SonicWALL INTERNET SECURITY APPLIANCE User Manual

Download

SONICWALL

Internet Security Appliances

Contents

About this Guide ......... ......................... ... ......................... .............. 7

SonicWALL Technical Support ......................................................... 8

1 Introduction

Your SonicWALL Internet Security Appliance ................................... 9

SonicWALL Internet Security Appliance Functional Diagram .............10

SonicWALL Internet Security Appliance Features .............................11

2 SonicWALL Installation

Inspecting the Package .................................................................15

Overview .....................................................................................15

Connecting the SonicWALL to the Network ..................... ................16

Performing the Initial Configuration ...............................................18

3 Managing Your SonicWALL

Status .............. .......... .............. .............. ........... .............. ........... .. 29

CLI Support and Remote Management ...........................................30

4 General and Network Settings

Network .............. ........... .......... ....... ........... ........... .......... ....... ......32

Network Settings ..........................................................................33

Standard Configuration .................................................................35

NAT with DHCP Client Configuration ..............................................37

NAT with PPPoE Configuration .......................................................39

NAT with L2TP Client ......... .... ... ......................... .... .......................41

Setting the Time and Date ............................................................43

Setting the Administrator Password ...............................................44

Setting the Administrator Inactivity Timeout ...................................45

5 Logging and Alerts

View Log .....................................................................................46

SonicWALL Log Messages .............................................................47

Log Settings .................................................................................48

Log Categories .............................................................................50

Alert Categories ............................................................................51

Reports ............ ... .... ........................ .... ......................... ... .............51

6 Content Filtering and Blocking

Categories ...................................................................................53

Time of Day .................................................................................55

List Update .................................. ......................... .......................55

Contents Page 1

Customize .............. ..................... ..................... .................. .......... 57

Keywords ............... ....... ....... ....... .... ....... ....... ....... ... ........ ....... ......59

Consent ................. ................................... ................................... 59

7 Web Management Tools

Restarting the SonicWALL .............................................................63

Preferences ............ ........... ....... .......... ........... ....... ........... .......... ...64

Exporting the Settings File ............................................................65

Importing the Settings File ............................................................66

Restoring Factory Default Settings .................................................67

Upgrade Features .........................................................................70

Diagnostic Tools ...........................................................................71

DNS Name Lookup .......................................................................71

Ping ............................................................................................72

Packet Trace ................................................................................74

Tech Support Report ....................................................................75

8 Network Access Rules

Services ................. ..................... ......................... ........................77

Windows Networking (NetBIOS) Broadcast Pass Through ................78

Detection Prevention .............................. ... ......................... .... ......78

Network Connection Inactivity Timeout ..........................................79

Add Service ................ ........................ .... ......................... .............79

Rules .................. ............................ ........................ ..................... 80

Understanding the Access Rule Hierarch y . ......................... ... ..........86

SonicWALL TELE3 and SOHO3 IP Address Management ..................89

Users .................. ....... .......... ........... .......... ....... ........... ........... ......90

SonicWALL Management ..............................................................92

SonicWALL Remote Management ..................................................93

9 Advanced Features

Proxy Relay ................................. .... ........................ .... .................96

Intranet ................. ................................... ................................... 98

Routes ................ .............. .............. .............. .......... ............... ....100

DMZ Addresses .......... ... .... ........................ .... ......................... ... .101

Delete a DMZ Address Range ........................................... ...........103

One-to-One NAT ........................................................................103

The Ethernet Tab .............. ........................ ......................... .... ....106

10 DHCP Server

Setup ........................................................................................108

Enable DHCP Server ...................................................................109

Page 2 SonicWALL Internet Security Appliance User’s Guide

Deleting Dynamic Ranges and Static Entries .................................110

DHCP Status ..............................................................................110

SonicWALL TELE3 and SOHO3 IP Address Management ................111

11 SonicWALL VPN

VPN Applications ........................................................................113

The VPN Interface ................................................. .....................114

SonicWALL VPN Client for Remote Access and Management ..........115

The Configure Tab ... ........................ .... ......................... ... ...........116

VPN Advanced Settings ...............................................................119

Advanced Settings for VPN Configurations ....................................123

Enabling Group VPN on the SonicWALL ........................................124

Group VPN Client Configuration ................... ......................... ... ....126

Manual Key Configuration for a SonicWALL and VPN Client ............129

Installing the VPN Client Software ................................................131

VPN for Two SonicWALLs ............................................................136

Example of Manual Key Configuration for Two SonicWALLs ...........139

IKE Configuration for Two SonicWALLs ........................................142

Example: Linking Two SonicWALLs using IKE ...............................145

Testing a VPN Tunnel Connection Using PING ..............................149

Configuring Windows Networking ................................................150

Adding, Modifying and Deleting Destination Networks ...................152

RADIUS and XAUTH Authentication ..............................................153

SonicWALL Enhanced VPN Logging ..............................................156

Disabling Security Associations ....................................................157

Basic VPN Terms and Concepts ...................................................158

12 SonicWALL Options and Upgrades

SonicWALL VPN Upgrade ............................................................161

SonicWALL VPN Client for Windows .............................................161

SonicWALL Network Anti-Virus ....................................................162

Content Filter List Subscription ....................................................162

SonicWALL High Availability Upgrade ...........................................162

Vulnerability Scanning Service .....................................................163

SonicWALL Authentication Service ...............................................163

SonicWALL ViewPoint Reporting ..................................................163

SonicWALL Per Incident Support ..................................................164

SonicWALL Premium Support ......................................................164

SonicWALL Extended Warranty ....................................................164

SonicWALL Global Management System .......................................164

Contents Page 3

13 Hardware Description

SonicWALL PRO 200 and PRO 300 Fron t Pan el .............................165

SonicWALL PRO 200 and PRO 300 Ba ck Pane l ............... ...............166

SonicWALL PRO 100 Front Panel ............................................. ... .167

SonicWALL PRO 100 Front Panel Description ................................167

SonicWALL PRO 100 Back Panel .......... ......................... ...............168

The SonicWALL PRO 100 Back Panel Descript ion .................. .... ... .168

SonicWALL SOHO3 and TELE3 Front Panel ...................................169

SonicWALL SOHO3 and SonicWALL TELE3 Front Panel Description .169

SonicWALL SOHO3 and TELE3 Back Panel ....................................170

The SonicWALL SOHO3 and TELE3 Back Panel Description ............170

14 Troubleshooting Guide

The Link LED is off. ....................................................................172

A computer on the LAN cannot access the Internet. ......................172

The SonicWALL does not establish authenticated sessions. ............172

The SonicWALL does not save changes that you have made. .........173

Duplicate IP address errors .........................................................173

Machines on the WAN are not reachable. .................. .... ...............173

15 Appendices

Appendix A - Technical Specifications ...........................................174

Appendix B - Introduction to Networking ................ ......................178

Overview ................................................................................... 178

Network Hardware Components ..................................................178

Network Types ...........................................................................178

Firewalls .................................................................................... 178

Gateways ............ ........................ .... ........................ .... ...............179

Network Protocols ......................................................................179

IP Addressing .............................................................................180

Appendix C - IP Port Numbers .....................................................183

Appendix D - Configuring TCP/IP Settings ................................ ... .184

Appendix E - Erasing the Firmware ..............................................186

Appendix F - Securing the SonicWALL .................................. ........188

Mounting the SonicWALL PRO 200 and SonicWALL PRO 300 ..........188

Appendix G - Electromagnetic Compatibility ..................................189

SonicWALL PRO 200 and SonicWALL PRO 300 ..............................189

SonicWALL PRO 100, SonicWALL SOHO3 an d SonicWALL TELE3 ....190

Notes ........................................................................................192

Page 4 SonicWALL Internet Security Appliance User’s Guide

Under the copyright laws, this manual or the software described within, can not be copied, in whole or part, without the written consent of the manufacturer, except in the normal use of the software to make a backup copy. The same proprietary and copyright notices must be affixed to any permitted copies as were affixed to the original. This exception does not allow copies to be made for others, whether or not sold, but all of the material purchased (with all backup copies) can be sold, given, or loan ed to another person. Under the law, copying includes translating into another language or format.

SonicWALL is a registered trademark of SonicWALL, Inc. Other product and company names mentioned herein can be trademarks and/or registered

trademarks of their respective companies. Specifications and descriptions subject to change without notice.

LIMITED WARRANTY

SonicWALL, Inc. warrants the SonicWALL Internet Security Appliance (the Product) for one (1) year from the date of purchase against defects in materials and workmanship. If there is a defect in the hardware, SonicWALL will replace the product at no charge, provided that it is returned to SonicWALL with transportation charges prepaid. A Return Materials Authorization (RMA) number must be displayed on the outside of the package for the product being returned for replacement or the product will be refused. The RMA number can be obtained by calling SonicWALL Customer Service between the hours of 8:30 AM and 5:30 PM Pacific Standard Time, Monday through Friday.

Phone:(408) 752-7819 Fax:(408) 745-9300 Web: <http://www.sonicwall.com/support> This warranty does not apply if the Product has been damaged by accident, abuse, misuse,

or misapplication or has been modified without the written permission of SonicWALL. In no event shall SonicWALL , Inc. or its suppliers be liable for any damages whatsoever

(including, without limitation, damages for loss of profits, business interruption, los s of information, or other pecuniary loss) arising out of the use of or inability to use the Product.

Some states do not allow the exclusion or limitation of implied warranties or liability for incidental or consequential damages, so the above limitation or exclusion can not apply to you. Where liability can not be limited under applicable law, the SonicWALL liability shall be limited to the amount you paid for the Product. This warra nty gives you spec ific legal rights, and you can have other rights which vary from state to state.

By using this Product, you agree to these limitations of liability.

Preface Page 5

THIS WARRANTY AND THE REMEDIES SET FORTH ABOVE ARE EXCLUSIVE AND IN LIEU OF ALL OTHER WARRANTIES, ORAL OR WRITTEN, EXPRESS OR IMPLIED.

No dealer, agent, or employee of SonicWALL is authorized to make any extension or addition to this warranty.

Page 6 SonicWALL Internet Security Appliance User’s Guide

About this Guide

Thank you for purchasing the SonicWALL Internet Security Appliance. The SonicWALL protects your Local Area Network (LAN) from attacks and intrusions, filters objectional Web sites, provides private VPN connections to business partners and remote offices, and offers a centrally-managed defense against software viruses.

This guide covers the installation and configuration of the SonicWALL SOHO3, SonicWALL TELE3, SonicWALL PRO 100, SonicWALL PRO 200 and SonicWALL PRO 300. The instructions are the same for every hardware model except where specifically noted.

Organization of This Guide

Chapter 1, Introduction, describes the features and applications of the SonicWALL. Chapter 2, SonicWALL QuickStart Installation, demonstrates how to connect the

SonicWALL to your network and perform the initial configuration. Chapter 3, Managing Your SonicWALL, provides a brief overview of the SonicWALL Web

Management Interface. Chapter 4, Network Set tings, describes the configuration of the SonicWALL IP setting s,

time and password. Chapter 5, Logging and Alerting, illustrates the SonicWALL logging, alerting and

reporting features. Chapter 6, Content Filtering and Blocking, describes SonicWALL Web content filtering,

including subscription updates and customized Web blocking. Chapter 7, Web Management Tools, provides directions to restart the SonicWALL,

import and export settings, upload new firmware, and perform diagnostic tests. Chapter 8, Network Access Rules, explains how to permit and block traffic through the

SonicWALL, set up servers, and enable remote management. Chapter 9, Advanced Features, describes advanced SonicWALL settings, such as One-to-

One NAT, Automatic Web Proxying and DMZ addresses. Chapter 10, DHCP Server, describes the configuration and setup of the SonicWALL DHCP

server. Chapter 11, SonicWALL VPN, explains how to create a VPN tunnel between two

SonicWALLs and from the VPN client to the SonicWALL. Chapter 12, SonicWALL Options and Upgrades, presents a brief summary of the

SonicWALL's subscription services, firmware upgrades and other options. Chapter 13, Hardware Description, illustrates and describes the SonicWALL front and

back panel displays. This chapter is divided into three sections f or the Son icW ALL SOHO3 and SonicWALL TELE3, the SonicWALL PRO 100, and the SonicWALL PRO 200 and SonicWALL PRO 300.

