3 Wireless Bridge myWLAN 1 (auto) 10.30.30.254/24 172.16.31.3/24

wireless appliance 4 Access Point otherWLAN 6 10.30.30.253/24 172.16.31.1/24

Wireless Bridging (without WiFiSec)
To provide compatibility with other non-WiFiSec wireless access points, the SonicWALL wireless
security appliance supports a non-secure form of wireless bridging, but insecure wireless
communications should only be employed when data is non-sensitive. By default, WiFiSec
Enforcement is enabled on Wireless Settings for Wireless Bridge Mode. To connect to a non-
WiFiSec access point, this check box must be disabled. Since VPN tunnels are not established in
non-secure Wireless Bridging deployments, traffic routes must be clearly defined for both the Access
Point and the Bridge Mode sites:
• The default route on the Bridge Mode SonicWALL wireless security appliance must point from the
WLAN interface to the WLAN interface of the connecting Access Point SonicWALL wireless
security appliance.
Referring to the example above, the default route on wireless appliance 2 and wireless
appliance 3 is set over their WLAN interfaces to 172.16.31.1.
• Static routes must be entered on the Access Point SonicWALL wireless security appliance to route
back to the LAN subnets of the Bridge Mode SonicWALL wireless security appliance.
Referring to the example network, wireless appliance 1 must have static routes to
10.20.20.x/24 by way of 172.16.31.2 and to 10.30.30.x/24 by way of 172.16.31.3

Configuring VPN Policies for the Access Point and Wireless Bridge
Access Point

After Wireless Settings are defined, the WiFiSec connections (VPN Policies) must be configured. The
VPN Policies are defined as would any other site-to-site VPN policy, typically with the following in
mind:
• The Access Point SonicWALL wireless security appliance must specify the destination networks of
the remote sites.
• The Access Point SonicWALL wireless security appliance must specify its LAN management IP
address as the Default LAN Gateway under the Advanced tab.
• The Wireless Bridge Mode SonicWALL wireless security appliance must be configured to use the
tunnel as the default route for all internet traffic.



Referring to our example network, the Access Point wireless appliance has the following two VPN
Policies defined:

Advanced Configuration for both VPN Policies
1 Click Advanced.
2 Select Enable Keep Alive and Try to bring up all possible tunnels.
3 Select Enable Windows Networking (NetBIOS) Broadcast.
4 Select Forward Packets to remote VPNs.
5 Enter the LAN IP address of the Access Point in the Default LAN Gateway field.
6 Select LAN for VPN Terminated at.


Wireless > Settings

7 Click OK to close the window, and then click Apply for the settings to take effect on the
SonicWALL.

Wireless Bridge VPN Policy

The Wireless Bridge VPN Policy is configured as follows:
1 Click VPN, then Configure.
2 Select IKE using Preshared Secret from the IPSec Keying Mode menu.
3 Enter a name for the SA in the Name field.
4 Type the IP address of the Access Point in the IPSec Gateway field. In our example network, the
IP address is 172.16.31.1.
5 Select Use this VPN Tunnel as default route for all Internet traffic from the Destination
Networks section.

Click OK to close the window, and then click Apply for the settings to take effect on the SonicWALL.


Wireless > WEP/WPA Encryption

C H A P T E R

20
Chapter 20: Configuring WEP and WPA
Encryption

Wired Equivalent Protocol (WEP) can be used to protect data as it is transmitted over the wireless
network, but it provides no protection past the SonicWALL. It is designed to provide a minimal level of
protection for transmitted data, and is not recommended for network deployments requiring a high
degree of security. WiFiSec should be enabled in addition to WEP for added security on the wireless
network.

Wi-Fi Protected Access (WPA and WPA2) provides much greater security than WEP, but requires a
separate authentication protocol, such as RADIUS, be used to authenticate all users. WPA uses a
dynamic key that constantly changes, as opposed to the static key that WEP uses.

The SonicWALL Secure Anti-Virus Router provides a number of permutations of WEP and WPA
encryption.

Authentication Overview
Below is a list of available authentication types with descriptive features and uses for each:

WEP
• Lower security
• For use with older legacy devices, PDAs, wireless printers


CHAPTER 20: Configuring WEP and WPA Encryption

WPA
• Good security (uses TKIP)
• For use with trusted corporate wireless clients
• Transparent authentication with Windows log-in
• No client software needed in most cases

WPA2
• Best security (uses AES)
• For use with trusted corporate wireless clients
• Transparent authentication with Windows log-in
• Client software install may be necessary in some cases
• Supports 802.11i “Fast Roaming” feature
• No backend authentication needed after first log-in (allows for faster roaming)

WPA2-AUTO
• Tries to connect using WPA2 security.
• If the client is not WPA2 capable, the connection will default to WPA.

WEP Encryption Settings
Open-system authentication is the only method required by 802.11b. In open-system authentication,
the SonicWALL allows the wireless client access without verifying its identity.

Shared-key authentication uses WEP and requires a shared key to be distributed to wireless clients
before authentication is allowed.

The SonicWALL wireless security appliance provides the option of using Open System, Shared Key,
or both when WEP is used to encrypt data.

If Both (Open System & Shared Key) is selected, the Default Key assignments are not important as
long as the identical keys are used in each field. If Shared Key is selected, then the key assignment
is important.

To configure WEP on the SonicWALL, log into the SonicWALL and click Wireless, then WEP
Encryption.
1 Select the authentication type from the Authentication Type list. Both (Open System & Shared
Key) is selected by default.
2 Select 64-bit or 128-bit from the WEP Key Mode. 128-bit is considered more secure than 64-bit.
This value is applied to all keys.

WEP Encryption Keys
1 Select the key number, 1,2,3, or 4, from the Default Key menu.
2 Select the key type to be either Alphanumeric or Hexadecimal.
WEP - 64-bit WEP - 128-bit
Alphanumeric - 5 characters (0-9, A-Z) Alphanumeric - 13 characters (0-9, A-Z)
Hexadecimal - 10 characters (0-9, A-F) Hexadecimal - 26 characters (0-9, A-F)

3 Type your keys into each field.
4 Click Apply.



WPA Encryption Settings
Both WPA and WPA2 support two protocols for storing and generating keys:
• Pre-Shared Key (PSK): PSK allows WPA to generate keys from a pre-shared passphrase that you
configure. The keys are updated periodically based on time or number of packets. Use PSK in
smaller deployments where you do not have a RADIUS server.
• Extensible Authentication Protocol (EAP): EAP allows WPA to synchronize keys with an external
RADIUS server. The keys are updated periodically based on time or number of packets. Use EAP
in larger, enterprise-like deployments where you have an existing RADIUS framework.

WPA2 also supports EAP and PSK protocols, but adds an optional AUTO mode for each protocol.
WPA2 EAP AUTO and WPA2 PSK AUTO try to connect using WPA2 security, but will default back to
WPA if the client is not WPA2 capable.
Note: WPA support is only available in Access Point Mode. WPA support is not available in Bridge
Mode.

WPA-PSK Settings

Encryption Mode: In the Authentication Type field, select WPA-PSK.

WPA Settings:
• Cypher Type: select TKIP. Temporal Key Integrity Protocol (TKIP) is a protocol for enforcing key
integrity on a per-packet basis.
• Group Key Update: Specifies when the SonicWALL wireless security appliance updates the key.
Select By Timeout to generate a new group key after an interval specified in seconds. Select By
static key.
• Interval: If you selected By Timeout, enter the number of seconds before WPA automatically
generates a new group key.

Preshared Key Settings (PSK)
• Passphrase: Enter the passphrase from which the key is generated.

Click Apply in the top right corner to apply your WPA settings.



WPA-EAP Settings

Encryption Mode: In the Authentication Type field, select WPA-EAP.

WPA Settings:
• Cypher Type: Select TKIP. Temporal Key Integrity Protocol (TKIP) is a protocol for enforcing key
integrity on a per-packet basis.
static key.
• Interval: If you selected By Timeout, enter the number of seconds before WPA automatically
• Packet Threshold: If you selected By Packet, select the number (x 1000) of packets to pass
before generating a new group key.

Extensible Authentication Protocol Settings (EAP)
• Radius Server 1 IP and Port: Enter the IP address and port number for your primary RADIUS
server.
• Radius Server 1 Secret: Enter the password for access to Radius Server
• Radius Server 2 IP and Port: Enter the IP address and port number for your secondary RADIUS
server, if you have one.

Click Apply in the top right corner to apply your WPA settings.

WPA/WPA2 Encryption Settings
Like WPA, WPA2 supports two protocols for storing and generating keys:
• Pre-Shared Key (PSK): PSK allows WPA2 to generate keys from a pre-shared passphrase that
you configure. The keys are updated periodically based on time or number of packets. Use PSK in
smaller deployments where you do not have a RADIUS server.
• Extensible Authentication Protocol (EAP): EAP allows WPA to synchronize keys with an external
RADIUS server. The keys are updated periodically based on time or number of packets. Use EAP
in larger, enterprise-like deployments where you have an existing RADIUS framework.
• WPA2 PSK / WPA2 EAP: There are optional AUTO modes for each WPA2 protocol. WPA2 EAP
AUTO and WPA2 PSK AUTO try to connect using WPA2 security, and will default back to WPA if
the client is not WPA2 capable.



Note: WPA2 support is only available in Access Point Mode. WPA support is not available in Bridge
Mode.

WPA2-PSK Settings

Encryption Mode: In the Authentication Type field, select WPA2-PSK.

WPA2/WPA Settings:
• Cypher Type: select AES. Advanced Encryption Standard (AES) is an advanced block cipher
protocol for enforcing key integrity.
static key.
• Interval: If you selected By Timeout, enter the number of seconds before WPA2 automatically

Preshared Key Settings (PSK)
• Passphrase: Enter the passphrase from which the key is generated.

Click Apply in the top right corner to apply your WPA2 settings.

WPA2-EAP Settings

Encryption Mode: In the Authentication Type field, select WPA-EAP.



WPA Settings:
• Cypher Type: select AES. Advanced Encryption Standard (AES) is an advanced block cipher
protocol for enforcing key integrity.
static key.
• Interval: If you selected By Timeout, enter the number of seconds before WPA2 automatically
• Packet Threshold: If you selected By Packet, select the number (x 1000) of packets to pass
before generating a new group key.

Extensible Authentication Protocol Settings (EAS)
• Radius Server 1 IP and Port: Enter the IP address and port number for your primary RADIUS
server.
• Radius Server 2 IP and Port: Enter the IP address and port number for your secondary RADIUS
server, if you have one.

Click Apply in the top right corner to apply your WPA2 settings.


Wireless > Advanced

C H A P T E R

21
Chapter 21: Configuring Advanced Wireless
Settings

Wireless > Advanced
To access Advanced configuration settings for the SonicWALL wireless security appliance, log into
the SonicWALL, click Wireless, and then Advanced. The Wireless > Advanced page is only
available when the SonicWALL is acting as an access point.

Beaconing & SSID Controls
1 Select Hide SSID in Beacon. Suppresses broadcasting of the SSID name and disables
responses to probe requests. Checking this option helps prevent your wireless SSID from being
seen by unauthorized wireless clients.


CHAPTER 21: Configuring Advanced Wireless Settings

2 Type a value in milliseconds for the Beacon Interval. Decreasing the interval time makes passive
scanning more reliable and faster because Beacon frames announce the network to the wireless
connection more frequently.

Wireless Client Communications
1 Enter the number of clients to associate with the SonicWALL wireless security appliance in the
Maximum Client Associations field. The default value is 32 which means 32 users can access
the WLAN at the same time. However, an unlimited number of wireless clients can access the
WLAN because node licensing does not apply to the WLAN.
2 If you do not want wireless clients communicating to each other, select Disabled from the
Interclient Communications menu. If you want wireless clients communicating with each other,
select Enabled. Enabling and disabling Interclient communications changes the associated
network access rule on the Firewall > Access Rules page.
3 Guests on the wireless network can download the SonicWALL Global VPN Client to install on their
computer or laptop. Type the URL location for the software in the VPN Client Download URL http
field. This field can contain up to 128 characters.

Advanced Radio Settings

1 Select Full Power from the Transmit Power menu to send the strongest signal on the WLAN. For
example, select Full Power if the signal is going from building to building. Half is recommended
for office to office within a building, and Quarter or Eighth is recommended for shorter distance
communications.
2 Select Short or Long from the Preamble Length menu. Short is recommended for efficiency and
improved throughput on the wireless network.
3 The Fragmentation Threshold (bytes) is 2346 by default. Increasing the value means that
frames are delivered with less overhead but a lost or damaged frame must be discarded and
retransmitted.
4 The RTS Threshold (bytes) is 2432 by default. If network throughput is slow or a large number of
frame retransmissions is occurring, decrease the RTS threshold to enable RTS clearing.
5 The default value for the DTIM Interval is 3. Increasing the DTIM Interval value allows you to
conserve power more effectively.
6 The Association Timeout (seconds) is 300 seconds by default. If your network is very busy, you
can increase the timeout by increasing the number of seconds in the Association Timeout
(seconds) field.


Wireless > Advanced

7 Data Rate: Select the speed at which the data is transmitted and received. Best automatically
selects the best rate available in your area given interference and other factors. You can select:
Best, 6 Mbps, 9 Mbps, 12 Mbps, 18 Mbps, 24 Mbps, 36 Mbps, 48 Mbps, or 54 Mbps.
8 Protection Mode: Protection can decrease collisions, particularly where you have two overlapping
SonicPoints. However, it can slow down performance. Auto is probably the best setting, as it will
engage only in the case of overlapping SonicPoints.
9 Protection Rate: The protection rate determines the data rate when protection is on. The slowest
rate offers the greatest degree of protection but the slowest data transmission rate. Choose 1
Mbps, 2 Mbps, 5 Mbps, or 11 Mbps.
10 Protection Type: Select the type of handshake used to establish a wireless connection: CTS-
only or RTS-CTS. 802.11b traffic is only compatible with CTS.
11 CCK OFDM Power Delta: This setting determines the difference in transmission power between
802.11b (CCK mode) and 802.11g (OFDM mode). When both 802.11g and 802.11b are used
simultaneously, 802.11g covers a smaller physical area than 802.11b. Increasing the CCK OFDM
Power Delta lowers the transmission power for 802.11b, so the two radio modes will cover the
same area. Choose 0 dBm, 1 dBm, or 2 dBm.
12 Enable Short Slot Time: Select Enable Short Slot Time to increase performance if you only
expect 802.11g traffic. 802.11b is not compatible with short slot time.

Click Restore Default Settings to return the radio settings to the default settings.

Click Apply in the top right corner of the page to apply your changes to the security appliance.


CHAPTER 21: Configuring Advanced Wireless Settings


Wireless > MAC Filter List

C H A P T E R

22
Chapter 22: Configuring the MAC Filter List

Wireless > MAC Filter List
Wireless networking provides native MAC filtering capabilities which prevents wireless clients from
authenticating and associating with the SonicWALL wireless security appliance. If you enforce MAC
filtering on the WLAN, wireless clients must provide you with the MAC address of their wireless
networking card. Unless you enable Easy WGS MAC Filtering as a privilege when you configure a
User account in Users > Settings.

To set up your MAC Filter List, log into the SonicWALL, and click Wireless, then MAC Filter List.

1 Click Add to add a MAC address to the MAC Filter List.

2 Select Allow from the Action menu to allow access to the WLAN. To deny access, select Block.
3 Type the MAC address in the MAC Address field. The two character groups should be separated
by a hyphen.
4 Type a name or comment in the Comment field. The Comment field can be used to identify the
source of the MAC address.


CHAPTER 22: Configuring the MAC Filter List

5 Click OK to add the MAC address.

Once the MAC address is added to the MAC Address List, you can select Allow or Block next to the
entry. For example, if the user with the wireless card is not always in the office, you can select Block
to deny access during the times the user is offsite.

Click on the Edit icon under Configure to edit the entry. Click on the Trashcan icon to delete the
entry. To delete all entries, click Delete All.


Wireless > IDS

C H A P T E R

23
Chapter 23: Configuring Wireless IDS

Wireless > IDS
Wireless Intrusion Detection Services (WIDS) greatly increase the security capabilities of the
SonicWALL wireless security appliance by enabling it to recognize and even take countermeasures
against the most common types of illicit wireless activity. WIDS consists of three types of services,
namely, Sequence Number Analysis, Association Flood Detection, and Rogue Access Point
Detection. WIDS logging and notification can be enabled under Log > Categories by selecting the
WIDS checkbox under Log Categories and Alerts.

Wireless Bridge IDS
When the Radio Role of the SonicWALL wireless security appliance is set to a Wireless Bridge
mode, Rogue Access Point Detection defaults to active mode (actively scanning for other Access
Points using probes on all channels).


CHAPTER 23: Configuring Wireless IDS

Access Point IDS
When the Radio Role of the SonicWALL wireless security appliance is set to Access Point mode, all
three types of WIDS services are available, but Rogue Access Point detection, by default, acts in a
passive mode (passively listening to other Access Point Beacon frames only on the selected channel
of operation). Selecting Scan Now momentarily changes the Radio Role to allow the SonicWALL
wireless security appliance to perform an active scan, and may cause a brief loss of connectivity for
associated wireless clients. While in Access Point mode, the Scan Now function should only be
used if no clients are actively associated, or if the possibility of client interruption is acceptable.

Enable Client Null Probing
The control to block Null probes is not available on the 802.11g card built into the SonicWALL wireless
security appliance. Instead, enabling this setting allows the SonicWALL wireless security appliance to
detect and log Null Probes, such as those used by Netstumbler and other similar tools.

Association Flood Detection
Association Flood is a type of Wireless Denial of Service attack intended to interrupt wireless services
by depleting the resources of a wireless Access Point. An attacker can employ a variety of tools to
establish associations, and consequently association IDs, with an access point until it reaches its
association limit (generally set to 255). Once association saturation occurs, the access point discards
further association attempts until existing associations are terminated.

Association Flood Detection allows thresholds to be set limiting the number of association attempts a
client makes in a given period of time before its activities are considered hostile. Association attempts
default to a value of 5 (minimum value is 1, maximum value is 100) within the specified time period.
And the time period defaults to a value of 5 seconds (minimum value is 1 second, maximum value is
999 seconds). If association attempts exceed the set thresholds, an event is logged according to log
settings.

If the Block station's MAC address in response to an association flood option is selected and
MAC Filtering is enabled, then in addition to logging actions, the SonicWALL wireless security
appliance takes the countermeasure of dynamically adding the MAC address to the MAC filter list.
Any future Denial of Service attempts by the attacker are then blocked.

Enable Association Flood Detection is selected by default. The Association Flood Threshold is
set to 5 Association attempts within 5 seconds by default.

Rogue Access Point Detection
Rogue Access Points have emerged as one of the most serious and insidious threats to wireless
security. In general terms, an access point is considered rogue when it has not been authorized for
use on a network. The convenience, affordability and availability of non-secure access points, and the
ease with which they can be added to a network creates an easy environment for introducing rogue
access points. Specifically, the real threat emerges in a number of different ways, including
unintentional and unwitting connections to the rogue device, transmission of sensitive data over non-
secure channels, and unwanted access to LAN resources. So while this doesn't represent a
deficiency in the security of a specific wireless device, it is a weakness to the overall security of
wireless networks.

The SonicWALL wireless security appliance can alleviate this weakness by recognizing rogue access
points potentially attempting to gain access to your network. It accomplishes this in two ways: active
scanning for access points on all 802.11b channels, and passive scanning (while in Access Point
mode) for beaconing access points on a single channel of operation.


Wireless > IDS

Active scanning occurs when the SonicWALL wireless security appliance starts up, and at any time
Scan Now is clicked on the Wireless > IDS page. When the SonicWALL wireless security appliance
is operating in a Bridge Mode, the Scan Now feature does not cause any interruption to the bridged
connectivity. When the SonicWALL wireless security appliance is operating in Access Point Mode,
however, a temporary interruption of wireless clients occurs for no more than a few seconds. This
interruption manifests itself as follows:
• Non-persistent, stateless protocols (such as HTTP) should not exhibit any ill-effects.
• Persistent connections (protocols such as FTP) are impaired or severed.
• WiFiSec connections should automatically re-establish and resume with no noticeable interruption
to the client.
Alert: The Scan Now feature causes a brief disruption in service. If this is a concern, wait and use the
Scan Now feature at a time when no clients are active, or the potential for disruption becomes
acceptable.

Authorizing Access Points on Your Network
Access Points detected by the SonicWALL wireless security appliance are regarded as rogues until
they are identified to the SonicWALL wireless security appliance as authorized for operation. To
authorize an access point, it can be manually added to the Authorized Access Points list by clicking
Add and specifying its MAC address (BSSID) along with an optional comment.

Alternatively, if an access point is discovered by the SonicWALL wireless security appliance scanning
feature, it can be added to the list by clicking the Authorize icon .


CHAPTER 23: Configuring Wireless IDS


PART

5
Wireless Guest Services
Part 5


WGS > Status

C H A P T E R

24
Chapter 24: Viewing Wireless Guest Services
Status

Wireless Guest Services (WGS) allow you to create access accounts for temporary use that allow
wireless clients to connect from the WLAN to the WAN.

WGS > Status
The WGS > Status page displays the Active Wireless Guest Sessions. The table lists the Account
Name, MAC Address, IP Address, Time Remaining, and Comment. The last column, Configure,
allows you to make changes to the guest account when you click the Configure icon next to the
account.

If Wireless Guest Services are not enabled, Click the link in the Status page to enable the services.


CHAPTER 24: Viewing Wireless Guest Services Status


WGS > Settings

C H A P T E R

25
Configuring Chapter 25:

Wireless Guest Services

Note: SonicWALL recommends not using WPA or WPA2 security with WGS. WGS is designed to
provide access to untrusted resources (the Internet) for guest users who have no prior association
with the SonicWALL wireless security appliaace.

WPA requires that either users have a shared key (when using PSK) or that they be entered into the
appliance’s user database (when using EAP). Therefore, using WPA would require either providing a
shared key (for PSK) to transitory guest users or entering them into the user database (for EAP).

WGS > Settings
The WGS > Settings page allows you to configure wireless guest services on your SonicWALL
wireless security appliance.


CHAPTER 25: Configuring Wireless Guest Services

Check Enable Wireless Guest Services to enable wireless guest service access to the SonicWALL
wireless security appliance network.
Note: SonicWALL recommends not using WPA or WPA2 security with Wireless Guest Services. If
WPA is enabled when you select the Enable Wireless Guest Services checkbox, a pop-up warning
message is displayed.

Bypass Guest Authentication
Bypass Guest Authentication allows a SonicWALL wireless security appliance running WGS to
integrate into environments already using some form of user-level authentication. This feature
automates the WGS authentication process, allowing wireless users to reach WGS resources without
requiring authentication. This feature should only be used when unrestricted WGS access is desired,
or when another device upstream of the SonicWALL wireless security appliance is enforcing
authentication.

Bypass Filters for Guest Accounts
Bypass Filters for Guest Accounts disables the SonicWALL Content Filtering Service for guests.
Use this if your network is protected by content filtering somewhere between the SonicWALL wireless
security appliance and the Internet, or if you want to provide unrestricted internet access to your
guests. See Chapter 39, Managing SonicWALL Security Services for more information about
content filtering.

Enable Dynamic Address Translation (DAT)
One of the SonicWALL wireless security appliance key features is Wireless Guest Services (WGS),
which provides spur of the moment “hotspot” access to wireless-capable guests and visitors. For easy
connectivity, WGS allows wireless users to authenticate and associate, obtain IP settings from the
SonicWALL wireless security appliance DHCP services, and authenticate using any web-browser.
Without DAT, if a WGS user is not a DHCP client, but instead has static IP settings incompatible with
the SonicWALL wireless security appliance WLAN network settings, network connectivity is prevented
until the user’s settings change to compatible values.

Dynamic Address Translation (DAT) is a form of Network Address Translation (NAT) that allows the
SonicWALL wireless security appliance to support any IP addressing scheme for WGS users. For
example, the SonicWALL wireless security appliance WLAN interface is configured with its default
address of 172.16.31.1, and one WGS client has a static IP Address of 192.168.0.10 and a default


WGS > Settings

gateway of 192.168.0.1, while another has a static IP address of 10.1.1.10 and a gateway of 10.1.1.1,
and DAT enables network communication for both of these clients.

Enable SMTP Redirect
Enable SMTP Redirect causes SMTP traffic coming in from a guest account to be redirected to the
SMTP server you specify. Check Enable SMTP Redirect and click the Configure button in the same
line. In the SMTP Redirect Settings window, enter the IP address of the SMTP server.

Enable URL Allow List for Authenticated Users
Enable URL Allow List for Unauthenticated Users, when selected, allows for the creation of a list
of URLs (HTTP and HTTPS only) that WGS users can visit even before they authenticate. This
feature could be used, for example, to allow users to reach advertising pages, disclaimer pages, and
search engines. Entries should be made in URL format, and can be in either Fully Qualified Domain
Name (FQDN) or IP address syntax.
1 Select Enable URL Allow List for Unauthenticated Users.



2 Click Configure to display the URL Allow List Configuration window.

3 Click Add to display the Add URL dialogue box.
4 Enter the URL in http or https format or domain name. For instance,
http://www.yahoo.com or yahoo.com. Click OK, then OK again.
Tip: Up to 32 entries consisting of 128 characters each can be added to the SonicWALL wireless
security appliance.

Enable IP Address Deny List for Authenticated Users
When Enable IP Address Deny List for Authenticated Users is selected, allows for the
specification of IP addresses/subnet masks to which WGS users are explicitly denied access.
Individual hosts can be entered by using a 32 bit subnet mask (255.255.255.255), networks can be
entered with appropriate subnet mask, or network ranges can be aggregated using CIDR notation or
supernetting (e.g. entering 192.168.0.0/255.255.240.0 to cover individual class C networks
192.168.0.0/24 through 192.168.15.0/24).
1 Select Enable IP Address Deny List for Authenticated Users.
2 Click Configure.


WGS > Settings

3 Click Add to display the Add IP Address Deny List Entry window.
4 Type the IP Address in the IP Network field. Type the subnet mask in the Subnet Mask field.
5 Click OK. Then click OK again.

The IP address or network range is added to the list.
Tip: Up to 32 entries consisting of 128 characters each can be added to the SonicWALL wireless
security appliance.

Customize Login Page
Customize Login Page allows you to display a custom login page to guest users when they first log
into the Secure Anti-Virus Router 80. The custom login page is constructed from a header and footer
you specify and entry fields for guest user name and password between the header and footer. To
configure a custom login page:
1 Check the Customize Login Page box.
2 Click Configure to open the Custom Login Page Settings window

3 Check Display custom login page on WLAN only to restrict only wireless guests to this page.
Leave it unchecked to display it to all guest users.
4 Select Specify URLs for custom content if you have graphics or text available on a web server
to use at the header and footer of the login page. Enter the URLs for the content in the Custom
Header URL and Custom Footer URL fields.
5 Select Enter simple text for custom content to enter the header and footer text for the login
page directly. Enter the text in the Custom Header Text and Custom Footer Text fields.
6 Click OK to save these entries.

Custom Post Authentication Redirect Page
Custom Post Authentication Redirect Page redirects the users to a web page you specify upon
successful log in and authentication.
1 Check Custom Post Authentication Redirect Page.
2 Click Configure to display the Post Authentication Redirect Page window.
3 Enter the URL of the redirect page in the URL field and click OK.



Maximum Concurrent Guests
You can restrict the number of concurrent guests on your SonicWALL wireless security appliance.
Enter the maximum number of guests in the Maximum Concurrent Guests field. Click Apply at the
top right corner of this page to enact this setting.

WGS Account Profiles
The Guest Profiles list shows the profiles you have created and enables you to add, edit, and delete
profiles.

To add a profile:
1 Click Add below the Guest Profile list to display the Add Guest Profile window.

2 In the Add Guest Profile window, configure:
Profile Name: Enter the name of the profile.
User Name Prefix: Enter the first part of every user account name generated from this profile.
Enable Account: Check this for all guest accounts generated from this profile to be enabled
upon creation.
Auto-Prune Account: Check this to have the account removed from the database after its
lifetime expires.
Enforce login uniqueness: Check this to allow only a single instance of an account to be used
at any one time. By default, this feature is enabled when creating a new guest account. If you
want to allow multiple users to login with a single account, disable this enforcement by clearing
the Enforce login uniqueness checkbox.
Activate account upon first login: Check this for the account to remain inactive until the user
logs in and activates the account.
Account Lifetime: This setting defines how long an account remains on the security appliance
before the account expires. If Auto-Prune is enabled, the account is deleted when it expires. If
the Auto-Prune checkbox is cleared, the account remains in the list of guest accounts with an
Expired status, allowing easy reactivation.
Session Lifetime: Defines how long a guest login session remains active after it has been
activated. By default, activation occurs the first time a guest user logs into an account.
Alternatively, activation can occur at the time the account is created by clearing the Activate
account upon first login checkbox. The Session Lifetime cannot exceed the value set in the
Account Lifetime
Idle Timeout: Defines the maximum period of time when no traffic is passed on an activated
guest services session. Exceeding the period defined by this setting expires the session, but
the account itself remains active as long as the Account Lifetime hasn't expired. The Idle
Timeout cannot exceed the value set in the Session Lifetime.


WGS > Settings

Comment: Any text can be entered as a comment in the Comment field.
3 Click OK to add the profile.


WGS > Accounts

C H A P T E R

26
Chapter 26: Managing Wireless Guest
Accounts


WGS > Accounts
The task of generating a new WGS account is now easier with the introduction of an automated
account generation function with the ability to generate (or re-generate) account name and account
password information.

Working with Guest Accounts
To disable a Guest Account, clear the Enable check box in the Guest Account entry line. To edit an
existing Guest Account, click on the Notepad icon under Configure. To delete a Guest Account, click
the Trashcan icon under Configure. To delete all Guest Accounts, click Delete All.

Automatically Generating Guest Accounts
You can generate a specified number of guest accounts.


CHAPTER 26: Managing Wireless Guest Accounts

1 Under the list of accounts, click Generate.

2 In the Auto Generate Guest Account window, configure the settings for all the accounts you are
generating:
Profile: Select the Guest Profile to generate the accounts from.
Number of Accounts: Specify the number of accounts to generate.
Enable Account: Check this for the accounts to be enabled upon creation.
Auto-prune Account: Check this to have the account removed from the database after its
lifetime expires.
Enforce login uniqueness: Check this to allow only one instance of each generated account
to log into the security appliance at one time. Leave it unchecked to allow multiple users to use
this account at once.
Activate account upon first login: Check this option to make this account active when the
user first logs in to WGS.
Number of Accounts: Enter the number of accounts to generate.
Account Name: Enter a name for the accounts. If you generate more than one account at a
time, a number will be added at the end of each account name to make the name unique.
Account Password: The password is automatically generated by default. If you do not want to
use the generated password, enter a new one, and confirm it in the Confirm Password field,
or click Generate to generate a new password.
Account Lifetime: This setting defines how long an account remains on the security appliance
before the account expires. If Auto-Prune is enabled, the account is deleted when it expires. If
the Auto-Prune checkbox is cleared, the account remains in the list of guest accounts with an
Expired status, allowing easy reactivation. This setting overrides the account lifetime setting in
the profile.
Session Lifetime: Defines how long a guest login session remains active after it has been
activated. By default, activation occurs the first time a guest user logs into an account.
Alternatively, activation can occur at the time the account is created by clearing the Activate
account upon first login checkbox. The Session Lifetime cannot exceed the value set in the
Account Lifetime. This setting overrides the session lifetime setting in the profile.
Idle Timeout: Defines the maximum period of time when no traffic is passed on an activated
guest services session. Exceeding the period defined by this setting expires the session, but
the account itself remains active as long as the Account Lifetime hasn't expired. The Idle
Timeout cannot exceed the value set in the Session Lifetime. This setting overrides the idle
timeout setting in the profile.
Comment: Enter a descriptive comment.
3 Click OK to generate the accounts.