Preface Page 7

Chapter 14, Troubleshooting Guide, shows solutions to commonly encountered problems.

Appendix A, Technical Specifications, lists the SonicW ALL specifications. Appendix B, Introduction t o N etw ork in g, provides an overview of the Internet, TCP/IP

settings, IP security, and other general networking topics. Appendix C, IP Port Number s, offers information about IP port numbering. Appendix D, Configuring TCP/IP Settings, provides instructions for configuring your

Management Station's IP address. Appendix E, Erasing the Firmware, describes the firmware erase procedure. Appendix F, Securing the SonicWALL, details the steps necessary to safely mount the

SonicWALL on a mounting rack. Appendix G, Electromagnetic Compat ibility, presents important emissions standards

approvals and EMC information.

SonicWALL Technical Support

For fast resolution of technical question s, please visit the SonicWALL Tech Support Web site at <http://www.sonicwall.com/support>. There, you will find resources to resolve most technical issues and a Web request form to contact one of the SonicWALL Technical Support engineers.

Page 8 SonicWALL Internet Security Appliance User’s Guide

1 Introduction

Your SonicWALL Inter n et Se cu rit y Ap plian ce

The SonicWALL Internet security appliance provides a complete security solution that protects your network from attacks, intrusions, and malicious tampering. In addition, the SonicWALL filters objectionable Web content and logs security threats. SonicWALL VPN provides secure, encrypted communications to business partners and branch offices. SonicWALL VPN is included with the SonicWALL TELE3, the SonicWALL PRO 200, the SonicWALL PRO 300, and the GX series of appliances. It is also available as an upgrade.

The SonicWALL Internet security appliance uses stateful packet inspection to ensure secure firewall filtering. Stateful packet inspection is widely considered to be the most effective method of filtering IP traffic. MD5 authentication is used to encrypt communications between your Management Station and the SonicWALL Web Management Interface. MD5 Authentication prevents unauthorized users from detecting and stealing the SonicWALL password as it is sent over your network.

The SonicWALL family of Internet security appliances include eight SonicWALL models customized to the requirements of different networks.

SonicWALL Feature Chart

SonicWALL

Model

TELE3 5 Included SOHO3/10 10 Optional SOHO3/50 50 Optional PRO 100 Unlimited Optional Included PRO 200 Unlimited Included Included Optional Optional PRO 300 Unlimited Included Included Included Optional GX 2500 Unlimite d Included Included Included Optional GX 6500 Unlimite d Included Included Included Optional

Nodes VPN DMZ Port

High

Availability

Introduction Page 9

AntiVirus

SonicWALL Internet Security Appliance Functional Diagram

The following figure illustrates the SonicWALLInternet Security Appliance functions.

By default, the SonicWALL allows outbound access from the LAN to the Internet and blocks inbound access from the Internet to the LAN. Users on the Internet are restricted from accessing resources on the LAN unless they are authorized remote u sers or Network Access Rules were created to allow inbound access.

If the SonicWALL includes a DMZ port, users on the LAN and on the Internet have full access to the devices on the DMZ.

Page 10 SonicWALL Internet Security Appliance User’s Guide

SonicWALL Internet Security Appliance Features

Internet Security

• ICSA-Certified Firewall After undergoing a rigorous suite of tests to expose security vulnerabilities, SonicWALL

Internet security appliances have received Firewall Certification from ICSA, the internationally-accepted authority on network security. The SonicWALL uses stateful packet inspection, the most effective method of packet filtering, to protect your LAN from hackers and vandals on the Internet.

• Hacker Attack Prevention The SonicWALL automatically detects and thwarts Denial of Service (DoS) attacks such

as Ping of Death, SYN Flood, LAND Attack, and IP Spoofing.

• Network Address Translation (NAT) Network Address Translation (NAT) translates the IP addresses used on your private

LAN to a single, public IP address that is used on the Internet. NAT allows multiple computers to access the Internet, even if only one IP address has been provided by your ISP.

• Network Access Rules The default Network Access Rules allow traffic from the LAN to the Internet and block

traffic from the Internet to the LAN. You can create additional Network Access Rules that allow inbound traffic to network servers, such as Web and mail servers, or that restrict outbound traffic to certain destinations on the Internet.

• AutoUpdate The SonicWALL maintains the highest level of security by automatically notifying you

when new firmware is released. When new firmware is available, the SonicWALL Web Management Interface displays a link to download and install the latest firmware. The SonicWALL also sends an e-mail with firmware release notes.

• DMZ Port SonicWALL PRO 100, SonicWAL L PRO 200 and SonicW ALL PRO 300 inc lude a DMZ port

allowing users to access public servers, such as Web and FTP servers. While Internet users have unlimited access to the DMZ, the servers located on the DMZ are still protected against DoS attacks.

• SNMP Support SNMP (Simple Network Management Pro tocol ) is a network protocol u sed over

User Datagram Protocol (UDP) that allows network administrators to monitor the status of the SonicWALL Int ernet Security applian ces and receive notification of any critical events as they occur on the network.

Introduction Page 11

Content Filtering

• SonicWALL Content Filt ering Overview You can use the SonicWALL Web content filtering to enforce your company's Internet

access policies. The SonicWALL blocks specified categories, such as violence or nudity, using an optional Content Filter List. Users on your network can bypass the Content Filter List by authenticating with a unique user name and password.

• Content Filter List Updates (optional) Since content on the Internet is constantly changing, the SonicWALL automatically

updates the optional Content Filter List every week to ensure that access restrictions to new and relocated websites and newsgroups are properly enforced.

• Log and Block or Log Only You can configure the SonicWALL to log and block access to obje ction al Web sites, or

to log inappropriate usage without blocking Web access.

• Filter Protocols In addition to filtering access to We b sites, the SonicWALL can also block Newsgroups,

ActiveX, Java, Cookies, and Web Proxies.

Logging and Reportin g

• Log Categorie s You can select the information you wish to display in the SonicWALL event log. You can

view the event log from the SonicWALL Web Management Interface or receive the log as an e-mail file.

• Syslog Serve r Support In addition to the standard screen log, the SonicWALL can write extremely detailed

event log information to an external Syslog server. Syslog is the industry-standard method to capture information about network activity.

• ViewPoint Reporting Monitoring critical network events and activity, such as security threats, inappropriate

Web use, and bandwidth levels, is an essential component of network security. SonicWALL ViewPoint compliments the SonicWALL security features by providing detailed and comprehensive reports of network activity. SonicWALL ViewPoint is a software application that creates dynamic, Web-based network reports. ViewPoint reporting generates both real-time and historical reports to offer a complete view of all activity through your SonicWALL Internet security appliance.

• E-mail Alerts The SonicWALL can be configured to send alerts of high-priority events, such as

attacks, system errors, and blocked Web sites. When these events occur, alerts can be immediately sent to an e-mail address or e-mail pager.

Page 12 SonicWALL Internet Security Appliance User’s Guide

Dynamic Host Configuration Prot ocol ( DHC P )

• DHCP Server The DHCP Server offers centralized management of TCP/IP client configurations,

including IP addresses, gateway addresses, and DNS addresses. Upon startup, each network client rece ives its TCP/IP settings automatically from the SonicWALL DHCP Server.

• DHCP Client DHCP Client allows the SonicWALL to acquire TCP/IP settings (such as IP address,

gateway address, DNS address) from your ISP. This is necessary if your ISP assigns you a dynamic IP address.

Installation and Configuration

• Installation Wizard The SonicWALL Installation Wizard helps quickly install and configure the SonicWALL.

• Online help SonicWALL help documentation is built into the SonicWALL Web Management Interface

for easy access during installation and management.

IPSec VPN

• SonicWALL VPN SonicWALL VPN provides a simple, secure tool that enables corporate offices and

business partners to connect securely over the Internet. By encrypting data, SonicWALL VPN provides private communications between two or more sites without the expense of leased site-to-site lines. SonicWALL VPN comes standard with the SonicWALL TELE3, the SonicWALL PRO 200 and the SonicWALL PRO 300, and can also be purchased as an upgrade.

• VPN Client Software for Windows Mobile users with dial-up Internet accounts can securely access remote network

resources with the SonicWALL VPN Client. The Sonic WALL VPN Client establishes a private, encrypted VPN tunnel to the SonicW ALL, allowing users to trans parently access network servers from any location. The SonicWALL PRO 200 includes a single VPN client for secure remote management. The SonicWALL PRO 300 includes 50 VPN client licenses for remote management and remote access. Single, 10, 50 and 100 VPN client license packs can be purchased separately.

Introduction Page 13

Contact SonicWALL, Inc. for information about the Content Filter List, Network Anti- Virus subscriptions, and other upgrades.

Web: http://www.sonicwall.com E-mail: sales@sonicwall.com Phone: (408) 745-9600 Fax: (408) 745-9300

Page 14 SonicWALL Internet Security Appliance User’s Guide

2 SonicWALL Installation

This chapter describes the procedure used to install your SonicWALL and perform the initial configuration.

Inspecting the Package

The following items should be included in the package:

• One SonicWALL Internet security appliance

• One power supply (not included with International SonicWALL PRO 200 or PRO 300)

• One Category 5 Ethernet crossover cable (labeled "Crossover")

• One Category 5 Ethernet standard cable

• One SonicWALL Quickstart Guide

• One Companion CD

• One SonicWALL Internet Security Appliance User's Guide

If an item is missing from the package, you can contact SonicWALL, Inc. by phone at (408) 752-7819 or submit a Web Support Form at <http://techsupport.sonicwall.com/ swtech.html>.

Overview

Here are a few helpful guidelines for installing the SonicWALL appliance.

•The WAN Ethernet port should be connected to the Internet router or modem.

•The LAN Ethernet port should be connected to a network hub or switch on the internal, protected network.

•The DMZ Ethernet port, included with the SonicWALL PRO 100, the SonicWALL PRO 200 and the Sonic WALL P RO 30 0, sho uld b e connected to public ly accessible servers, such as Web and Mail servers.

• A crossover cable should be used when connecting the SonicWALL directly to another machine or router.

• A standard Ethernet cable should be used when connecting the SonicWALL to a network hub, switch, or modem.

SonicWALL Internet Security Appliance User’s Guide Page 15

Connecting the SonicWALL to the Network

The following diagram illustrates how the SonicWALL is connected to the network:

The following steps describe integration of the SonicWALL into the network.

1. Connect the WAN Ethernet port on the back of the SonicWALL to the Ethernet port on your Internet router or modem. Use a crossover cable when conn ecting the SonicWALL to a router. Use a standard Ethernet cable when connecting to a modem or a hub.

2. Connect the LAN Ethernet port to your Local Area Network (LAN). Use a standard Ethernet cable when connecting the SonicWALL to a hub or switch. Use a crossover cable when connecting directly to a computer.

3. Optional: Connect the DMZ Ethernet po rt to a hub or switch with a standard Ethern et cable. Or connect the DMZ port directly to a public server with a crossover cable.

4. Plug the SonicWALL power supply into an AC power outlet, then plug the power supply output cable into the port on the back labeled Power. Use the power adapter supplied with the SonicWALL, do not use another power supply.

Note: If you are installing a SonicWALL PRO 200 or a SonicWALL PRO 300, connect the SonicWALL to an AC power outlet using a power cable. Then press the power switch to the On position.

5. The SonicWALL runs a series of self-diagnostic tests to check for proper operation. During the diagnostic tests, which take about 90 seconds, the Test LED remains on. Wait for the Test LED to turn off.

Verify that all used Link LEDs are illuminated. If not, go to Chapter 14 for troubleshooting tips. The SonicWALL is now properly attached to your network.

SonicWALL Installation Page 16

SonicWALL Installation Checklist

The SonicWALL requires information about the IP address configuration of your network. Your Internet Service Provider (ISP) should be able to provide this information. If you are unfamiliar with the terms used in the section, review Appendix B for networking basic terms and information.