WGS > Accounts

Manually Configuring Wireless Guests
To configure new wireless guest accounts, click Add. The Add Guest Account window is displayed.
• Account Profile:
• The following settings are enabled by default:
• Enable Account: When selected, the wireless guest account is automatically enabled. You can
clear the checkbox to disable the account until necessary.
• Auto-Prune Account: By default, newly created accounts are set to Auto-Prune, automatically
deleted when expired. If Auto-Prune is cleared, the account remains in the list of WGS accounts
with an Expired status, allowing it to be easily reactivated.
• Enforce login uniqueness: By enforcing login uniqueness, the Secure Anti-Virus Router 80
Wireless allows only a single instance of a WGS account to be used at any one time. By default,
this feature is enabled when creating a new WGS account. If you want to allow multiple users to
login with a single account, this enforcement is disabled by clearing the Enforce login
uniqueness checkbox.
• Activate account upon first login: By default, the Activate Account Upon First Login is enabled
on the Secure Anti-Virus Router 80 Wireless. The WGS account remains inactive until the user
logs in and activates the account.
• Account Name: Generate
• Account Password: Generate
• Confirm Password:
• Account Lifetime: This setting defines how long an account remains on the Secure Anti-Virus
Router 80 Wireless before the account expires. If Auto-Prune is enabled, the account is deleted
by the SonicWALL security appliance. If the Auto-Prune checkbox is cleared, the account remains
in the list of WGS accounts with an Expired status, allowing easy reactivation.
• Session Lifetime: Defines how long a WGS session remains active after it has been activated. By
default, activation occurs the first time a WGS user logs into an account. Alternatively, activation
can occur at the time the account is created by clearing the Activate account upon first login
checkbox. The Session Lifetime cannot exceed the value set in the Account Lifetime.
• Idle Timeout: Defines the maximum period of time when no traffic is passed on an activated WGS
session. Exceeding the period defined by this setting expires the session, but the account itself
remains active as long as the Account Lifetime hasn't expired. The Idle Timeout cannot exceed
the value set in the Session Lifetime.
• Comment: Any text can be entered as a comment in the Comment field.

Account Detail Printing
Following the generation of an account, it is possible to click the Print icon on the WGS > Settings
page to send the pertinent account details to the active printer on the administrative workstation for
easy distribution to WGS users. Clicking the Print icon launches the following window, followed by
the administrative workstation's system print dialog.



Flexible Default Route
Previously, network traffic from the LAN and WLAN was directed to the WAN interface. With the
release of SonicOS Standard, the Default Route can be the WAN, LAN, or WLAN allowing flexible
configuration of the Secure Anti-Virus Router 80 Wireless, primarily wireless bridging without WiFiSec
and Secure Access Point with Virtual Adapter support.

Secure Access Point with Virtual Adapter Support
Secure Access Point deployment previously required the corporate LAN to be connected to the
Secure Anti-Virus Router 80 Wireless WAN port, because the default route could only be specified on
the Secure Anti-Virus Router 80 Wireless WAN interface. However, the Secure Anti-Virus Router 80
Wireless could not support Wireless Guest Services and SonicWALL Global VPN Clients
simultaneously preventing corporate LAN clients from communicating with WLAN clients, inhibiting
crucial functions such as wireless print servers, Microsoft Outlook mail notification, or any other
function requiring LAN initiated communications to WLAN clients.

Any LAN clients attempting to resolve an IP address of a Global VPN Virtual Adapter address
receives a response from the Secure Anti-Virus Router 80 Wireless LAN.

This allows any client on the LAN to communicate directly with WLAN clients over the secure WiFiSec
link, enabling configurations like the one below.


WGS > Accounts

To configure routing on the Secure Anti-Virus Router 80 Wireless to support the above example, click
Network and then Routing.

1 Under Default Route, click Configure. The Edit Default Route window is displayed.
2 Enter the IP address in the Default Gateway field, and then select LAN, WAN, or WLAN from the
Interface menu.
3 Click OK. The default gateway is now configured.

Secure Access Point with Wireless Guest Services
If simultaneous Wireless Guest Services support is a requirement, then access to the 172.16.31.x
network is necessary. The following diagram portrays such a configuration, and also allows for an
introduction to one of the WGS enhancements of SonicOS 2.0, explicit WGS allow and deny lists.



The example above describes a moderately complex network configuration where the Secure Anti-
Virus Router 80 Wireless offers both WiFiSec and WGS access over a default route on LAN. As the
blue (WiFiSec) and green (WGS) traffic lines indicate, the Secure Anti-Virus Router 80 Wireless
allows WGS access only to the Internet, while allowing WiFiSec access to the Internet, the LAN, and
to a remote network connected over a LAN router.

Prior to SonicOS 1.5.0.0, Wireless Guest Services were only available in default route on WAN
configurations. This scheme provided an automatic differentiation of destinations for WGS traffic. In
other words, WGS traffic bound for the WAN was permitted, but WGS traffic attempting to reach the
LAN (local traffic), to cross the LAN (to reach an adjacent network connected over a router) or to cross
a VPN tunnel was dropped.

When the Secure Anti-Virus Router 80 Wireless is configured to provide both Secure Access Point
and WGS services over a default route on LAN, all traffic exits the LAN interface, eliminating any
means of automatically classifying “WGS permissible” traffic. To address this ambiguity, any traffic
sourced from a WGS client attempting to reach the default gateway (in our above example,
192.168.168.254) is allowed, but any traffic attempting to traverse a VPN, or reach a LAN resource
(for example, 192.168.168.100) is dropped. Finally, to safeguard adjacent networks attached over a
router, a WGS IP Address Deny List has been added to the WGS > Settings page.


PART

6
Firewall
Part 6


Network Access Rules Overview

C H A P T E R

27
Chapter 27: Configuring Network Access
Rules

Network Access Rules Overview
Network Access Rules are management tools that allow you to define inbound and outbound access
policy, configure user authentication, and enable remote management of the SonicWALL.

By default, the SonicWALL’s stateful packet inspection allows all communication from the LAN to the
Internet, and blocks all traffic to the LAN from the Internet. The following behaviors are defined by the
“Default” stateful inspection packet rule enabled in the SonicWALL:
• Allow all sessions originating from the LAN, OPT, DMZ, or WLAN to the WAN
• Deny all sessions originating from the WAN to the LAN, OPT, DMZ, or WLAN

Additional Network Access Rules can be defined to extend or override the default rules. For example,
rules can be created that block certain types of traffic such as IRC from the LAN to the WAN, or allow
certain types of traffic, such as Lotus Notes database synchronization, from specific hosts on the
Internet to specific hosts on the LAN, or restrict use of certain protocols such as Telnet to authorized
users on the LAN.

The custom rules evaluate network traffic source IP addresses, destination IP addresses, IP protocol
types, and compare the information to rules created on the SonicWALL. Network Access Rules take
precedence, and can override the SonicWALL stateful packet inspection. For example, a rule that
blocks IRC traffic takes precedence over the SonicWALL default setting allowing this type of traffic.
Alert: The ability to define Network Access Rules is a very powerful tool. Using custom rules can
disable firewall protection or block all access to the Internet. Use caution when creating or deleting
Network Access Rules.


CHAPTER 27: Configuring Network Access Rules

Using Bandwidth Management with Access
Rules
Bandwidth management allows you to assign guaranteed and maximum bandwidth to services and
also set priorities for outbound traffic. Bandwidth management only applies to outbound traffic from
the SonicWALL to the WAN or any other destination. The minimum guaranteed bandwidth in Kbps is
20 and the maximum is 100,000 kbps. Any rule using bandwidth management has a higher priority
than rules not using bandwidth management. For example, consider the case where you create a rule
for outbound mail traffic (SMTP) and enable Bandwidth Management with a guaranteed bandwidth of
20 Kbps and a maximum bandwidth of 40 Kbps, priority of 0, outbound SMTP traffic always has 20
Kbps available to it and can get as much as 40 Kbps. If this is the only rule using Bandwidth
Management, it has priority over all other rules on the SonicWALL. Other rules use the leftover
bandwidth minus 20 Kbps (guaranteed) or minus 40 Kbps (maximum).
Alert: You must select Bandwidth Management on the WAN > Ethernet tab. Click Network, then
Configure in the WAN line of the Interfaces table, and enter your available bandwidth in the
Available WAN Bandwidth (Kbps) field.

Firewall > Access Rules

The Access Rules page displays a table of defined Network Access Rules. Rules are sorted from the
most specific at the top, to less specific at the bottom of the table. At the bottom of the table is the
Default rule. The Default rule is all IP services except those listed in the Access Rules page. Rules
can be created to override the behavior of the Default rule; for example, the Default rule allows users
on the LAN to access all Internet services, including NNTP News.

You can enable or disable Network Access Rules by selecting or clearing the check box in the Enable
column. Clicking the edit icon allows you to edit an existing rule, or clicking the delete icon
deletes an existing rule. If the two icons are unavailable, the rule cannot be changed or removed from
the list. Rules with a funnel icon are using bandwidth management.
Tip: You can easily create Network Access Rules using the Network Access Rule Wizard.



Navigating and Sorting the Access Rules Table Entries
The Access Rules table provides easy pagination for viewing a large number of VPN policies. You
can navigate a large number of VPN policies listed in the Access Rules table by using the navigation
control bar located at the top right of the Access Rules table. Navigation control bar includes four
buttons. The far left button displays the first page of the table. The far right button displays the last
page. The inside left and right arrow buttons navigate to the previous or next page respectively.

the Items field to move to a specific VPN policy. The default table configuration displays 50 entries
per page. You can change this default number of entries for tables on the System > Administration
page.


Restoring Default Network Access Rules
The SonicWALL includes a set of default Network Access Rules, which are listed in the Access
Rules table. You can reset the SonicWALL at any time to restore the Network Access Rules to just
the default rules by clicking on the Defaults button.

Adding Rules using the Network Access Rule Wizard
The Network Access Rule Wizard takes you step by step through the process of creating network
access rules and public server rule on the SonicWALL.

Configuring a Public Server Rule
1 Click the Rule Wizard button at the top right of the Firewall > Access Rules page. Click Next.

2 Select Public Server Rule. Click Next.



3 You can add an optional text in the Comment field. This information is displayed in the Options
column of the Access Rules table. Click Next.

4 Select the type of service for the rule from the Service menu. In this example, select
Web (HTTP) to allow network traffic to a Web Server on your LAN.
5 Type the IP address of the mail server in the IP address field.
6 Select the destination of the network traffic from the Destination Interface menu. In this case, you
are sending traffic to the LAN. Select LAN.
7 Click Next. Then click Apply to complete the wizard and create a Public Server on your network.

Configuring a General Network Access Rule
1 Click the Rule Wizard button at the top right of the Firewall > Access Rules page.
2 Select General Rule. Click Next.
3 You can add an optional text in the Comment field. This information is displayed in the Options
column of the Access Rules table. Click Next.

4 Select the type of service for the rule. If you do not see the service in the list, you must add it
manually to the list of services on the Firewall > Services page. Click Next.



5 Select Allow action to allow the service to the network, or select Deny to disallow the service to
the network.

6 Enter a value in minutes in the Inactivity Timeout (minutes) field. The default value is 5 minutes.
Click Next.

7 Select the source interface of the service from the Interface menu. If you want to allow or deny the
service from the Internet, select WAN. To allow or deny the service from any source, select * from
the Interface menu.
8 If you have a range of IP addresses, enter the first one in the IP Address Begin field. If you do not
want to specify an IP address, enter “*” in the IP Address Begin field. By typing * (asterisk) in the
field, all traffic using the service is either allowed or denied to all computers on the network. Click
Next.
9 Select the destination interface of the service from the Interface menu. If you have a range of IP
addresses, enter the first one in the IP Address Begin field. If you do not want to specify an IP



address, enter “*” in the IP Address Begin field. By typing “*” in the field, all traffic using the
service is either allowed or denied to all computers on the network. Click Next.

10 The rule is always active unless you specify a time period for the rule to be active. For instance,
you can deny access to News (NNTP) between 8 a.m. and 5 p.m. Monday through Friday, but
allow access after work hours and on weekends. Specify any specific times in the Hours Active
fields and the Days Active menus. Click Next.
11 Click Apply to save your new rule. The new rule is listed in the Access Rules table.

Configuring Rules Using the Add Rule Window
1 Click Add at the bottom of the Access Rules table. The Add Rule window is displayed.

2 In the General page, select Allow or Deny from the Action list depending upon whether the rule is
intended to permit or block IP traffic.
3 Select the name of the service affected by the Rule from the Service list. If the service is not listed,
you must define the service in the Add Service window. The Any service encompasses all IP
services.
4 Select the source of the traffic affected by the rule from the Source list.



5 If you want to define the source IP addresses that are affected by the rule, such as restricting
certain users from accessing the Internet, enter the starting IP addresses of the address range in
the Address Range Begin field and the ending IP address in the Address Range End field. To
include all IP addresses, enter * in the Address Range Begin field.
6 Select the destination of the traffic affected by the rule, LAN, WAN, or *, from the Destination
menu.
7 If you want to define the destination IP addresses that are affected by the rule, for example, to
allow inbound Web access to several Web servers on your LAN, enter the starting IP addresses of
the address range in the Address Range Begin field and the ending IP address in the Address
Range End field. To include all IP addresses, enter * in the Address Range Begin field.
8 Enter any comments to help identify the rule in the Comments field.
9 Click the Advanced tab.

10 Select always from the Apply this Rule menu if the rule is always in effect.
11 Select from the Apply this Rule menu to define the specific time and day of week to enforce the
rule. Enter the time of day (in 24-hour format) to begin and end enforcement. Then select the day
of the week to begin and end enforcement.
Tip: If you want to enable the rule at different times depending on the day of the week, make
additional rules for each time period.
12 If you would like for the rule to time out after a period of inactivity, set the amount of time, in
minutes, in the Inactivity Timeout (minutes) field. The default value is 5 minutes.
13 Do not select the Allow Fragmented Packets check box. Large IP packets are often divided into
fragments before they are routed over the Internet and then reassembled at a destination host.
Because hackers exploit IP fragmentation in Denial of Service attacks, the SonicWALL blocks
fragmented packets by default. You can override the default configuration to allow fragmented
packets over PPTP or IPSec.



14 Click the Bandwidth tab.

15 Select Bandwidth Management, and enter the Guaranteed Bandwidth in Kbps.
16 Enter the maximum amount of bandwidth available to the Rule at any time in the Maximum
Bandwidth field.
Tip: Rules using Bandwidth Management take priority over rules without bandwidth management.
17 Assign a priority from 0 (highest) to 7 (lowest) in the Bandwidth Priority list.
18 Click OK.
Tip: Although custom rules can be created that allow inbound IP traffic, the SonicWALL does not
disable protection from Denial of Service attacks, such as the SYN Flood and Ping of Death attacks.

Rule Examples
The following examples illustrate methods for creating Network Access Rules.

Blocking LAN Access for Specific Services
This example shows how to block LAN access to NNTP servers on the Internet during business
hours.
1 Click Add to launch the Add window.
2 Select Deny from the Action settings.
3 Select NNTP from the Service menu. If the service is not listed in the list, you must to add it in the
Add Service window.
4 Select LAN from the Source Ethernet menu.
5 Since all computers on the LAN are to be affected, enter * in the Source Address Range Begin
field.
6 Select WAN from the Destination Ethernet menu.
7 Enter * in the Destination Address Range Begin field to block access to all NNTP servers.
8 Click on the Options tab.
9 Select from the Apply this Rule list to configure the time of enforcement.
10 Enter 8:30 and 17:30 in the hour fields.
11 Select Mon to Fri from the menu.



12 Click OK.

Enabling Ping
By default, your SonicWALL does not respond to ping requests from the Internet. This Rule allows
ping requests from your ISP servers to your SonicWALL security appliance.
1 Click Add to launch the Add Rule window.
2 Select Allow from the Action menu.
3 Select Ping from the Service menu.
4 Select WAN from the Source Ethernet menu.
5 Enter the starting IP address of the ISP network in the Source Address Range Begin field and
the ending IP address of the ISP network in the Source Address Range End field.
6 Select LAN from the Destination Ethernet menu.
7 Since the intent is to allow a ping only to the SonicWALL security appliance, enter the SonicWALL
security appliance LAN IP Address in the Destination Address Range Begin field.
8 Click the Options tab.
9 Select Always from the Apply this Rule menu to ensure continuous enforcement.
10 Click OK.


Access Rules > Advanced

C H A P T E R

28
Chapter 28: Configuring Advanced Rule
Options

Access Rules > Advanced
Click Advanced underneath Access Rules.The Advanced Rule Options page is displayed.

Windows Networking (NetBIOS) Broadcast Pass Through
Computers running Microsoft Windows communicate with one another through NetBIOS broadcast
packets. By default, the SonicWALL security appliance blocks these broadcasts. You can choose the
interfaces you want to allow Windows networking broadcast pass-through for supporting Windows
networking.


CHAPTER 28: Configuring Advanced Rule Options

Detection Prevention
Enable Stealth Mode
By default, the SonicWALL security appliance responds to incoming connection requests as either
“blocked” or “open”. If you enable Stealth Mode, your SonicWALL security appliance does not
respond to blocked inbound connection requests. Stealth Mode makes your SonicWALL security
appliance essentially invisible to hackers.

Randomize IP ID
Select Randomize IP ID to prevent hackers using various detection tools from detecting the presence
of a SonicWALL security appliance. IP packets are given random IP IDs which makes it more difficult
for hackers to “fingerprint” the SonicWALL security appliance.

Dynamic Ports
• Select Enable support for Oracle (SQLNet) if you have Oracle applications on your network.
• Select Enable Support for Windows Messenger if you are having problems using Windows
Messenger and Windows XP through the SonicWALL security appliance. If Enable Support for
Windows Messenger is selected, it may affect the performance of the SonicWALL security
appliance.
• Select Enable RTSP Transformations to support on-demand delivery of real-time data, such as
audio and video. RTSP (Real Time Streaming Protocol) is an application-level protocol for control
over delivery of data with real-time properties.

Source Routed Packets
Drop Source Routed Packets is selected by default. Clear the check box if you are testing traffic
between two specific hosts and you are using source routing.

TCP Connection Inactivity Timeout
If a connection to a remote server remains idle for more than five minutes, the SonicWALL security
appliance closes the connection. Without this timeout, Internet connections could stay open
indefinitely, creating potential security holes. You can increase the Inactivity Timeout if applications,
such as Telnet and FTP, are frequently disconnected. The default value is 15 minutes.

TCP Checksum Validation
Enable TCP checksum validation - enables TCP checksum validation for error checking.

Access Rule Service Options
Force inbound and outbound FTP data connections to use default port: 20 - The default
configuration allows FTP connections from port 20 but remaps outbound traffic to a port such as 1024.
If the check box is selected, any FTP data connection through the security appliance must come from
port 20 or the connection is dropped. The event is then logged as a log event on the security
appliance.


Firewall > Services

C H A P T E R

29
Chapter 29: Configuring Custom Services

Firewall > Services

Services are anything a server provides to other computers. A service can be as simple as the
computer asking a server for the correct time (NTP) and the server returns a response. Other types of
services provide access to different types of data. Web servers (HTTP) respond to requests from
clients (browser software) for access to files and data. Services are used by the SonicWALL security
appliance to configure network access rules for allowing or denying traffic to the network.

User Defined (Custom) Services
If protocol is not listed in the Predefined Services table, you can add it to the User Defined (Custom)
Services table.


CHAPTER 29: Configuring Custom Services

1 Click Add. The Add Service window is displayed.

2 Enter the name of the service in the Name field.
3 Enter the port number or numbers that apply to the service in the Port Range fields. A list of well
known port numbers can be found in any networking reference.
4 Select the type of protocol, TCP, UDP, or ICMP from the Protocol menu.
5 Click OK. The service appears in the User Defined (Custom) Services table.

Predefined Services
The Predefined Services table lists are the services that are predefined in the SonicWALL security
appliance. You cannot delete any of these predefined services.

The Predefined Services table displays the following information about each predefined service:
• Name - the name of the service
• Port Start - the beginning port number associated with the service
• Port End - the ending port number associated with the service
• Protocol - the protocol the service is associated with: TCP, UDP, ICMP or IPSEC-ESP
• Enable Logging - checked, the service traffic is logged by the SonicWALL security appliance
event log. Unchecked, the service traffic is not logged.


Firewall > VoIP

C H A P T E R

30
Chapter 30: Configuring VoIP

Firewall > VoIP

The SonicWALL security appliance supports the most widely used VoIP standard protocols and the
most commonly used VoIP vendors and systems on the market. Providing full VoIP support on the
SonicWALL security appliance enables organizations with increasingly decentralized workforces to
access corporate voice services from remote sites. VoIP systems consist of multiple clients (such as
IP phones or soft phones) and VoIP servers residing at different parts of the network.

VoIP Overview
This section provides an overview of VoIP. It contains the following sections:
• “What is VoIP?” on page 208
• “VoIP Security” on page 208
• “VoIP Protocols” on page 209
• “Configuring the VoIP Settings” on page 214
• “SonicWALL VoIP Vendor Interoperability” on page 211
• “CODECs” on page 211
• “How SonicOS Handles VoIP Calls” on page 212


CHAPTER 30: Configuring VoIP

What is VoIP?
Voice over IP (VoIP) is an umbrella term for a set of technologies that allow voice traffic to be carried
over Internet Protocol (IP) networks. VoIP transfers the voice streams of audio calls into data packets
as opposed to traditional, analog circuit-switched voice communications used by the public switched
telephone network (PSTN).

VoIP is the major driving force behind the convergence of networking and telecommunications by
combining voice telephony and data into a single integrated IP network system. VoIP is all about
saving cost for companies through eliminating costly redundant infrastructures and
telecommunication usage charges while also delivering enhanced management features and calling
services features.

VoIP Security
Companies implementing VoIP technologies in an effort to cut communication costs and extend
corporate voice services to a distributed workforce face security risks associated with the
convergence of voice and data networks. VoIP security and network integrity are an essential part of
any VoIP deployment.

The same security threats that plague data networks today are inherited by VoIP but the addition of
VoIP as an application on the network makes those threats even more dangerous. By adding VoIP
components to your network, you’re also adding new security requirements.

VoIP encompasses a number of complex standards that leave the door open for bugs and
vulnerabilities within the software implementation. The same types of bugs and vulnerabilities that
hamper every operating system and application available today also apply to VoIP equipment. Many
of today's VoIP call servers and gateway devices are built on vulnerable Windows and Linux
operating systems.

Firewall Requirements for VoIP

VoIP is more complicated than standard TCP/UDP-based applications. Because of the complexities
of VoIP signaling and protocols, as well as inconsistencies that are introduced when a firewall
modifies source address and source port information with Network Address Translation (NAT), it is
difficult for VoIP to effectively traverse a standard firewall. Here are a few of the reasons why.
• VoIP operates using two separate protocols - A signaling protocol (between the client and VoIP
Server) and a media protocol (between the clients). Port/IP address pairs used by the media
protocols (RTP/RTCP) for each session are negotiated dynamically by the signaling protocols.
Firewalls need to dynamically track and maintain this information, securely opening selected ports
for the sessions and closing them at the appropriate time.
• Multiple media ports are dynamically negotiated through the signaling session -
Negotiations of the media ports are contained in the payload of the signaling protocols (IP address
and port information). Firewalls need to perform deep packet inspection on each packet to acquire
the information and dynamically maintain the sessions, thus demanding extra firewall processing.
• Source and destination IP addresses are embedded within the VoIP signaling packets - A
firewall supporting NAT translates IP addresses and ports at the IP header level for packets. Fully
symmetric NAT firewalls adjust their NAT bindings frequently, and may arbitrarily close the
pinholes that allow inbound packets to pass into the network they protect, eliminating the service
provider's ability to send inbound calls to the customer. To effectively support VoIP it is necessary
for a NAT firewall to perform deep packet inspection and transformation of embedded IP
addresses and port information as the packets traverse the firewall.
• Firewalls need to process the signaling protocol suites consisting of different message
formats used by different VoIP systems - Just because two vendors use the same protocol
suite does not necessarily mean they will interoperate.


Firewall > VoIP

To overcome many of the hurdles introduced by the complexities of VoIP and NAT, vendors are
offering Session Border Controllers (SBCs). An SBC sits on the Internet side of a firewall and
attempts to control the border of a VoIP network by terminating and re-originating all VoIP media and
signalling traffic. In essence, SBCs act as a proxy for VoIP traffic for non-VoIP enabled firewalls.
SonicWALL security appliances are VoIP enabled firewalls that eliminate the need for an SBC on
your network.

VoIP Protocols
VoIP technologies are built on two primary protocols, H.323 and SIP.

H.323

H.323 is a standard developed by the International Telecommunications Union (ITU). It’s a
comprehensive suite of protocols for voice, video, and data communications between computers,
terminals, network devices, and network services. H.323 is designed to enable users to make point-
to-point multimedia phone calls over connectionless packet-switching networks such as private IP
networks and the Internet. H.323 is widely supported by manufacturers of video conferencing
equipment, VoIP equipment and Internet telephony software and devices.

H.323 uses a combination of TCP and UDP for signaling and ASN.1 for message encoding. H.323v1
was released in 1996 and H.323v5 was released in 2003. As the older standard, H.323 was
embraced by many early VoIP players.

An H.323 network consists of four different types of entities:
• Terminals - Client end points for multimedia communications. An example would be an H.323
enabled Internet phone or PC.
• Gatekeepers - Performs services for call setup and tear down, and registering H.323 terminals for
communications. Includes:
Address translation.
Registration, admission control, and status (RAS).
Internet Locator Service (ILS) also falls into this category (although it is not part of H.323). ILS
uses LDAP (Lightweight Directory Access Protocol) rather than H.323 messages.
• Multipoint control units (MCUs) - Conference control and data distribution for multipoint
communications between terminals.
• Gateways - Interoperation between H.323 networks and other communications services, such as
the circuit-switched Packet Switched Telephone Network (PSTN).

SonicOS provides the following support for H.323:
• VoIP devices running all versions of H.323 (currently 1 through 5) are supported
• Microsoft's LDAP-based Internet Locator Service (ILS)
• Discovery of the Gatekeeper by LAN H.323 terminals using multicast
• Stateful monitoring and processing of Gatekeeper registration, admission, and status (RAS)
messages
• Support for H.323 terminals that use encryption for the media streams
• DHCP Option 150. The SonicWALL DHCP Server can be configured to return the address of a
VoIP specific TFTP server to DHCP clients
• In addition to H.323 support, SonicOS supports VoIP devices using the following additional ITU
standards:
T.120 for application sharing, electronic white-boarding, file exchange, and chat
H.239 to allow multiple channels for delivering audio, video and data
H.281 for Far End Camera Control (FECC)



SIP

The Session Initiation Protocol (SIP) standard was developed by the Internet Engineering Task Force
(IETF). RFC 2543 was released in March 1999. RFC 3261 was released in June 2002. SIP is a
signaling protocol for initiating, managing and terminating sessions. SIP supports ‘presence’ and
mobility and can run over User Datagram Protocol (UDP) and Transmission Control Protocol (TCP).

Using SIP, a VoIP client can initiate and terminate call sessions, invite members into a conferencing
session, and perform other telephony tasks. SIP also enables Private Branch Exchanges (PBXs),
VoIP gateways, and other communications devices to communicate in standardized collaboration.
SIP was also designed to avoid the heavy overhead of H.323.

A SIP network is composed of the following logical entities:
• User Agent (UA) - Initiates, receives and terminates calls.
• Proxy Server - Acts on behalf of UA in forwarding or responding to requests. A Proxy Server can
fork requests to multiple servers. A back-to-back user agent (B2BUA) is a type of Proxy Server that
treats each leg of a call passing through it as two distinct SIP call sessions: one between it and the
calling phone and the other between it and the called phone. Other Proxy Servers treat all legs of
the same call as a single SIP call session.
• Redirect Server - Responds to requests but does not forward requests.
• Registration Server - Handles UA authentication and registration.

SonicOS provides the following support for SIP:
• Base SIP standard (both RFC 2543 and RFC 3261)
• SIP INFO method (RFC 2976)
• Reliability of provisional responses in SIP (RFC 3262)
• SIP specific event notification (RFC 3265)
• SIP UPDATE method (RFC 3311)
• DHCP option for SIP servers (RFC 3361)
• SIP extension for instant messaging (RFC 3428)
• SIP REFER method (RFC 3515)
• Extension to SIP for symmetric response routing (RFC 3581)

Supported Interfaces
VoIP devices are supported on the following SonicOS Standard Interfaces:
• WAN
• LAN
• WLAN
• OPT
• Site-to-site VPNs
• Client-to-gateway VPNs


Firewall > VoIP

SonicWALL VoIP Vendor Interoperability
The following is a partial list of devices from leading manufacturers with which SonicWALL VoIP
interoperates.

H.323 SIP
Soft-Phones: Soft-Phones:
Avaya Apple iChat
Microsoft NetMeeting Avaya
OpenPhone Microsoft MSN Messenger
PolyCom Nortel Multimedia PC Client
SJLabs SJ Phone PingTel Instant Xpressa
PolyCom
Telephones/VideoPhones: Siemens SCS Client SJLabs
Avaya SJPhone
Cisco XTen X-Lite
D-Link Ubiquity SIP User Agent
PolyCom
Sony Telephones/ATAs:
Avaya
Gatekeepers: Cisco
Cisco Grandstream BudgetOne
OpenH323 Gatekeeper Mitel
Packet8 ATA
Gateway: PingTel Xpressa PolyCom
Cisco PolyCom
Pulver Innovations WiSIP
SoundPoint

SIP Proxies/Services:
Cisco SIP Proxy Server
Brekeke Software OnDo SIP Proxy
Packet8
Siemens SCS SIP Proxy
Vonage

CODECs
SonicOS supports media streams from any CODEC - Media streams carry audio and video
signals that have been processed by a hardware/software CODEC (COder/DECoder) within the VoIP
device. CODECs use coding and compression techniques to reduce the amount of data required to
represent audio/video signals. Some examples of CODECs are:
• H.264, H.263, and H.261 for video
• MPEG4, G.711, G.722, G.723, G.728, G.729 for audio



How SonicOS Handles VoIP Calls
SonicOS provides an efficient and secure solution for all VoIP call scenarios. The following are
examples of how SonicOS handles VoIP call flows.

Incoming Calls

The following figure shows the sequence of events that occurs during an incoming call.
Figure 30.1 Incoming VoIP Call Flow

The following describes the sequence of events shown in Figure 42.1:
1 Phone B registers with VoIP server - The SonicWALL security appliance builds a database of
the accessible IP phones behind it by monitoring the outgoing VoIP registration requests. SonicOS
translates between phone B’s private IP address and the firewall’s public IP address used in
registration messages. The VoIP server is unaware that phone B is behind a firewall and has a
private IP address—it associates phone B with the firewall’s public IP address.
2 Phone A initiates a call to phone B - Phone A initiates a call to phone B using a phone number
or alias. When sending this information to the VoIP server, it also provides details about the media
types and formats it can support as well as the corresponding IP addresses and ports.
3 VoIP Server validates the call request and sends the request to phone B. The VoIP server
sends the call request to the firewall’s public IP address. When it reaches the firewall, SonicOS
validates the source and content of the request. The firewall then determines phone B’s private IP
address.
4 Phone B rings and is answered. When phone B is answered, it returns information to the VoIP
server for the media types and formats it supports as well as the corresponding IP addresses and
ports. SonicOS translates this private IP information to use the firewall’s public IP address for
messages to the VoIP server.


Firewall > VoIP

5 VoIP server returns phone B media IP information to phone A. Phone A now has enough
information to begin exchanging media with Phone B. Phone A does not know that Phone B is
behind a firewall, as it was given the public address of the firewall by the VoIP Server.
6 Phone A and phone B exchange audio/video/data through the VoIP server. Using the internal
database, SonicOS ensures that media comes from only Phone A and is only using the specific
media streams permitted by Phone B.

Local Calls

The following figure shows the sequence of events that occurs during a local VoIP call.
Figure 30.2 Local VoIP Call Flow

The following describes the sequence of events shown in Figure 42.2:
1 Phones A and B register with VoIP server - The SonicWALL security appliance builds a
database of the accessible IP phones behind it by monitoring the outgoing VoIP registration
requests. SonicOS translates between the phones’ private IP addresses and the firewall’s public
IP address. The VoIP server is unaware that the phones are behind a firewall. It associates the
same IP address for both phones, but different port numbers.
2 Phone A initiates a call to phone B by sending a request to the VoIP server - Even though
they are behind the same firewall, phone A does not know Phone B’s IP address. Phone A initiates
a call to phone B using a phone number or alias.
3 VoIP Server validates the call request and sends the request to phone B - The VoIP server
sends the call request to the firewall’s public IP address.The firewall then determines phone B’s
private IP address.
4 Phone B rings and is answered - When phone B is answered, the firewall translate its private IP
information to use the firewall’s public IP address for messages to the VoIP server.
5 VoIP Server returns phone B media IP information to phone A - Both the called and calling
party information within the messages are translated by SonicOS back to the private addresses
and ports for phone A and phone B.



6 Phone A and phone B directly exchange audio/video/data - The SonicWALL security
appliance routes traffic directly between the two phones over the LAN. Directly connecting the two
phones reduces the bandwidth requirements for transmitting data to the VoIP server and
eliminates the need for the SonicWALL security appliance to perform address translation.

Configuring the VoIP Settings
SonicOS includes the VoIP configuration settings on the Firewall > VoIP page. This page is divided
into three configuration settings sections: General Settings, SIP Settings, and H.323 Settings.

Configuring Consistent Network Address Translation (NAT)
Consistent NAT enhances standard NAT policy to provide greater compatibility with peer-to-peer
applications that require a consistent IP address to connect to, such as VoIP. Consistent NAT uses an
MD5 hashing method to consistently assign the same mapped public IP address and UDP Port pair to
each internal private IP address and port pair.

For example, NAT could translate the private (LAN) IP address and port pairs, 192.116.168.10/50650
and 192.116.168.20/50655 into public (WAN) IP/port pairs as follows:

Private IP/Port Translated Public IP/Port
192.116.168.10/50650 64.41.140.167/40004
192.116.168.20/50655 64.41.140.167/40745

With Consistent NAT enabled, all subsequent requests from either host 192.116.168.10 or
192.116.168.20 using the same ports illustrated in the previous result in using the same translated
address and port pairs. Without Consistent NAT, the port and possibly the IP address change with
every request.

To enable Consistent NAT, select the Enable Consistent NAT setting and click Apply. This
checkbox is disabled by default.
Note: Enabling Consistent NAT causes a slight decrease in overall security, because of the increased
predictability of the address and port pairs. Most UDP-based applications are compatible with
traditional NAT. Therefore, do not enable Consistent NAT unless your network uses applications that
require it.

SIP Settings

By default, SIP clients use their private IP address in the SIP Session Definition Protocol (SDP)
messages that are sent to the SIP proxy. If your SIP proxy is located on the public (WAN) side of the
SonicWALL security appliance and SIP clients are on the private (LAN) side behind the firewall, the
SDP messages are not translated and the SIP proxy cannot reach the SIP clients.


Firewall > VoIP

Selecting Enable SIP Transformations transforms SIP messages between LAN (trusted) and WAN/
DMZ (untrusted). You need to check this setting when you want the SonicWALL security appliance to
do the SIP transformation. If your SIP proxy is located on the public (WAN) side of the SonicWALL
and SIP clients are on the LAN side, the SIP clients by default embed/use their private IP address in
the SIP/Session Definition Protocol (SDP) messages that are sent to the SIP proxy, hence these
messages are not changed and the SIP proxy does not know how to get back to the client behind the
SonicWALL. Selecting Enable SIP Transformations enables the SonicWALL to go through each SIP
message and change the private IP address and assigned port. Enable SIP Transformation also
controls and opens up the RTP/RTCP ports that need to be opened for the SIP session calls to
happen. NAT translates Layer 3 addresses but not the Layer 7 SIP/SDP addresses, which is why you
need to select Enable SIP Transformations to transform the SIP messages.
Tip: In general, you should check the Enable SIP Transformations box unless there is another NAT
traversal solution that requires this feature to be turned off. SIP Transformations works in bi-
directional mode, meaning messages are transformed going from LAN to WAN and vice versa.

Selecting Permit non-SIP packets on signaling port enables applications such as Apple iChat and
MSN Messenger, which use the SIP signaling port for additional proprietary messages. Enabling this
checkbox may open your network to malicious attacks caused by malformed or invalid SIP traffic.
This checkbox is disabled by default.

SIP Signaling inactivity time out (seconds) and SIP Media inactivity time out (seconds) define
the amount of time a call can be idle (no traffic exchanged) before the SonicWALL security appliance
denies further traffic. A call goes idle when placed on hold. The default time value for SIP Signaling
inactivity time out is 1800 seconds (30 minutes). The default time value for SIP Media inactivity
time out is 120 seconds (2 minutes).

The Additional SIP signaling port (UDP) for transformations setting allows you to specify a non-
standard UDP port used to carry SIP signaling traffic. Normally, SIP signaling traffic is carried on UDP
port 5060. However, a number of commercial VOIP services use different ports, such as 1560. Using
this setting, the security appliance performs SIP transformation on these non-standard ports.
Tip: Vonage’s VoIP service uses UDP port 5061.

H.323 Settings

Select Enable H.323 Transformation in the H.323 Settings section and click Apply to allow stateful
H.323 protocol-aware packet content inspection and modification by the SonicWALL security
appliance. The SonicWALL security appliance performs any dynamic IP address and transport port
mapping within the H.323 packets, which is necessary for communication between H.323 parties in
trusted and untrusted networks/zones. Disable the Enable H.323 Transformation to bypass the
H.323 specific processing performed by the SonicWALL security appliance.

The H.323 Signaling/Media inactivity time out (seconds) field specifies the amount of time a call
can be idle before the SonicWALL security appliance denying further traffic. A call goes idle when
placed on hold. The default time value for H.323 Signaling/Media inactivity time out is 300 seconds
(5 minutes).



Configuring VoIP Access Rules
By default, the SonicWALL security appliance’s stateful packet inspection allows all communication
from the LAN to the Internet and blocks all traffic to the LAN from the Internet. Additional network
access rules can be defined to extend or override the default access rules.

If you are defining VoIP access for a client to use a VoIP service provider from the WAN, you
configure network access rules between source and destination interface or zones to enable clients
behind the firewall to send and receive VoIP calls.

If your SIP Proxy or H.323 Gateway is located behind the firewall, you can use the SonicWALL Public
Server Wizard to automatically configure access rules.
Tip: Although custom rules can be created that allow inbound IP traffic, the SonicWALL security
appliance does not disable protection from Denial of Service attacks, such as the SYN Flood and Ping
of Death attacks.

To add access rules for VoIP traffic on the SonicWALL security appliance running SonicOS Standard:
1 Go to the Firewall > Access Rules page, and under View Style click All Rules.
2 Click Add at the bottom of the Access Rules table. The Add Rule window is displayed.
3 In the General tab, select Allow from the Action list to permit traffic.
4 Select H.323 Call Signaling or SIP from the Service menu.
5 Select the source and destination interfaces from the Source and Destination menus. You can
optionally specify an IP address range for each interface in the Address Range Begin and
Address Range End fields.
6 Enter any comments to help identify the access rule in the Comments field.
7 Click the Bandwidth tab.
8 Select Bandwidth Management, and enter the Guaranteed Bandwidth in Kbps.
9 Enter the maximum amount of bandwidth available to the Rule at any time in the Maximum
Bandwidth field.
10 Assign a priority from 0 (highest) to 7 (lowest) in the Bandwidth Priority list. For higher VoIP call
quality, ensure VoIP traffic receives HIGH priority.
11 Click OK.

VoIP Deployment Scenarios
SonicWALL security appliances can be deployed in a variety of VoIP network configurations. This
section describes the following deployment scenarios:
• “Generic Deployment Scenario” on page 216
• “Deployment Scenario 1: Point-to-Point VoIP Service” on page 216
• “Deployment Scenario 2: Public VoIP Service” on page 217
• “Deployment Scenario 3: Trusted VoIP Service” on page 218

Generic Deployment Scenario
All three of the following deployment scenarios begin with the following basic configuration procedure:
1 Enable bandwidth management on the WAN interface on Network > Interfaces.
2 Configure SIP or H.323 transformations and inactivity settings on VoIP > Settings.
3 Configure the DHCP Server on the Network > DHCP Server page with static private IP address
assignments to VoIP clients.


Firewall > VoIP

4 Enable SonicWALL Intrusion Prevention Service to provide application-layer protection for VoIP
communications on the Security Services > Intrusion Prevention page.
5 Connect VoIP Clients to network.

Deployment Scenario 1: Point-to-Point VoIP Service
The point-to-point VoIP service deployment is common for remote locations or small office
environments that use a VoIP end point device connected to the network behind the firewall to receive
calls directly from the WAN. The VoIP end point device on the Internet connects to a VoIP client
device on the LAN behind the firewall using the SonicWALL security appliance’s Public IP address.
The following figure shows a point-to-point VoIP service topology
Figure 30.3 Point-to-Point VoIP Service Topology

This deployment does not require a VoIP server. The Public IP address of the SonicWALL security
appliance is used as the main VoIP number for hosts on the network. This requires a static Public IP
address or the use of a Dynamic DNS service to make the public address available to callers from the
WAN. Incoming call requests are routed through the SonicWALL security appliance using NAT,
DHCP Server, and network access rules.

To make multiple devices behind the SonicWALL security appliance accessible from the public side,
configure one-to-one NAT.

Deployment Scenario 2: Public VoIP Service
The Public VoIP Service deployment uses a VoIP service provider, which maintains the VoIP server
(either a SIP Proxy Server or H.323 Gatekeeper). The SonicWALL security appliance public IP
address provides the connection from the SIP Proxy Server or H.323 Gatekeeper operated by the
VoIP service provider. The following figure shows a public VoIP service topology.



Figure 30.4 Public VoIP Service Topology

For VoIP clients that register with a server from the WAN, the SonicWALL security appliance
automatically manages NAT policies and access rules. The SonicWALL security appliance performs
stateful monitoring of registration and permits incoming calls for clients while they remain registered.
No configuration of clients is required.

Deployment Scenario 3: Trusted VoIP Service
The organization deploys its own VoIP server on a DMZ or LAN to provide in-house VoIP services
that are accessible to VoIP clients on the Internet or from local network users behind the security
gateway. The following figure shows a trusted VoIP service topology.


Firewall > VoIP

Figure 30.5 Trusted VoIP Service Topology

For VoIP clients that register with a server on the DMZ or LAN, the SonicWALL security appliance
automatically manages NAT policies and access rules. The SonicWALL security appliance performs
stateful monitoring of registration and permits incoming calls for clients while they remain registered.
No configuration on the VoIP clients is required.

To make a server on the LAN accessible to clients on the WAN:
1 Define a Host address object with the interface and IP address of the server.
2 Define a NAT policy, mapping traffic coming to the SonicWALL security appliance’s public (WAN)
IP address and VoIP service (SIP or H.323 Gatekeeper) to the server.
3 Define access rules allowing VoIP service to pass through the firewall.


Firewall > Connections Monitor

C H A P T E R

31
Chapter 31: Monitoring Active Firewall
Connections

Firewall > Connections Monitor
The Firewall > Connections Monitor page provides you the filtering controls to query log event
messages based on your configured filter logic.


CHAPTER 31: Monitoring Active Firewall Connections

Setting Filter Logic
By default, the SonicOS filter logic is set to “Priority && Category && Source && Destination.” The
double ampersand symbols (&&) indicate the boolean expression “and.” The default SonicOS filter
logic displays all log events.
1 Enter the source IP address in the Source IP field.
2 Enter the destination IP address in the Destination IP field.
3 Enter the destination port number in the Destination Port field.
4 Select the protocol from the Protocol menu.
5 Select the source interface from the Src Interface.
6 Select the destination interface from Dst Interface.
7 Click Apply Filters.

Using Group Filters
Use Group Filters to change the default SonicOS filter logic (Priority && Category && Source &&
Destination) from double ampersand symbols (&&) to double pipe symbols (||) to indicate the boolean
expression “or.” When using group filters, select two or more Group Filters checkboxes.

If you select only one Group Filter checkbox, the filter logic will remain the same. Selecting only the
Priority-Group Filter checkbox provides you with the following filter logic:

Source IP: (Priority) && Category && Source && Destination


PART

7
VPN
Part 7


SonicWALL VPN Options Overview

C H A P T E R

32
Chapter 32: Configuring VPN Settings

SonicWALL VPN Options Overview

The SonicWALL security appliance can be configured to support remote VPN clients and/or site-to-
site VPN connections between offices. SonicWALL VPN is based on the industry-standard IPSec
VPN implementation.

Mobile users, telecommuters, and other remote users with broadband (DSL or cable) or dialup
Internet access can securely and easily access your network resources with the SonicWALL GVC or
Global Security Client and SonicWALL GroupVPN on your SonicWALL security appliance.
Note: For more information on the SonicWALL GVC, see the SonicWALL Global VPN Client
Administrator’s Guide. For more information on the SonicWALL Global Security Client, see the
SonicWALL Global Security Client Administrator’s Guide. Both guides are available on the
SonicWALL security appliance Resource CD and at the SonicWALL documentation Web site at
http://www.sonicwall.com/us/Support.html.

Remote office networks can securely connect to your network using site-to-site VPN connections that
enable network-to- network VPN connections. Using the SonicWALL security appliance’s
management interface, you can quickly create a VPN policy to a remote site. Whenever data is
intended for the remote site, the SonicWALL automatically encrypts the data and sends it over the
Internet to the remote site, where it is decrypted and forwarded to the intended destination.


CHAPTER 32: Configuring VPN Settings

VPN > Settings
The VPN > Settings page provides the SonicWALL features for configuring site-to-site VPN
connections and client VPN connections.

The GroupVPN policy is automatically enabled and ready to use for supporting remote SonicWALL
Global VPN Clients.

VPN Global Settings
The Global VPN Settings section displays the following information:
• Enable VPN must be selected to allow VPN policies through the SonicWALL.
• Unique Firewall Identifier - the default value is the serial number of the SonicWALL. You can
change the Identifier, and use it for configuring VPN tunnels.

VPN Policies
All existing VPN policies are displayed in the VPN Policies table. Each entry displays the following
information:
• Name - User-defined name to identify the Security Association.
• Gateway - The IP address of the remote SonicWALL. If 0.0.0.0 is used, no Gateway is displayed.
• Destinations - The IP addresses of the destination networks.
• Crypto Suite - The type of encryption used
• Enable - Selecting the check box enables the VPN Policy. Clearing the check box
disables it.
• Configure - Edit or delete the VPN Policy information. GroupVPN has a Disk icon for
exporting the configuration for SonicWALL Global VPN Clients.

The number of VPN policies defined, policies enabled, and the maximum number of Policies allowed
is displayed below the table.

Navigating and Sorting the VPN Policies Entries
The VPN Policies table provides easy pagination for viewing a large number of VPN policies. You
can navigate a large number of VPN policies listed in the VPN Policies table by using the navigation


Configuring GroupVPN Policy on the SonicWALL

control bar located at the top right of the VPN Policies table. Navigation control bar includes four
buttons. The far left button displays the first page of the table. The far right button displays the last
page. The inside left and right arrow buttons moved the previous or next page respectively.

page.

ascending or descending order. The arrow to the right of the column header indicates the sorting
status. A down arrow means ascending order. An up arrow indicates a descending order.

Currently Active VPN Tunnels
A list of currently active VPN tunnels is displayed in this section. The table lists the name of the VPN
Policy, the local LAN IP addresses, and the remote destination network IP addresses as well as the
Peer Gateway IP address.

Configuring GroupVPN Policy on the
SonicWALL
SonicWALL GroupVPN facilitates the set up and deployment of multiple VPN clients by the
administrator of the SonicWALL security appliance. GroupVPN allows for easy deployment of
multiple SonicWALL Global VPN Clients or Global Security Clients.
Note: For more information on the SonicWALL Global Security Client, refer to the SonicWALL Global
Security Client Administrator’s Guide on the Resource CD or available on the SonicWALL
documentation Web site at http://www.sonicwall.com/us/Support.html.

The default GroupVPN configuration allows you to support SonicWALL Global VPN Clients using IKE
using Preshared Secret without any further editing of the VPN policy. You can configure GroupVPN
to use IKE using 3rd Party Certificates as your IPSec Keying Mode instead of IKE using
Preshared Secret.

To enable GroupVPN using the default IKE using Preshared Secret settings, simply click the
Enable checkbox in the VPN Policies table.



Configuring IKE Preshared Secret
To edit the default settings for GroupVPN, follow these steps:
1 Click the edit icon in the GroupVPN entry. The VPN Policy window is displayed.

2 In the General tab, IKE using Preshared Secret is the default setting for IPSec Keying Mode. A
Shared Secret is automatically generated in the Shared Secret field, or you can generate your
own shared secret. Shared Secrets must be minimum of four characters.
3 Click the Proposals tab to continue the configuration process.



In the IKE (Phase 1) Proposal section, select the following settings:
Group 2 from the DH Group menu.
3DES from the Encryption menu
SHA1 from the Authentication menu
Leave the default setting, 28800, in the Life Time (secs) field. This setting forces the tunnel to
renegotiate and exchange keys every 8 hours.

In the IPSec (Phase 2) Proposal section, select the following settings:
ESP from the Protocol menu
3DES from the Encryption menu
MD5 from the Authentication menu
Select Enable Perfect Forward Secrecy if you want an additional Diffie-Hellman key exchange
as an added layer of security. Then select Group 2 from the DH Group menu.
Leave the default setting, 28800, in the Life Time (secs) field. This setting forces the tunnel to
4 Click the Advanced tab. Select any of the following settings you want to apply to your GroupVPN
policy.

Enable Windows Networking (NetBIOS) broadcast - to allow access to remote network
resources by browsing the Windows® Network Neighborhood.
Apply NAT and Firewall Rules - This feature allows a remote site’s LAN subnet to be hidden
from the corporate site, and is most useful when a remote office’s network traffic is initiated to
the corporate office. The IPSec tunnel is located between the SonicWALL WAN interface and
the LAN segment of the corporation. To protect the traffic, NAT (Network Address Translation)
is performed on the outbound packet before it is sent through the tunnel, and in turn, NAT is
performed on inbound packets when they are received. By using NAT for a VPN connection,
computers on the remote LAN are viewed as one address (the SonicWALL public address)
from the corporate LAN.
Alert: Offices can have overlapping LAN IP ranges if the Apply NAT and Firewall Rules feature is
selected.



Forward Packets to Remote VPNs - allows the remote VPN tunnel to participate in the
SonicWALL routing table. Inbound traffic is decrypted and can be forwarded to a remote site by
way of another VPN tunnel. Normally, inbound traffic is decrypted and only forwarded to the
SonicWALL LAN or a specific route on the LAN configured on the Routing page located in the
Network section. Enabling this feature allows a network administrator to create a “hub and
spoke” network configuration by forwarding inbound traffic to a remote site by way of a VPN
security association. To create a “hub and spoke” network, select the Forward Packets to
Remote VPNs check box.Traffic can travel from a branch office to a branch office by way of the
corporate office.
Default LAN Gateway - used at a central site in conjunction with a remote site using Use this
VPN Tunnel as default route for all Internet traffic. Default LAN Gateway allows the
network administrator to specify the IP address of the default LAN route for incoming IPSec
packets for this SA. Incoming packets are decoded by the SonicWALL and compared to static
routes configured in the SonicWALL. Since packets can have any IP address destination, it is
impossible to configure enough static routes to handle the traffic. For packets received over an
IPSec tunnel, the SonicWALL looks up a route for the LAN. If no route is found, the SonicWALL
checks for a Default LAN Gateway. If a Default LAN Gateway is detected, the packet is routed
through the gateway. Otherwise, the packet is dropped.
VPN Terminated at the LAN, OPT/DMZ/WLAN, or LAN/OPT/DMZ/WLAN - Selecting this
option allows you to terminate a VPN tunnel on a specific destination instead of allowing the
VPN tunnel to terminate on the entire SonicWALL network. By terminating the VPN tunnel to a
specific destination, the VPN tunnel has access to a specific portion of the destination LAN or
OPT/DMZ/WLAN network.
Require Authentication of VPN Clients via XAUTH - requires that all inbound traffic on this
SA is from an authenticated user. Unauthenticated traffic is not allowed on the VPN tunnel.
5 Click the Client tab. Select any of the following settings you want to apply to your GroupVPN
policy.

Cache XAUTH User Name and Password - Allows Global VPN Client (GVC) to cache any
username and password required for XAUTH user authentication. The drop-down list provides the
following options:
Never - GVC is not allowed to cache username and password. The user will be prompted for a
username and password when the connection is enabled and also every time there is an IKE
phase 1 rekey.



Single Session - The user will be prompted for username and password each time the
connection is enabled and will be valid until the connection is disabled. This username and
password is used through IKE phase 1 rekey.
Always - The user will be prompted for username and password only once when connection is
enabled. When prompted, the user will be given the option of caching the username and
password.
Virtual Adapter Settings - The use of the Virtual Adapter by the GVC has always been
dependent upon a DHCP server, either the internal SonicOS or a specified external DHCP server,
to allocate addresses to the Virtual Adapter. In instances where predictable addressing was a
requirement, it was necessary to obtain the MAC address of the Virtual Adapter, and to create a
DHCP lease reservation. To reduce the administrative burden of providing predictable Virtual
Adapter addressing, you can configure the GroupVPN to accept static addressing of the Virtual
Adapter's IP configuration. This feature requires the use of GVC version 3.0 or later.
None - A Virtual Adapter will not be used by this GroupVPN connection.
DHCP Lease - The Virtual Adapter will obtain its IP configuration from the DHCP Server only,
as configured in the VPN > DHCP over VPN page.
DHCP Lease or Manual Configuration - When the GVC connects to the SonicWALL, the
policy from the SonicWALL instructs the GVC to use a Virtual Adapter, but the DHCP
messages are suppressed if the Virtual Adapter has been manually configured. The configured
value is recorded by the SonicWALL so that it can proxy ARP for the manually assigned IP
address.
Note: By design, there are currently no limitations on IP address assignments for the Virtual Adapter.
Only duplicate static addresses are not permitted.
Allow Connections to - Specifies single or multiple VPN connections. The drop-down list provides
the following options:
This Gateway Only - Allows a single connection to be enabled at a time. Traffic that matches
the destination networks as specified in the policy of this gateway is sent through the VPN
tunnel. All other traffic is blocked. If this option is selected along with Set Default Route as this
Gateway, then the Internet traffic is also sent through the VPN tunnel. If this option is selected
without selecting Set Default Route as this Gateway, then the Internet traffic is blocked.
All Secured Gateways - Allows one or more connections to be enabled at the same time.
Traffic matching the destination networks of each gateway is sent through the VPN tunnel of
that specific gateway. If this option is selected along with Set Default Route as this Gateway,
then Internet traffic is also sent through the VPN tunnel. If this option is selected without
selecting Set Default Route as this Gateway, then the Internet traffic is blocked. Only one of
the multiple gateways can have Set Default Route as this Gateway enabled.
Split Tunnels - Allows the VPN user to have both local Internet access and VPN connectivity.
Set Default Route as this Gateway - If checked, GVC traffic that does not match selectors for the
gateway’s protected subnets must also be tunneled. In effect, this changes the GVC’s default
gateway to the gateway tunnel endpoint. If unchecked, the GVC must drop all non-matching traffic
if Allow traffic to This Gateway Only or All Secured Gateways is selected.
Require Global Security Client for this Connection - Allows a VPN connection from the remote
Global Security Client only if the remote computer is running the SonicWALL Distributed Security
Client, which provides policy enforced firewall protection.
Use Default Key for Simple Client Provisioning - If set, authentication of initial Aggressive
mode exchange uses a default Preshared Key by gateway and all GVCs. This allows for the
control of the use of the default registration key. If not set, then Preshared Key must be distributed
out of band.
6 Click OK.



Configuring GroupVPN with IKE 3rd Party Certificates
To configure your GroupVPN policy with IKE 3rd Party Certificates, follow these steps:
Alert: Before configuring GroupVPN with IKE using 3rd Party Certificates, your certificates must be
installed on the SonicWALL.
1 In the VPN > Settings page click the edit icon under Configure for the GroupVPN entry.
The VPN Policy window is displayed.
2 In the Security Policy section, select IKE using 3rd Party Certificates from the IPSec Keying
Mode menu. The SA name is Group VPN by default and cannot be changed.

3 Select a certificate for the SonicWALL from the Gateway Certificate menu.
4 Select one of the following Peer ID types from the Peer ID Type menu and enter the Peer ID filter
information in the Peer ID Filter field.
E-Mail ID and Domain Name - The Email ID and Domain Name types are based on the
certificate's Subject Alternative Name field, which is not contained in all certificates by default.
If the certificate does not contain a Subject Alternative Name field, this filter will not work. The
certificate verification process does not verify the email address or domain name, only that the
certificate that is selected to use has a matching entry contained in the Alternative Subject
Name field. The E-Mail ID and Domain Name filters can contain a string or partial string
identifying the acceptable range required. The strings entered are not case sensitive and can
contain the wild card characters * (for more than 1 character) and ? (for a single character). For
example, the string *@sonicwall.com when E-Mail ID is selected, would allow anyone with an
email address that ended in sonicwall.com to have access; the string *sv.us.sonicwall.com
when Domain Name is selected, would allow anyone with a domain name that ended in
sv.us.sonicwall.com to have access.
Distinguished Name - Based on the certificate’s Subject Distinguished Name field, which is
contained in all certificates by default. Valid entries for this field are based on country (c=),
organization (o=), organization unit (ou=), and /or commonName (cn=). Up to three
organizational units can be specified. The usage is c=*;o=*;ou=*;ou=*;ou=*;cn=*. The final
entry does not need to contain a semi-colon. You must enter at least one entry, for example
c=us.
5 Check Allow Only Peer Certificates Signed by Gateway Issuer to specify that peer certificates
must be signed by the issuer specified in the Gateway Certificate menu.



6 Click on the Proposals tab.

7 In the IKE (Phase 1) Proposal section, select the following settings:
Group 2 from the DH Group menu.
3DES from the Encryption menu.
SHA1 from the Authentication menu.
Leave the default setting, 28800, in the Life Time (seconds) field. This setting forces the tunnel to
8 In the IPSec (Phase 2) Proposal section, select the following settings:
ESP from the Protocol menu.
3DES from the Encryption menu.
MD5 from the Authentication menu.
as an added layer of security. Then select Group 2 from the DH Group menu.
Leave the default setting, 28800, in the Life Time (seconds) field. This setting forces the tunnel to



9 Click on the Advanced tab and select any of the following optional settings that you want to apply
to your GroupVPN policy:

Enable Windows Networking (NetBIOS) broadcast - To allow access to remote network
resources by browsing the Windows Network Neighborhood.
the LAN segment of the corporation. To protect the traffic, NAT (Network Address Translation)
is performed on the outbound packet before it is sent through the tunnel, and in turn, NAT is
performed on inbound packets when they are received. By using NAT for a VPN connection,
computers on the remote LAN are viewed as one address (the SonicWALL public address)
from the corporate LAN. If the SonicWALL uses the Transparent Mode network configuration,
using this check box applies the firewall access rules and checks for attacks, but not does not
apply NAT.
Forward Packets to Remote VPNs - Allows the remote VPN tunnel to participate in the
SonicWALL routing table. Inbound traffic is decrypted and can be forwarded to a remote site
over another VPN tunnel. Normally, inbound traffic is decrypted and only forwarded to the
spoke” network configuration by forwarding inbound traffic to a remote site over a VPN security
association. To create a “hub and spoke” network, select the Forward Packets to Remote
VPNs check box. Traffic can travel from a branch office to another branch office by way of the
corporate office.
Default LAN Gateway - Used at a central site in conjunction with a remote site using the
Route all Internet traffic through this SA check box. Default LAN Gateway allows the



Require Authentication of VPN Clients via XAUTH - Requires that all inbound traffic on this
SA is from an authenticated user. Unauthenticated traffic is not allowed on the VPN tunnel.
10 Click on the Client tab and select any of the following boxes that you want to apply to GVC
provisioning:

Cache XAUTH User Name and Password - Allows GVC to cache any username and password
required for XAUTH user authentication. The drop-down list provides the following options:
Never - GVC is not allowed to cache username and password. The user will be prompted for a
username and password when the connection is enabled and also every time there is an IKE
phase 1 rekey.
Single Session - The user will be prompted for username and password each time the
connection is enabled and will be valid until the connection is disabled. This username and
password is used through IKE phase 1 rekey.
Always - The user will be prompted for username and password only once when connection is
enabled. When prompted, the user will be given the option of caching the username and
password.
Virtual Adapter Settings - The use of the Virtual Adapter by the GVC has always been
dependent upon a DHCP server, either the internal SonicOS or a specified external DHCP server,
to allocate addresses to the Virtual Adapter. In instances where predictable addressing was a
requirement, it was necessary to obtain the MAC address of the Virtual Adapter, and to create a
DHCP lease reservation.
To reduce the administrative burden of providing predictable Virtual Adapter addressing, you can
configure the GroupVPN to accept static addressing of the Virtual Adapter's IP configuration. This
feature requires the use of GVC version 3.0 or later.
None - A Virtual Adapter will not be used by this GroupVPN connection.
DHCP Lease - The Virtual Adapter will obtain its IP configuration from the DHCP Server only,
as configured in the VPN > DHCP over VPN page.