• WAN Gateway (Router) IP Address The WAN Gateway (Router) IP Address is the address of the router t hat connec ts your

LAN to the Internet. If you have cable or DSL Internet access, the route r is probably located at your ISP.

• DNS Addresses The DNS Addresses are the addresses of Domain Name Servers, either on your LAN or

the Internet. These addresses are required for downloading the Content Filter List and for the DNS Name Lookup tool. The DNS addresses should be supplied by your ISP.

• Mail Server (Optional) The Mail Server address is the name or the IP address of the mail server used to e- mail

log messages; it can be a server on your LAN or the Internet. For best results, use the same server used on your LAN for e-mail.

If you are using Network Address Translation (NAT), then you also must h ave the following information:

• SonicWALL WAN IP (NAT Public) Address The SonicWALL WAN IP (NAT Public) Address is the valid IP address that your entire

network uses to access the Internet. This address should be supplied by your ISP.

• WAN/DMZ Subnet Mask The WAN Subnet Mask defines which IP addresses are co nnec t ed t o t he WA N port of

the SonicWALL but not accessed through the WAN router. This subnet mask should be supplied by your ISP.

• SonicWALL LAN IP Address The SonicWALL LAN IP address is the address assigned to the SonicWALL LAN port and

is used to manage the SonicWALL. It should be a unique IP address from your Local Area Network (LAN) address range.

• LAN Subnet Mask The LAN Subnet Mask defines the range of IP addresses located on your LAN.

SonicWALL Internet Security Appliance User’s Guide Page 17

Performing the Initial Conf igu ration

Setting up your Management Stati on

All management functio ns on the SonicWALL are performed from a Web browser-based user interface. Management can be performed from any computer connected to the LAN port of the SonicWALL. The computer used for management is referred to as the Management Station.

The SonicWALL is pre-configured with the IP add res s “1 92 .16 8. 1 68 .1 68 " , whi ch i s us ed t o access it during initial configuration. During the initial configuration, it is necessary to temporarily change the IP address of your Management Station to one in the same subnet as the SonicWALL. For example, set the IP address of your Management Statio

“192.168.168.200". Restart the Management Station to activate the address change.

Note: Appendix D describes how to change the IP address of your Management Station.

Launching the Web br owser

1. Open a Web Browser. Then type the default SonicWALL IP address, "192.168.168.168", into the Location or Address field in the Web browser.

Note: Your Web browser must be Java-enabled a nd support HTTP uploads in order to fully manage SonicWALL. Netscape Navigator 3.0 and above is recommended.

The first time you contact the SonicWALL, the SonicWALL Installation Wizard automatically launches and begins the installation process.

n to

The SonicWALL Installation Wizard simplifies the initial installation and configuration of the SonicWALL. The Wizard provides a series of menu-driven instructions for setting the administrator password and configuring the settings necessary to access the Internet.

Note: To bypass the Wizard, click Cancel. Then log into the SonicWALL Management Interface by entering the User Name "admin" and the Password "password".

SonicWALL Installation Page 18

To configure you r SonicWALL appliance, read the instructions on the Wizard Welcome window and click Next to continue.

Setting the Password

Note: It is very important to choose a password which cannot be easily guessed by others.

2. To set the password, enter a new password in the New Password and Confirm New Password fields.

This window also displays the Use SonicWALL Global Management System check box. SonicWALL Global Management System (SonicWALL GMS) is a web browser-based security management system. SonicWALL GMS allows enterprises and service providers to monitor and manage hundreds of remote SonicWALLs from a ce ntral location. For more information about SonicWALL GMS, contact SonicWALL Sales at (408 ) 745-9600.

3. Do not select the Use Global Management System check box unless your SonicWALL is remotely managed by SonicWALL GMS. Click Next to continue.

SonicWALL Internet Security Appliance User’s Guide Page 19

Setting the Time and Date

4. Select the appropriate Time Zone from the Time Zone menu. The SonicWALL internal clock is set automatically by a Netw ork Time Server on the Internet. Click Next to continue.

Connecting to the Internet

The Connecting to the Internet screen lists the information required to complete the installation. You need instructions for obtaining an IP address automatically or IP addresses from your ISP.

5. Confirm that you have the proper network information necessary to configure the SonicWALL to access the Internet. Click the hyperlinks for definitions of the networking terms. Click Next to proceed to the next step.

SonicWALL Installation Page 20

Selecting Your Internet Connection

6. Select Assigned you a single static IP address, if your ISP has provided you with a single, valid IP address. Now go to Step 10.

7. Select the second option, Assigned you two or more IP addresses, if your ISP has provided you with two or more IP addresses. Either NAT or Standard mode can be enabled if your network has two or more valid IP addresses. If you select the second option, go to Step 11.

8. Select the third option, Provided you with desktop software, a user name, and password (PPPoE ), if your ISP requires us er name and password authen ti ca ti on a s well as the installation of log in software. If you select the third option, go to Step 12.

9. Select the fourth option, Automatically assigns you a dynamic IP address (DHCP), if your ISP automatically assigns you an IP address from their DHCP server. Your SonicWALL enables NAT with DHCP Client, a typical network addressing mode for cable and DSL u sers. If you select the fourth option, go to Step 13.

Note: The SonicWALL Installation Wizard autodetects PPPoE and DHCP connections. Therefore, it may not be necessary to select from the above options.

Confirming Network Address Translation (NAT) Mode

If you select Assigned you a single static IP address in the Connecting to the Internet window, the Use Network Address Translation (NAT) window is

displayed.

SonicWALL Internet Security Appliance User’s Guide Page 21

The Use Network Address Translation (NAT) window verifies that the SonicWALL has a registered IP address. To confirm this, click Next and go to Step 10.

Selecting Standard or NAT Enabled Mode If you selected Assigned you a single static IP Address in Step 6, the Optional-

Network Address Translation window is displayed.

10. The Optional-Network Address Translation (NAT) window offers the ability to enable NAT. Select Don’t Use NAT if there are enough static IP addresses for your SonicWALL, all PCs, and all network devices on your LAN. Selecting Don’t Use NAT enables the Standard mode. Select Use NAT if valid IP addresses are in short supply or to hide all devices on your LAN behind the SonicWALL valid IP address. Click Next to continue.

SonicWALL Installation Page 22

Configuring WAN Ne twork Settings

If you selected either NAT or Standard mode, the Getting to the Internet window is displayed.

11. Enter the valid IP address provided by your ISP in the Getting to the Internet window. Enter the SonicWALL WAN IP Address, WAN/DMZ Subnet Mask, WAN Gateway (Router) Address, and DNS Server Addresses. Click Next to continue. If NAT is disabled, go to Step 13. If Standard mode is selected, go to Step 14.

Setting the User Name and Password for PPPoE If you select NAT with PPPoE in the Connecting to the Internet window, the

SonicWALL I S P Settings (PPPo E ) window is displayed

12. Enter the User Name and Password provided by your ISP. The Password is casesensitive. Click Next and go to Step 13.

SonicWALL Internet Security Appliance User’s Guide Page 23

Confirming DHCP Client Mode

If you select DHCP in Step 6, the Obtain an IP address automatically window is displayed.

13. The Obtain an IP address automatically window states that the ISP dynamically assigns an IP address to the SonicWAL L. To confirm th is, click Next and go to Step

15.

Configuring LAN Ne twork Settings

14. The Fill in informat ion about your LAN window allows the configuration of the SonicWALL LAN IP Address and the LAN Subnet Mask .The SonicWALL LAN IP Address is the private IP address assigned to the LAN port of th e SonicWALL. The LAN Subnet Mask defines the range of IP addresses on the LAN. The default values

provided by the SonicWALL work for most networks. Enter the SonicWALL LAN settings and click Next to continue.

SonicWALL Installation Page 24

Configuring the SonicWALL DHCP Server

15. The Optional-SonicWALL DHCP Server windo w configures the S onicWALL DHCP Server. If enabled, the SonicWALL automatically configures the IP settings of computers on the LAN. To enable the DHCP server, select the Enable DHCP Server check box, and specify the range of IP addresses that are assigned to computers on the LAN.

If the Enable DHCP Server check box is not selected, th e DHCP Server is disabled. Click Next to continue.

Configuration Summary

16. The Configuration Summary window displays the configuration defined usin g the Installation Wizard. To modify any of the settings, click Back to return to the Connecting to the Internet window. If the configuration is correct, click Next to

proceed to the Congratulations window.

SonicWALL Internet Security Appliance User’s Guide Page 25

Congratulations

Note:The new SonicWALL LAN IP address, displayed in the URL field of the Congratulations window, is used to log in and manage the SonicW ALL.

17. Click Restart to restart the SonicWALL. Restarting

Note:The final window provides important information to help configure the computers on

the LAN. Click Print this Page to print the window information.

The SonicWALL takes 90 seconds to restart. During this time, the yellow Test LED is lit. Click Close to exit the SonicWALL Wizard.

SonicWALL Installation Page 26

18. Reset the Management Station Information Reset the IP address of the Management Station according to the information

displayed in the final window of the Installation Wizard.

19. Log into the SonicWALL Management Interface Once the SonicWALL restarts, contact the SonicWALL Web Management Interface at

the new SonicWALL LAN IP address. Type the User Name “admin” and enter the new administrator password to log into t he SonicWALL.

20. Register the SonicWALL The Status window in the SonicWALL Web Management Inte rface displays a link

to the online registration form. Registering the SonicWALL provides access to technical support, software updates, and information about new products. Once registered, you are eligible for a free one-month subscription to the SonicWALL Content Filter List and a 15-day trial o f SonicWALL Network Anti-Virus.

SonicWALL Internet Security Appliance User’s Guide Page 27

3 Managing Your SonicWALL

This chapter c onta ins a b rief o ver view of Sonic WALL mana gemen t com mands and functions. The commands and functions are accessed through the SonicWALL Web Management Interface. Th e configuration is the same for all SonicWAL L Internet security appliances; any exceptions are noted.

1. Log into the SonicWALL using a Web Browser

You can manage the SonicWALL from any computer connected to the LAN port of the SonicWALL using a Web browser. The computer used for management is referred to as the "Management Station".

Note: To manage the SonicWALL, your Web browser must have Java and Java

applets enabled and support HTTP uploads.

2. Open a Web browser and type the SonicWALL IP address---initially, "192.168.168.168" --- into the Location or Address field at the top of the browser. An Authentication window with a Password dialogue box is displayed.

3. Type “admin” in the User Name field and the password previously defined in the Installation Wizard in the Password field. Passwords are case-sensitive. Enter the password exactly as defined and click Login.

Note: All SonicWALLs are configured with the User Name “admin” and the defau lt Password “password”. The User Name is not configurable.

If you cannot log into the SonicWALL, a cached copy of the page is displayed instead of the correct page. Click Reload or Refresh on the Web browser and try again. Also, be sure to wait until the Java applet has finished loading before attempting to log in.

Once the password is entered, an authenticated management session is established. This session times out after 5 minutes of inactivity. The default timeout can be increased on the Password window in the General section.

Page 28 Managing Your SonicWALL

Status

To view the Status tab, log into your SonicWALL us ing your web browser. Click General and then click the Status tab.

Note: The SonicWALL Status window is displayed above. Each SonicWALL Internet Security appliance displays unique characteristics, such as th e presence of VPN acceleratio n hardware or a different amount of memory.

The Status tab displays the following information:

• SonicWAL L Serial Numbe r - the serial number of the SonicWALL unit.

• Number of LAN IP addresses allowed with this license - number of IP addresses that can be managed by the SonicWALL

• Registration code - the registration code generated when the SonicWALL is registered at <http//www.mysonicwall.com>.

• SonicWALL Active time - the length of time in days, hours and minutes that the SonicWALL is active.

• Firmware version - shows the current versio n number of the firmware installed on the SonicWALL.

• ROM version - the version number of the ROM.

• CPU - the type and speed of the SonicWALL processor.

SonicWALL Internet Security Appliance User’s Guide Page 29

• VPN Hardware Accelerator Detected - indicates the presence of a VPN Hardware Accelerator in the firewall. This allows better throughput for V PN connections.