DHCP Lease or Manual Configuration - When the GVC connects to the SonicWALL, the
policy from the SonicWALL instructs the GVC to use a Virtual Adapter, but the DHCP
messages are suppressed if the Virtual Adapter has been manually configured. The configured
value is recorded by the SonicWALL so that it can proxy ARP for the manually assigned IP
address.
Note: By design, there are currently no limitations on IP address assignments for the Virtual Adapter.
Only duplicate static addresses are not permitted.
Allow Connections to - Specifies single or multiple VPN connections. The drop-down list provides
the following options:
This Gateway Only - Allows a single connection to be enabled at a time. Traffic that matches
the destination networks as specified in the policy of this gateway is sent through the VPN
tunnel. All other traffic is blocked. If this option is selected along with Set Default Route as this
Gateway, then the Internet traffic is also sent through the VPN tunnel. If this option is selected
without selecting Set Default Route as this Gateway, then the Internet traffic is blocked.
All Secured Gateways - Allows one or more connections to be enabled at the same time.
Traffic matching the destination networks of each gateway is sent through the VPN tunnel of
that specific gateway. If this option is selected along with Set Default Route as this Gateway,
then Internet traffic is also sent through the VPN tunnel. If this option is selected without
selecting Set Default Route as this Gateway, then the Internet traffic is blocked. Only one of
the multiple gateways can have Set Default Route as this Gateway enabled.
Split Tunnels - Allows the VPN user to have both local Internet access and VPN connectivity.
Set Default Route as this Gateway - If checked, GVC traffic that does not match selectors for the
gateway’s protected subnets must also be tunnelled. In effect, this changes the GVC’s default
gateway to the gateway tunnel endpoint. If unchecked, the GVC must drop all non-matching traffic
if Allow traffic to This Gateway Only or All Secured Gateways is selected.
Require Global Security Client for this Connection - Allows a VPN connection from the remote
Global Security Client only if the remote computer is running the SonicWALL Distributed Security
Client, which provides policy enforced firewall protection.
Use Default Key for Simple Client Provisioning - If set, authentication of initial Aggressive
mode exchange uses a default Preshared Key by gateway and all GVCs. This allows for the
control of the use of the default registration key. If not set, then the Preshared Key must be
distributed out of band.

13. Click OK, then click Apply to enable the changes.


Site-to-Site VPN Configurations

Export a GroupVPN Client Policy
If you want to export the GVC configuration settings to a file for users to import into their GVCs, follow
these instructions:
Alert: The GroupVPN SA must be enabled on the SonicWALL to export a configuration file.
1 Click the Disk icon under Configure for the GroupVPN policy. The Export VPN Client Policy

2 rcf format is required for SonicWALL Global Clients is selected by default. Files saved in the
rcf format can be password encrypted.
3 Click Yes. The VPN Policy Export window is displayed.
4 If you want to encrypt the exported file, type a password in the Password field, re-enter the
password in the Confirm Password field, and then click Submit.
5 If you do not want the exported file encrypted, click Submit. A message appears confirming your
choice. Click OK.
6 Select the locations to save the file and click Save.
7 Click Close. The file can be saved to a floppy disk or sent electronically to remote users to
configure their GVCs.

You can configure the SonicWALL security appliance for site-to-site VPN connections using the VPN
Policy Wizard or the VPN Policy window.

Site-to-Site VPN Deployments
When designing VPN connections, be sure to document all pertinent IP Addressing information and
create a network diagram to use as a reference. See below for a “VPN Planning Sheet for Site-to-Site
VPN Policies” on page 238. The SonicWALL must have a routable WAN IP Address whether it is
dynamic or static. Be sure that the networks behind the SonicWALLs are unique. The same subnets
cannot reside behind two different VPN gateways.

In a VPN network with dynamic and static IP addresses, the VPN gateway with the dynamic address
must initiate the VPN connection.

Site-to-Site VPN Configurations can include the following options:



• Branch Office (Gateway to Gateway) - A SonicWALL is configured to connect to another
SonicWALL over a VPN tunnel. Or, a SonicWALL is configured to connect over IPSec to another
manufacturer’s firewall.
• Hub and Spoke Design - All SonicWALL VPN gateways are configured to connect to a central
SonicWALL (hub), such as a corporate SonicWALL. The hub must have a static IP address, but
the spokes can have dynamic IP addresses. If the spokes are dynamic, the hub must be a
SonicWALL.
• Mesh Design - All sites connect to all other sites. All sites must have static IP addresses.

VPN Planning Sheet for Site-to-Site VPN Policies
You need the information below before you begin configuring Site-to-Site VPN Policies.

Site A
Workstation

LAN IP Address: ___.___.___.___

Subnet Mask: ___.___.___.___

Default Gateway: ___.___.___.___

SonicWALL

LAN IP Address: ___.___.___.___

WAN IP Address: ___.___.___.___

Subnet Mask: ___.___.___.___

Default Gateway: ___.___.___.___

Router
Internet Gateway

WAN IP Address: ___.___.___.___

Subnet Mask: ___.___.___.___

DNS Server #1: ___.___.___.___

DNS Server #2: ___.___.___.___

Additional Information
SA Name:____________________

Manual Key, SPI In_____ SPI Out_____

Enc.Key:____________________

Auth.Key:___________________

If Preshared Secret,



Shared Secret:___________________

Phase 1 DH - 1 2 5

SA Lifetime 28800 or ____________

Phase 1 Enc/Auth DES 3DES AES-128 AES-256 MD5 SHA1 (circle)

Phase 2 Enc/Auth DES 3DES AES-128 AES-256 MD5 SHA1 (circle)

ARC NULL

Configuring Site-to-Site VPN Policies Using the
VPN Policy Wizard
The VPN Policy Wizard quickly and easily walks you through the steps of configuring a VPN security
policy between two SonicWALL appliances.

The VPN Policy Wizard allows you to create a Typical VPN connection. Using this option, the wizard
creates a VPN policy based on IKE using Preshared Secret.

Using the Custom option in the VPN Policy Wizard allow you to create a VPN policy with your own
configuration options based on one of the following IPSec Keying Modes:
• IKE using Preshared Secret
• Manual Key
• IKE using 3rd Party Certificates
Note: You need IP addressing information for your local network as well as your remote network. Use
the VPN Planning Sheet to record your information.



Creating a Typical IKE Preshared Secret VPN Policy
You can create a Typical VPN policy using the VPN Policy Wizard to configure an IPSec VPN
security association between two SonicWALL appliances.
1 Click VPN Policy Wizard on the VPN > Settings page to launch the wizard. Click Next.

2 Select Typical and click Next.

3 Enter a name for the policy in the Policy Name field. You may want to use the name of a remote
office or other identifying feature so that it is easily identified. Enter the IP address or Fully



Qualified Domain Name (FQDN) of the remote destination in the IPSec Gateway Name or
Address field. Click Next.

4 Enter the IP address of the network protected by the remote SonicWALL in the Remote Network
field. This is a private IP address on the remote network. Enter the subnet mask in the Remote
Netmask field. Click Next.

5 Enter a shared secret in the Shared Secret field. Use a combination of letters and numbers to
create a unique secret. Click Next.
6 To enable the VPN policy immediately, click Apply. If you prefer to disable the policy initially,
select Create this Policy Disabled, and then click Apply.

Creating a Custom VPN Policy IKE with Preshared Secret
To create a custom VPN policy using IKE and a Preshared Secret, follow these steps:
1 Click VPN Policy Wizard to launch the wizard. Click Next to continue.
2 Select Custom, and click Next.
office or other identifying feature so that it is easily identified. Enter the IP address or FQDN of the
remote destination in the IPSec Gateway Name or Address field. Click Next.



Note: You can add additional networks by editing the VPN policy after it is created in the VPN Policy
Wizard.
5 Select IKE using Preshared Secret as the IPSec Keying Mode. Click Next.
6 Enter a shared secret in the Shared Secret field. Use a combination of letters and numbers to
create a unique secret. Click Next.
7 Select from the DH Group menu. Diffie-Hellman (DH) key exchange (a key agreement protocol) is
used during phase 1 of the authentication process to establish pre-shared keys. To compromise
between network speed and network security, select Group 2.
Select an encryption method from the Encryption list for the VPN tunnel. If network speed is
preferred, then select DES. If network security is preferred, select 3DES. To compromise between
network speed and network security, select DES.
Select an authentication method from the Authentication list. SHA1 is preferred for network
security.
Keep the default value of 28800 (8 hours) as the Life Time (seconds) for the VPN Policy. Click
Next.
8 Select ESP from the Protocol menu. ESP is more secure than AH, but AH requires less
processing overhead.
Select 3DES from the Encryption menu. 3DES is extremely secure and recommended for use.
Select SHA1 from the Authentication menu.
Select Enable Perfect Forward Secrecy. The Enable Perfect Forward Secrecy check box
increases the renegotiation time of the VPN tunnel. By enabling Perfect Forward Secrecy, a
hacker using brute force to break encryption keys is not able to obtain other or future IPSec keys.
During the phase 2 renegotiation between two SonicWALL appliances or a Group VPN SA, an
additional Diffie-Hellman key exchange is performed. Enable Perfect Forward Secrecy adds
incremental security between gateways.
If Enable Perfect Forward Secrecy is enabled, select the type of Diffie-Hellman (DH) Key
Exchange (a key agreement protocol) to be used during phase 2 of the authentication process to
establish pre-shared keys.
Leave the default value, 28800, in the Life Time (seconds) field. The keys renegotiate every 8
hours.
Click Next.

Creating a Manual Key VPN Policy with the VPN Policy
Wizard
You can create a custom VPN Policy using the VPN Wizard to configure a different IPSec method or
configure more advanced features for the VPN Policy.
Qualified Domain Name of the remote destination in the IPSec Gateway Name or Address field.
Click Next.



Note: You can add additional networks by editing the VPN policy after it is created in the VPN Policy
Wizard.
5 Select Manual Key from the IPSec Keying Modes list. Click Next.
6 Define an Incoming SPI and an Outgoing SPI. The SPIs are hexadecimal (0123456789abcedf)
and can range from 3 to 8 characters in length. Or use the default values.
Alert: Each Security Association must have unique SPIs; no two Security Associations can share the
same SPIs. However, each Security Association Incoming SPI can be the same as the Outgoing SPI.
ESP is selected by default from the Protocol menu. ESP is more secure than AH, but AH requires
less processing overhead.
3DES is selected by default from the Encryption Method menu. Enter a 48-character
hexadecimal key if you are using 3DES encryption.Enter a 16-character hexadecimal key in the
Encryption Key field if you are using DES or ARCFour encryption. This encryption key must
match the remote SonicWALL's encryption key.
The default 48-character key is a unique key generated every time a VPN Policy is created.
AH is selected by default from the Authentication Key field. When a new SA is created, a 32-
character key is automatically generated in the Authentication Key field. This key can be used as
a valid key. If this key is used, it must also be entered in the Authentication Key field in the
remote SonicWALL. If authentication is not used, this field is ignored.
Click Next.

Configuring IKE 3rd Party Certificates with the VPN Policy
Wizard
Alert: You must have a valid certificate from a third party Certificate Authority installed on your
SonicWALL before you can configure your VPN policy with IKE using a third party certificate. See
Chapter 36, Managing Certificates for more information.
Qualified Domain Name of the remote destination in the IPSec Gateway Name or Address field.
Click Next.
5 Select IKE using 3rd Party Certificates from the IPSec Keying Modes list. Click Next.
6 Select your third party certificate from the Third Party Certificate menu. Select the ID type from
the Peer Certificate’s ID Type, and enter the ID string in the ID string to match field. Click Next.
7 Select from the DH Group menu. Diffie-Hellman (DH) key exchange (a key agreement protocol) is
used during phase 1 of the authentication process to establish pre-shared keys. To compromise
between network speed and network security, select Group 2.
Select an encryption method from the Encryption list for the VPN tunnel. If network speed is
preferred, then select DES. If network security is preferred, select 3DES. To compromise between
network speed and network security, select DES.



Select an authentication method from the Authentication list. SHA1 is preferred for network
security.
Leave the default value of 28800 (8 hours) as the Life Time (seconds) for the VPN Policy.
Click Next.
8 ESP is selected by default from the Protocol menu. ESP is more secure than AH, but AH requires
3DES is selected by default from the Encryption menu. Enter a 48-character hexadecimal key if
you are using 3DES encryption.Enter a 16-character hexadecimal key in the Encryption Key field
if you are using DES or ARCFour encryption. This encryption key must match the remote
SonicWALL's encryption key.
AH is selected by default from the Authentication Key field. When a new SA is created, a 32-
character key is automatically generated in the Authentication Key field. This key can be used as
a valid key. If this key is used, it must also be entered in the Authentication Key field in the
remote SonicWALL. If authentication is not used, this field is ignored.
Click Next.

Creating Site-to-Site VPN Policies Using the VPN Policy
Window
You can create or modify existing VPN policies using the VPN Policy window. Clicking the Add button
under the VPN Policies table displays the VPN Policy window for configuring the following IPSec
Keying mode VPN policies:
• IKE using Preshared Key
• Manual Key
• IKE using 3rd Party Certificates
Tip: You can create these policies using the VPN Policy Wizard.



Configuring a VPN Policy IKE with Preshared Secret
To manually configure a VPN Policy using IKE with Preshared Secret, follow the steps below:
1 In the VPN > Settings page, click Add. The VPN Policy window is displayed.

2 In the General tab, IKE using Preshared Secret is selected by default from the IPSec Keying
Mode menu.
Tip: Use the “VPN Planning Sheet for Site-to-Site VPN Policies” on page 238 to record your settings.
These settings are necessary to configure the remote SonicWALL and create a successful VPN
connection.
3 Enter a name for the VPN Policy in the Name field.
4 Enter the IP address or gateway name of the remote SonicWALL in the IPSec Primary Gateway
Name or Address field.
5 If you have a second IP address or gateway name, enter it in the IPSec Secondary Gateway
Name or Address field. If the primary gateway is unavailable, the SonicWALL uses the second
gateway to create the VPN tunnel.
6 Enter a combination of letters, symbols, and numbers as the Shared Secret in the Shared Secret
field.
Tip: The Shared Secret must be a minimum of four characters.
7 Choose from the following options in the Destination Networks section:
Use this VPN Tunnel as the default route for all Internet traffic - select this option if all local
users access the Internet through this tunnel. You can only configure one tunnel to use this
option.
Destination network obtains IP addresses using DCHP through this VPN Tunnel - select
this option if you are managing your network IP address allocation from a central location.
Specify destination networks below - configure the remote destination network for your SA.
Click Add to add the IP address and subnet mask. You can modify existing destination
networks by click Edit, and delete networks by selecting the network and clicking Delete.



8 Click the Proposals tab.

9 In the IKE (Phase 1) Proposal section, the default settings offer a secure connection
configuration, however, the settings can be modified to reflect your preferences. In addition to
3DES, AES-128, AES-192, and AES-256 can be selected for encryption methods.
10 In the Ipsec (Phase 2) Proposal section, the default settings offer a secure connection
configuration, however, the settings can be modified to reflect your preferences. In addition to
3DES, AES-128, AES-192, and AES-256 can be selected for encryption methods. Selecting
Enable Perfect Forward Secrecy prevents a hacker using brute force to break encryption keys
from obtaining the current and future IPSec keys. During Phase 2 negotiation, an additional Diffie-
Hellman key exchange is performed. This option adds an additional layer of security to the VPN
tunnel.



11 Click the Advanced tab. Select any optional configuration options you want to apply to your VPN
policy in the Advanced Settings section.

Enable Keep Alive - Select this setting if you want to maintain the current connection by
listening for traffic on the network segment between the two connections. If multiple VPN
tunnels are configured on the SonicWALL, select Try to bring up all possible tunnels to have
the SonicWALL renegotiate the tunnels if they lose communication with the
SonicWALL.
Require authentication of local users - Requires that all outbound VPN traffic from this SA is
from an authenticated source.
Require authentication of remote users - Requires that all inbound VPN traffic for this SA is
from an authenticated user. Select Remote users behind VPN gateway if remote users have
a VPN tunnel that terminates on the VPN gateway. Select Remote VPN clients with XAUTH if
remote users require authentication using XAUTH and are access the SonicWALL using a VPN
clients.
Enable Secure Wireless Bridging - Enables a WiFiSec VPN policy between SonicWALL
wireless gateways.
Enable Windows Networking (NetBIOS) broadcast - To allow access to remote
network resources by browsing the Windows® Network Neighborhood.
the LAN segment of the corporation. To protect the traffic, NAT
(Network Address Translation) is performed on the outbound packet before it is sent through
the tunnel, and in turn, NAT is performed on inbound packets when they are
received. By using NAT for a VPN connection, computers on the remote LAN are viewed as
one address (the SonicWALL public address) from the corporate LAN.



VPNs check box.Traffic can travel from a branch office to another branch office by way of the
corporate office.
Route all internet traffic through this SA check box. Default LAN Gateway allows the
12 Click OK. Your new VPN policy is displayed in the VPN Policies table.

Configuring a VPN Policy using Manual Key
To manually configure a VPN Policy in the VPN Policy window using Manual Key, follow the steps
below:
2 Select Manual Key from the IPSec Keying Mode menu.
Tip: Use the “VPN Planning Sheet for Site-to-Site VPN Policies” on page 238 to record your settings.
These settings are necessary to configure the remote SonicWALL and create a successful VPN
connection.
3 In the Security Policy section, enter a name for the VPN Policy in the Name field.
4 Enter the IP address or gateway name of the REMOTE SonicWALL in the IPSec Gateway Name
or Address field.
5 In the Destination Networks section, one of the following options:
Use this VPN Tunnel as the default route for all Internet traffic - select this option if all local
users access the Internet through this tunnel. You can only configure one SA to use this option.
Specify destination networks below - configure the remote destination network for your SA.
Click Add to add the IP address and subnet mask. You can modify existing destination
networks by click Edit, and delete networks by selecting the network and clicking Delete.
6 Click on the Proposals tab.
7 In the Ipsec SA section, define an Incoming SPI and an Outgoing SPI. The SPIs are
hexadecimal (0123456789abcedf) and can range from 3 to 8 characters in length. Or use the
default values.
Alert: Each Security Association must have unique SPIs; no two Security Associations can share the
same SPIs. However, each Security Association Incoming SPI can be the same as the Outgoing SPI.
8 ESP is selected by default from the Protocol menu. ESP is more secure than AH, but AH requires
9 3DES is selected by default from the Phase 2 Encryption menu. Enter a 48-character
hexadecimal key if you are using 3DES encryption.Enter a 16-character hexadecimal key in the
Encryption Key field if you are using DES or ARCFour encryption. This encryption key must
match the remote SonicWALL's encryption key.
10 SHA1 is selected by default from the Phase 2 Authentication menu. When a new Policy is
created, a 32-character key is automatically generated in the Authentication Key field. This key



can be used as a valid key. If this key is used, it must also be entered in the Authentication Key
field in the remote SonicWALL. If authentication is not used, this field is ignored.
11 Click on the Advanced tab. Select the optional configuration settings you want to apply to your
VPN policy from the Advanced Settings section.
clients.
wireless gateways.
corporate office.
12 Click OK to add the Manual Key VPN Policy to the SonicWALL.

Configuring a VPN Policy with IKE 3rd Party Certificate
Alert: You must have a valid certificate from a third party Certificate Authority installed on your
SonicWALL before you can configure your VPN policy with IKE using a third party certificate. See
Chapter 36, Managing Certificates for more information.



To create a VPN SA using IKE and third party certificates, follow these steps:
2 In General tab, select IKE using 3rd Party Certificates.
3 Type a Name for the Security Association in the Name field.
4 Type the IP address or Fully Qualified Domain Name (FQDN) of the primary remote SonicWALL in
the IPSec Primary Gateway Name or Address field. If you have a secondary remote
SonicWALL, enter the IP address or Fully Qualified Domain Name (FQDN) in the IPSec
Secondary Gateway Name or Address field.
5 Select a certificate from the Third Party Certificate menu.
6 Select one of the following Peer ID types from the Peer ID Type menu and enter an ID string in the
ID string to match field.
E-Mail ID and Domain Name - The Email ID and Domain Name types are based on the
certificate's Subject Alternative Name field, which is not contained in all certificates by default.
If the certificate does not contain a Subject Alternative Name field, this filter will not work. The
certificate verification process does not verify the email address or domain name, only that the
certificate that is selected to use has a matching entry contained in the Alternative Subject
Name field. The E-Mail ID and Domain Name filters can contain a string or partial string
identifying the acceptable range required. The strings entered are not case sensitive and can
contain the wild card characters * (for more than 1 character) and ? (for a single character). For
example, the string *@sonicwall.com when E-Mail ID is selected, would allow anyone with an
email address that ended in sonicwall.com to have access; the string *sv.us.sonicwall.com
when Domain Name is selected, would allow anyone with a domain name that ended in
sv.us.sonicwall.com to have access.
Distinguished Name - based on the certificates Subject Distinguished Name field, which is
contained in all certificates by default. Valid entries for this field are based on country (c=),
organization (o=), organization unit (ou=), and /or commonName (cn=). Up to three
organizational units can be specified. The usage is c=*;o=*;ou=*;ou=*;ou=*;cn=*. The final
entry does not need to contain a semi-colon. You must enter at least one entry, for example
c=us.
7 In the Destination Network section, select one of the following options:
Use this VPN Tunnel as default route for all Internet traffic - select this option if you don’t want
any local user to leave the SonicWALL security appliance unless the traffic goes through a VPN
tunnel.
Destination network obtains IP addresses using DHCP through this VPN Tunnel - Select this
setting if you want the remote network to obtain IP addresses from your DHCP server.
Specify destination networks below - allows you to add the destination network or networks. To
add a destination network, click Add. The Edit VPN Destination Network window is displayed.
Enter the IP address in the Network field and the subnet in the Subnet Mask field, then click OK.
8 Click the Proposals tab.
9 In the IKE (Phase 1) Proposal section, select the following settings:
Select Aggressive Mode from the Exchange menu.
Select Group 2 from the DH Group menu.
Select 3DES from the Encryption menu.
Enter a maximum time in seconds allowed before forcing the policy to renegotiate and exchange
keys in the Life Time field. The default settings is 28800 seconds (8 hours).
10 In the Ipsec (Phase 2) Proposal section, select the following settings:
Select ESP from the Protocol menu.
Select 3DES from the Encryption menu.
Select SHA1 from the Authentication menu.



as an added layer of security, then select Group 2 from the DH Group menu.
Enter a maximum time in seconds allowed before forcing the policy to renegotiate and exchange
keys in the Life Time field. The default settings is 28800 seconds (8 hours).
11 Click the Advanced tab. Select any optional configuration options you want to apply to your VPN
policy in the Advanced Settings section.
Enable Keep Alive - Select this setting if you want to maintain the current connection by
listening for traffic on the network segment between the two connections. If multiple VPN
tunnels are configured on the SonicWALL, select Try to bring up all possible tunnels to have
the SonicWALL renegotiate the tunnels if they lose communication with the
SonicWALL.
clients.
wireless gateways.
corporate office.



12 Click OK. Your new VPN policy is displayed in the VPN Policies table.


VPN > Advanced

C H A P T E R

33
Chapter 33: Configuring Advanced VPN
Settings

VPN > Advanced
The VPN > Advanced page includes optional settings that affect all VPN policies.

Advanced VPN Settings
• Disable all VPN Windows Networking (NetBIOS) Broadcasts - Computers running Microsoft
Windows® communicate with one another through NetBIOS broadcast packets. Disable this
setting access to remote network resources by browsing the Windows® Network Neighborhood.
• Enable Fragmented Packet Handling - If the VPN log report shows the log message
“Fragmented IPSec packet dropped,” select this feature. Do not select it until the VPN tunnel is
established and in operation. When you select this setting, the Ignore DF (Don’t Fragment) Bit
setting becomes active.
• Enable NAT Traversal - Select this setting if a NAT device is located between your VPN
endpoints. IPSec VPNs protect traffic exchanged between authenticated endpoints, but
authenticated endpoints cannot be dynamically re-mapped mid-session for NAT traversal to work.
Therefore, to preserve a dynamic NAT binding for the life of an IPSec session, a 1-byte UDP is
designated as a keep alive that acts as a “heartbeat” sent by the VPN device behind the NAT or
NAPT device. The “keepalive” is silently discarded by the IPSec peer.


CHAPTER 33: Configuring Advanced VPN Settings

Selecting Enable NAT Traversal allows VPN tunnels to support this protocol, and log messages
are generated by the SonicWALL when an IPSec Security Gateway is detected behind a NAT/
NAPT device. The following log messages are found on the View > Log page:
Peer IPSec Gateway behind a NAT/NAPT device
Local IPSec Security Gateway behind a NAT/NAPT device
No NAT/NAPT device detected between IPSec Security
Peer IPSec Security Gateway doesn’t support VPN NAT Traversal
• Keep Alive interval (seconds) - The default value is 240 seconds (4 minutes). If Enable Keep
Alive is selected on the Advanced VPN Settings page, a new negotiation begins if the previous
VPN Policy was deleted by Dead Peer Detection (DPD).
• Enable IKE Dead Peer Detection - Select if you want inactive VPN tunnels to be dropped by the
SonicWALL. Enter the number of seconds between heartbeats in the Dead Peer Detection
Interval (seconds) field. The default value is 60 seconds. Enter the number of missed heartbeats
in the Failure Trigger Level (missed heartbeats) field. The default value is 3. If the trigger level is
reached, the VPN connection is dropped by the SonicWALL security appliance. The SonicWALL
uses a UDP packet protected by Phase 1 Encryption as the heartbeat.
• VPN Single Armed mode (stand-alone VPN gateway) - Select if you are deploying a
SonicWALL with a single port (WAN) utilized as a VPN tunnel termination point. Clear text traffic is
routed to the single interface and the data is encapsulated to the appropriate IPSec gateway. Note
that Single-Armed mode cannot be enabled when the SonicWALL is configured for NAT.
Alert: When Single-Armed mode is enabled, the LAN port is automatically disabled and a rule is
automatically added to the VPN SonicWALL for HTTPS management from the WAN.
• Clean up Active tunnels when Peer Gateway DNS name resolves to a different IP address -
Breaks down SAs associated with old IP addresses and reconnects to the peer gateway.
• Preserve IKE Port for Pass Through Connections - Preserves UDP 500/4500 source port and
IP address information for pass-through VPN connections.
• Send vpn tunnel traps only when tunnel status changes - Reduces the number of log
messages (traps) that are generated by VPN traffic.

VPN User Authentication Settings

• Allow these services to bypass user authentication on SAs - This feature allows VPN users
without authentication to access the specified services. To add a service, select the service from
the menu and click Add. The service is added to the Allow these services to bypass user
authentication on SAs list. To remove a service, select the service in the Allow these services
to bypass user authentication on VPN SAs list and click Remove.
• Allow these address ranges to bypass user authentication on SAs - This feature allows the
specified IP address or IP address range to bypass user authentication on VPN connections. To
add an IP address, enter the single IP address in the text box, then click Add. To add an IP
address range, enter the range starting IP address in the first field and the length in the text field
(up to the last three numbers of the IP address).


VPN > Advanced

VPN Bandwidth Management

Bandwidth management is a method of allocating bandwidth resources to critical applications on a
network. The VPN Bandwidth Management section allows you to define the amount of outbound
VPN traffic allowed from the SonicWALL. Traffic is then scheduled in Kbps according to Guaranteed
Bandwidth (minimum) and Maximum Bandwidth settings.

To enable VPN Bandwidth Management, follow these steps:
1 Select Enable VPN Bandwidth Management.
2 Enter the minimum amount of bandwidth allowed in the Guaranteed Bandwidth (Kbps) field.
3 Enter the maximum amount of bandwidth allowed in Maximum Bandwidth (Kbps) field.
4 Select VPN bandwidth priority from the Priority menu, 0 (highest) to 7 (lowest).
5 Click Apply.
Tip: Bandwidth management is available only on outbound VPN traffic. You cannot configure
individual Security Associations to use bandwidth management.


CHAPTER 33: Configuring Advanced VPN Settings


VPN > DHCP over VPN

C H A P T E R

34
Chapter 34: Configuring DHCP Over VPN

VPN > DHCP over VPN

The VPN > DHCP over VPN page allows a Host (DHCP Client) behind a SonicWALL obtain an IP
address lease from a DHCP server at the other end of a VPN tunnel. In some network deployments, it
is desirable to have all VPN networks on one logical IP subnet, and create the appearance of all VPN
networks residing in one IP subnet address space. This facilitates IP address administration for the
networks using VPN tunnels.

DHCP Relay Mode
The SonicWALL appliance at the remote and central site are configured for VPN tunnels for initial
DHCP traffic as well as subsequent IP traffic between the sites. The SonicWALL at the remote site
(Remote Gateway) passes DHCP broadcast packets through its VPN tunnel. The SonicWALL at the
central site (Central Gateway) relays DHCP packets from the client on the remote network to the
DHCP server on the central site.


CHAPTER 34: Configuring DHCP Over VPN

Configuring the Central Gateway for DHCP Over VPN
To configure DHCP over VPN for the Central Gateway, use the following steps:
1 On the DHCP over VPN page, select Central Gateway from the DHCP Relay Mode menu.
2 Click Configure. The DHCP over VPN Configuration window is displayed.

3 Select Use Internal DHCP Server to enable the Global VPN Client or a remote firewall or both to
use an internal DHCP server to obtain IP addressing information.
4 If you want to send DHCP requests to specific servers, select Send DHCP requests to the server
addresses listed below.
5 Click Add. The IP Address window is displayed.
6 Enter the IP addresses of DHCP servers in the IP Address field, and click OK. The SonicWALL
now directs DHCP requests to the specified servers.
7 Enter the IP address of a relay server in the Relay IP Address (Optional) field.

To edit an entry in the IP Address table, click Edit. To delete a DHCP Server, highlight the entry in
the IP Address table, and click Delete. Click Delete All to delete all entries.

Configuring DHCP over VPN Remote Gateway
1 Select Remote Gateway from the DHCP Relay Mode menu.


VPN > DHCP over VPN

2 Click Configure. The DHCP over VPN Configuration window is displayed.

3 Select the VPN Security Association to be used for the VPN tunnel from the Relay DHCP through
this VPN Tunnel menu.
Alert: Only VPN Security Associations using IKE and terminate on the LAN appear in the Obtain
using DHCP through this VPN Tunnel.
4 The Relay IP address is used in place of the Central Gateway address, and must be reserved in
the DHCP scope on the DHCP server. The Relay IP address can also be used to manage the
SonicWALL remotely through the VPN tunnel behind the Central Gateway.
5 The Remote Management IP Address, if entered, can be used to manage the SonicWALL
remotely through the VPN tunnel behind the Central Gateway.
6 If you enable Block traffic through tunnel when IP spoof detected, the SonicWALL blocks any
traffic across the VPN tunnel that is spoofing an authenticated user’s IP address. If you have any
static devices, however, you must ensure that the correct Ethernet address is entered for the
device. The Ethernet address is used as part of the identification process, and an incorrect
Ethernet address can cause the SonicWALL to respond to IP spoofs.
7 If the VPN tunnel is disrupted, temporary DHCP leases can be obtained from the local DHCP
server. Once the tunnel is again active, the local DHCP server stops issuing leases. Enable the
Obtain temporary lease from local DHCP server if tunnel is down check box. By enabling this
check box, you have a failover option in case the tunnel ceases to function. If you want to allow
temporary leases for a certain time period, enter the number of minutes for the temporary lease in
the Temporary Lease Time box. The default value is two (2) minutes.