• RAM - the amount of Random Access Memory on the board

• Flash - the size of the flash on the board

• Ethernet Speeds - network speeds of the network card

• Current Connections - number of computers connected to the SonicWALL.

Other SonicWALL general st atus information is displayed in this section relating to other features in the SonicWALL such as the type of network settings in use, log settings, content filter use, and if Stealth Mode is enabled on the SonicWALL.

The General, Log, Filter, Tools, Access, Advanced, DHCP, VPN, Anti-Virus, and High Availability buttons appear on the left side of the window. When one of the buttons is clicked, related management functions are selected by clicking the tabs at the top of the window.

Note: High Availability is available in the SonicWALL PRO 200 and the SonicWALL PRO 300. The High Availability button does not appear in the Web Management Interface of the SonicWALL TELE3, the SonicWALL SOHO3, and the SonicWALL PRO 100

A Logout button at the bottom of the screen terminates the management session and redisplays the Authentication window. I f Logout is clicked, you must log in again to manage the SonicWALL . Online help is also available. Click Help at the top of any browser window to view the help files stored in the SonicWALL.

The Status window, shown on the previous page, displays the status of your SonicWALL. It contains an overview of the SonicWALL configuration, as well as any important messages. Check the Status window after making changes to ensure that the SonicWALL is configured properly.

CLI Support and Remote Management

Out-of-band m anagement is availab le on Sonic WALL Internet security appliances using the CLI (Command Line Interface) feature. SonicWALL Internet security a ppliances can be managed from a console using typed commands and a modem or null-modem cable that is connected to the serial port located on the back of the SonicWALL appliance. CLI Support and Remote Management is available on the PRO 200 and PRO 300 models. The only modem currently supported is the US Robotics v.90/v.92 modem. CLI communication requires the following modem settings:

• 9600 bps

• 8 bits

• no parity

• no hand-shaking

After the modem is accessed, a terminal emulator wind ow such as a hyper terminal window is used to manage the SonicWALL Internet se curity appliance. O nce the SonicWA LL is

Page 30 Managing Your SonicWALL

accessed, type in the User Name and password: admin for User Name and then the password used for the management interface.

The following CLI commands are available for the SonicWALL:

• ? or Help - displays a listing of the top level commands available.

• Export - exports preferences from the SonicWALL using Z-modem file transfer protocol.

• Import - imports preferences from the SonicWALL using Z-modem file transfer protocol.

• Logout - logout of the SonicWALL appliance.

• Ping - pings either an IP address or domain name for a specified host.

• Restart - restart the SonicWALL

• Restore - restores the factory default settings for all saved parameters with the exception of the password, the LAN IP address, and the subnet mask.

• Status - displays the information typically seen on the web management interface tab labeled General.

• TSR - retrieves a copy of the tech support report using Z-modem file transfer protocol.

SonicWALL Internet Security Appliance User’s Guide Page 31

4 General and Network Settings

This chapter describes the tabs in the General section and the configuration of the SonicWALL Network Settings. The Network Settings include the SonicWALL IP settings, the administrator password, and the time and date. There are three tabs other than the Status tab in the General section:

• Network

• Time

• Password

Network

To configure the SonicWALL Network Settings, click General on the left side of the browser window, and then click the Network tab at the top of the window.

Note: The High Availability button only appears in the Web Management Interface of the SonicWALL PRO 200 and PRO 300.

General and Network Settings Page 32

Network Settings

Network Addressing Mode

The Network Address ing Mode menu determines the network address scheme of your SonicWALL. It includes five options: Standard, NAT Enabled, NAT with DHCP Client, NAT with PPPoE, and NAT with L2TP Client .

• Standard mode requires valid IP addresses for all computers on your n etwork, but allows remote access to authenticated users.

• NAT Enabled mode translates the private IP addresses on the network to the single, valid IP address of the SonicWALL. Select NAT Enabled if your ISP assigned yo u onl y one or two valid IP addresses.

• NAT with DHCP Client mode configures the SonicWALL to request IP settings from a DHCP server on the Internet. NAT with DHCP Client is a typical network addressing mode for cable and DSL customers.

• NAT with PPPoE mode uses PPPoE to connect to the Internet. If desktop software and a user name and password is required by your ISP, select NAT with PPPoE.

• NAT with L2TP Client mode uses L2TP to connect to an L2TP server. This mode is used to connect a SonicWALL to an ISP or other L2TP server.

LAN Settings

• SonicWALL LAN IP Address The SonicWALL LAN IP Address is the IP address assigned to the SonicWALL LAN

port. It is used for managing the SonicWALL. This IP address should be a unique address from the LAN address range.

• LAN Subnet Mask The LAN Subnet Mask defines which IP addresses are on the LAN. The default Class C

subnet mask of "255.255.255 .0" supports up to 254 IP addresses on the LAN. If the Class C subnet mask is used, all local area network addresses should contain the same first three numbers as the SonicWALL LAN IP Address--for example, "192.168.168."

Multiple LAN Subnet Mask Support

Note: This feature does not replace or substitute configuring routes with the Routes tab in

the Advanced section o f the S on icW AL L. If y o u hav e t o d ef i ne a su b net o n t he o th er si de of a router, y ou must d efine a static ro ute usin g the Routes tab in the Advanced section.

Multiple LAN Subne t Mask Suppor t facilitates the support of legacy networks incorporating the SonicWALL, and makes it easier to add additional nodes if the original subnet is full. Before you can configure multiple local LAN subnets in the SonicWALL, you must have the following information:

• Network Gateway Address - This is an IP address assigned to the SonicWALL, in addition to the existing LAN IP address. If you have configured your Sonic WALL in Standard mode, the IP address should be the Default Gateway IP address assigned

Page 33 SonicWALL Internet Security Appliance User’s Guide

to your Internet router on the same subnet. All users on the subnet you are configuring must use this IP address as their default router/gateway address.

• Subnet Mask - This value defines the size, and based upon the Network Gateway entry, the scope of the subnet. If you are configuring a subnet mask that currently exists on the LAN, enter the existing subnet mask address into the Subnet Mask field. If you are configuring a new subnet mask, use a subnet mask that does not overlap any previously defined subnet masks.

Note: The SonicWALL cannot be mana ged from any of the additional Network Ga teway addresses. You must use the IP address set as the LAN IP address of the Son icWALL. Also, you cannot mix Standard and NAT subnets behind the SonicWALL.

WAN Settings

• WAN Gateway (Router) Address The WAN Gateway (Router) Address is the IP address of the WAN router or default

gateway that connects your network to the Internet. If you use Cable or DSL, your WAN router is probably located at your ISP.

If you select NAT with DHCP Client or NAT with PPPoE mode, the WAN Gateway

(Router) Address is assigned automatically. SonicWALL WAN IP Address

The SonicWALL WAN IP Address is a valid IP address assigned to the WAN port of the SonicWALL. This address should be assigned by your ISP.

If you select NAT Enabled mode, this is the only address seen by users on the Internet and all activity appears to originate from this address.

If you select NAT with DHCP Client, NAT with PPPoE, or NAT with L2TP Client mode, the SonicWALL WAN IP address is assigned automatically.

If you select Standard mode, the SonicWALL WAN IP Address is the same as the SonicWALL LAN IP Address.

• WAN/DMZ Subnet Mask The WAN/DMZ Su bnet Mask determines which IP addresses are located on the

WAN. This subnet mask should be assigned by your ISP. If you select NAT with DHCP Client, NAT with PPPoE, or NAT with L2TP

Clientmode, the WAN/DMZ Subnet Mask is assigned automatically. If you select Standard mode, the WAN/DMZ Subnet Mask is the same as the LAN

Subnet Mask.

General and Network Settings Page 34

DNS Settings

• DNS Servers DNS Servers, or Domain Name System Servers, are used by the SonicWALL for

diagnostic tests with the DNS Lookup Tool, and for upgrade and registration functionality. DNS Server addresses should be assigned by your ISP.

If you select NAT with DHCP Client or NAT with PPPoE mode, the DNS Server addresses is assigned automatically.

Note: The SonicWALL does not relay DNS settings to the LAN; you must enable and configure the SonicWALL's DHCP server or manually configure your computer DNS settings to obtain DNS name resolution.

Standard Configuration

If your ISP provided you with enough IP addresses for all the computers and network devices on your LAN, enable Standard mode.

To configure Standard addressing mode, complete the following instructions:

1. Select Standard from the Network Addressing Mode menu. Because NAT is disabled, you must assign valid IP addresses to all computers and network devices on your LAN.

2. Enter a unique, valid IP address from your LAN address range in the SonicWALL LAN IP Address field. The SonicWALL LAN IP Addre ss is the address assigned to the SonicWALL LAN port and is used for management of the SonicWALL.

3. Enter your network's subnet mask in the LAN Subnet Mask field. The LAN Subnet Mask tells your SonicWALL which IP addresses are on your LAN. The default v alue, "255.255.255.0", supports up to 254 IP addresses.

4. Enter your WAN router or default gateway address in the WAN Gateway (Router) Address field. Your router is the device that connects your network to the Internet. If you use Cable or DSL, your WAN router is located at your ISP.

5. Enter your DNS server IP address(es) in the DNS Servers field. The SonicWALL uses the DNS servers for diagnostic tests and for upgrade and registration functionality.

6. Click Update. Once the SonicWALL has been updated, a message confirming the update is displayed at the bottom of the browser window. Restart the SonicWALL for these changes to take effect.

NAT Enabled Configuration

Network Address Translation (NAT) connects your entire network to the Internet using a single IP address. Network Address Translation offers the following:

• Internet access to additional computers on the LAN. Multiple computers can access the Internet even if your ISP only assigned one or two valid IP addresses to your network.

Page 35 SonicWALL Internet Security Appliance User’s Guide

• Additional security and anonymity because your LAN IP addresses are invisible to the outside world.

If your ISP hasn't provided enough IP addresses for all machines on your LAN, enable NAT and assign your network a private IP address range. You should use addresses from one of the following address ranges on your private network:

10.0.0.0 - 10.255.255.255

172.16.0.0 - 172.31.255.255

192.168.0.0 - 192.168.255.255

Note: If your network address range uses valid TCP/IP addresses, Internet sites within that range are not accessible from the LAN. For example, if you assign the address range

199.2.23.1 - 19 9. 2.2 3.2 55 to yo ur L A N, a W eb serve r o n t h e In tern et with the addres s of

199.2.23.20 is not accessible.

When NAT is enabled, users on the Internet cannot access machines on the LAN unless they have been designated as Public LAN Servers.

To enable Network Address Translation (NAT), complete the following instructions.

1. Select NAT Enabled from the Network Addressing Mode menu in the Network window.

General and Network Settings Page 36

2. Enter a unique IP address from your LAN address range in the SonicWALL LAN IP Address field. The SonicWALL LAN IP Address is the address assigned to the SonicWALL LAN port and is used for management of the SonicWALL.

3. Enter your network subnet mask in the LAN Subnet Mask field. The LAN Subnet Mask tells the SonicWALL which IP addresses are on your LAN. Use the default value, "255.255.255.0", if there are less than 254 computers on your LAN.

4. Enter your WAN router or default gateway address in the WAN Gateway (Router) Address f ield. This is the device that connects your network to the Internet. If you use Cable or DSL, your WAN router is probably located at your ISP.

5. Enter a valid IP address assigned by your ISP in the SonicWALL WAN IP (NAT Public) Address field. Because NAT is enabled, all network activity appears to originate from this address.

6. Enter your WAN subnet mask in the WAN/DMZ Subnet Mask field. This subnet mask should be assigned by your ISP.

7. Enter your DNS server IP address(es) in the DNS Servers field. The SonicWALL uses these DNS servers for diagnostic tests and for upgrade and registration functionality.

8. Click Update. Once the SonicWALL has been updated, a message confirming the update is displayed at the bottom of the browser window. Restart the SonicWALL for these changes to take effect.

If you enable Network Address Translation, designate the SonicWALL LAN IP Address as the gateway address for computers on your LAN. Consider the following example:

• The SonicWALL WAN Gateway (Router) Address is "10.1.1.1".

• The SonicWALL WAN IP (NAT Public) Address is "10.1.1.25".

• The private SonicWALL LAN IP Address is "192.168.168.1".

• Computers on the LAN have private IP addresses ranging from "192.168.168.2" to "192.168.168.255".

In this exa mple, "192.16 8.168.1", t he SonicWALL LAN IP Address, is used as the gateway or router address for all computers on the LAN.

NAT with DHCP Client Configuration

The SonicWALL ca n recei ve an IP addr ess fr om a DHCP server on the Internet. If your ISP did not provide you with a valid IP address, and instructed you to set your network settings to obtain an IP address automatically, enable NAT with DHCP Client. NAT with DHCP Client mode is typically used with Cable and DSL connections.

To obtain IP settings dynamically, complete the following instructions.

Page 37 SonicWALL Internet Security Appliance User’s Guide

1. Select NAT with DHCP Client from the Networ k Addressing Mode menu.

3. Enter your network subnet mask in the LAN Subnet Mask field. The LAN Subnet Mask tells your SonicWALL which IP addresses are on your LAN. The default value, "255.255.255.0", supports up to 254 IP addresses.

4. Click Update. Once the SonicWALL has been updated, a message confirming the update is displayed at the bottom of the browser window. Restart the SonicWALL for these changes to take effect.

Note: When NAT is enabled, designate the SonicWALL LAN IP Address as the gateway address for computers on the LAN.

When your SonicWALL has successfully received a DHCP lease, the Network window displays the SonicWALL WAN IP settings.

•The Lease Expires value shows when your DHCP lease expires.

•The WAN Gateway (Router) Address, SonicWALL WAN IP (NAT Public) Address, WAN/ DMZ Subn et Mas k, and DNS Servers are obtained from a DHCP server on the Internet.

General and Network Settings Page 38

Note: The SonicWALL does not relay DNS settings to the LAN; you must enable and configure the SonicWALL'DHCP server or manually configure DNS settings on your computers to obtain DNS name resolution.

In the WAN/DMZ Settings section of Network, you can Renew and Release the SonicWALL WAN IP (NAT Public) Address lease. When you click on Renew, the SonicWALL renews the IP address used for the WAN IP address. Click Release, and the lease is released with the DHCP server.

NAT with PPPoE Configuration

The SonicWALL can use Point-to-Point Protocol over Ethernet to connect to the Internet. If your ISP requires the installation of desktop software and user name and password authentication to access the Internet, enable NAT with PPPoE.

To configure NAT with PPPoE, complete the following instructions.

1. Select NAT with PPPoE from the Network Addressing Mode menu.

3. Enter your network subnet mask in the LAN Subnet Mask field. The LAN Subnet Mask tells your SonicWALL which IP addresses are on your LAN. Use the default value, "255.255.255.0", if there are less than 254 computers on your LAN.

Page 39 SonicWALL Internet Security Appliance User’s Guide

4. Enter the user name provided by your ISP in the User Name field. The us er name identifies the PPPoE client.

5. Enter the password provided by your ISP in the Password field. The password authenticates the PPPoE session. This field is case sensitive.

6. Select the Disconnect afte r __ Minutes of Inactivity check box to automatically disconnect the PPPoE connection after a specified period of inactivity. Define a maximum number of minutes of inactivity in the Minutes field. This value can range from 1 to 99 minutes.

7. In the WAN/DMZ section, select Obtain an IP Address Automatically if your ISP does not provide a static IP address. Select Use the following IP Add ress if your ISP assigns a specific IP address to you.

8. Click Update. Once the SonicWALL has been updated, a message confirming the update is displayed at the bottom of the browser window. Restart the SonicWALL for these changes to take effect.

Note: When NAT is enabled, the SonicWALL LAN IP Address is used as the gateway address for computers on the LAN.

When your SonicWALL has successfully established a PPPoE connection, the Network page displays the SonicWALL WAN IP settings. The WAN Gateway (Router) Address,

SonicWALL WAN IP (NAT Public) Address, WAN/DMZ Subnet Mask, and DNS Servers are displayed.

Note: The SonicWALL does not relay DNS settings to the LAN; you must enable and

configure the Son icWALL DHCP server or manually c onfigure the comput er DNS settings to obtain DNS name resolution.

Restart the SonicWALL

Once the network settings have been updated, the Status bar at the bottom of the browser window displays "Restart SonicWALL for changes to take effect." Restart the SonicWALL by clicking Restart. Then click Yes to confirm the restart and send the restart command to the SonicWALL. The restart can ta ke up to 90 seconds, during which time th e SonicWALL is inaccessible and all network traffic through the SonicWALL is halted.

Note: If you change the SonicWALL LAN IP Address, you must to change the Management Station IP address to be in the same subnet as the new LAN IP address.

General and Network Settings Page 40

NAT with L2TP Client

L2TP is a standard tunneling protocol that is used to encapsulate Point-to-Point Protocol (PPP) frames for transmission over TC P/I P, X.25, fra me relay, or Asynchr onous Transfe r Mode (ATM) networks. It can be used to create virtual private networks (VPN) over public networks such as the Internet. It also provides interoperability between different VPN vendors which other protocols do not provide.

PPP provides the connection over which L2TP sends packets through a tunnel. The tunnel can be initiated by either a dial-up client used by the customer, or by the network access server (NAS) located at the L2TP service provider such as an ISP. When the client initiates the connection to th e NAS, the NA S is referre d to as an L2TP access concentrator (LAC). The LAC forwards its L2TP traffic to a remote node called an L2TP network server (LNS). The NAS performs the server-side function of PPP termination and acts as the receiver of incoming connections. If the NAS initiates the L2TP tunnel to the customer premises, the client PC acts as the LNS.

A VPN constructed using L2TP can be initiated two ways:

• Client-initiated tunnel - The client initiates a tunnel in a way similar to PPTP tunnels.

• NAS-initiated tunnel - If the tunnel is initiated by the NAS, it enables telephone companies and ISPs to provide corporate customers with VPN solutions.

To configure the SonicWALL for NAT with L2TP Client, follow these steps:

1. Select NAT with L2TP Client from the Network Addressing Mode menu on the Network tab.

Page 41 SonicWALL Internet Security Appliance User’s Guide

2. Configure t he LAN Sett ings by typing in the IP addresses for the SonicWALL LAN and the LAN Subnet Mask.

3. Type the IP address for the WAN in the WAN Gateway (Router) Address field. Then enter the IP address for the SonicWALL WAN IP (NAT Public) Address, and the WAN/DMZ Subnet Mask.

4. Configure the DNS Settings by typing the DNS Server IP address into the DNS Server field.

5. Enter the IP address of the L2TP Server into the L2TP Server IP Address field. Also, enter the User Name and User Password into the User Name and User Password fields.

6. You can select the Disconnect after __ minutes of inactivity check box, and also enter a value in minutes to disconnect an inactive user. The default value is 10 minutes.

7. Click Update to add the settings to the SonicWALL. The L2TP Gateway Address, L2TP SonicWALL IP Address, and the L2TP DNS Server addresses are configured once the connection is established between the SonicWALL and the L2TP server.

General and Network Settings Page 42

Setting the Time and Date

1. Click the Time tab.

The SonicWALL uses the time and date settings to time stamp log events, to automatically update the Content Filter List, and for other internal purposes.

2. Select your time zone from the Time Zone menu.

3. Click Update to add the information to the SonicWALL. You can also enable automatic adjustments for daylight savings time, use universal

time (UTC) rather than local time, and display the date in International format, with the day preceding the month.

To set the time and date manually, clear the check boxes and enter the time (in 24-hour format) and the date.

NTP Settings Network Time Protocol (NTP) is a protocol used to synchronize computer clock times

in a network of computers. NTP uses Coordinated Universal Time (UTC) to synchronize computer clock times to a millisecond, and sometimes to a fraction of a millisecond. Select Use NTP to set time automatically if you want to use your local server to set the SonicWALL clock. You can also set the Update Interval for the NTP server to synchronize the time in the SonicWALL. The default value is 60 minutes. You can add NTP servers to the SonicWALL for time synchronization by typing in the IP address of an NTP server in the Add NTP Server field. If there are no NTP Servers in the list, the intern al NTP list is used

Page 43 SonicWALL Internet Security Appliance User’s Guide

by default. To remove an NTP server, highlight the IP address and click Delete NTP Server.

When you have configured the Time window, click Update. Once the SonicWAL L has been updated, a message confirming the update is displayed at the bottom of the browser window.

Setting the Administrator Password

1. Click the Password tab.

To set the password, enter the old password in the Old Password field, and the new password in the New Password field. Type the new password again in the Confirm New Password field and click Update. Once the SonicWALL has been updated, a message confirming the update is displayed at the bottom of the browser window.

Note: When setting the password for the first time, remember that the SonicWALL's default password is “password”.

If the password is not entered exactly the same in both New Password fields, the password is not changed. If you mistype the password, yo u are not locked out of the SonicWALL.

Warning: The password cannot be recovered if it is lost or forgotten. If the password is lost, you must to reset the SonicWALL to its factory default state. Go to Appendix E for instructions.

General and Network Settings Page 44

Setting the Administrator Inactivity Timeout

The Administrator Inactivity Timeout setting allows you to configure the length of inactivity that can elapse before you are automatically logged out of the Web Management Interface. The SonicWALL is preconfigured to log out the administrator after 5 minutes of inactivity.

Note: If the Administrator Inactivity Timeout is extended beyond 5 minutes, you should end every management session by clicking Logout to prevent u nauthorized ac cess to the SonicWALL Web Management Interface.

Enter the desired number of minutes in the Administrator Inactivity Timeout section and click Update. The Ina ctivity Timeout can range from 1 to 99 minutes. Once the SonicWALL has been updated, a message confirming the update is displayed at the bottom of the browser window.

Page 45 SonicWALL Internet Security Appliance User’s Guide

5 Logging and Alerts

This chapter describes the SonicWALL Internet Security appliance logging, al erting, and reporting features, which can be viewed in the Log section of the SonicWALL Web Management Interface.There are three tabs in the Log section:

• View Log

• Log Settings

• Reports A fourth tab, ViewPoint

purchased upgrade for the PRO 200, but it is included with the PRO 300.

View Log

The SonicWALL ma intain s an Event log which displays potential security threats. This log can be viewed with a browser using the SonicWALL Web Management Interface, or it can be automatically sent to an e-mail address for convenience and archiving. The log is displayed in a table and is sortable by column.

The SonicWALL can alert you of important events, such as an attack to the SonicWALL. Al ert s ar e im medi ate ly e-m ail ed, either to an e-mail address or to an e-mail pager.Each log entry contains the date and time of the event and a brief message describing the event.

Click Log on the left side of the browser window, and then click the View Log tab.

™, is available on the PRO 200 and PRO 300. It is a

Page 46 SonicWALL Internet Security Appliance User’s Guide

SonicWALL Log Messages

Each log entry contains the date and time of the event and a brief message describing the event. It is also possible to copy the log entries from the management interface and paste into a report.

• TCP, UDP, or ICMP packets dropped When IP packets are blocked by the SonicWALL, dropped TCP, UDP and ICMP

messages is displayed. The messages include the source and destination IP addresses of the packet. The TCP or UDP port number or the ICMP code follows the IP address. Log messages usually include the name of the service in quotation marks.

• Web, FTP, Gopher, or Newsgroup blocked When a machine attempts to connect to the blocked site or newsgroup, a log event is

displayed. The machine's IP address, Ethernet address, the name of the blocked Web site, and the Content Filter List Code is displayed. Code definitions for the 12 Content Filter List categories are shown below.

a=Violence/Profanity g=Satanic/Cult b=Partial Nudity h=Drug Culture c=Full Nudity i=Militant/Extremist d=Sexual Acts j=Sex Education e=Gross Depictions k=Gambling/Illegal f=Intolerance l=Alcohol/Tobacco

Descriptions of these categories are available on the Web at <http://www.sonicwall.com/ Content-Filter/categories.html>.