Device Configuration
1 To configure devices on your LAN, click the Devices tab.

2 To configure Static Devices on LAN, click Add to display the Add LAN Device Entry window,
and type the IP address of the device in the IP Address field and then type the Ethernet address
of the device in the Ethernet Address field. An example of a static device is a printer as it cannot
obtain an IP lease dynamically. If you do not have Block traffic through tunnel when IP spoof
detected enabled, it is not necessary to type the Ethernet address of a device. You must exclude
the Static IP addresses from the pool of available IP addresses on the DHCP server so that the
DHCP server does not assign these addresses to DHCP clients. You should also exclude the IP
address used as the Relay IP Address. It is recommended to reserve a block of IP address to use
as Relay IP addresses. Click OK.
3 To exclude devices on your LAN, click Add to display the Add Excluded LAN Entry window.
Enter the MAC address of the device in the Ethernet Address field. Click OK.
4 Click OK to exit the DHCP over VPN Configuration window.
Alert: You must configure the local DHCP server on the remote SonicWALL to assign IP leases to
these computers.

Alert: If a remote site has trouble connecting to a central gateway and obtaining a lease, verify that
Deterministic Network Enhancer (DNE) is not enabled on the remote computer.

Tip: If a static LAN IP address is outside of the DHCP scope, routing is possible to this IP, for
example two LANs.

Current DHCP over VPN Leases
The scrolling window shows the details on the current bindings: IP and Ethernet address of the
bindings, along with the Lease Time, and Tunnel Name. To edit an entry, click the edit icon
under Configure for that entry.

To delete a binding, which frees the IP address in the DHCP server, select the binding from the list,
and then click the Trashcon icon. The operation takes a few seconds to complete. Once completed, a
message confirming the update is displayed at the bottom of the Web browser window.

Click Delete All to delete all VPN leases.


VPN > DHCP over VPN


VPN > L2TP Server

C H A P T E R

35
Chapter 35: Configuring L2TP Server Settings

VPN > L2TP Server

You can use Layer 2 Tunneling Protocol (L2TP) to create VPN over public networks such as the
Internet. L2TP provides interoperability between different VPN vendors that protocols such as PPTP
and L2F do not, although L2TP combines the best of both protocols and is an extension of them.
L2TP is supported on Microsoft Windows 2000 Operating System.

L2TP supports several of the authentication options supported by PPP, including Password
Authentication Protocol (PAP), Challenge Handshake Authentication Protocol (CHAP), and Microsoft
Challenge Handshake Authentication Protocol (MS-CHAP). You can use L2TP to authenticate the
endpoints of a VPN tunnel to provide additional security, and you can implement it with IPSec to
provide a secure, encrypted VPN solution.
Note: You must enable Group VPN before configuring the SonicWALL L2TP feature. Also, the
encryption method and shared secret must match the L2TP client settings.


CHAPTER 35: Configuring L2TP Server Settings

To enable L2TP Server functionality on the SonicWALL, select Enable L2TP Server. Then click
Configure to display the L2TP Server Configuration window.

L2TP Server Settings
Configure the following settings:
1 Enter the number of seconds in the Keep alive time (secs) field to send special packets to keep
the connection open.
2 Enter the IP address of your first DNS server in the DNS Server 1 field.
3 If you have a second DNS server, enter the IP address in the DNS Server 2 field.
4 Enter the IP address of your first WINS server in the WINS Server 1 field.
5 If you have a second WINS server, enter the IP address in the WINS Server 2 field.

IP Address Settings
6 Select IP address provided by RADIUS Server if a RADIUS Server provides IP addressing
information to the L2TP clients.
7 If the L2TP Server provides IP addresses, select Use the Local L2TP IP pool. Enter the range of
private IP addresses in the Start IP and End IP fields.
Note: The IP addresses in the local L2TP pool must be a unique IP subnet—they cannot be IP
addresses from the LAN subnet or any other interface on the SonicWALL security appliance.
8 Click OK.

Adding L2TP Clients to the SonicWALL
To add L2TP clients to the local user database or a RADIUS database, click Users, then Add. When
adding privileges for a user, select L2TP Client as one of the privileges. Then the user can access the
SonicWALL as a L2TP client.


VPN > L2TP Server

Currently Active L2TP Sessions
• User Name - the user name assigned in the local user database or the RADIUS user database.
• PPP IP - the source IP address of the connection.
• Interface - the enter of interface used to access the L2TP Server, whether it’s a VPN client or
another SonicWALL appliance.
• Authentication - enter of authentication used by the L2TP client.
• Host Name - the name of the network connecting to the L2TP Server.


CHAPTER 35: Configuring L2TP Server Settings


Digital Certificates Overview

C H A P T E R

36
Chapter 36: Managing Certificates

Digital Certificates Overview
A digital certificate is an electronic means to verify identity by a trusted third party known as a
Certificate Authority (CA). X.509 v3 certificate standard is a specification to be used with
cryptographic certificates and allows you to define extensions which you can include with your
certificate. SonicWALL has implemented this standard in its third party certificate support.

You can use a certificate signed and verified by a third party CA to use with an Internet Key Exchange
(IKE) VPN policy. IKE is an important part of IPSec VPN solutions, and it can use digital certificates to
authenticate peer devices before setting up SAs. Without digital certificates, VPN users must
authenticate by manually exchanging shared secrets or symmetric keys. Devices or clients using
digital signatures do not require configuration changes every time a new device or client is added to
the network.

A typical certificate consists of two sections: a data section and a signature section. The data section
typically contains information such as the version of X.509 supported by the certificate, a certificate
serial number, information about the user’s public key, the Distinguished Name (DN), validation
period for the certificate, optional information such as the target use of the certificate. The signature
section includes the cryptographic algorithm used by the issuing CA, and the CA digital signature.

SonicWALL Third-Party Digital Certificate Support
SonicWALL supports third-party certificates from any Certificate Authority thatissues X.509v3
certificates. This includes almost any CA available commercially or in the public domain. To
implement the use of certificates for VPN SAs, you must locate a source for a valid CA certificate from
a third party CA service. Once you have a valid CA certificate, you can import it into the SonicWALL to
validate your Local Certificates and IKE Peer Certificates presented during the IKE negotiation. You
import the valid CA certificate into the SonicWALL using the VPN > CA Certificates page. Once you
import the valid CA certificate, you can use it to validate your local certificates you add in the VPN >
Local Certificates page.


CHAPTER 36: Managing Certificates

VPN > Local Certificates

After a certificate is signed by the CA and returned to you, you can import the certificate into the
SonicWALL to be used as a Local Certificate for a VPN Security Association.
Tip: After you import a local certificate on the SonicWALL, it is recommended you export the
certificate to the local disk as a backup. When exporting a local certificate, a password is required.

Importing Certificate with Private Key
Use the following steps to import the certificate into the SonicWALL:
1 In the Import Certificate with private key section of Local Certificates, type the Certificate
Name.
2 Type the Certificate Management Password. This password was created when you exported
your signed certificate.
3 Use Browse to locate the certificate file.
4 Click Import, and the certificate appears in the list of Current Certificates.
5 To view details about the certificate, select it from the list of Current Certificates.

Certificate Details
To view details about the certificate, select the certificate from the Certificates menu in the Current
Certificates section. The Certificate Details section lists the following information about the
certificate:
• Certificate Issuer
• Subject Distinguished Name
• Certificate Serial Number
• Expiration On
• Alternate Subject Name
• Alternate Subject Name Type
• Status


VPN > Local Certificates

Delete This Certificate
To delete the certificate, click Delete This Certificate. You can delete a certificate if it has expired or
if you decide not to use third party certificates for VPN authentication.

Generating a Certificate Signing Request
To generate a local certificate for use with a VPN policy, follow these steps:
Tip: You should create a Certificate Policy to be used in conjunction with local certificates. A
Certificate Policy determines the authentication requirements and the authority limits required for the
validation of a certificate.
1 Select Add New Local Certificate from the Certificates menu.

2 In the Generate Certificate Signing Request section, enter a name for the certificate in the
Certificate Name field.
3 Enter information for the certificate in the Request fields. As you enter information in the Request
fields, the Distinguished Name (DN) is created in the Subject Distinguished Name field.
You can also attach an optional Subject Alternative Name to the certificate such as the Domain
Name or E-mail Address. You need to provide the proper input for the Domain Name
(yourcompanyname.com) or E-mail Address (abc@yourcompanyname.com) option in the
corresponding field.
4 The Subject Key type is preset as an RSA algorithm. RSA is a public key cryptographic algorithm
used for encrypting data.
5 Select a Subject Key size from the Subject Key Size menu.
Note: Not all key sizes are supported by a Certificate Authority, therefore you should check with your
CA for supported key sizes.
6 Click Generate to create a Certificate Signing Request file. Once the Certificate Signing
Request is generated, a message describing the result is displayed.
7 Click Export to download the Certificate Request file to your computer, then click Save to save it
to a directory on your computer.



8 Send the Certificate Request file to your Certificate Authority for validation. After your CA service
has validated your CA Certificate, it will issue an X.509v3 Certificate. The Certificate file will
typicall be in one of the following formats:
Raw format (typically with a .der file extension)
Base64-encoded format (typically with a .der or .b64 file extension), usually with a header and
footer such as:

-----BEGIN CERTIFICATE-----
MIICmTCCAkOgAwIBAgIQFqMhNXFex7NObU4dKUNNvDANBgkqhkiG9w0BAQUFADBY
...
-----END CERTIFICATE-----

PKCS#7 format (typically with a .p7b file extension)
Note: File extensions can very depending on the issuer of the certificate and are not a reliable method
for determing the format of the certificate. SonicWALL secuirty appliances support all three formats,
regardless of their file extension.
9 Once you have received a certificate, you can import it into the SonicWALL and use it as a Local
Certificates for VPN Security Associations. On the VPN > Local Certificates page, select the
name you enetered for the Certificate Alias from the Certificates pulldown menu.

The Certificate Details section displays the Subject Distinguished Name you generated, the
Subject Key Identifier unique to this request, and the CSR Status: Request Generated.
10 Select the Browse button next to the Import Signed Certificate text box, locate the Certificate file
issued by your CA, and click Open.
11 Click the Import Certificate button to import this certificate. Upon successful import, the
Certifcate Details will display the fields from the imported certificate.


VPN > CA Certificates

VPN > CA Certificates

Importing CA Certificates into the SonicWALL
After your CA service has validated your CA Certificate, you can import it into the SonicWALL and
use it to validate Local Certificates for VPN Security Associations. To import your CA Certificate
into the SonicWALL, follow these steps:
1 On the VPN > CA Certificates page, select Add New CA Certificate.
2 Click Browse, and locate the encoded certificate file sent by the CA service. It will typically have
either a *.p7b, *.der, or *.cer file extension.
3 Click Open to set the directory path to the certificate.
4 Click Import to import the certificate into the SonicWALL. Once it is imported, you can view the
Certificate Details.

Certificate Details
The Certificate Details section lists the following information:
• Certificate Issuer
• Subject Distinguished Name
• Certificate Serial Number
• Expires On
• CRL Status

The Certificate Issuer, Certificate Serial Number, and the Expiration Date are generated by the
CA service. The information is used when a Generate Certificate Signing Request is created and
sent to your CA service for validation.

Delete This Certificate
To delete the certificate, click Delete This Certificate. You can delete a certificate if it has expired or
if you decide not to use third party certificates for VPN authentication.



Certificate Revocation List (CRL)
A Certificate Revocation List (CRL) is a way to check the validity of an existing certificate. A
certificate may be invalid for several reasons:
• It is no longer needed.
• A certificate was stolen or compromised.
• A new certificate was issued that takes precedence over the old certificate.

If a certificate is invalid, the CA may publish the certificate on a Certificate Revocation List at a
given interval, or on an online server in a X.509 v3 database using Online Certificate Status Protocol
(OCSP). Consult your CA provider for specific details on locating a CRL file or URL.

You can import the CRL by manually downloading the CRL and then importing it into the SonicWALL.
You can also enter the URL location of the CRL by entering the address in the Enter CRL’s location
(URL) for auto-import field. The CRL is downloaded automatically at intervals determined by the CA
service. Certificates are checked against the CRL by the SonicWALL for validity when they are used.

Importing a CRL List
To import a CRL list, follow these steps:
1 Click Browse for Please select a file to import.
2 Locate the PKCS#12 (*.p12) or Micorosft (*.pfx) encoded file.
3 Click Open to set the directory path to the certificate.
4 Click Import to import the certificate into the SonicWALL.

Automatic CRL Update
To enable automatic CRL updates to the SonicWALL, type the URL of the CRL server for your CA
service in the Enter CRL’s location (URL) for auto-import, then click Apply.


PART

8
Users
Part 8


User Level Authentication Overview

C H A P T E R

37
Viewing User Status and
Chapter 37:

Configuring User Authentication

User Level Authentication Overview
The SonicWALL security appliance provides a mechanism for user level authentication that gives
users access to the LAN from remote locations on the Internet as well as a means to bypass content
filtering. Also, you can permit only authenticated users to access VPN tunnels and send data across
the encrypted connection.

User level authentication can performed using a local user database, RADIUS, or a combination of
the two applications. The local database on the SonicWALL security appliance can support up to
1,000 users. If you have more than 1,000 users or want to add an extra layer of security for
authenticating users to the SonicWALL security appliance, use RADIUS for authentication.

Users > Status


CHAPTER 37: Viewing User Status and Configuring User Authentication

Active User Sessions
The Active User Sessions table lists the User Name, the IP Address of the user, the Session Time,
Time Remaining of the session, and the Inactivity Remaining time. You can also click the
Trashcan icon in the Logout column to log a user out of the SonicWALL security appliance.

Users > Settings

On the Users > Settings page, you can configure the authentication method required, global user
settings, and an acceptable use policy that is displayed to users when logging onto your network. The
SonicWALL security appliance supports user level authentication using the local SonicWALL security
appliance database, a RADIUS server, or a combination of the two authentication methods.

Authentication Method
• Use RADIUS for user authentication - if you have more than 100 users or want to add an extra
layer of security for authenticating the user to the SonicWALL security appliance. If you select Use
RADIUS for user authentication, users must log into the SonicWALL security appliance using
HTTPS in order to encrypt the password sent to the SonicWALL security appliance. If a user
attempts to log into the SonicWALL security appliance using HTTP, the browser is automatically
redirected to HTTPS. If you select Use RADIUS for user authentication, the Configure button
becomes available.
• Allow only users listed locally - enable this setting if you have a subset of RADIUS users
accessing the SonicWALL security appliance. The user names must be added to the internal
SonicWALL security appliance user database on the Users > Local Users page before they can
be authenticated using RADIUS.
• Include privileges from users listed locally - includes the privileges assigned to users in the
Users > Local Users page.
• Configure users locally - selecting this setting allows you to configure users in the local
SonicWALL security appliance database using the Users > Local Users page.


Users > Settings

Global User Settings

The settings listed below apply to all users when authenticated through the SonicWALL security
appliance.
• Inactivity timeout (minutes) - users can be logged out of the SonicWALL security appliance after
a preconfigured inactivity time. Enter the number of minutes in this field.
• Limit login session time to (minutes) - you can limit the time a user is logged into the
SonicWALL security appliance by selecting the check box and typing the amount of time, in
minutes, in the Limit login session time to (minutes) field. The default value is 30 minutes.
• Show user login status window with logout button - displays a logout button in the user login
status window.
• User’s login status window refreshes every (minutes) - refreshes the user login status window
based on the specified minutes.
• Allow only authenticated users to access the Internet - this feature allows Internet access to
only users configured on the SonicWALL security appliance. When you check this setting, the
Exclusions button becomes available. Clicking the Exclusions button displays the Internet
Authentication Exclusions window.

Internet Authentication Exclusions
When you select Allow only authenticated users to access the Internet, and click the Exclusions
button, the Internet Authentication Exclusions window is displayed for configuring exclusions from
Internet User Authentication.

• Always allow these services - the default is None. You can add or remove services available to
users. To add a service, select the service from the menu, and click Add. To remove a service,
select the service in the in the services list, and click Remove.
• Always allow these address ranges - this feature allows the specified IP address or IP address
range to bypass user authentication. To add an IP address, enter the single IP address in the first



field, then click Add. To add an IP address range, enter the range starting IP address in the first
field and the length of the range in the next field (up to the last three numbers of the IP address).
• Always allow these HTTP URLs - this feature allows you to specify HTTP URLs to bypass user
authentication. To add a URL, click the Add button. Enter the URL, then click OK. To remove a
URL, select the URL entry, and click Remove.

Acceptable Use Policy

An acceptable use policy (AUP) is a policy users must agree to follow in order to access a network or
the Internet. It is common practice for many businesses and educational facilities to require that
employees or students agree to an acceptable use policy before accessing the network or Internet
through the SonicWALL security appliance.

You can choose to display an acceptable use policy message when users log in by selecting the
interface LAN, WAN, DMZ, OPT, WLAN, or VPN in the Display on login section. The LAN option is
checked by default. If these settings are unchecked, no AUP is displayed.

In the Acceptable Use Policy field, enter the text of your policy where the placeholder text
-- Enter your text here -- is displayed. You can add HTML tags to format the page.

Click Preview to display the AUP window as it appears to users.

Click Apply to save your AUP message.
Tip: Acceptable Use Policies can use HTML formatting in the body of the message.


Users > Settings

Configuring RADIUS Authentication
To enable the SonicWALL security appliance to use authentication from a RADIUS server, follow
these steps:
1 Select Use RADIUS for user authentication.
2 Select Allow only users listed locally if only the users listed in the SonicWALL security
appliance database are authenticated using RADIUS.
3 Click Configure to set up your RADIUS server settings on the SonicWALL security appliance. The
RADIUS Configuration window is displayed.

4 In the Global RADIUS Settings section, define the RADIUS Server Timeout (seconds). The
allowable range is 1-60 seconds with a default value of 5.
5 Define the number of times the SonicWALL security appliance attempts to contact the RADIUS
server in the Retries field. If the RADIUS server does not respond within the specified number of
retries, the connection is dropped. This field can range between 0 and 10, however 3 RADIUS
server retries is recommended.
6 In the RADIUS Servers section, specify the settings of the primary RADIUS server in the RADIUS
servers section. An optional secondary RADIUS server can be defined if a backup RADIUS server
exists on the network.
7 Type the IP address of the RADIUS server in the IP Address field.
8 Type the Port Number for the RADIUS server.
9 Type the RADIUS server administrative password or “shared secret” in the Shared Secret field.
The alphanumeric Shared Secret can range from 1 to 31 characters in length. The shared secret
is case sensitive.
10 If there is a secondary RADIUS server, type the appropriate information in the Secondary Server
section.



11 Click the RADIUS Users tab.

12 Select the default privileges for all RADIUS users in this section.
Access to the Internet (when access is restricted) - If you have selected Allow only
authenticated users to access the Internet, you can allow individual users to access the
Internet.
Bypass Filters - Enable this feature if the user has unlimited access to the Internet from the LAN,
bypassing SonicWALL security appliance Web, News, Java, and ActiveX blocking.
Access to VPNs - Enable feature to allow the user to send information over the VPN connection
with authentication enforcement.
Access from the VPN Client with XAUTH - Enable this feature if the user requires XAUTH for
authentication and accesses the SonicWALL security appliance over a VPN client.
Access from L2TP VPN client - Enable this feature to allow the user to send information using a
L2TP VPN Client with authentication enforcement.
Limited Management Capabilities - Enabling this feature allows the user to have limited local
management access to the SonicWALL security appliance management interface. This access is
limited to the following pages: General (Status, Network, Time); Log (View Log, Log Settings, Log
Reports); Diagnostics (All tools except Tech Support Report).
13 Click Apply, then click the Test tab.


Users > Settings

14 Type in a valid user name in the User field, and the password in the Password field.
15 Click Test. If the validation is successful, the Status messages changes to Success. If the
validation fails, the Status message changes to Failure.
16 Click OK.

Once the SonicWALL security appliance has been configured, a VPN Security Association requiring
RADIUS authentication prompts incoming VPN clients to type a user name and password into a
dialogue box.


Users > Local Users

C H A P T E R

38
Chapter 38: Configuring Local Users

Users > Local Users

Adding a Local User
To add local users to the SonicWALL security appliance internal database, perform the following
steps.


CHAPTER 38: Configuring Local Users

1 Click Add User to display the Add User configuration window.

1 Create a user name and type it in the User Name field.
2 Create a password for the user and type it in the Password field. Passwords are case-sensitive
and should consist of a combination of letters and numbers rather than names of family, friends, or
pets.
3 Confirm the password by retyping it in the Confirm Password field.
4 Select from the following list of privileges to assign the user:
Access to the Internet (when access is restricted) - If you have selected Allow only
authenticated users to access the Internet, you can allow individual users to access the
Internet.
Bypass Filters - Enable this feature if the user has unlimited access to the Internet from the LAN,
bypassing SonicWALL security appliance Web, News, Java, and ActiveX blocking.
Access to VPNs - Enable feature to allow the user to send information over the VPN connection
with authentication enforcement.
Access from the VPN Client with XAUTH - Enable this feature if the user requires XAUTH for
authentication and accesses the SonicWALL security appliance over a VPN client.
Access from L2TP VPN client - Enable this feature to allow the user to send information using a
L2TP VPN Client with authentication enforcement.
Limited Management Capabilities - Enabling this feature allows the user to have limited local
management access to the SonicWALL management interface. This access is limited to the
following pages: General (Status, Network, Time); Log (View Log, Log Settings, Log Reports);
Modem (Status, Settings, Failover, Dialup Profiles); Diagnostics (All tools except Tech Support
Report).
5 Click OK.

The users you add appear in the Local Users table with their privileges listed. Click the edit icon
in the Configure column to edit the user information. Click the delete icon to delete a user.


PART

9
Security Services
Part 9


SonicWALL Security Services

C H A P T E R

39
Chapter 39: Managing SonicWALL Security
Services

SonicWALL Security Services
SonicWALL, Inc. offers a variety of subscription-based security services to provide layered security
for your network. SonicWALL security services are designed to integrate seamlessly into your
network to provide complete protection.

The following security services are listed in Security Services in the SonicWALL security appliance’s
management interface:
• SonicWALL Content Filtering Service
• SonicWALL Network Anti-Virus/E-Mail Filter
• SonicWALL Gateway Anti-Virus
• SonicWALL Intrusion Prevention Service
• SonicWALL Global Security Client
Tip: After you register your SonicWALL security appliance, you can try FREE TRIAL of these
services.

You can activate and manage SonicWALL security services directly from the SonicWALL
management interface or from <https://www.mysonicwall.com>.
Note: For more information on SonicWALL security services, please visit
<http://www.sonicwall.com>.

Note: Complete product documentation for SonicWALL security services are on the SonicWALL
security appliance Resource CD or on the SonicWALL documentation site at
http://www.sonicwall.com/us/Support.html.


CHAPTER 39: Managing SonicWALL Security Services

mysonicwall.com
mysonicwall.com delivers a convenient, one-stop resource for registration, activation, and
management of your SonicWALL products and services. Your mysonicwall.com account provides a
single profile to do the following:
• Register your SonicWALL security appliance
• Try free trials of SonicWALL security services
• Purchase/Activate SonicWALL security service licenses
• Receive SonicWALL firmware and security service updates and alerts
• Manage your SonicWALL security services
• Access SonicWALL Technical Support

Creating a mysonicwall.com account is easy and free. Simply complete an online registration form.
Once your account is created, you can register SonicWALL security appliances and activate any
SonicWALL Security Services associated with the SonicWALL security appliance.

Your mysonicwall.com account is accessible from any Internet connection with a Web browser using
the HTTPS (Hypertext Transfer Protocol Secure) protocol to protect your sensitive information. You
can also access mysonicwall.com license and registration services directly from the SonicWALL
management interface for increased ease of use and simplified services activation.

Activating Free Trials
You can activate free 30-day trails of the following SonicWALL security services when you register
your SonicWALL security appliance at mysonicwall.com:
• SonicWALL Content Filtering Service
• SonicWALL Network Anti-Virus/E-Mail Filter
• SonicWALL Gateway Anti-Virus
• SonicWALL Intrusion Prevention Service
Note: Refer to Chapter 1, Basic SonicWALL Security Appliance Setup for instructions on registering
your SonicWALL security appliance.


Security Services > Summary

The Security Services > Summary page lists the available SonicWALL security services and
upgrades available for your SonicWALL security appliance and provides access to mysonicwall.com
to activate services.

Security Services Summary
A list of currently available services through mysonicwall.com is displayed in the Security Services
Summary table. Subscribed services are displayed with Licensed in the Status column. If the
service is limited to a number of users, the number is displayed in the Count column. The service
expiration date is displayed in the Expiration column.

Manage and Synchronizing Licenses
Clicking the Manage Licenses button displays the mysonicwall.com Login page for accessing your
mysonicwall.com account licensing information. Enter your mysonicwall.com username and
password in the User Name and Password fields, and then click Submit. The System > Licenses
page is displayed with the Manage Services Online table. The information in the Manage Services
Online table is updated from your mysSonicWALL.com account.



If you are already connected to your mysonicwall.com account from the management interface, the
Manage Services Online table is displayed.

Click the Synchronize button to update the licensing and subscription information on the SonicWALL
security appliance from your mysonicwall.com account.

If Your SonicWALL Security Appliance is Not Registered
If your SonicWALL security appliance is not registered, the Security Services > Summary page
does not include the Services Summary table. Your SonicWALL security appliance must be
registered to display the Services Summary table.

Cross Reference: Refer to Chapter 2, Basic SonicWALL Security Appliance Setup for instructions on
registering your SonicWALL security appliance.

Security Services Settings

• Security Services Setting - The Recommended setting provides maximum protection. The Per-
formance Optimized setting utilizes knowledge of the currently known threats in the SonicWALL
GRID network to provide high protection against active threats in the threat landscape. For either
setting, as the threat landscape changes, SonicWALL immediately provides dynamic updates to
the appliance to deliver the highest possible dynamic threat protection available.
• Reduce Anti-Virus and E-mail Filter traffic for ISDN connections - Selecting this feature
enables the SonicWALL Anti-Virus to only check daily (every 24 hours) for updates and reduces
the frequency of outbound traffic for users who do not have an “always on” Internet connection.
• Drop all packets while IPS, GAV and Anti-Spyware database is reloading - Selecting this
feature will drop all other traffic while the database is loading security service updates, allowing for
quicker updates.
• HTTP Clientless Notification Timeout for Gateway AntiVirus and AntiSpyware (sec) - During
a synchronization event, sets the maximum time (in seconds) before notification of a connectivity
timeout.



Security Services Information
This section includes a brief overview of services available for your SonicWALL security appliance.

Update Signature Manually
The Manual Signature Update feature is intended for networks where reliable, broadband Internet
connectivity is either not possible or not desirable (for security reasons).

The Manual Signature Update feature provides a method to update the latest signatures at the
network administrator’s discretion. The network administrator first downloads the signatures from
http://www.mysonicwall.com to a separate computer, a USB drive, or other media. Then the network
administrator uploads the signatures to the SonicWALL security appliance.

The same signature update file can be used to all SonicWALL security appliances that meet the
following requirements:
• Devices that are registered to the same mysonicwall.com account
• Devices that belong to the same class of SonicWALL security appliances.

To manually update signature files, complete the following steps:



1 On the Security Services > Summary page, scroll to the Update Signatures Manually heading
at the bottom of the page. Note the Signature File ID for the device

2 Log on to http://www.mysonicwall.com using the mysonicwall.com account that was used to
register the SonicWALL security appliance.
Note: The signature file can only be used on SonicWALL security appliances that are registered to
the mysonicwall.com account that downloaded the signature file.



3 Click on Download Signatures under the Downloads heading.

4 In the pull down window next to Signature ID:, select the appropriate SFID for your SonicWALL
security appliance.
5 Download the signature update file by clicking on Click here to download the Signature file.
Note: The remaining steps can be performed while disconnected from the Internet.

6 Return to the Security Services > Summary page on the SonicWALL security appliance GUI.
7 Click on the Import Signatures box.
8 In pop-up window that appears, click the browse button, and navigate to the location of the
signature update file.
9 Click Import. The signatures are uploaded for the security services that are enabled on the



Verifying Manual Signature Update
After you manually import the signatures, verify that the signatures were successfully updated by viewing
the Security Services pages for the services you updated (Gateway Anti-Virus, Intrusion Prevention,
and/or Anti-Spyware). The Signature Database: field should be Downloaded.
When manually updating signatures, the Last Checked: date is 01/19/1900 00:00:00.000. If Last Checked:
shows a current date, the signature was updated automatically—not manually.
Note: The manual update process may take several minutes, during which time, the Signature
Database: field will state Downloading.

Note: Clicking on the Update button activates the automatic signature update. The Update button is
not used in the Manual Signature Update feature.


SonicWALL Content Filtering Service

C H A P T E R

40
Chapter 40: Configuring SonicWALL Content
Filtering Service

SonicWALL Content Filtering Service
SonicWALL Content Filtering Service (CFS) enforces protection and productivity policies for
businesses, schools and libraries, as well as reduce legal and privacy risks while minimizing
administration overhead. SonicWALL CFS utilizes a dynamic database of millions of URLs, IP
addresses and domains to block objectionable, inappropriate or unproductive Web content. At the
core of SonicWALL CFS is an innovative rating architecture that cross references all Web sites
against the database at worldwide SonicWALL
co-location facilities. A rating is returned to the SonicWALL security appliance and then compared to
the content filtering policy established by the administrator. Almost instantaneously, the Web site
request is either allowed through or a Web page is generated by the SonicWALL security appliance
informing the user that the site has been blocked according to policy.

With SonicWALL CFS, network administrators have a flexible tool to provide comprehensive filtering
based on keywords, time of day, trusted and forbidden domain designations, and file types such as
Cookies, Java™ and ActiveX® for privacy. SonicWALL CFS automatically updates the filters, making
maintenance simple.

SonicWALL CFS can also be customized to add or remove specific URLs from the blocked list and to
block specific keywords. When a user attempts to access a site that is blocked by the SonicWALL
security appliance, a customized message is displayed on the user’s screen. SonicWALL security
appliances can also be configured to log attempts to access sites on the SonicWALL Content Filtering
Service database, on a custom URL list, and on a keyword list to monitor Internet usage before
putting new usage restrictions in place.
Note: Refer to the SonicWALL Content Filtering Service Administrator’s Guide on the Resource CD
or the SonicWALL documentation Web site at http://www.sonicwall.com/us/Support.html for
complete instructions.


CHAPTER 40: Configuring SonicWALL Content Filtering Service

Security Services > Content Filter
The Security Services > Content Filter page allows you to configure the SonicWALL security
appliance Restrict Web Features and Trusted Domains settings, which are included with SonicOS.
You can activate and configure SonicWALL Content Filtering Service as well as two third-party
Content Filtering products from the Security Services > Content Filter page.

Content Filter Status
If SonicWALL CFS is activated, the Content Filter Status section displays the status of the Content
Filter Server, as well as the date and time that your subscription expires. The expiration date and time
is displayed in Universal Time Code (UTC) format.

You can also access the SonicWALL CFS URL Rating Review Request form by clicking on the

here link in If you believe that a Web site is rated incorrectly or you wish to submit a new URL,
click here.

If SonicWALL CFS is not activated, you must activate it. If you do not have an Activation Key, you
must purchase SonicWALL CFS from a SonicWALL reseller or from your mysonicwall.com account
(limited to customer in the USA and Canada).

Activating SonicWALL Content Filtering Service
If you have an Activation Key for your SonicWALL CFS subscription, follow these steps to activate
SonicWALL CFS:

Alert: You must have a mysonicwall.com account and your SonicWALL must be registered to activate
SonicWALL Network Anti-Virus.


Security Services > Content Filter

1 Click the SonicWALL Content Filtering Subscription link on the Security Services > Content
Filtering page. The mysonicwall.com Login page is displayed.

2 Enter your mysonicwall.com account username and password in the User Name and Password
fields, then click Submit. The System > Licenses page is displayed. If your SonicWALL security
appliance is already connected to your mysonicwall.com account, the System > Licenses page
appears after you click the SonicWALL Content Filtering Subscription link.
3 Click Activate or Renew in the Manage Service column in the Manage Services Online table.
Type in the Activation Key in the New License Key field and click Submit. Your SonicWALL CFS
subscription is activated on your SonicWALL security appliance.

If you activated SonicWALL CFS at mysonicwall.com, the SonicWALL CFS activation is automatically
enabled on your SonicWALL security appliance within 24-hours or you can click the Synchronize
button on the Security Services > Summary page to update your SonicWALL security appliance.

Activating a SonicWALL Content Filtering Service
FREE TRIAL
You can try a FREE TRIAL of SonicWALL CFS by following these steps:
1 Click the FREE TRIAL link. The mysonicwall.com Login page is displayed.
appears after you click the FREE TRIAL link.
3 Click FREE TRIAL in the Manage Service column in the Manage Services Online table. Your
SonicWALL CFS trial subscription is activated on your SonicWALL security appliance.

Content Filter Type



There are three types of content filtering available on the SonicWALL security appliance.
• SonicWALL CFS - Selecting SonicWALL CFS as the Content Filter Type allows you to use the
SonicWALL Content Filtering Service that is available as an upgrade. You can obtain more
information about SonicWALL Content Filtering Service at
<http://www.sonicwall.com/products/cfs.html>
• N2H2 - N2H2 is a third party content filter software package supported by SonicWALL security
appliance.
• Websense Enterprise - Websense Enterprise is also a third party content filter list supported by

Apply filter and Restrict Web Features on - Allows you to specify the LAN or the WLAN interface
for applying content filtering or Restrict Web Features protection.

Restrict Web Features

Restrict Web Features enhances your network security by blocking potentially harmful Web
applications from entering your network.

Restrict Web Features are included with SonicOS. Select any of the following applications to block:
• ActiveX - ActiveX is a programming language that embeds scripts in Web pages. Malicious
programmers can use ActiveX to delete files or compromise security. Select the ActiveX check
box to block ActiveX controls.
• Java - Java is used to download and run small programs, called applets, on Web sites. It is safer
than ActiveX since it has built-in security mechanisms. Select the Java check box to block Java
applets from the network.
• Cookies - Cookies are used by Web servers to track Web usage and remember user identity.
Cookies can also compromise users' privacy by tracking Web activities. Select the Cookies check
box to disable Cookies.
• Access to HTTP Proxy Servers - When a proxy server is located on the WAN, LAN users can
circumvent content filtering by pointing their computer to the proxy server. Check this box to
prevent LAN users from accessing proxy servers on the WAN.

You can choose LAN for applying your Restrict Web Features protection from the Apply filter and
Restrict Web Features on setting in Content Filter Type.

Trusted Domains

Trusted Domains can be added to enable content from specific domains to be exempt from Restrict
Web Features. If you trust content on specific domains and want them exempt from Restrict Web
Features, follow these steps to add them
1 Select Don’t block Java/ActiveX/Cookies to Trusted Domain sites.
2 Click Add. The Add Trusted Domain Entry window is displayed.


Configuring SonicWALL Filter Properties

3 Enter the trusted domain name in the Domain Name field.
4 Click OK. The trusted domain entry is added to the Trusted Domain table.

To keep the trusted domain entries but enable Restrict Web Features, uncheck Don’t block Java/
ActiveX/Cookies to Trusted Domains.

To delete an individual trusted domain, click on the delete icon for the entry.

To delete all trusted domains, click the Delete All button

To edit a trusted domain entry, click the edit icon.

CFS Exclusion List
IP address ranges can be manually added to the CFS Exclusion List.

To manually add a range of IP addresses to the CFS Exclusion List, follow these steps:
1 Check the Enable CFS Exclusion List check box.
2 Click Add. The Add CFS Range Entry window is displayed.
3 Enter the first IP address in the range in the IP Address From: field and the last address in the IP
Address To: field.
4 Click OK. The IP address range is added to the CFS Exclusion List.

To keep the CFS Exclusion List entries but temporarily allow access to these sites, uncheck the
Enable CFS Exclusion LIst check box. To delete an individual trusted domain, click on the
Trashcan icon for the entry. To delete all trusted domains, click Delete All. To edit a trusted domain
entry, click the Notepad icon.

Message to Display when Blocking

You can enter your customized text to display to the user when access to a blocked site is attempted.
The default message is This site is blocked by the SonicWALL Content Filter Service. Any
message, including embedded HTML, up to 255 characters long, can be entered in this field.

You can customize SonicWALL security appliance filter features included with SonicOS Standard
from the SonicWALL Filter Properties window. To display the SonicWALL Filter Properties



window, select SonicWALL CFS from the Content Filter Type menu on the Security Services >
Content Filter page, and click Configure. The SonicWALL Filter Properties window is displayed.

Note: If SonicWALL Premium Content Filtering Service is activated, the SonicWALL Filter Properties
window includes additional configuration pages: CFS and URL List. Refer to the SonicWALL
Premium Content Filtering Service Administrator’s Guide on the Resource CD or the SonicWALL
documentation Web site at <http://www.sonicwall.com/support/documentation.html> for complete
instructions.

URL List

The URL List page allows you to specify objectionable categories. Commonly selected categories
include Violence/Hate/Racism, Nudism, Pornography, Weapons, Adult/Mature Content, Drugs/
Illegal Drugs, Alcohol/Tobacco.

To block URLs based on any of these categories, select the categories you wish to block and click the
OK button to apply changes.



CFS

The CFS page allows you to make general changes to global CFS settings.

the CFS Settings section allows you to block traffic to all Web sites of Allow traffic to all Web
sites if the CFS Server becomes unavailable. You can set the length of time before traffic is blocked
in the If Server is unavailable for (seconds) field.

Check the option to Block access to URL in order to block access when a connection attempt is
made to CFS controlled URL. You can also choose to log and save all connection attempts to CFS
controlled URLs by checking the Log Access to URL check box.

The URL Cache section allows you to adjust the Cache Size (KBs) of the CFS cache in Kilobytes.

The URL Rating Review section allows you to contact SonicWALL support if you believe that a Web
site is rated in correctly, or if you wish to submit a new URL to the CFS database.

Custom List



The Custom List page allows you to specify allowed or forbidden domains and keywords to block.

Allowed/Forbidden Domains
You can customize your URL list to include Allowed Domains and Forbidden Domains. By
customizing your URL list, you can include specific domains to be accessed, blocked, and include
specific keywords to block sites. Select the check box Enable Allowed/Forbidden Domains to
activate this feature.

To allow access to a Web site that is blocked by the Content Filter List, click Add, and enter the host
name, such as “www.ok-site.com”, into the Allowed Domains fields. 256 entries can be added to the
Allowed Domains list.

To block a Web site that is not blocked by the Content Filter Service, click Add, and enter the host
name, such as “www.bad-site.com” into the Forbidden Domains field. 256 entries can be added to
the Forbidden Domains list.
Alert: Do not include the prefix “http://” in either the Allowed Domains or Forbidden Domains the
fields. All subdomains are affected. For example, entering “yahoo.com” applies to “mail.yahoo.com”
and “my.yahoo.com”.

To remove a trusted or forbidden domain, select it from the appropriate list, and click Delete. Once the
domain has been deleted, the Status bar displays Ready.

Keyword Blocking
To enable blocking using Keywords, select Enable Keyword Blocking.Click Add, and enter the
keyword to block in the Add Keyword field, and click OK.

To remove a keyword, select it from the list and click Delete. Once the keyword has been removed,
the Status bar displays Ready.

Disable all Web traffic except for Allowed Domains
When the Disable Web traffic except for Allowed Domains check box is selected, the SonicWALL
security appliance only allows Web access to sites on the Allowed Domains list. With careful
screening, this can be nearly 100% effective at blocking pornography and other objectionable
material.



Settings

The Settings page allows you specify time periods for enabling the filtering of objectionable URLs
specified in the Custom List page. For example, you could configure the SonicWALL security
appliance to filter employee Internet access during normal business hours, but allow unrestricted
access at night and on weekends.
• Enable Filtering Always - When selected, filtering is enforced at all times.
• Enable Filtering From - When selected, filtering is enforced during the time and days specified.
Enter the time period, in 24-hour format in the hour and minute fields, and select the start and end
days of the week from the menus.

Consent

The Consent tab allows you to enforce content filtering on designated computers and provide
optional filtering on other computers. Consent can be configured to require the user to agree to the
terms outlined in an Acceptable Use Policy window before Web browsing is allowed.

To enable the Consent properties, select Require Consent.



• Maximum Web Usage (minutes) - In an environment where there are more users than
computers, such as a classroom or library, time limits are often imposed. The SonicWALL security
appliance can be used to remind users when their time has expired by displaying the page defined
in the Consent page URL field. Enter the time limit, in minutes, in the Maximum Web usage field.
When the default value of zero (0) is entered, this feature is disabled.
• User Idle Timeout (minutes) - After a period of Web browser inactivity, the SonicWALL security
appliance requires the user to agree to the terms outlined in the Consent page before accessing
the Internet again. To configure the value, follow the link to the Users window and enter the desired
value in the User Idle Timeout section.
• Consent Page URL (optional filtering) - When a user opens a Web browser on a computer
requiring consent, they are shown a consent page and given the option to access the Internet with
or without content filtering. This page must reside on a Web server and be accessible as a URL by
users on the network. It can contain the text from, or links to an Acceptable Use Policy (AUP). This
page must contain links to two pages contained in the SonicWALL security appliance, which, when
selected, tell the SonicWALL security appliance if the user wishes to have filtered or unfiltered
access. The link for unfiltered access must be <192.168.168.168/iAccept.html> and the link for
filtered access must be <192.168.168.168/iAcceptFilter.html>, where the SonicWALL security
appliance LAN IP Address is used instead of 192.168.168.168".
• Consent Accepted URL (filtering off) - When a user accepts the terms outlined in the Consent
page and chooses to access the Internet without the protection of Content Filtering, they are
shown a Web page confirming their selection. Enter the URL of this page in the Consent
Accepted (filtering off) field. This page must reside on a Web server and be accessible as a URL
by users on the network.
• Consent Accepted URL (filtering on) - When a user accepts the terms outlined in the Consent
page and chooses to access the Internet with the protection of Content Filtering, they are shown a
Web page confirming their selection. Enter the URL of this page in the Consent Accepted
(filtering on) field. This page must reside on a Web server and be accessible as a URL by users
on the network.

Mandatory Filtered IP Addresses
Consent Page URL (mandatory filtering)
When a user opens a Web browser on a computer using mandatory content filtering, a consent page
is displayed. You must create the Web page that appears when the Web browser is opened. It can
contain text from an Acceptable Use Policy, and notification that violations are logged or blocked.

This Web page must reside on a Web server and be accessible as a URL by users on the LAN. This
page must also contain a link to a page contained in the SonicWALL security appliance that tells the
SonicWALL security appliance that the user agrees to have filtering enabled. The link must be
<192.168.168.168/iAcceptFilter.html>, where the SonicWALL security appliance LAN IP Address is
used instead of 192.168.168.168.

Enter the URL of this page in the Consent Page URL (mandatory filtering) field and click OK. Once
the SonicWALL security appliance has been updated, a message confirming the update is displayed
at the bottom of the Web browser window.

Adding a New Address
The SonicWALL security appliance can be configured to enforce content filtering for certain
computers on the LAN. Click Add to display the Add Filtered IP Address Entry window.

Enter the IP addresses of these computers in the Add New Address field and click Submit button.
Up to 128 IP addresses can be entered.



To remove a computer from the list of computers to be filtered, highlight the IP address in the
Mandatory Filtered IP Addresses list and click Delete.


SonicWALL Client/Server Anti-Virus

C H A P T E R

41
Chapter 41: Managing SonicWALL Anti-Virus
and E-Mail Filter Services

SonicWALL Client/Server Anti-Virus
The widespread outbreaks of viruses illustrate the problematic nature of virus defense for small
offices. Users without the most current virus definition files allow these viruses to multiply and infect
many other users and networks. By their nature, anti-virus products typically require regular, active
maintenance on every PC. When a new virus is discovered, all anti-virus software deployed within an
organization must be updated with the latest virus definition files. Failure to do so severely limits the
effectiveness of anti-virus software and disrupts productive work time.

SonicWALL Client/Server Anti-Virus is a SonicWALL subscription service that prevents occurrences
like these and offers a new approach to virus protection. The SonicWALL security appliance
constantly monitors the version of the virus definition file and automatically triggers download and
installation of new virus definition files to each user’s computer. In addition, the SonicWALL security
appliance restricts network users’ access to the Internet until they are protected, therefore acting as
an enforcer of the company’s virus protection policy. This new approach ensures the most current
version of the virus definition file is installed and active on each PC on the network, preventing a
rogue user from disabling the virus protection and potentially exposing the entire organization to an
outbreak.
Note: Refer to the SonicWALL Client Anti-Virus Administrator’s Guide available at the SonicWALL
documentation Web site http://www.sonicwall.com/us/Support.html for complete configuration
instructions.


CHAPTER 41: Managing SonicWALL Anti-Virus and E-Mail Filter Services

Security Services > Client AV Enforcement
If SonicWALL Client/Server Anti-Virus is not activated, the Security Services > Client AV
Enforcement page indicates an upgrade is required and provides links to activate a SonicWALL CFS
license or activate a free trial version.

If you do not have an Activation Key, you must purchase SonicWALL Client/Server Anti-Virus from a
SonicWALL reseller or from your mysonicwall.com account (limited to customer in the USA and
Canada). If you have an Activation Key, you can activate SonicWALL Client/Server Anti-Virus from
this page.

If SonicWALL Client/Server Anti-Virus is activated on your SonicWALL security appliance, the
Security Services > Client AV Enforcement page includes status information and access to
configuration settings.

Note: Refer to the SonicWALL Client Anti-Virus Administrator’s Guide on the SonicWALL
documentation Web site at http://www.sonicwall.com/us/Support.html for complete instructions on
setting up Client/Server Anti-Virus on your SonicWALL security appliance.

Activating SonicWALL Client/Server Anti-Virus
If you have an Activation Key for your SonicWALL Client/Server Anti-Virus subscription, follow these
steps to activate SonicWALL Client/Server Anti-Virus:
Alert: You must have a mysonicwall.com account and your SonicWALL must be registered to activate
SonicWALL Client/Server Anti-Virus.


Security Services > E-Mail Filter

1 Click the SonicWALL Client Anti-Virus Subscription link on the Security Services > Client AV
Enforcement page. The mysonicwall.com Login page is displayed.

appears after you click the SonicWALL Client Anti-Virus Subscription link.
Type in the Activation Key in the New License Key field and click Submit. Your SonicWALL
Client/Server Anti-Virus subscription is activated on your SonicWALL security appliance.

If you activated SonicWALL Client/Server Anti-Virus at www.mysonicwall.com, the SonicWALL
Client/Server Anti-Virus activation is automatically enabled on your SonicWALL security appliance
within 24-hours or you can click the Synchronize button on the Security Services > Summary page
to update your SonicWALL security appliance.

Activating a SonicWALL Client/Server Anti-Virus
FREE TRIAL
You can try a FREE TRIAL of SonicWALL Client/Server Anti-Virus by following these steps:
Alert: You must have a mysonicwall.com account and your SonicWALL must be registered to
activate SonicWALL Client/Server Anti-Virus.
SonicWALL Client/Server Anti-Virus subscription is activated on your SonicWALL.

Security Services > E-Mail Filter
The Security Services > E-Mail Filter page allows the administrator to selectively delete or disable
inbound e-mail attachments as they pass through the SonicWALL security appliance. This feature
provides control over executable files and scripts, and applications sent as e-mail attachments.


CHAPTER 41: Managing SonicWALL Anti-Virus and E-Mail Filter Services

E-Mail Filter is included with SonicWALL Client/Server Anti-Virus. When you activate Client/Server
Anti-Virus, the settings on the Security Services > E-Mail Filter page are displayed.

Configuring SonicWALL Network
Anti-Virus
If you have activated a SonicWALL Client/Server Anti-Virus license or FREE TRIAL version, refer to
the SonicWALL Client Anti-Virus Administrator’s Guide available at the SonicWALL documentation
Web site <http://www.sonicwall.com/us/support/> for complete configuration instructions.


SonicWALL Gateway Anti-Virus Overview

C H A P T E R

42
Managing SonicWALL
Chapter 42:

Gateway Anti-Virus Service

SonicWALL Gateway Anti-Virus is part of the SonicWALL Gateway Anti-Virus/Intrusion Prevention
Service solution that provides comprehensive protection against real-time for viruses, worms,
Trojans, and software vulnerabilities using deep packet inspection scanning engine. SonicWALL’s
unique solution features a high-performance deep packet inspection architecture that scans for
viruses on a packet-by-packet basis, rather than copy every packet into a file and then scanning the
file. SonicWALL Gateway Anti-Virus has the capacity to analyze files of any size and an unlimited
number of files per user, providing ultimate scalability.

When you activate SonicWALL Gateway Anti-Virus, SonicWALL Intrusion Prevention Service is also
activated to provide comprehensive, real-time gateway anti-virus and intrusion prevention. The
SonicWALL Gateway Anti-Virus/Intrusion Prevention Services secures your network from the
gateway against a comprehensive array of dynamic threats. No client software is required.
Note: Refer to the SonicWALL Intrusion Prevention Service 2.0 Administrator’s Guide for information
you need to successfully activate, configure, and administer SonicWALL Intrusion Prevention Service
2.0 on a SonicWALL security appliance.

SonicWALL Gateway Anti-Virus delivers threat protection directly on the SonicWALL security
appliance by matching downloaded or e-mailed files against an extensive and dynamically updated
database of high threat virus signatures. Virus attacks are caught and suppressed before they travel
to employee desktops. New signatures are created and added to the database by a combination of
SonicWALL’s SonicAlert Team, third-party virus analysts, open source developers and other sources.

SonicWALL Gateway Anti-Virus can be configured to protect against internal threats as well as those
originating outside the network. It operates over a multitude of protocols including SMTP, POP3,
IMAP, HTTP, FTP, NetBIOS, instant messaging and peer-to-peer applications and dozens of other
stream-based protocols, to provide administrators with comprehensive network threat prevention and
control. Because files containing malicious code and viruses can also be compressed and therefore
inaccessible to conventional anti-virus solutions, SonicWALL Gateway Anti-Virus integrates
advanced decompression technology that automatically decompresses and scans files on a per
packet basis.


CHAPTER 42: Managing SonicWALL Gateway Anti-Virus Service

SonicWALL Gateway Anti-Virus/Intrusion Prevention
Features
• Real-Time Anti-Virus Gateway Scanning - SonicWALL Gateway Anti-Virus/Intrusion Prevention
Service delivers intelligent file-based virus and malicious code prevention through a patent-
pending deep packet inspection virus scanning engine that scans for viruses, worms and other
Internet threats in real-time over the corporate network.
• Powerful Intrusion Prevention - SonicWALL Gateway Anti-Virus/Intrusion Prevention Service
provides complete protection from a comprehensive array of network-based application layer
threats by scanning packet payloads for worms, Trojans, software vulnerabilities such as buffer
overflows, peer-to-peer and instant messenger applications, backdoor exploits, and other
malicious code.
• Integrated Deep Packet Inspection Technology - SonicWALL Gateway Anti-Virus/Intrusion
Prevention Service features a patent-pending, high-performance deep packet inspection engine
that uses parallel searching algorithms up through the application layer to deliver increased
application layer, Web and e-mail, attack prevention capabilities over those supplied by traditional
stateful packet inspection firewalls. Parallel processing reduces the performance impact on the
firewall and maximizes available memory for exceptional throughput on SonicWALL security
appliance.
• Extensive Virus Signature List - SonicWALL Gateway Anti-Virus/Intrusion Prevention Service
utilizes an extensive database containing thousands of attack and vulnerability signatures written
to detect and prevent intrusions, viruses, worms, application exploits, and the use of peer-to-peer
and instant messaging applications.
• Application Control - SonicWALL Gateway Anti-Virus/Intrusion Prevention Service provides
network administrator’s with the ability to monitor and manage the use of instant messaging and
peer-to-peer file sharing programs from operating through the firewall, closing a potential backdoor
that can be used to compromise the network while improving employee productivity and
conserving Internet bandwidth.
• Simplified Deployment and Management - SonicWALL Gateway Anti-Virus/Intrusion Prevention
Service allows network administrators to create global policies between security zones and group
attacks by priority, simplifying deployment and management across a distributed network.

Registering SonicWALL Gateway Anti-Virus
If you do not have SonicWALL Gateway Anti-Virus installed on your SonicWALL security appliance,
the Security Services > Gateway Anti-Virus page indicates an upgrade is required and includes a
link to activiate it from your SonicWALL security appliance management interface.



If your SonicWALL security appliance is connected to the Internet and registered at mysonicwall.com,
you can activate a 30-day FREE TRIAL of SonicWALL Gateway Anti-Virus or activate a SonicWALL
Gateway Anti-Virus license directly from the SonicWALL management interface. If you need to create
a mysonicwall.com account to register your SonicWALL security appliance, you can create it directly
from the SonicWALL management interface.

SonicWALL Gateway Anti-Virus is part of the unified SonicWALL Gateway Anti-Virus/Intrusion
Prevention Service that provides comprehensive protection against viruses, worms, Trojans, and
other vulnerabilities. When you activate SonicWALL Gateway Anti-Virus, SonicWALL Intrusion
Prevention Service is also activated.
Note: Refer to the SonicWALL Intrusion Prevention Service 2.0 Administrator’s Guide for the
information you need to successfully activate, configure, and administer SonicWALL Intrusion
Prevention Service 2.0 on a SonicWALL security appliance.

Your mysonicwall.com account is also accessible at <https://www.mysonicwall.com> from any
Internet connection with a Web browser using the HTTPS (Hypertext Transfer Protocol Secure)
protocol to protect your sensitive information.

If you do not have a SonicWALL Gateway Anti-Virus license activated on your SonicWALL security
appliance, you must purchase it from a SonicWALL reseller or through your mysonicwall.com account
(limited to customers in the USA and Canada).

If you activated SonicWALL Gateway Anti-Virus at <https://www.mysonicwall.com>, SonicWALL
Gateway Anti-Virus activation is automatically enabled on your SonicWALL within 24-hours or you
can click the Synchronize button on the Security Services > Summary page to update your

mysonicwall.com registration information is not sold or shared with any other company.

Activating SonicWALL Gateway Anti-Virus
If you have an Activation Key for your SonicWALL Gateway Anti-Virus, perform these steps to
activate the service:
1 On the Security Services > Gateway Anti-Virus page, click the SonicWALL Gateway Anti-
Virus Subscription link. The mysonicwall.com Login page is displayed.
fields, then click Submit. If your SonicWALL security appliance is already registered to your
mysonicwall.com account, the System > Licenses page appears.
4 Type in the Activation Key in the New License Key field and click Submit. Your SonicWALL
Gateway Anti-Virus subscription is activated on your SonicWALL security appliance.

If you activated the SonicWALL Gateway Anti-Virus subscription on mysonicwall.com, the
SonicWALL IPS activation is automatically enabled on your SonicWALL within 24-hours or you can
click the Synchronize button on the Security Services > Summary page to update your SonicWALL
security appliance.

Activating the SonicWALL Gateway Anti-Virus
FREE TRIAL
To try a FREE TRIAL of SonicWALL Gateway Anti-Virus, perform these steps:



fields, then click Submit. If your SonicWALL security appliance is already connected to your
mysonicwall.com account, the System > Licenses page appears after you click the FREE TRIAL
link.
3 Click Try in the FREE TRIAL column in the Manage Services Online table. Your SonicWALL
Gateway Anti-Virus trial subscription is activated on your SonicWALL security appliance.

Configuring SonicWALL Gateway
Anti-Virus
After activating SonicWALL Gateway Anti-Virus, the Security Services > Gateway Anti-Virus page
displays the configuration settings for managing the service on your SonicWALL security appliance.

If you have activated a SonicWALL Content Filtering Service license or FREE TRIAL version, refer to
the SonicWALL Gateway Anti-Virus Administrator’s Guide available at the SonicWALL documentation
Web site http://www.sonicwall.com/us/Support.html for complete configuration instructions.

Applying SonicWALL GAV Protection on Interfaces
To enable SonicWALL GAV, check the Enable Gateway Anti-Virus on Interface: box, and then
check the boxes for the interfaces that you want to enable SonicWALL GAV protection for. Depending
on the SonicWALL security appliance model you are using, you can choose the WAN, LAN, DMZ,
OPT, or WLAN port. After selecting the interface(s), click Apply. It is recommended that you select
the WAN and LAN interfaces.

Viewing SonicWALL GAV Status Information
The Gateway Anti-Virus Status section shows the state of the anti-virus signature database,
including the database's timestamp, and the time the SonicWALL signature servers were last checked


Configuring SonicWALL Gateway Anti-Virus

for the most current database version. The SonicWALL security appliance automatically attempts to
synchronize the database on startup, and once every hour.

The Gateway Anti-Virus Status section displays the following information:
• Signature Database indicates whether the signature database needs to be downloaded or has
been downloaded.
• Signature Database Timestamp displays the last update to the SonicWALL GAV signature
database, not the last update to your SonicWALL security appliance.
• Last Checked indicates the last time the SonicWALL security appliance checked the signature
database for updates. The SonicWALL security appliance automatically attempts to synchronize
the database on startup, and once every hour.
• Gateway Anti-Virus Expiration Date indicates the date when the SonicWALL GAV service
expires. If your SonicWALL GAV subscription expires, the SonicWALL IPS inspection is stopped
and the SonicWALL GAV configuration settings are removed from the SonicWALL security
appliance. These settings are automatically restored after renewing your SonicWALL GAV license
to the previously configured state.

If your SonicWALL security appliance has no interfaces specified in the Gateway Anti-Virus Global
Settings section, the message: Warning: No interfaces have Gateway Anti-Virus enabled is
displayed in the Gateway Anti-Virus Status section. You must check the Enable Gateway Anti-
Virus on Interface and specify the interface(s) you want to apply anti-virus scanning.

Updating SonicWALL GAV Signatures
By default, the SonicWALL security appliance running SonicWALL GAV automatically checks the
SonicWALL signature servers once an hour. There is no need for an administrator to constantly check
for new signature updates. You can also manually update your SonicWALL GAV database at any
time by clicking the Update button located in the Gateway Anti-Virus Status section.

SonicWALL GAV signature updates are secured. The SonicWALL security appliance must first
authenticate itself with a pre-shared secret, created during the SonicWALL Distributed Enforcement
Architecture licensing registration. The signature request is transported through HTTPS, along with
full server certificate verification.

Specifying Protocol Filtering

Application-level awareness of the type of protocol that is transporting the violation allows SonicWALL
GAV to perform specific actions within the context of the application to gracefully handle the rejection
of the payload.



By default, SonicWALL GAV inspects all inbound HTTP, FTP, IMAP, SMTP and POP3 traffic. Generic
TCP Stream can optionally be enabled to inspect all other TCP based traffic, such as
non-standard ports of operation for SMTP and POP3, and IM and P2P protocols.

Enabling Inbound Inspection
Within the context of SonicWALL GAV, the Enable Inbound Inspection protocol traffic handling
refers to the following:
• Non-SMTP traffic initiating from a Trusted, Wireless, or Encrypted Zone destined to any Zone.
• Non-SMTP traffic from a Public Zone destined to an Untrusted Zone.
• SMTP traffic initiating from a non-Trusted interface destined to a Trusted, Wireless, Encrypted, or
Public interface.
• SMTP traffic initiating from a Trusted, Wireless, or Encrypted interface destined to a Trusted,
Wireless, or Encrypted interface.

Enabling Outbound SMTP Inspection
The Enable Outbound Inspection feature is available for SMTP traffic, such as for a mail server that
might be hosted on the DMZ. Enabling outbound inspection for SMTP scans mail that is delivered to
the internally hosted SMTP server for viruses.

Restricting File Transfers
For each protocol you can restrict the transfer of files with specific attributes by clicking on the
Settings button under the protocol in the Gateway Anti-Virus Global Settings section.

These restrict transfer settings include:
• Restrict Transfer of password-protected Zip files - Disables the transfer of password protected
ZIP files over any enabled protocol. This option only functions on protocols (e.g. HTTP, FTP,
SMTP) that are enabled for inspection.
• Restrict Transfer of MS-Office type files containing macros (VBA 5 and above) - Disables the
transfers of any MS Office 97 and above files that contain VBA macros.
• Restrict Transfer of packed executable files (UPX, FSG, etc.) - Disables the transfer of packed
executable files. Packers are utilities which compress and sometimes encrypt executables.
Although there are legitimate applications for these, they are also sometimes used with the intent
of obfuscation, so as to make the executables less detectable by anti-virus applications. The
packer adds a header that expands the file in memory, and then executes that file. SonicWALL
Gateway
Anti-Virus currently recognizes the most common packed formats: UPX, FSG, PKLite32, Petite,


Configuring Gateway AV Settings

and ASPack. additional formats are dynamically added along with SonicWALL GAV signature
updates.

Configuring Gateway AV Settings
Clicking the Configure Gateway AV Settings button at the bottom of the Gateway Anti-Virus
Global Settings section displays the Gateway AV Config View window, which allows you to
configure client notification alerts and create a SonicWALL GAV exclusion list.

Configuring Client Alerts
If you want clients on your network to receive notifications on their desktop when a HTTP file
download is blocked by GAV, check the Enable Client Notification Alerts (desktop client
installation is required) box. You must install the client software included on the Resource CD for
your SonicWALL security appliance for the client to receive these notifications from SonicWALL GAV.

If you want to suppress the sending of e-mail messages (SMTP) to clients from SonicWALL GAV
when a virus is detected in an e-mail or attachment, check the Disable SMTP Responses box.