• ActiveX, Java, Cookie or Code Archi v e blo c ked When ActiveX, Java or Web cookies are blocked, messages with the source and

destination IP addresses of the connection attempt is displayed.

• Ping of Death, IP Spoo f , and SYN Flood Attacks The IP address of the machine under attack and the source of the attack is displayed.

In most attacks, the source address shown is fake and does not reflect the real source of the attack.

Note: Some network conditions can produce network traffic that appears to be an attack, even when no one is deliberately attacking the LAN. To follow up on a possible attack, contact your ISP to determine the source of the attack. Regardless of the nature of the attack, your LAN is protected and no further steps must be taken.

Logging and Alerts Page 47

Log Settings

Click Log on the left side of the browser window, and then click the Log Settings tab.

Configure the following settings:

1. Mail Server - To e-mail log or alert messages, enter the name or IP address of your mail server in the Mail Server field. If this field is left blank, log and ale rt messages are not be e-mailed.

2. Send Log To - Enter your full e-mail address(username@mydomain.com) in the Send log to field to receive the event log via e-mail. Once sent, the log is cleared from the SonicWALL memory. If this field is left blank, the log is not e-mailed.

3. Send Alerts To - Enter your full e-mail address (username@mydomain.com) in the Send alerts to field to be immediately e-mailed when attacks or system errors occur. Enter a standard e-mail address or an e-mail paging service. If this field is left blank , alert messages are not e-mailed.

4. Firewall Name - The Firewall Name appears in the subject of e-mails sent by the SonicWALL. The Firewall Name is helpful if you are managing multiple S onicWALLs because it specifies the individual SonicWALL sending a log or an alert e-mail. By default, the Firewall Name is set to the SonicWALL serial number.

5. Syslog Server - In addition to the standard event log, the SonicWALL can send a detailed log to an external Syslog server. Syslog is an industry-standard protocol used to capture information about network activity. The SonicWALL Syslog captures all log

Page 48 SonicWALL Internet Security Appliance User’s Guide

activity and includes every connection source and destination IP address, IP service, and number of bytes transferred. The SonicWALL Syslog support requires an external server running a Syslog daemon on UDP Port 514.

Syslog Analyzers such as WebTrends Firewall Suite can be used to sort, analyze, and graph the Syslog data.

Enter the Syslog server name or IP address in the Syslog Server field. Restart the SonicWALL for the change to take effect.

6. E-mail Log Now - Clicking E-mail Log Now immediately sends the log to the address in the Send Log To field and then clears the log.

7. Clear Log Now - Clicking Clear Log Now deletes the contents of the log.

8. Send Log / Every / At - The Send Log menu determines the frequency of log e-mail messages: Daily, Weekly, or When Full. If the Weekly option is selected, then enter the day of the week the e-ma il is se nt in th e Every menu. If the Weekly or the Daily option is selected, enter the time of day when the e-mail is sent in the At field. If the When Full option is selected and the log fills up, it is e-mailed automatically.

9. When log overflows - The log buffer fills up if the SonicWALL cannot e-mail the log file. The default behavior is to overwrite the log and discard its contents. However, you can configure the SonicWALL to shut down and prevent traffic from traveling through the SonicWALL if the log is full.

10. Syslog Individual Event Rate (seconds/event) - The Syslog Individual Even t Rate setting filters repetitive messages from being written to Syslog. If duplicate events occur during the period specified in the Syslog Individual Event Rate field, they are not written to Syslog as unique events. Instead, the additional events are counted, and then at the end of the period, a message is written to the Syslog that includes the number of times the event occurred.

The Syslog Indi vidual Event Rate d efault value is 60 seconds and the maximum value is 86,400 seconds (24 hours). Setting this value to 0 second s sends all Syslog messages without filtering.

11. Syslog Format - You can choose the format of the Syslog to be Default or WebTrends. If you select WebTrends, however, you must have WebTrends software installed on your system.

Logging and Alerts Page 49

Log Categories

You can define which log messages appear in the SonicWALL Event Log. All Log Categories are enabled by default except Network Debug.

• System Maintenance Logs general system activity, such as administrator log ins, automatic downloads of the

Content Filter Lists, and system activations.

• System Errors Logs problems with DNS, e-mail, and automatic downloads of the Content Filter List.

• Blocked Web Sites Logs Web sites or newsgroups blocked by the Content Filter List or by customized

filtering.

• Blocked Java, ActiveX, and Cookies Logs Java, ActiveX, and Cookies blocked by the SonicWALL.

• User Activity Logs successful and unsuccessful log in attempts.

• Attacks Logs messages showing Denial of Service attacks, such a s SYN Flood, Ping of Death ,

and IP spo ofing.

• Dropped TCP Logs blocked incoming TCP connections.

• Dropped UDP Logs blocked incoming UDP packets.

• Dropped ICMP Logs blocked incoming ICMP packets.

• Network Debug Logs NetBIOS broadcasts, ARP resolution problems, and NAT resolution problems.

Also, detailed messages for VPN connections are displayed to assist the network administrator with troubleshooting problems with active VPN tunnels. Network Debug information is intended for experienced network administrators.

Page 50 SonicWALL Internet Security Appliance User’s Guide

Alert Categories

Alerts are events, such as attacks, which warrant immediate attention. When events generate alerts, messages are immediately sent to the e-mail address defined in the Send alerts to field. Attacks and System Errors are enabled by default, Blocked Web Sites is disabled.

• Attacks Log entries categorized as Attacks generate alert messages.

• System Errors Log entries categorized as System Errors generate alert messages.

• Blocked Web Sites Log entries categorized as Blocked Web Sites generate alert messages.

Once you have configured the Log Settings window, click Update. Once the SonicWALL is updated, a message confirming t he update is displayed at the bottom of the browser window.

Reports

The SonicWALL is able to perform a rolling analysis of the event log to show the top 25 most frequently accessed Web sites, the top 25 users of bandwidth by IP address, and the top 25 services consuming the most bandwidth.

Click Log on the left side of the browser window, and then click the Reports tab.

Logging and Alerts Page 51

The Reports window includes the following functions and commands:

• Start Data Collection Click Start Data Collectio n to begin log analy sis. When log an alysis is enabled, the

button label changes to Stop Data Collection.

• Reset Data Click Reset to clear the report statistics and begin a new sample period. The sample

period is also reset when data collection is stopped or started, and when the SonicWALL is restarted.

• View Data Select the desired report from the Report to view menu. The options are Web Site

Hits, Bandwidth Usage by IP Address, and Bandwidth Usage by Service. These reports are explained below. Click Refresh Data to update the report. The length of time analyzed by the report is displayed in the Current Sample Period.

Web Site Hits

Selecting Web Site Hits from the Display Report menu displays a table showing the URLs for the 25 most frequently accessed Web sites and the number of hits to a site during the current sample period.

The Web Site Hits report ensures that the majority of Web access is to appropriate Web sites. If leisure, sports, or other inappropriate sites appear in the Web Site Hits Report, you can choose to block the sites.

Bandwidth Usage by IP Address

Selecting Bandwidth Usage by IP Address from the Display Report menu displays a table showing the IP Address of the 25 top users of Internet bandwidth and the number of megabytes transmitted during the current sample period.

Bandwidth Usage by Service

Selecting Band width U sage by Se rvice from the Display Report menu displays a table showing the name of the 25 top Internet services, such as HTTP, F TP, RealAudio, etc., and the number of megabytes received from the service during the current sample period.

The Bandwidth Usa ge by Service report shows whether the services being used are appropriate for your organization. If services such as video or push broadcasts are consuming a large portion of the available bandwidth, you can choose to block these services.

Page 52 SonicWALL Internet Security Appliance User’s Guide

6 Content Filtering and Blocking

This chapter describes the SonicWALL content filtering features configured in the Filter section of the SonicWALL Web Management Interface. Content Filtering and Blocking records Web site blocking by Filter List category, domain name, and keyword.

There are five tabs in the Filter section:

• Categories

• List Update

• Customize

• Keywords

• Consent

Categories

Click Filter on the left side of the browser window, and then click on the Categories tab.

Note: Content Filtering applies only to the SonicWALL LAN.

Configure the following settings in the Categories window: Restrict Web Featur es

• ActiveX ActiveX is a programming language that embeds scripts in Web pages. Malicious

programmers can use ActiveX to delete files or compromise security. Select the ActiveX check box to block ActiveX controls.

Content Filtering and Blocking Page 53

• Java Java is used to embed small programs, called applets, in Web pages. It is safer than

ActiveX since it has built-in security mechanisms. Select the Java check box to block Java applets from the network.

• Cookies Cookies are used by Web servers to track Web usage and remember user identity.

Cookies can also compromise users' privacy by tracking Web activities. Select the Cookies check box to disable Cookies.

• Disable Web Proxy When a proxy server is located on the WAN, LAN users can circumvent content filtering

by pointing to this proxy server. The Disable Web Proxy check box disables access to proxy servers located on the WAN. It does not block Web proxies located on the LAN.

• Known Fraudulent Certificates Digital certificates help verify that Web content and files originated from an authorized

party. Enabling this feature protects users on the LAN from downloading malicious programs warranted by these fraudulent certificates. If digital certificates are proven fraudulent, then the SonicWALL blocks the Web content and the files that use these fraudulent certificates.

Known fraudulent certificates blocked by SonicWALL include two certificates issued on January 29 and 30, 2001 by VeriSign to an impostor masquerading as a Microsoft employee.

Use Filter List (Web/News/FTP/Gopher)

• Log and Block Access Select the check box and the SonicWALL blocks access to sites on the Content Filter,

custom, and keyword lists and log attempts to access these sites.

• Log Only If this check box is selected, the SonicWALL logs and then allows access to all sites on

the Content Filter, custom, and keyword lists. T he Log Only check box allows you to monitor inappropriate usage without restricting access.

• Block all categories The SonicWALL uses a Content Filter List generated by CyberPatrol to block access

to objectional Web sites. CyberPatrol classifies objectional Web sites based upon input from a wide range of social, political, and civic organizations. Select the Block all categories check box to block all of these categories. Alternatively, you can select categories individually by selecting the appropriate check box.

When you register your So nicWALL at <http://www. mysonicwall.com>, you can download a one month subscription to Content Filter List updates.

Page 54 SonicWALL Internet Security Appliance User’s Guide

The following is a list of the Content Filter List categories:

Violence/Profanity Satanic/Cult Partial Nudity Drugs/Drug Culture Full Nudity Militant/Extremist Sexual Acts Sex Education Gross Depictions Questionable/Illegal Gambling Intolerance Alcohol & Tobacco

Visit <http://www.sonicwall.com/Content-Filter /categories.html> for a detailed description of the criteria used to define Content Filter List categories.

Time of Day

The Time o f Day feature allows you to define specif ic times when Conten t Filtering is enforced. For example, you could configure the SonicWALL to filter employee Internet access during normal business hours, but allow unrestricted access at night and on weekends.

Note: Time of Day restrictions only apply to the Content Filter, Customized blocking and Keyword blocking. Consent and Restrict Web Features are not affected.

• Always Block When selected, Content Filtering is enforced at all times.

• Block Between When selected, Content Filtering is enforced during the time and days specified.

Enter the time period, in 24-hour format, and select the starting and ending day of the week that Content Filtering is enforced.

List Update

Since content on the Internet is constantly changing, the Content Filter List requires updating regularly. The List Up date window c onfigures the SonicWALL to automatically download a new list at a specified time every week.

Registering t he Soni cWALL wit h SonicW ALL, I nc. allows you to receive a one month trial of the Content Filter List subscription at no charge. Contact SonicWALL Sales at <sales@sonicwall.com> for information about purchasing a SonicWALL Content Filter List subscription.

Content Filtering and Blocking Page 55

Click Filter on the left side of the browser window, and then click the List Update tab.

Configure the following settings in the List Update window.

• Download Now Click Do wnload Now to immediately download and install a new Content Fil ter

List. This process takes several minutes and requires a current subscription to Content Filter List updates.