Configuring HTTP Clientless Notification
The HTTP Clientless Notification feature notifies users when GAV detects an incoming threat from an
HTTP server. To configure this feature, check the Enable HTTP Clientless Notification Alerts box and
enter a message in the Message to Display when Blocking field, as shown below.



With this option disabled, when GAV detects an incoming threat from an HTTP server, GAV blocks
the threat and the user receives a blank HTTP page. Typically, users will attempt to reload the page
because they are not aware of the threat. The HTTP Clientless Notification feature informs the user
that GAV detected a threat from the HTTP server.
Tip: The HTTP Clientless Notification feature is also available for SonicWALL Anti-Spyware.

Optionally, you can configure the timeout for the HTTP Clientless Notification on the Security
Services > Summary page under the Security Services Summary heading.

Configuring a SonicWALL GAV Exclusion List
Any IP addresses listed in the exclusion list bypass virus scanning on their traffic.The Gateway AV
Exclusion List section provides the ability to define a range of IP addresses whose traffic will be
excluded from SonicWALL GAV scanning.
Alert: Use caution when specifying exclusions to SonicWALL GAV protection.

To add an IP address range for exclusion, perform these steps:
1 Click the Enable Gateway AV Exclusion List checkbox to enable the exclusion list.
2 Click the Add button. The Add GAV Range Entry window is displayed.

3 Enter the IP address range in the IP Address From and IP Address To fields, then click OK. You
IP address range appears in the Gateway AV Exclusion List table. Click the edit icon in the
Configure column to change an entry or click the trashcan icon to delete an entry.
4 Click OK to exit the Gateway AV Config View window.


Viewing SonicWALL GAV Signatures

Viewing SonicWALL GAV Signatures
The Gateway Anti-Virus Signatures section allows you to view the contents of the SonicWALL GAV
signature database. All the entries displayed in the Gateway Anti-Virus Signatures table are from
the SonicWALL GAV signature database downloaded to your SonicWALL security appliance.

Note: Signature entries in the database change over time in response to new threats.

Displaying Signatures

You can display the signatures in a variety of views using the View Style menu.
• Use Search String - Allows you to display signatures containing a specified string entered in the
Lookup Signatures Containing String field.
• All Signatures - Displays all the signatures in the table, 50 to a page.
• 0 - 9 - Displays signature names beginning with the number you select from the menu.
• A-Z - Displays signature names beginning with the letter you select from menu.

Navigating the Gateway Anti-Virus Signatures Table
The SonicWALL GAV signatures are displayed fifty to a page in the Gateway Anti-Virus Signatures
table. The Items field displays the table number of the first signature. If you’re displaying the first page
of a signature table, the entry might be Items 1 to 50 (of 58). Use the navigation buttons to navigate
the table.



Searching the Gateway Anti-Virus Signature Database
You can search the signature database by entering a search string in the Lookup Signatures
Containing String field, then clicking the edit (Notepad) icon.

The signatures that match the specified string are displayed in the Gateway Anti-Virus Signatures
table.


SonicWALL Intrusion Prevention Service

C H A P T E R

43
Managing SonicWALL
Chapter 43:

Intrusion Prevention Service

SonicWALL Intrusion Prevention Service (SonicWALL IPS) delivers a configurable, high performance
Deep Packet Inspection engine for extended protection of key network services such as Web, e-mail,
file transfer, Windows services and DNS. SonicWALL IPS is designed to protect against application
vulnerabilities as well as worms, Trojans, and peer-to-peer, spyware and backdoor exploits. The
extensible signature language used in SonicWALL’s Deep Packet Inspection engine also provides
proactive defense against newly discovered application and protocol vulnerabilities. SonicWALL IPS
offloads the costly and time-consuming burden of maintaining and updating signatures for new hacker
attacks through SonicWALL’s industry-leading Distributed Enforcement Architecture (DEA). Signature
granularity allows SonicWALL IPS to detect and prevent attacks based on a global, attack group, or
per-signature basis to provide maximum flexibility and control false positives.
Note: Refer to the SonicWALL Intrusion Prevention Service Administrator’s Guide on the Resource
CD or the SonicWALL documentation Web site at http://www.sonicwall.com/us/Support.html for
complete instructions.

SonicWALL IPS Features
• High Performance Deep Packet Inspection Technology - SonicWALL’s Intrusion Prevention
Service features a configurable, high-performance Deep Packet Inspection engine that uses
parallel searching algorithms on incoming packets through the application layer to deliver
increased attack prevention capabilities over those supplied by traditional stateful packet
inspection firewall. By performing all of the matching on packets, SonicWALL IPS eliminates the
overhead of having to reassemble the data stream. Parallel processing reduces the impact on the
processor and maximizes available memory for exceptional performance on SonicWALL security
appliances.
• Inter-Zone Intrusion Prevention - SonicWALL IPS provides an additional layer of protection
against malicious threats by allowing administrator’s to enforce intrusion prevention not only
between each network zone and the Internet, but also between internal network zones. This is
performed by enabling intrusion prevention on inbound and outbound traffic between trusted
zones (SonicOS Enhanced).
• Extensive Signature Database - SonicWALL IPS utilizes an extensive database of over 1,700
attack and vulnerability signatures written to detect and prevent intrusions, worms, application
exploits, as well as peer-to-peer and instant messaging traffic. The SonicWALL Deep Packet
Inspection engine can also read signatures written in the popular Snort format, allowing


CHAPTER 43: Managing SonicWALL Intrusion Prevention Service

SonicWALL to easily incorporate new signatures as they are published by third parties.
SonicWALL maintains a current and robust signature database by incorporating the latest
available signatures from thousands of open source developers and by continually developing new
signatures for application vulnerabilities that are not immediately available or provided by open
source.
• Dynamically Updated Signature Database - SonicWALL IPS includes automatic signature
updates delivered through SonicWALL’s Distributed Enforcement Architecture (DEA), providing
protection from emerging threats and lowering total cost of ownership. Updates to the signature
database are dynamic for SonicWALL security appliances under an active subscription.
• Scalable - SonicWALL IPS is a scalable solution for SonicWALL TZ and PRO Series Appliances
that secures small, medium and large networks with complete protection from application exploits,
worms and malicious traffic.
• Application Control - SonicWALL IPS provides the ability to prevent Instant Messaging and Peer-
to-Peer file sharing programs from operating through the firewall, closing a potential backdoor that
can be used to compromise the network while also improving employee productivity and
conserving Internet bandwidth.
• Simplified Deployment and Management - SonicWALL IPS allows network administrators to
quickly and easily manage the service within minutes. Administrator’s can create global policies
between security zones and interfaces as well as group attacks by priority, simplifying deployment
and management across a distributed network.
• Granular Policy Management - SonicWALL IPS provides administrators with a range of granular
policy tools to enforce IPS on a global, group, or individual signature level to enable more control
and reduce the number of false policies. SonicWALL IPS allows also allows administrators to
choose between detection, prevention, or both to tailor policies for their specific network
environment.
• Logging and Reporting - SonicWALL IPS offers comprehensive logging of all intrusion attempts
with the ability to filter logs based on priority level, enabling administrator’s to highlight high priority
attacks. Granular reporting based on attack source, destination and type of intrusion is available
through SonicWALL ViewPoint and Global Management System. A hyperlink of the intrusion
brings up the signature window for further information from the SonicWALL security appliance log.
• Management by Risk Category - SonicWALL IPS allows you to enable/disable detection or
prevention based on the priority level of attack through High, Medium, or Low predefined priority
groups.
• Detection Accuracy - SonicWALL IPS detection and prevention accuracy is achieved minimizing
both false positives and false negatives. Signatures are written around applications, such as
Internet Explorer or SQL Server rather than ports or protocols to ensure that malicious code
targeting them are correctly identified and prevented.

SonicWALL Deep Packet Inspection
Deep Packet Inspection looks at the data portion of the packet. The Deep Packet Inspection
technology includes intrusion detection and intrusion prevention. Intrusion detection finds anomalies
in the traffic and alerts the administrator. Intrusion prevention finds the anomalies in the traffic and
reacts to it, preventing the traffic from passing through.

Deep Packet Inspection is a technology that allows a SonicWALL security appliance to classify
passing traffic based on rules. These rules include information about layer 3 and layer 4 content of the
packet as well as the information that describes the contents of the packet’s payload, including the
application data (for example, an FTP session, an HTTP Web browser session, or even a middleware
database connection). This technology allows the administrator to detect and log intrusions that pass
through the SonicWALL security appliance, as well as prevent them (for example dropping the packet
or resetting the TCP connection). SonicWALL’s Deep Packet Inspection technology also correctly
handles TCP fragmented byte stream inspection as if no TCP fragmentation has occurred.



How SonicWALL’s Deep Packet Inspection Architecture
Works
Deep Packet Inspection technology enables the firewall to investigate farther into the protocol to
examine information at the application layer and defend against attacks targeting application
vulnerabilities. This is the technology behind SonicWALL Intrusion Prevention Service. SonicWALL’s
Deep Packet Inspection technology enables dynamic signature updates pushed from the SonicWALL
Distributed Enforcement Architecture.

The following steps describe how the SonicWALL Deep Packet Inspection Architecture works:
1 Pattern Definition Language Interpreter uses signatures that can be written to detect and prevent
against known and unknown protocols, applications and exploits.
2 TCP packets arriving out-of-order are reassembled by the Deep Packet Inspection framework.
3 Deep Packet Inspection engine preprocessing involves normalization of the packet’s payload. For
example, a HTTP request may be URL encoded and thus the request is URL decoded in order to
perform correct pattern matching on the payload.
4 Deep Packet Inspection engine postprocessors perform actions which may either simply pass the
packet without modification, or could drop a packet or could even reset a TCP connection.
5 SonicWALL’s Deep Packet Inspection framework supports complete signature matching across
the TCP fragments without performing any reassembly (unless the packets are out of order). This
results in more efficient use of processor and memory for greater performance.



Security Services > Intrusion Prevention
The Security Services > Intrusion Prevention page provides the settings for configuring
SonicWALL Intrusion Prevention Service.

If you do not have SonicWALL IPS activated on your SonicWALL security appliance, you must
purchase SonicWALL IPS from a SonicWALL reseller or through your mysonicwall.com account
(limited to customers in the USA and Canada).

If you do not have SonicWALL IPS installed on your SonicWALL security appliance, the Security
Services > Intrusion Prevention page indicates an upgrade is required and includes a link to
activate your IPS subscription from the SonicWALL management interface or to activate a FREE
TRIAL of SonicWALL IPS.

Activating SonicWALL IPS

If you have an Activation Key for your SonicWALL IPS, follow these steps to activate the service:
1 Click the SonicWALL IPS Subscription link on the Security Services > Intrusion Prevention
page. The mysonicwall.com Login page is displayed.
appliance is already registered to your mysonicwall.com account, the System > Licenses page
appears after you click the SonicWALL IPS Subscription link.
Type in the Activation Key in the New License Key field and click Submit. Your SonicWALL IPS
subscription is activated on your SonicWALL security appliance.

If you activated the SonicWALL IPS subscription on mysonicwall.com, the SonicWALL IPS activation
is automatically enabled on your SonicWALL within 24-hours or you can click the Synchronize button
on the Security Services > Summary page to update your SonicWALL security appliance.

Activating the SonicWALL IPS FREE TRIAL
To try a FREE TRIAL of SonicWALL IPS, follow these steps:
SonicWALL IPS trial subscription is activated on your SonicWALL security appliance.


Security Services > Intrusion Prevention


SonicWALL Anti-Spyware Overview

C H A P T E R

44
Chapter 44: Activating SonicWALL
Anti-Spyware

SonicWALL Anti-Spyware is included within the SonicWALL Gateway Anti-Virus (GAV), Anti-Spyware
and Intrusion Prevention Service (IPS) unified threat management solution. SonicWALL GAV,
Anti-Spyware and IPS delivers a comprehensive, real-time gateway security solution for your entire
network.
Note: For complete instructions on setting up SonicWALL Anti-Spyware Service, refer to the
SonicWALL Anti-Spyware Service Administrator’s Guide available on the SonicWALL Web site

The Spyware Threat
Spyware is software that utilizes a computer’s Internet access without the host’s knowledge or
permission. Spyware can gather information about browsing habits, data entered into online forms,
and keystrokes.

Computers are infected with Spyware applications from a variety of sources:
• Downloaded programs such as P2P applications, freeware, screensavers, utilities, download
managers, demo software, and video games.
• Trojans delivered through e-mail, downloaded from an FTP site, or installed with freeware.
• Banner ads

The impact of spyware for users includes the following threats:
• Identity theft
• Stolen proprietary data
• Invasion of privacy
• Degraded computer performance
• Excessive bandwidth use resulting in a network slowdown


CHAPTER 44: Activating SonicWALL Anti-Spyware

SonicWALL Anti-Spyware Service
The SonicWALL Anti-Spyware Service protects networks from intrusive spyware by cutting off
spyware installations and delivery at the gateway and denying previously installed spyware from
communicating collected information outbound. SonicWALL Anti-Spyware works with other anti-
spyware program, such as programs that remove existing spyware applications from hosts. You are
encouraged to use or install host-based anti-spyware software as an added measure of defense
against spyware.

SonicWALL Anti-Spyware analyzes inbound connections for the most common method of spyware
delivery, ActiveX-based component installations. It also examines inbound setup executables and
cabinet files crossing the gateway, and resets the connections that are streaming spyware setup files
to the LAN. These file packages may be freeware bundled with adware, keyloggers, or other spyware.
If spyware has been installed on a LAN workstation prior to the SonicWALL Anti-Spyware solution
install, the service will examine outbound traffic for streams originating at spyware infected clients and
reset those connections. For example, when spyware has been profiling a user's browsing habits and
attempts to send the profile information home, the SonicWALL security appliance identifies that traffic
and resets the connection.

The SonicWALL Anti-Spyware Service provides the following protection:
• Blocks spyware delivered through auto-installed ActiveX components, the most common vehicle
for distributing malicious spyware programs.
• Scans and logs spyware threats that are transmitted through the network and alerts administrators
when new spyware is detected and/or blocked.
• Stops existing spyware programs from communicating in the background with hackers and servers
on the Internet, preventing the transfer of confidential information.
• Provides granular control over networked applications by enabling administrators to selectively
permit or deny the installation of spyware programs.
• Prevents e-mailed spyware threats by scanning and then blocking infected e-mails transmitted
either through SMTP, IMAP or Web-based e-mail.

SonicWALL’s Unified Threat Management Solution
Utilizing SonicWALL’s configurable, high-performance Deep Packet Inspection architecture,
SonicWALL Gateway Anti-Virus, Anti-Spyware and Intrusion Prevention Service secures the network
from the core to the perimeter against a comprehensive array of dynamic threats including viruses,
spyware, worms, Trojans, and remote exploitation of software vulnerabilities, such as buffer
overflows, as well as peer-to-peer and instant messenger applications, backdoor exploits, and other
malicious code. Because new threats emerge daily and are often unpredictable, the deep packet
inspection architecture is constantly updated to deliver the highest protection against an ever-
changing threat landscape.

SonicWALL Gateway Anti-Virus, Anti-Spyware, and Intrusion Prevention Service inspects e-mail,
Web traffic, file transfers, a multitude of stream-based protocols, as well as instant messaging and
peer-to-peer applications. Because files containing malicious code, viruses and worms can be
compressed and therefore inaccessible to conventional solutions, SonicWALL Gateway Anti-Virus,
Anti-Spyware and Intrusion Prevention Service integrates advanced decompression technology that
automatically decompresses and scans files on a per packet basis. Supported compression formats
include ZIP, Deflate, GZIP and packed executables. As an added layer of security, SonicWALL
Gateway Anti-Virus, Anti-Spyware and Intrusion Prevention Service provides application layer attack
protection not only against external threats, but also against those originating inside the network.

Unlike other threat management solutions, SonicWALL Gateway Anti-Virus, Anti-Spyware and
Intrusion Prevention Service has the capacity to analyze files of any size in real-time without the need
to add expensive hardware drive or extra memory. SonicWALL Gateway Anti-Virus, Anti-Spyware
and Intrusion Prevention Service includes a pro-active alerting mechanism that notifies network



administrators when a new threat is discovered. Granular policy tools and an intuitive user interface
enable administrators to configure a custom set of detection or prevention policies tailored to their
specific network environment. Network administrators can create global policies between interfaces
and group attacks by priority, simplifying deployment and management across a distributed network.

SonicWALL Gateway Anti-Virus, Anti-Spyware, and Intrusion Prevention Service running on multiple
SonicWALL security appliances can be managed by SonicWALL Global Management System
(SonicWALL GMS) from a central location. SonicWALL ViewPoint solutions allow administrator’s to
create detailed reports of network activities.

SonicWALL Gateway Anti-Virus, Anti-Spyware and
Intrusion Prevention Security Services
• Integrated Deep Packet Inspection Technology - features a configurable, high-performance
Deep Packet Inspection architecture that uses parallel searching algorithms up through the
application layer to deliver complete application layer, Web and e-mail attack prevention. Parallel
processing reduces the impact on the processor and maximizes available memory for exceptional
performance on SonicWALL appliances.
• Spyware Protection - prevents malicious spyware from infecting networks by blocking spyware
installations at the gateway and disrupts background communications from existing spyware
programs that transmit confidential data.
• Real-Time AV Gateway Scanning - delivers intelligent file-based virus and malicious code
prevention by scanning in real-time for decompressed and compressed files containing viruses,
Trojans, worms and other Internet threats over the corporate network.
• Powerful Intrusion Prevention - delivers complete protection from a comprehensive array of
network-based application layer threats by scanning packet payloads for worms, Trojans, software
vulnerabilities such as buffer overflows, peer-to-peer and instant messenger applications,
backdoor exploits, and other malicious code.
• Scalability and Performance - utilitizes a per packet scanning engine, allowing the SonicWALL
unified threat management solution to handle unlimited file size and virtually unlimited concurrent
downloads.
• Day Zero Protection - ensures fast time-to-protection by employing a dynamically updated
database of signatures created by a combination of SonicWALL’s SonicAlert Team and third-party
sources.
• Extensive Signature List - utilizes an extensive database of thousands of attack and vulnerability
signatures written to detect and prevent intrusions, viruses, spyware, worms, Trojans, application
exploits, and malicious applications.
• Distributed Enforcement Architecture - utilizes a distributed enforcement architecture to deliver
automated signature updates, providing real-time protection from emerging threats and lowering
total cost of ownership.
• Inter-zone Protection - provides application layer attack protection against malicious code and
other threats originating from the Internet or from internal sources. Administrators have the ability
to enforce intrusion prevention and anti-virus scanning not only between each network zone and
the Internet, but also between internal network zones for added security (Requires SonicOS
Enhanced).
• Advanced File Decompression Technology - includes advanced decompression technology
that can automatically decompress and scan files on a per packet basis to search for viruses,
Trojans, worms and malware. Supported compression formats include: ZIP, Deflate and GZIP.
• File-Based Scanning Protocol Support - delivers protection for high threat viruses and malware
by inspecting the most common protocols used in today’s networked environments, including
SMTP, POP3, IMAP, HTTP, FTP, NETBIOS, instant messaging and peer-to-peer applications,
and dozens of other stream-based protocols. This closes potential backdoors that can be used to
compromise the network while also improving employee productivity and conserving Internet
bandwidth.
• Application Control - provides the ability to prevent instant messaging and peer-to-peer file
sharing programs from operating through the firewall, closing a potential back door that can be



used to compromise the network while also improving employee productivity and conserving
Internet bandwidth.
• Simplified Deployment and Management - allows network administrators to create global
policies between network interfaces and group attacks by priority, simplifying deployment and
management across a distributed network.
• Granular Management - provides an intuitive user interface and granular policy tools, allowing
network administrators to configure a custom set of detection or prevention policies for their
specific network environment and reduce the number of false policies while identifying immediate
threats.
• Logging and Reporting - offers comprehensive logging of all intrusion attempts with the ability to
filter logs based on priority level, enabling administrators to highlight high priority attacks. Granular
reporting based on attack source, destination and type of intrusion is available through SonicWALL
ViewPoint and Global Management System.



How SonicWALL’s Deep Packet Inspection Works
Deep Packet Inspection technology enables the firewall to investigate farther into the protocol to
examine information at the application layer and defend against attacks targeting application
vulnerabilities. This is the technology behind SonicWALL Gateway Anti-Virus, Anti-Spyware and
Intrusion Prevention Service. SonicWALL’s Deep Packet Inspection technology enables dynamic
signature updates pushed from the SonicWALL Distributed Enforcement Architecture.

The following steps describe how the SonicWALL Deep Packet Inspection Architecture works:
1 Pattern Definition Language Interpreter uses signatures that can be written to detect and prevent
against known and unknown protocols, applications and exploits.
2 TCP packets arriving out-of-order are reassembled by the Deep Packet Inspection framework.
3 Deep Packet Inspection engine preprocessing involves normalization of the packet’s payload. For
example, a HTTP request may be URL encoded and thus the request is URL decoded in order to
perform correct pattern matching on the payload.
4 Deep Packet Inspection engine postprocessors perform actions which may either simply pass the
packet without modification, or could drop a packet or could even reset a TCP connection.
5 SonicWALL’s Deep Packet Inspection framework supports complete signature matching across
the TCP fragments without performing any reassembly (unless the packets are out of order). This
results in more efficient use of processor and memory for greater performance.

Deep Packet Inspection looks at the data portion of the packet. The Deep Packet Inspection
technology includes intrusion detection and intrusion prevention. Intrusion detection finds anomalies
in the traffic and alerts the administrator. Intrusion prevention finds the anomalies in the traffic and
reacts to it, preventing the traffic from passing through.



Deep Packet Inspection is a technology that allows a SonicWALL security appliance to classify
passing traffic based on rules. These rules include information about layer 3 and layer 4 content of the
packet as well as the information that describes the contents of the packet’s payload, including the
application data (for example, an FTP session, an HTTP Web browser session, or even a middleware
database connection). This technology allows the administrator to detect and log intrusions that pass
through the SonicWALL Security Appliance, as well as prevent them (for example dropping the packet
or resetting the TCP connection). SonicWALL’s Deep Packet Inspection technology also correctly
handles TCP fragmented byte stream inspection as if no TCP fragmentation has occurred.

Inbound and Outbound Protection
SonicWALL Gateway Anti-Virus, Anti-Spyware and Intrusion Service are applied to both inbound and
outbound traffic, because signatures are written directionally. That is, the direction of the attack is
considered when applying protection on a SonicWALL security appliance.

For example, the Sasser worm. SonicWALL signatures were written to examine different stages and
directions of this complex attack. One signature looked for a NetBIOS buffer overflow attack that uses
the common NetBIOS ports as an exploit. This SonicWALL signature is applied inbound between
zones (SonicOS Enhanced) and interfaces (SonicOS Standard) from the Internet, effectively stopping
the proliferation of the exploit from the external network. After the initial exploit, the Sasser worm
attempts to download the main part of its program through an FTP session out to the Internet.

Another SonicWALL signature automatically prevents Sasser from establishing an outbound FTP
session to the Internet, and it may be applied to each zone or interface.

SonicWALL Gateway Anti-Virus, Anti-Spyware and Instrusion Prevention Service does not require
you to understand what signatures are applied in what directions. You simply select predefined
groups based on the severity of the attacks or the danger level of the spyware.

Activating the SonicWALL Anti-Spyware License
If you do not have SonicWALL Gateway Anti-Virus, Anti-Spyware, and Intrusion Prevention Service
installed on your SonicWALL security appliance, the Security Services > Anti-Spyware page
indicates an upgrade is required and includes a link to activate it from your SonicWALL security
appliance management interface.

SonicWALL Anti-Spyware is part of the unified SonicWALL Gateway Anti-Virus, Anti-Spyware, and
Intrusion Prevention Service, so you use a single parent License Key to activate all three services on
your SonicWALL security appliance. You activate the SonicWALL Gateway Anti-Virus, Anti-Spyware,
and Intrusion Prevention Service parent license for SonicWALL Intrusion Prevention Service first from
the Security Services > Intrusion Prevention page. Once you have activated Intrusion Prevention
Service, you can then activate SonicWALL Gateway Anti-Virus and SonicWALL Anti-Spyware.

To activate a SonicWALL Gateway Anti-Virus, Anti-Spyware, and Intrusion Prevention Service on
your SonicWALL security appliance, you need the following:
• SonicOS Standard 3.1 or later. Your SonicWALL security appliance must be running SonicOS
Standard 3.1 or later for SonicWALL Gateway Anti-Virus, Anti-Spyware, and Intrusion Prevention
Service. If you do not have SonicOS 3.1 or later installed on your SonicWALL security appliance,
refer to the SonicOS Standard or Enhanced Administrator’s Guide available on the SonicWALL
Web site http://www.sonicwall.com/us/Support.html for SonicOS upgrade instructions.
• mysonicwall.com account. A mysonicwall.com account allows you to manage your SonicWALL
products. You need to register your SonicWALL security appliance to activate SonicWALL security
services. Creating a mysonicwall.com is fast, simple, and FREE. Simply complete an online
registration form directly from your SonicWALL security appliance management interface. Your



mysonicwall.com account is also accessible at
<https://www.mysonicwall.com> from any Internet connection with a Web browser.
• Registered SonicWALL Security Appliance with Active Internet Connection. Registering your
SonicWALL security appliance is a simple procedure done directly from the management
interface. Once your SonicWALL security appliance is registered, you can activate your
SonicWALL security service using an activation key.
• SonicWALL Gateway Anti-Virus, Anti-Spyware, and Intrusion Prevention Service License.
You need to purchase a SonicWALL Gateway Anti-Virus, Anti-Spyware, and Intrusion Prevention
Service license from a SonicWALL reseller or through your mysonicwall.com account (limited to
customers in the USA and Canada). After purchasing the license, you are provided with an
Activation Key. You use this Activation Key to activate the service on your SonicWALL security
appliance.
Tip: If your SonicWALL security appliance is connected to the Internet and registered at
mysonicwall.com, you can activate a 30-day FREE TRIAL of SonicWALL Gateway Anti-Virus,
SonicWALl Anti-Virus, and SonicWALL Intrusion Prevention Service separately from the Security
Services > Gateway Anti-Virus, Security Services > Anti-Spyware, and Security Services >
Intrusion Prevention pages in the management interface.
Tip: Services > Gateway Anti-Virus, Security Services > Anti-Spyware, and Security Services >
Intrusion Prevention pages in the management interface.

Creating a mysonicwall.com Account
To create a mysonicwall.com account:
Note: If you already have a mysonicwall.com account, go to “Registering Your SonicWALL Security
Appliance” on page 334.
1 Log into the SonicWALL security appliance management interface.
2 If the System > Status page is not displayed in the management interface, click System in the
left-navigation menu, and then click Status.
3 On the System > Status page, in the Security Services section, click the Register link in Your
SonicWALL is not registered. Click here to Register your SonicWALL.

4 In the mysonicwall.com Login page, click the here link in If you do not have a mysonicwall
account, please click here to create one.

5 In the MySonicWall Account page, enter in your information in the Account Information,
Personal Information and Preferences fields. All fields marked with an asterisk (*) are required
fields.
Note: Remember your username and password to access your mysonicwall.com account.
6 Click Submit after completing the MySonicWALL Account form.



7 When the mysonicwall.com server has finished processing your account, you will see a page
saying that your account has been created. Click Continue.

Congratulations. Your mysonicwall.com account is activated.

Now you need to log into mysonicwall.com to register your SonicWALL security appliance.

You need to register your SonicWALL security appliance to activate SonicWALL security services. If
your SonicWALL security appliance is not registered, the Security Services section on the System >
Status page displays the message: Your SonicWALL is not registered. Click here to Register
your SonicWALL.

8 Log into the SonicWALL security appliance management interface.
1 If the System > Status page is not displaying in the management interface, click System in the
left-navigation menu, and then click Status.
2 On the System > Status page, in the Security Services section, click the Register link. The
mysonicwall.com Login page is displayed.
fields, then click Submit.
4 The next several pages inform you about the free trials available to you for SonicWALL’s Security
Services:
Gateway Anti-Virus - Delivers real-time virus protection for your entire network.
Network Anti Virus - Provides desktop and server anti-virus protection with software running
on each computer.
Premium Content Filtering Service - Enhances productivity by limiting access to
objectionable Web content.
Intrusion Prevention Service - Protects your network against worms, Trojans, and application
layer attacks.
Anti-Spyware - Protects your network from malicious spyware by blocking spyware
installations at the gateway and disrupts.
Click Continue on each page.
Note: Clicking on the Continue button does not activate the FREE TRIAL versions of these
SonicWALL Security Services. You must activate these free trials from the System Licenses page.
5 At the top of the Product Survey page, Enter a “friendly name” for your SonicWALL content
security appliance in the Friendly Name field. The friendly name allows you to easily identify your
SonicWALL content security appliance in your mysonicwall.com account.
6 Please complete the Product Survey. SonicWALL uses this information to further tailor services to
fit your needs.
7 Click Submit.
8 When the mysonicwall.com server has finished processing your registration, a page is displayed
informing you that the SonicWALL security appliance is registered. Click Continue, and the
System > Licenses page is displayed showing you the available services. You can activate the



service from this page or the specific service page under the Security Services left-navigation
menu in the management interface.

Activating the SonicWALL Gateway Anti-Virus,
Anti-Spyware, and Intrusion Prevention Service License
Since SonicWALL Anti-Spyware is part of SonicWALL Gateway Anti-Virus, Anti-Spyware, and
Intrusion Prevention Service. The Activation Key you receive is for all three services on your
Alert: After activating your SonicWALL Anti-Spyware license, you must enable and configure
SonicWALL Anti-Spyware on the SonicWALL management interface before anti-spyware policies are
applied to your network traffic.

If you do not have a SonicWALL Gateway Anti-Virus, Anti-Spyware, and Intrusion Prevention Service.
license activated on your SonicWALL security appliance, you must purchase it from a SonicWALL
reseller or through your mysonicwall.com account (limited to customers in the USA and Canada).

If you have an Activation Key for SonicWALL Gateway Anti-Virus, Anti-Spyware, and Intrusion
Prevention Service, perform these steps to activate the combined services:
1 On the Security Services > Intrusion Prevention page, click the SonicWALL Intrusion
Prevention Service Subscription link. The mysonicwall.com Login page is displayed.
fields, then click Submit. If your SonicWALL security appliance is already registered to your
mysonicwall.com account, the System > Licenses page appears.

4 Type in the Activation Key in the New License Key field and click Submit. SonicWALL Intrusion
Prevention Service is activated. The System > Licenses page is displayed with the Anti-Spyware



and Gateway Anti-Virus links displayed at the bottom of the Manage Services Online table with
the child Activation Keys.

5 Click on the Gateway Anti-Virus link. The child Activation Key is automatically entered in the New
License Key field. The child Activation Key is a different key than the parent key for the
SonicWALL Gateway Anti-Virus, Anti-Spyware, and Intrusion Prevention Service.
6 Click Submit. If you have activated a FREE TRIAL version or are renewing a license, the renew
screen is displayed that shows the expiration date of the current license and the expiration date of
the updated license. Click Renew.

7 Click on the SonicWALL Gateway Anti-Virus link. The child Activation Key is automatically entered
in the New License Key field. The child Activation Key is a different key than the parent key for the
SonicWALL Gateway Anti-Virus, Anti-Spyware, and Intrusion Prevention Service.
8 Click Submit. If you have activated a FREE TRIAL version or are renewing a license, the renew
screen is displayed that shows the expiration date of the current license and the expiration date of
the updated license. Click Renew.