• Automatic Download Select the Automatic Download check box to enable automatic, weekly downloads

of the Content Filt er Li st. Then select the day of the week and the time of day when the new list should be retrieved. A current subscription to the Content Filter List updates is required.

Once loaded, the creation date of the current active list is displayed at the top of the window.

• If Filter List Not Loaded The Content Filter List expires 30 days after it is downloaded. The Content Filter

List can also be erased if there is a failure while downloading a new list. If the Content Filter List expires or fails to download, the SonicWALL can be configured to block all

Web sites except for Trusted Domains, or to allow access to all Web sites.

Page 56 SonicWALL Internet Security Appliance User’s Guide

In the If Filter List Not Loaded section, select either Block traffic to all web sites except for Trusted Domains or Allow traffic to all web sites.

If Allo w traf fic to al l web site s is selected, Forbi dden Domains and Keywords are still blocked.

Note: The SonicWALL does not ship with the Content Filter List installed. Registering the SonicWALL provides a one month trial subscription to the Content Fi lter List. Follow the "Download Now" instructions to install the initial Content Filter List

Click Update. Once the SonicWALL is updated, a message confirming the update is displayed at the bottom of the browser window.

Customize

Click Filter on the left side of the browser window, and then click the Customize tab. The

Customize window allows you to customize the Content Filt er List by manually blocking

or allowing Web site access. To allow access to a Web site that is blocked by the Content Filter List, enter the host

name, such as “www.ok-site.com”, in to the Tru sted Domain s fields. 25 6 entries can be added to the Trusted Domains list.

Content Filtering and Blocking Page 57

To block a Web site that is not blocked by the Content Filter List, enter the host name, such as “www.bad-site.com” in to the Forbidden Domains field. 256 entries can be added to the Forbidden Domains list.

Note: Do not include the prefix “http://” in either the Trusted Domains or Forbidden Domains the fields. All subdomains are affected. For example, entering “yahoo.com” applies to “mail.yahoo.com” and “my.yahoo.com”.

Click Update. Once the SonicWALL has been updated, a message confirming the upd ate is displayed at the bottom of the browser window.

Note: Customized domains do not have to be re-entered when the Content Filter List is updated each week and do not require a filter list subscription.

To remove a trusted or forbidden domain, select it from the appropriate list, and click the Delete Domain button. Once the domain has been deleted, a message is displayed at the bottom of the Web browser window.

• Enable Content Filter List Customizati on To deactivate Content Filter List customization, clear the Enable Content Filter

List Customization check box, and click Update. This option allows you to enable and disable customization without removing and re-entering custom domains.

• Disable Web traffic except for Trusted Domains When the Disable Web traffic except for Trusted Domains check box is selected,

the SonicWALL only allows Web access to sites on the Trusted Domains list.

• Don’t block Java/ActiveX/Cookies to Trusted Domains When this box is selected, SonicWALL permits Java, ActiveX and Cookies from sites on

the Trusted Domains list to the LAN. This check box allows Java, Ac tive X or Co okies from sites that are known and trusted.

• Message to display when a site is blocked When a user attempts to access a site that is blocked by the SonicWALL Content

Filter List, a message is displayed on their screen. The default message is “Web Site Blocked by SonicWALL Filter”. Any message, including embedded H TML, up to 255 characters long, can be defined.

The following example displays a message explaining why the Web site was blocked, with links to the Acceptable Use Policy and the Network Administrator’s e-mail address:

Access to this site was denied because it violates this company’s <A HREF=http:// www.your-domain.com/acceptable_use _policy.htm>Accep table Use Policy</A >. Please contact the <A HRE F=”admin@your -domain.com”> Network Adminis trator</A> if yo u feel this was in error.

Page 58 SonicWALL Internet Security Appliance User’s Guide

Keywords

Click Filter on the left side of the browser window, and then click the Keywords tab.

The SonicWALL allows you to block Web URLs containing keywords. For example, if you add the keyword "XXX", the Web site <http://www.new-site.com/xxx.html> is blocked, even if it is not included in the Content Filter List.

To enable this function, select the Enable Keyword Blocking check box. Enter the keyword to block in the Add Keyword field, and click Update. Once the

keyword has been added, a message confirming the update is displayed at the bottom of the browser window.

To remove a keyword, select it from the list and click Delete Keyword. Once the keyword has been removed, a message confirming the update is displayed at the bottom of the browser window.

Consent

The Consent tab allows you to enforce content filtering on designated computers and provide optional filtering on other computers. Consent can be configured to require the user to agree to the terms outlined in an Acceptable Use Policy window before Web browsing is allowed.

Content Filtering and Blocking Page 59

Click Filter on the left side of the browser window, and then click the Consent tab.

• Require Consent Select the Require Consent check box to enable the Consent features.

• Maximum Web usage In an environment where there are more users than computers, such as a classroom

or library, time limits are often imposed. The SonicWALL can be used to remind users when their time has expired by displaying the page defined in the Consent page URL field. Enter the time limit, in minutes, in the Maximum Web usage field. When the default value of zero (0) is entered, this feature is disabled.

• Maximum idle time After a period of inactivity, the SonicWALL requires the user to agree to the terms

outlined in the Consent page before any additional Web browsing is allowed. To configure the value, follow the link to the Users window and enter the desired value in the User Idle Timeout section.

Page 60 SonicWALL Internet Security Appliance User’s Guide

• Consent page URL (Optional Filtering) When a user opens a Web browser on a computer requiring consent, they are shown

a consent page and given the option to access the Internet with or without content filtering. An example of this page is shown below:

You must create this Web (HTML) page. It can c ontain the text from, or lin ks to an Acceptable Use Policy (AUP).

This page must contain li nks to two pages c ontained in the SonicWA LL, which, wh en selected, tell the SonicWALL if the user wishes to hav e filtered or unfiltered access. The link for unfiltered access must be <192.168.168.16 8/iAccept.html> and the link for filtered access must be <192.168.168.168/iAcceptFilter.html>, where the SonicWALL LAN IP Address is used instead of "192.168.168.168".

• “Consent Accepted” URL (Filtering Off) When a user accepts the terms outlined in the Consent page and chooses to access

the Internet without the protection of Content Filtering, they are shown a Web page confirming their selection. Enter the URL of this page in the “Consent Accepted” (Filtering Off) field. This page must reside on a Web server and be accessible as a URL by users on the LAN.

Content Filtering and Blocking Page 61

• “Consent Accepted” URL (Filtering On) When a user accepts the terms outlined in the Consent page and chooses to access

the Internet with the protection of Content Filtering, they are shown a Web page confirming their selection. Enter the URL of this page in the “Consent Accepted” (Filtering On) field. This page must reside on a Web server and be accessible as a URL by users on the LAN.

• Consent page URL (Mandatory Filtering) When a user opens a Web browser on a computer using mandatory content filtering,

a consent page is displayed. You must create the Web page that appears when the web browser is opened. It can contain the text from an Acceptable Use Policy, and notification that violations are logged or blocked.

This Web page must reside on a Web server and be accessible as a URL by users on the LAN. This page must also contain a link to a page contained in the SonicWALL that tells the SonicWALL that the user agrees to have filtering enabled. The link must be <192.168.168.168/iAcce ptFilter.html>, w here the SonicWALL LAN IP Address is used instead of "192.168.168.168".

Enter the URL of this page in the Consent page URL (Mandatory Filtering) field and click Update. Once the SonicWALL has been updated, a message confirming the update is displayed at the bottom of the Web browser window.

• Add New Address The SonicWALL can be configured to enforce content filtering for certain computers on

the LAN. Enter the IP addresses of these computers in the Add New Address field and click Submit button. Up to 128 IP addresses can be entered.

To remove a computer from the list of computers to be filtered, highlight the IP address in the Mandatory Filtered IP Addresses list and click Delete Address.

Page 62 SonicWALL Internet Security Appliance User’s Guide

7 Web Management Tools

This chapter d escribe s the SonicWAL L Manage ment Too ls, available in the Tools section of the SonicWALL Web Management Interf ace. The Web Mana gement Tools section allows you to restart the SonicWALL, import and export configuration settings, update the SonicWALL firmware, and perform several diagnostic tests.

There are four tabs in the Tools section:

• Restart

• Preferences

• Firmware

• Diagnostic

Restarting the SonicWALL

Click Tools on the left side of the browser window, and then click the Restart tab.

The SonicWALL can be restarted from the Web Management Interface. Click Restart SonicWALL, and then click Yes to confirm the restart.

The SonicWALL takes up to 90 seconds to restart, and the yellow Test LED is lit. During the restart time, Internet access for all users on the LAN is momentarily interrupted.

Web Management Tools Page 63

Preferences

Click Tools on the left side of the browser window, and then click the Preferences tab.

You can save the SonicWALL settings, and then retrieve them later for backup purposes. SonicWALL recommends saving the SonicWALL settings when upgr ading the firmware.

The Preferences window also provides options to restore the SonicWALL factory def ault settings and launch the SonicWALL Installation Wizard. These functions are described in detail in the following pages.

Page 64 SonicWALL Internet Security Appliance User’s Guide

Exporting the Se ttings File

It is possible to save the SonicWALL configuration information as a file on your computer, and retrieve it for later use.

1. Click Export in the Preferences tab.

2. Click Export again to download the settings file. Then choose the location to save the settings file. The file is named “sonicwall.exp” by default, but it can be renamed.

3. Click Save to save the file. This process can take up to a minute.

Web Management Tools Page 65

Importing the Settings File

After exporting a settings file, you can import it back to the SonicWALL.

1. Click Import in the Preferences tab.

2. Click Browse to locate a settings file which was saved using Export.

3. Select the file, and click Import.

4. Restart the SonicWALL for the settings to take effect.

Note: The Web browser used to Import S ettings must support HTTP uploads. Netscape Navigator 3.0 and above is recommended. Netscape Navigator can be downloaded at <http://www.netscape.com>

Page 66 SonicWALL Internet Security Appliance User’s Guide

Restoring Factory Default Settings

You can erase the SonicWALL configuration settings and restore the SonicWALL to its factory default state.

1. Click Restore on the Preferences tab to restore factory default settings.

2. Click Yes, and then restart the SonicWALL for the change to take effect.

Note: The SonicWALL LAN IP Address, LAN Subnet Mask, and the Administrator Password are not reset.

Updating Firmware

The SonicWALL ha s fla sh memory an d can be easily upgraded with new firmware. Current firmware can be downloaded from SonicWALL, Inc. Web site directly into the SonicWALL.

Note: Firmware updates are only available to registered users. You can register your SonicWALL online at <http://www.mysonicwall.com>

1. Click Tools on the left side of the browser window, and then click the Firmware tab.

Web Management Tools Page 67

To be automatically notified when new firmware is available, select the Notify me when new firmware is available check box. Then click Update. If you enable firmware notification, your So nicWALL sends a status message to SonicWALL, Inc. Firmware Server on a daily basis. The status message includes the following information:

• SonicWAL L Serial Numbe r

• Unit Type

• Current Firmware Version

• Language

• Current Available memory

• ROM version

• Options and Upgrades (SonicWALL VPN, Network Anti-Virus)

Note: Please see the SonicWALL Privacy Policy at www.sonicwall.com/corporate_info/ privacy.html for additional information about privacy.

When new firmware is available, a messag e is e-mailed to the address specified in the Log Settings window. In addition, the Status window includes notification of new firmware availability. This notification provides links to firmware release notes and to a Firmware Update Wizard. Th e Firmware Updat e Wizard simplifies and automates the upgrade process. Follow the instructions in the Firmware Update Wizard to update the firmware.

Page 68 SonicWALL Internet Security Appliance User’s Guide

Updating Firmware Manua lly You can also upload firmware from the local hard drive. Click Upload Firmware.

Note: The Web browse r used to upl oad new f irmware int o the Sonic WALL must su pport

HTTP uploads. Netscape Navigator 3.0 and above is recommended.

When firmware is uploaded, the SonicWALL settings can be erased. Before uploading new firmware, export and save the SonicWALL settings so that they can be restored later. Once the settings have been saved, click Yes.