Congratulations! You have activated the SonicWALL Gateway Anti-Virus, Anti-Spyware, and
Intrusion Prevention Service.

If you activate the SonicWALL Gateway Anti-Virus, Anti-Spyware, and Intrusion Prevention Service
subscription on mysonicwall.com, the activation is automatically enabled on your SonicWALL security
appliance within 24-hours or you can click the Synchronize button on the
Security Services > Summary page to immediately update your SonicWALL security appliance.


Setting Up SonicWALL Anti-Spyware Protection

Activating FREE TRIALs
You can try FREE TRIAL versions of SonicWALL Gateway Anti-Virus, SonicWALL Anti-Spyware, and
SonicWALL Intrusion Prevention Service. You must activate each service separately from the
Manage Services Online table on the System > Licenses page or by clicking the FREE TRIAL link on
the respective Security Services page (for example Security Services > Gateway Anti-Virus).

To try a FREE TRIAL of SonicWALL Gateway Anti-Virus, SonicWALL Anti-Spyware, or SonicWALL
Intrusion Prevention Service, perform these steps:
1 Click the FREE TRIAL link on the Security Services > Gateway Anti-Virus,
Security Services > Anti-Spyware, or Security Services > Intrusion Prevention page. The
mysonicwall.com Login page is displayed.
fields, then click Submit. If your SonicWALL security appliance is already connected to your
mysonicwall.com account, the System > Licenses page appears after you click the FREE TRIAL
link.
3 Click Try in the FREE TRIAL column in the Manage Services Online table. The service is
enabled on your security appliance.

Setting Up SonicWALL Anti-Spyware
Protection
Activating the SonicWALL Anti-Spyware license on your SonicWALL security appliance does not
automatically enable the protection. To configure SonicWALL Anti-Spyware to begin protecting your
network, you need to perform the following steps:
4 Enable SonicWALL Anti-Spyware
1 Specify Spyware Danger Level Protection
Note: For complete instructions on setting up SonicWALL Anti-Spyware Service, refer to the
SonicWALL Anti-Spyware Service Administrator’s Guide available on the SonicWALL Web site

Once you configured these basic anti-spyware protection settings, you can perform additional
configuration options to tailor SonicWALL Spyware protection for your network environment.

Selecting Security Services > Anti-Spyware displays the configuration settings for SonicWALL
Anti-Spyware on your SonicWALL security appliance. The Anti-Spyware page is divided into three
sections:
• Anti-Spyware Status - displays status information on the state of the signature database, your
SonicWALL Anti-Spyware license, and other information.

• Anti-Spyware Global Settings - provides the key settings for enabling SonicWALL Anti-Spyware
on your SonicWALL security appliance, specifying global SonicWALL Anti-Spyware protection
based on three classes of spyware, and other configuration options.



• Anti-Spyware Policies - allows you to view SonicWALL Anti-Spyware signatures and configure
the handling of signatures by category groups or on a signature by signature basis. Categories are
signatures grouped together based on the type of attack.
Alert: After activating your SonicWALL Anti-Spyware license, you must enable and configure
SonicWALL Anti-Spyware on the SonicWALL management interface to before anti-spyware policies
are applied to your network traffic.

Enabling SonicWALL Anti-Spyware
SonicWALL Anti-Spyware must be globally enabled on your SonicWALL security appliance. Select
the the Enable Anti-Spyware check box (a checkmark is displayed), and then click Apply.

Checking the Enable Anti-Spyware check box does not automatically start SonicWALL
Anti-Spyware protection. You must also specify a Prevent All action in the Signature Groups table
to activate anti-spyware on the SonicWALL security appliance, and then specify the interfaces you
want to protect by checking the boxes for WAN, LAN, OPT, or WLAN. You can also select Detect All
for spyware event logging and alerting.

Specifying Spyware Danger Level Protection
SonicWALL Anti-Spyware allows you to globally manage your network protection against attacks by
simply selecting the class of attacks: High Danger Level Spyware, Medium Danger Level Spyware
and Low Danger Level Spyware.

Selecting the Prevent All and Detect All check boxes for High Danger Level Spyware and Medium
Danger Level Spyware in the Signature Groups table, and then clicking Apply protects your
network against the most dangerous spyware.
Alert: SonicWALL recommends enabling Prevent All for High Danger Level Spyware and Medium
Danger Level Spyware signature groups to provide anti-spyware protection against the most
damaging and disruptive spyware applications. You can also enable Detect All for spyware logging
and alerting.

SonicWALL Anti-Spyware also allows you to configure anti-spyware policies at the category and
signature level to provide flexible granularity for tailoring SonicWALL Anti-Spyware protection based
on your network environment requirements. If you’re running SonicOS Enhanced, you can apply
these custom SonicWALL Anti-Spyware policies to Address Objects, Address Groups, and User
Groups, as well as create enforcement schedules.


Setting Up SonicWALL Anti-Spyware Protection

For more information, refer to the SonicWALL Anti-Spyware Administrator’s Guide available on the
SonicWALL Web site: <http://www.sonicwall.com/support/documentation>


PART

10
Log
Part 10


SonicOS Log Event Messages Overview

C H A P T E R

45
Chapter 45: Viewing Log Events

SonicOS Log Event Messages Overview
During the operation of a SonicWALL security appliance, SonicOS software sends log event
messages to the console. Event logging automatically begins when the SonicWALL security
appliance is powered on and configured. SonicOS supports a traffic log containing entries with
multiple fields.

Log event messages provide operational informational and debugging information to help you
diagnose problems with communication lines, internal hardware, or your firmware configuration.
Note: Not all log event messages indicate operational issues with your SonicWALL security
appliance.

The Log > View console display provides log event messages including the following fields for alert
notification:
• Time—Displays the hour and minute the event occurred.
• Priority—Displays the level urgency for the event.
• Category—Displays the event type.
• Message—Displays a description of the event.
• Source—Displays the source IP address of incoming IP packet.
• Destination—Displays the destination IP address of incoming IP packet.
• Note—Displays displays additional information specific to a particular event occurrence.
• Rule—Displays the source and destination interfaces for the access rule. This field provides a link
to the access rule defined in the Firewall > Access Rules page.

The display fields for a log event message provides you with data to verify your configurations,
trouble-shoot your security appliance, and track IP traffic.


CHAPTER 45: Viewing Log Events

Log > View

The SonicWALL security appliance maintains an Event log which displays potential security threats.
This log can be viewed with a browser using the SonicWALL Web management interface, or it can be
automatically sent to an e-mail address for convenience and archiving. The log is displayed in a table
and can be sorted by column.

The SonicWALL security appliance can alert you to important events, such as an attack to the
SonicWALL security appliance. Alerts are immediately e-mailed, either to an e-mail address or to an
e-mail pager. Each log entry contains the date and time of the event and a brief message describing
the event.

Click Log on the left side of the browser window. The default view is Log > View.

The SonicWALL security appliance provides logging, alerting, and reporting features, which can be
viewed in the Log section of the SonicWALL Web management interface.
Note: For a complete description of log messages, see the SonicWALL Log Event Reference Guide
available at the SonicWALL documentation Web site http://www.sonicwall.com/us/Support.html

Navigating and Sorting Log View Table Entries
The Log View table provides easy pagination for viewing large numbers of log events. You can
navigate these log events by using the navigation control bar located at the top right of the Log View
table. Navigation control bar includes four buttons. The far left button displays the first page of the
table. The far right button displays the last page. The inside left and right arrow buttons moved the
previous or next page respectively.

page.



Log > View

SonicOS Log Entries
Each log entry contains the date and time of the event and a brief message describing the event. It is
also possible to copy the log entries from the management interface and paste into a report. The
SonicWALL security appliance manages log events in the following manner:
• Dropped TCP, UDP, or ICMP packets
When IP packets are blocked by the SonicWALL security appliance, dropped TCP, UDP and
ICMP messages are displayed. The messages include the source and destination IP addresses of
the packet. The TCP or UDP port number or the ICMP code follows the IP address. Log messages
usually include the name of the service in quotation marks.
• Blocked Web Sites
When a computer attempts to connect to the blocked site or newsgroup, a log event is displayed.
The computer’s IP address, Ethernet address, the name of the blocked Web site, and the Content
Filter List Code is displayed. Code definitions for the 12 Content Filter List categories are
displayed in the table below:

1. Violence/Hate/Racism 5. Weapons 9. Illegal Skills/Questionable Skills

2. Intimate Apparel/ 6. Adult/Mature Content 10. Sex Education
Swimsuit

3. Nudism 7. Cult/Occult 11. Gambling

4. Pornography 8. Drugs/Illegal Drugs 12. Alcohol/Tobacco

• Blocked Java, etc.
When ActiveX, Java or Web cookies are blocked, messages with the source and destination IP
addresses of the connection attempt is displayed.
• Ping of Death, IP Spoof, and SYN Flood Attacks
The IP address of the machine under attack and the source of the attack is displayed. In most
attacks, the source address shown is fake and does not reflect the real source of the attack.
Tip: Some network conditions can produce network traffic that appears to be an attack, even if no one
is deliberately attacking the LAN. Verify the log messages with SonicWALL Tech Support before
contacting your ISP to determine the source of the attack.

Refresh
To update log messages, clicking the Refresh button.

Clear Log
Clicking Clear Log deletes the contents of the log.

E-mail Log
If you have configured the SonicWALL security appliance to e-mail log files, clicking E-mail Log
sends the current log files to the e-mail address specified in the Log > Automation > E-mail section.


CHAPTER 45: Viewing Log Events


Log > Categories

C H A P T E R

46
Chapter 46: Specifying Log Categories

Log > Categories

You can define which log messages appear in the SonicWALL security appliance Event Log.

Log Categories
All Log Categories are enabled by default except Network Debug.
• Log all Categories - Select Log all Categories to begin logging all event categories.
• System Maintenance - Logs general system activity, such as system activations.
• System Errors - Logs problems with DNS, or e-mail.
• Blocked Web Sites - Logs Web sites or newsgroups blocked by the Content Filter List or by
customized filtering.
• Blocked Java, etc. - Logs Java, ActiveX, and Cookies blocked by the SonicWALL security
appliance.
• User Activity - Logs successful and unsuccessful log in attempts.
• VPN TCP Stats - Logs TCP connections over VPN tunnels.
• Attacks - Logs messages showing Denial of Service attacks, such as SYN Flood, Ping of Death,
and IP spoofing.


CHAPTER 46: Specifying Log Categories

• Dropped TCP - Logs blocked incoming TCP connections.
• Dropped UDP - Logs blocked incoming UDP packets.
• Dropped ICMP - Logs blocked incoming ICMP packets.
• Network Debug - Logs NetBIOS broadcasts, ARP resolution problems, and NAT resolution
problems. Also, detailed messages for VPN connections are displayed to assist the network
administrator with troubleshooting problems with active VPN tunnels. Network Debug information
is intended for experienced network administrators.
• Denied LAN IP - Logs all LAN IP addresses denied by the SonicWALL security appliance.

Alerts & SNMP Traps
Alerts are events, such as attacks, which warrant immediate attention. When events generate alerts,
messages are immediately sent to the e-mail address defined in the Send alerts to field. Attacks and
System Errors are enabled by default, Blocked Web Sites and VPN Tunnel Status are disabled.
• Alert all Categories - Select Alert all Categories to begin logging of all alert categories.
• Attacks - Log entries categorized as Attacks generate alert messages.
• System Errors - Log entries categorized as System Errors generate alert messages.
• Blocked Web Sites - Log entries categorized as Blocked Web Sites generate alert messages.
• VPN Tunnel Status - Log entries categorized as VPN Tunnel Status generate alert messages.

Once you have configured the Log Categories window, click Apply. Once the SonicWALL security
appliance is updated, a message confirming the update is displayed at the bottom of the browser
window.


Log > Automation

C H A P T E R

47
Chapter 47: Configuring Log Automation

Log > Automation
Click Log, and then Automation to begin configuring the SonicWALL security appliance to send log
files using e-mail and configuring syslog servers on your network.


CHAPTER 47: Configuring Log Automation

E-mail
• Mail Server - To e-mail log or alert messages, enter the name or IP address of your mail server in
the Mail Server field. If this field is left blank, log and alert messages are not
e-mailed.
• Send Log To - Enter your full e-mail address in the Send log to field to receive the event log over
e-mail. Once sent, the log is cleared from the SonicWALL security appliance memory. If this field is
left blank, the log is not e-mailed.
• Send Alerts To - Enter your full e-mail address (username@mydomain.com) in the Send alerts
to field to be immediately e-mailed when attacks or system errors occur. Enter a standard e-mail
address or an e-mail paging service. If this field is left blank, e-mail alert messages are not sent.
• Send Log / Every / At - The Send Log menu determines the frequency of log e-mail messages:
Daily, Weekly, or When Full. If the Weekly or Daily option is selected, then select the day of the
week the e-mail is sent in the Every menu. If the Weekly or the Daily option is selected, enter the
time of day when the e-mail is sent in the At field.

Syslog Servers

In addition to the standard event log, the SonicWALL security appliance can send a detailed log to an
external Syslog server. The SonicWALL security appliance Syslog captures all log activity and
includes every connection source and destination IP address, IP service, and number of bytes
transferred. The SonicWALL security appliance Syslog support requires an external server running a
Syslog daemon on UDP Port 514.

Syslog Analyzers such as SonicWALL ViewPoint or WebTrends Firewall Suite can be used to sort,
analyze, and graph the Syslog data.

To add syslog servers to the SonicWALL security appliance, click Add. The Add Syslog Server
1 Enter the Syslog server name or IP address in the Name or IP Address field. Messages from the
SonicWALL security appliance are then sent to the servers. Up to three Syslog Server IP
addresses can be added.
2 If your syslog is not using the default port of 514, enter the port number in the Port Number field.
3 Click OK.

If the SonicWALL security appliance is managed by SGMS, however, the Syslog Server fields
cannot be configured by the administrator of the SonicWALL security appliance.


Log > Automation

Syslog Event Redundancy Filter (seconds) - The Syslog Event Redundancy Filter setting
prevents repetitive messages from being written to Syslog. If duplicate events occur during the period
specified in the Syslog Event Redundancy Rate field, they are not written to Syslog as unique
events. Instead, the additional events are counted, and then at the end of the period, a message is
written to the Syslog that includes the number of times the event occurred.

The Syslog Event Redundancy Rate default value is 60 seconds and the maximum value is 86,400
seconds (24 hours). Setting this value to 0 seconds sends all Syslog messages without filtering.

Syslog Format - You can choose the format of the Syslog to be Default or WebTrends. If you select
WebTrends, however, you must have WebTrends software installed on your system.

Enable ViewPoint Settings - Check this box to override Syslog settings, if you’re using SonicWALL
ViewPoint for your reporting solution.


CHAPTER 47: Configuring Log Automation


Log > Name Resolution

C H A P T E R

48
Chapter 48: Configuring Name Resolution

Log > Name Resolution
The Log > Name Resolution page includes settings for configuring the name servers used to resolve
IP addresses and server names in the log reports.

The security appliance uses a DNS server or NetBIOS to resolve all IP addresses in log reports into
server names. It stores the names/address pairs in a cache, to assist with future lookups. You can
clear the cache by clicking Reset Name Cache in the top of the Log > Name Resolution page.


CHAPTER 48: Configuring Name Resolution

Selecting Name Resolution Settings
The security appliance can use DNS, NetBios, or both to resolve IP addresses and server names.

In the Name Resolution Method list, select:
• None: The security appliance will not attempt to resolve IP addresses and Names in the log
reports.
• DNS: The security appliance will use the DNS server you specify to resolve addresses and names.

• NetBios: The security appliance will use NetBios to resolve addresses and names. If you select
NetBios, no further configuration is necessary.
• DNS then NetBios: The security appliance will first use the DNS server you specify to resolve
addresses and names. If it cannot resolve the name, it will try again with NetBios.

Specifying the DNS Server
You can choose to specify DNS servers, or to use the same servers as the WAN zone.
1 Select Specify DNS Servers Manually or Inherit DNS Settings Dynamically from WAN Zone.
The second choice is selected by default.
2 If you selected to specify a DNS server, enter the IP address for at least one DNS server on your
network. You can enter up to three servers.
3 Click Apply in the top right corner of the Log > Name Resolution page to make your changes
take effect.


Log > Reports

C H A P T E R

49
Chapter 49: Generating and Viewing
Log Reports

Log > Reports

The SonicWALL security appliance can perform a rolling analysis of the event log to show the top 25
most frequently accessed Web sites, the top 25 users of bandwidth by IP address, and the top 25
services consuming the most bandwidth. Click Log on the left side of the browser window, and then
click the Reports.

Data Collection
The Reports page includes the following functions and commands:
• Start Data Collection - Click Start Data Collection to begin log analysis. When log analysis is
enabled, the button label changes to Stop Data Collection.
• Reset Data - Click Reset Data to clear the report statistics and begin a new sample period. The
sample period is also reset when data collection is stopped or started, and when the SonicWALL
security appliance is restarted.


CHAPTER 49: Generating and Viewing Log Reports

View Data
Select the desired report from the Report to view menu. The options are Web Site Hits, Bandwidth
Usage by IP Address, and Bandwidth Usage by Service. These reports are explained below. Click
Refresh Data to update the report. The length of time analyzed by the report is displayed in the
Current Sample Period.

Web Site Hits
Selecting Web Site Hits from the Report to view menu displays a table showing the URLs for the 25
most frequently accessed Web sites and the number of hits to a site during the current sample period.

The Web Site Hits report ensures that the majority of Web access is to appropriate Web sites. If
leisure, sports, or other inappropriate sites appear in the Web Site Hits Report, you can choose to
block the sites.

Bandwidth Usage by IP Address
Selecting Bandwidth Usage by IP Address from the Report to view menu displays a table showing
the IP Address of the 25 top users of Internet bandwidth and the number of megabytes transmitted
during the current sample period.

Bandwidth Usage by Service
Selecting Bandwidth Usage by Service from the Report to view menu displays a table showing the
name of the 25 top Internet services, such as HTTP, FTP, and RealAudio, and the number of
megabytes received from the service during the current sample period.

The Bandwidth Usage by Service report shows whether the services being used are appropriate for
your organization. If services such as video or push broadcasts are consuming a large portion of the
available bandwidth, you can choose to block these services.

Log > ViewPoint


Log > ViewPoint

SonicWALL ViewPoint
SonicWALL ViewPoint is a software solution that creates dynamic, Web-based reports of network
activity. ViewPoint generates both real-time and historical reports to provide a complete view of all
activity through your SonicWALL security appliance. With SonicWALL ViewPoint, you are able to
monitor network access, enhance network security and anticipate future bandwidth needs.
• Displays bandwidth use by IP address and service.
• Identifies inappropriate Web use.
• Presents detailed reports of attacks.
• Collects and aggregates system and network errors.
Note: For complete instructions on configuring and managing SonicWALL ViewPoint, see the
SonicWALL ViewPoint User’s Guide, available on the SonicWALl security appliance Resource CD or
at <http://www.sonicwall.com/support/ViewPoint_documentation.html>.


CHAPTER 49: Generating and Viewing Log Reports


SonicWALL SafeMode

A P P E N D I X

Resetting the SonicWALL Security
Appendix AW
A
Appliance Using SafeMode
SonicWALL SafeMode
If you are unable to connect to the SonicWALL security appliance’s management interface, you can
restart the SonicWALL security appliance in SafeMode. The SonicWALL security appliance security
appliance’s SafeMode is a simplified management interface that enables you to:
• Make a backup copy of your current settings
• Reboot the security appliance with your current settings
• Reboot the security appliance with factory default settings
• Reboot the security appliance with settings from your backup
• Upgrade SonicOS Firmware

To reset the SonicWALL security appliance, perform the following steps:
1 Connect your management station to a LAN port on the SonicWALL security appliance and
configure you management station IP address to 192.168.168.20.
2 Use a narrow, straight object, like a straightened paper clip or a toothpick, to press and hold the
reset button on the back of the security appliance for more than twenty seconds. The reset button
is in a small hole next to the console port or next to the power supply:

Reset button
Secure Anti-Virus Router 80 and 80 Wireless

3 The Test light starts blinking when the security appliance has rebooted into SafeMode.
Note: Holding the reset button for two seconds will take a diagnostic snapshot to the console. Holding
the reset button for six to eight seconds will reboot the appliance in regular mode.


APPENDIX A: Resetting the SonicWALL Security Appliance Using SafeMode

4 Connect to the management interface: Point the Web browser on your Management Station to
192.168.168.168. The SafeMode management interface displays:

5 If you have made any configuration changes to the security appliance, make a backup copy of
your current settings. Click Create Backup Settings.
6 First try rebooting the security appliance with your current settings. Click the boot icon in the
same line with Current Firmware.
7 After the SonicWALL security appliance has rebooted, try to open the management interface
again.
8 If you still cannot open the management interface, use the reset button to restart the appliance in
SafeMode again.
9 In SafeMode, restart the firmware with the factory default settings. Click the boot icon in the
same line with Current Firmware with Factory Default Settings.
10 After the SonicWALL security appliance has rebooted, try to open the management interface
again.
11 If you are able to connect, you can recreate your configuration or try to reboot with the backup
settings: Restart the security appliance in SafeMode again, and click the boot icon in the same
line with Current Firmware with Backup Settings.


Upgrading SonicOS Firmware

Upgrading SonicOS Firmware
In SafeMode, you can upload newer versions of the SonicOS firmware to your SonicWALL security
appliance.
1 Connect to <http://www.mysonicwall.com>. If you have already registered your security appliance,
you should be automatically notified of any upgrades available for your model.
2 Copy the new firmware to a directory on your management station.
3 If the SonicWALL security appliance is not already in safe mode, press and hold the reset button
to restart the security appliance in SafeMode.
4 At the bottom of the page, click Upload New Firmware.

5 In the Upload Firmware page, click Browse to locate and select the new firmware file.
6 Click Upload.
7 The list under Firmware Management now shows the current firmware and the newly uploaded
firmware with your current settings, factory default settings, and backup settings.

You can boot the security appliance from whichever one you want. Click the boot icon in the
same line with the firmware and settings you want to apply to the security appliance.


APPENDIX A: Resetting the SonicWALL Security Appliance Using SafeMode


Index

Chapter B: Index D
DAT, see dynamic address translation
DHCP server 121
configuring dynamic ranges 122
current DHCP leases 124
lease scopes 122
settings 121
static entries 123
Numerics
diagnostics 75
802.11b 133
active connections monitor 77
802.11g 133
CPU monitor 78
A DNS name lookup 79
access point status 141 find network path 79
access rules packet trace 79
bandwidth management 190 ping 81
configuration examples 196 process monitor 81
general rule wizard 192 reverse name resolution 81
overview 189 tech support report 76
public server rule wizard 191 trace route 82
restoring defaults 191 discards 142
rule wizard 191 bad WEP key 142
accounts DTIM interval 160
wireless guest services 181 dynamic address translation 174
activating the license dynamic DNS 125
procedures overview 326 configuring 126
registering the SonicWALL security appliance providers 125
328
E
SonicOS requirements 326
easy ACL 136
administration 63
exclusion list
changing the default size of tables 65
configuring 312
firewall name 64
login security 64 F
name and password 64 FCS errors 142
SNMP 66 file transfers
SonicWALL Global Management System 67 restrict 310
web management settings 65 firewall
ARP 115 advanced settings 199
ARP cache table 119 dynamic ports 200
flushing ARP cache 119 force FTP data connections port 20 200
associated stations 141 NetBIOS pass through 199
randomize IP ID 200
B
services 201
beaconing 159
source routed packets 200
bypass guest authentication 174
stealth mode 200
C TCP checksum 200
CFS Exclusion List 293 TCP inactivity timeout 200
channel 141, 147 user defined services 201
client alerts, configuring 311 VoIP 203
configuration wizard 54 firmware management 72
consistent NAT (see NAT) booting firmware 74
custom login page 177 notification 72
SafeMode 73
updating firmware 72
flexible default route 184
fragmentation threshold 160
fragments 142


Index

G M
Gateway Anti-Virus 305 MAC address 141
activating 306 MAC address list 164
application control 306 MAC filter list 136, 163
client alerts 311 MAC filtering 140
Config View window 311 management interface 23
deep packet inspection 306 accessing 29
exclusion list 312 applying changes 24
features 306 common icons 25
file transfers, restricting 310 getting help 26
free trial version 307 logging out 26
inbound inspection 310 navigating 23
intrusion prevention 306 navigating tables 25
outbound SMTP inspection 310 status bar 24
protocol filtering 309 submenus 24
signatures 306 maximum concurrent guests 178
signatures table 313 MCUs 205
SMTP messages, suppressing 311 multicast frames 142
guest account profiles 178 multiple retry frames 142
guest accounts 181 N
guest profiles 178 NAT
guest services 171, 173, 181 consistent
guest profile 178 network
H DHCP server 121
H.323 205 intranet 105
transforming H.323 messages 211 routing 107
I static routes 108
IEEE 802.11b 133 network settings
IEEE 802.11g 133 DNS 87
inbound and outbound traffic protection 326 interfaces 85
inspection interfaces table 86
inbound, enabling 310 LAN properties 94
outbound SMTP 310 NAT with DHCP client 90
interclient communications 160 NAT with L2TP client 91
intrusion prevention service NAT with PPPoE client 91
deep packet inspection 325 NAT with PPTP client 92
IP address deny list 176 transparent mode 88
ISP information for setup 27 wlan properties 96
L node licensing
LAN interface currently licensed 58
configuring 94 exclusion list 58
Ethernet settings 95 status 57
multiple subnets 94 O
log one-to-one NAT 99
alerts 342 example 100
categories 341 open system 154
configuring e-mail alerts 344 P
e-mail log files 339 post authentication redirect 177
messages 339 preamble length 160
name resolution 347 protocol filtering 309
reports 349 R
SNMP traps 342 registration and license wizard 47
SonicWALL ViewPoint 351 resetting the CSM 2100 CF 353
syslog servers 344 restart SonicWALL security appliance 82
viewing log events 338

Index
restore default settings 161 SonicWALl Anti-Spyware
retry limit exceeded 142 spyware threats 321
routing SonicWALL Gateway Anti-Virus 305
configuring static routes 108 SonicWALL Gateway Anti-Virus, Anti-Virus and In-
route advertisement 95, 109, 111 trusion Prevention Service 322
route advertisement configuration 95, 109, 111 SSID 141
static route example 108 SSID controls 159
table 110, 112 status 53
wireless guest services 185 latest alerts 55
RTS threshold 160 security services 55
S system information 54
safemode 353 system messages 54
SDP 211 wireless 140
security services status information
activating a free trial of Intrusion Prevention expiration date 309
Service 318 last checked 309
activating Content Filtering Service 290 overview 308
activating Intrusion Prevention Service 318 signature database 309
activating Network Anti-Virus 302 signature database timestamp 309
blocked message 293 support xviii
free trials 60 system licenses 57
manage services online 60 T
mandatory filtered IP addresses 298 technical support xviii
manual upgrade 60 time and date settings 69
manual upgrade for closed environments 60 transmit power 160
mySonicWALL.com 284 U
restrict web features 292 unicast frame 142
SonicWALL Content Filtering Service 289 unified threat management 322
SonicWALL E-Mail Filter 303 updating signatures 309
SonicWALL Intrusion Prevention Service 315 upgrading firmware 355
SonicWALL Network Anti-Virus 301 URL allow list 175
summary table 59 users
trusted domains 292 acceptable use policy 274
setting up anti-spyware protection active user sessions 272
enabling 332 adding users to SonicWALL database 279
setting up GAV protection authentication 271
applying to interfaces 308 authentication exclusions 273
setup wizard 29 authentication methods 272
DHCP configuration 32 global user settings 273
PPPoE configuration 32 guest profile 178
PPTP configuration 33 RADIUS authentication 275
static IP configuration 30 V
shared key 154 VoIP
signal retry frames 142 call flows 208
signatures table 313 CODECs 207
SIP 206 deployment scenarios 212–215
media 211 H.323 205
signaling 211 incoming calls 208
transforming SIP messages 211 local calls 209
UDP port 211 NAT
SMTP messages, suppressing 311 overview 203–210
SMTP redirect 175 SIP 206
SonicWALL Anti-Spyware third party interoperability 207
protects against 322
use with other anti-spyware programs 322


Index
VPN WEP encryption 140
3rd party certificates 263 WGS, see wireless guest services
active VPN tunnels 223 WiFiSec 133, 141
advanced settings 249 WiFiSec enforcement 136, 146
fragmented packet handling 249 WiFiSec Protected Access 156
IKE dead peer detection 250 EAP 156, 157
keep alive 250 PSK 155, 157
NAT traversal 249 wireless access point 184
NetBIOS broadcasts 249 wireless client communications 140
certificate authority certificates 267 wireless encryption
configuring bandwidth management 251 authentication type 154
configuring site-to-site VPN connections 233 Extensibe Authentication Protocol 139, 155
configuring SonicWALL GroupVPN 223 extensible authentication protocol 156, 157
creating a IKE with 3rd party certificates site-to- pre-shared key 138, 155, 156
site policy 239 WEP key 154
creating a manual key site-to-site policy 238 WPA encyrption 155
creating an IKE using preshared secret site-to- wireless firmware 141
site policy 236 wireless guest services 141, 171, 181
creating site-to-site policies using the VPN Pol- access point 184
icy window 240 account profiles 178
DHCP over VPN 253 accounts 181
central gateway 254 custom login page 177
remote gateway 254 dynamic address translation 174
exporting a GroupVPN policy 233 flexible default route 184
L2TP server 259 in wireless chapter 135
local certificates 264 IP address deny list 176
site-to-site VPN planning sheet 234 maximum concurrent guests 178
SonicWALL Global Security Client 221 post authentication redirect 177
SonicWALL Global VPN Client 221 settings 173
user authentication settings 250 SMTP redirect 175
VPN policy wizard 235 url allow list 175
X.509 v3 certificate support 263 virtual adapter 184
W wireless node count 136
WAN interface 87 wireless status 140
Ethernet settings 92 wireless wizard 137
NAT enabled 88 wizard
NAT with DHCP client 88 registration and license 47
NAT with L2TP client 88 wizards
NAT with PPPoE 88 wireless wizard 137
NAT with PPTP client 88 WLAN 141
transparent mode 88 IP address 141
web proxy 103 settings 141
bypass on server failure 104 statistics 142
configuring 103 subnet mask 141


:


SonicWALL, Inc.
1143 Borregas Avenue T +1 408.745.9600
Sunnyvale CA 94089-1306 F +1 408.745.9300 www.sonicwall.com

PN: 232-001422-00
Rev A 03/08
©2008 SonicWALL, Inc. is a registered trademark of SonicWALL, Inc. Other product names mentioned herein may be trademarks and/or registered trademarks of their respective companies.
Specifications and descriptions subject to change without notice.

Sonic os standard_3_9_administrators_guide

More Related Content

What's hot (19)

Similar to Sonic os standard_3_9_administrators_guide (20)

Recently uploaded (20)

Sonic os standard_3_9_administrators_guide