Web Management Tools Page 69

Click Browse and select the firmware file from your local hard drive or from the SonicWALL Companion CD. Click Upload, and then restart the SonicWALL.

Note: When uploading firmware to the SonicWALL, you must not interrupt the Web browser by closing the window, clicking a link, or loading a new page. If the browser is interrupted, it can corrupt the SonicWALL firmware.

Upgrade Featu res

The SonicWALL can be upgraded to support new or optional features. Chapter 12, SonicWALL Options and Upgrades, provides a summary of the SonicWALL

firmware upgrades, subscription services, and support offerings. You can contact SonicWALL or your local reseller for more information about SonicWALL options and upgrades.

Web:http://www.sonicwall.com E-mail:sales@sonicwall.com Phone:(408) 745-9600 Fax:(408) 745-9300 When an upgrade is purchased, an Activation Key and instructions for registering the

upgrade are included. Once you have registered the upgrade, an Upgrade Key is issued. Enter this key in the Enter upg rade key field and click Update. Follow the instructions included with the upgrade for configuration.

Page 70 SonicWALL Internet Security Appliance User’s Guide

Diagnostic Tools

The SonicWALL has several built-in tools which help troubleshoot network problems. Click

Tools on the left side of the browser window and then click the Diagnostic tab.

DNS Name Lookup

The SonicWALL has a DN S looku p tool th at returns the numerical IP address of a domain name or if you type in an IP address, it returns the domain name.

1. Select DNS Name Lookup from the Choose a diagnostic tool menu.

2. Enter the host name to lookup in the Look up the na me field and click Go. Do not add the prefix "http://". The SonicWALL then queries the DNS server and displays the result at the bottom of the screen.

Note: You must define a DNS server IP address in the Network tab of the General section to perform a DNS Name Lookup.

Find Network Path

The Find Network Path tool shows whether an IP host is located on the LAN, the WAN or the DMZ. This is helpful to determine if the SonicWALL is properly configured. For example, if the SonicWALL “thinks” that a machine on the Internet is located on the LAN port, then the SonicWALL Network or Intranet settings can be misconfigured. Find Network Path shows if the target device is behind a router, and the Ethernet address of the target device. Find Network Path also shows the gateway the device is using and helps isolate configuration problems.

Web Management Tools Page 71

1. Select Find Network Path from the Choose a diagnostic tool menu.

2. Enter the IP address of the device and click Go. The test takes a few seconds to complete. Once completed, a message showing the re sults is displayed in the browser window.

If the network path is incorrect, select the SonicWALL Intranet and Static Routes settings.

Note: Find Network Path requires an IP address. The SonicWALL DNS Name Lookup tool can be used to find the IP address of a host.

Ping

The Ping test bounces a packet off a machine on the Internet back to the sender. This test shows if the SonicWALL is able to contact the remote host. If users on the LAN are having problems accessing services on the Internet, try pinging the DNS server, or another machine at the ISP location. If this test is successful, try pinging devices outside the ISP. This shows if the problem lies with the ISP connection.

Page 72 SonicWALL Internet Security Appliance User’s Guide

1. Select Ping from the Choose a diagnostic tool menu.

2. Enter the IP address of the target device to ping and click Go. The test takes a few seconds to complete. On ce com pleted, a message show ing the results is displayed in the browser window.

Note: Ping requires an IP address. The SonicWALL DNS Name Lookup tool can be used to find the IP address of a host.

Web Management Tools Page 73

Packet Trace

The Packet Trace tool tracks the status of a communications stream as it moves from source to destination. This is a useful tool to determine if a communications stream is being stopped at the SonicWALL, or is lost on the Internet.

To interpret this tool, it is necessary to understand the three-way handshake that occurs for every TCP connection. The following displays a typical three-way handshake initiated by a host on the SonicWALL's LAN to a remote host on the WAN.

1. TCP received on LA N [SYN]

From 192.168.168.158 / 1282 (00:a0:4b:05:96:4a) To 204.71.200.74 / 80 (02:00:cf:58:d3:6a)

The SonicWALL receives SYN from LAN client.

2. TCP sent on WAN [SYN]

From 207.88.211.116 / 1937 (00:40:10:0c:01:4e) To 204.71.200.74 / 80 (02:00:cf:58:d3:6a)

The SonicWALL forwards SYN from LAN client to remote host.

3. TCP received on W AN [SYN,ACK]

From 204.71.200.74 / 80 (02:00:cf:58:d3:6a) To 207.88.211.116 / 1937 (00:40:10:0c:01:4e)

The SonicWALL recei ves SYN,ACK from remote host.

4. TCP sent on LAN [SYN,ACK]

From 204.71.200.74 / 80 (02:00:cf:58:d3:6a) To 192.168.168.1 58 / 1282 (00:a0:4b:05:96:4a)

The SonicWALL forwards SYN,ACK to LAN client.

5. TCP received on LA N [ACK]

From 192.168.168.158 / 1282 (00:a0:4b:05:96:4a) To 204.71.200.74 / 80 (02:00:cf:58:d3:6a)

Client sends a final ACK, and waits for start of data transfer.

6. TCP sent on WAN [ACK]

From 207.88.211.116 / 1937 (00:40:10:0c:01:4e To 204.71.200.74 / 80 (02:00:cf:58:d3:6a)

The SonicWALL forwards the client ACK to the remote host and waits for the data tran sfer to begin.

Page 74 SonicWALL Internet Security Appliance User’s Guide

When using packet traces to isolate network connectivity problems, look for the location where the three-way handshake is breaking down. This helps to determine if the problem resides with the SonicWALL configuration, or if there is a problem on the Internet.

1. Select Packet Trace from the Choose a diagnostic tool menu.

Note: Packet Trace requires an IP address. The SonicWALL DNS Name Lookup tool can be used to find the IP address of a host.

2. Enter the IP address of the remote host in the Trace on IP address field, and click Start. You must enter an IP address in the Trace on IP address field; do not enter a host name, such as “www.yahoo.com”.

3. Contact the remote host using an IP application such as Web, FTP, or Telnet.

4. Click Refresh and the packet trace information is displayed.

5. Click Stop to terminate the packet trace, and Reset to clear the results.

Tech Support Report

The Tech Support Report generates a detailed report of the SonicWALL configuration and status, and saves it to the local hard disk. This file can then be e-mailed to SonicWALL Technical Support to help assist with a problem.

Before e-mailing the Tech Support Report to the SonicWALL Technical Support team, complete a Tech Support Request Form at <http://techsupport.sonicwall.com/ swtech.html>. After the form is submitted, a unique case number is retu rned. Include this case number in all correspondence, as it allows SonicWALL tech support to provide you with better service.

Web Management Tools Page 75

In the Tools section, click the Diagnostic tab, and then select Tech Support Report from the Choose a diagnostic tool menu. Four Report Options are available in the Tech Support Report section:

• VPN Keys - saves shared secrets, encryption, and authentication keys to the report.

• ARP Cache - saves a table relating IP addresses to the corresponding MAC or physical addresses.

• DHCP Bindings - saves entries from the SonicWALL DHCP server.

• IKE Info - saves current information about active IKE configurations.

1. Select Tech Support Report from the Choose a diagnostic tool menu.

2. Select the Report Options to be included with your e-mail.

3. Click Save Report to save the file to your system. When you click Save Report, a warning message is displayed.

4. Click OK to save the file. Attach the report to your Tech Support Request e-mail.

Page 76 SonicWALL Internet Security Appliance User’s Guide

8 Network Access Rules

This chapter describes the SonicWALL Network Access Rules, which determine inbound and outbound access policy, user authentication and remote management. Network Access Rules are configured in the Access section of the SonicWAL L W eb Ma nage me nt Interface. There are five tabs in the Access section:

• Services

• Add Service

• Rules

• Users

• Management

Services

Click Access on the left side of the browser window, and then click the Services tab.

Note: The LAN In column is not displayed if NAT is enabled.

The Services window allows you to customize Network Access Rules by service. Services displayed in the Services window relate to the rules in the Rules window, so any changes on th e Services window appear in the Rules window. The Default rule, at the bottom of the table, encompasses all Services.

Network Access Rules Page 77

LAN Out

If the LAN Out check box is selected, users on your LAN are able to access that service on the Internet. Otherwise, they are blocked from accessing that service. By default, LAN Out check boxes are selected.

DMZ In (Optional)

If a DMZ In check box is selected, users on the Internet can access that service on the DMZ. Otherwise, they are blocked from a ccessing that service on the DMZ. By default, DMZ In check boxes are selected. The DMZ IN column does not appear in the Web Management Interfac e for the SonicWALL SOHO3 a nd SonicWALL TELE3, which do not have a separate DMZ port.

Note: If an Alert Icon appears next to a LAN Out, LAN In, or DMZ In check box, a rule in the Rules window modifies that service.

Public LAN Server

A Public LAN Server is a LAN server designated to receive inbound traffic for a specific service, such as Web or e-mail. You can define a Pu blic LAN Serv er by entering the server's IP address in the Public LAN Server field for th e appropriate service. If you do not have a Public LAN Server for a service, enter "0.0.0.0" in the field. See Creating a

Public LAN Server on the following page for more information.

Windows Networking (NetBIOS) Broadcast Pass Through

Computers runn ing M icro soft W indo ws® communicate with one another through NetBIOS broadcast packets. By default, the SonicWALL blocks these broadcasts. If you select the Windows Networking check box, your SonicWALL allows NetBIOS broadcasts from LAN to DMZ or from LAN to WAN. Then, LAN users are able to view machines on the DMZ and on the WAN in their Windows Network Neighborhood.

Detection Prevention

Enable Stealth Mode

By default, the SonicWALL responds to incoming connection requests as either "blocked" or "open". If you enable Stealth Mode, your SonicWALL d oes not respond to blocked inbound connection requests. Stealth Mode makes your SonicWALL essentially invisible to hackers.

Randomize IP ID

A Randomize IP ID check box is available to prevent hackers using various detection tools from detecting the presence of a SonicWALL appliance. IP pa ck et s ar e gi v en rand om IP IDs which makes it more difficult for hackers to “fingerprint” the SonicWALL appliance. Use this check box for additional security from hackers.

Page 78 SonicWALL Internet Security Appliance User’s Guide

Network Connection Inactivity Timeout

If a connection to a remote server remains idle for more than five minutes, the SonicWALL closes the connection. Without this timeout, Internet connections could stay open indefinitely, creating potential security holes. You can increase the Inactivity Timeo u t if applications, such as Telnet and FTP, are frequently disconnected.

Add Service

To add a service not listed in the Services wind ow, click Access on th e left side of the browser window, and then click the Add Service tab.

The list on the right side of the window displays the services that are currently defined. These services also appear in the Services window.

Two numbers appear in brackets next to each service. The first number indicates the service's IP port number. The second number indicates the IP protocol type (6 for TCP, 17 for UDP, or 1 for ICMP).

Note: There can be multiple entries with the same name. For example, the default configuration has two entries labeled “Name Service (DNS)”--for UDP port 53 and TCP port

53. Multiple entries with the same name are grouped together, and are treated as a single service. Up to 128 entries are supported.

Network Access Rules Page 79

Add a Known Service

1. Select the name of the service you want to add from the Add a known service list.

2. Click Add. The new service appears in the list box on the right side of the browser window. Note that some services add more than one entry to the list.

Add a Custom Service

1. Select [Custom Service] from the Add a known service list.

2. Type a unique name, such as “CC:mail” or “Quake” in the Name field.

3. Enter the beginning number of the IP port range and ending number of the IP port range in the Port Range fields. If the service only requires one IP port, enter the single port number in bot h Port Range fields.

Note: Visit <http://www.ietf.org/rfc/rfc1700.txt> for a list of IP port numbers.

4. Select the IP protocol type, TCP, UDP or ICMP, from the Protocol list.

5. Click Add. The new service appears in the list on the right side of the browser window.

Note: If multiple entries with the same name are created, they a re groupe d together a s a single service and can not function as expected.

Enable Logging

You can enable and disable logging of events in the SonicWALL Event Log. For example, if Linux authentication messages are filling up your log, you can disable logging of Linu x authentication.

1. Highlight the name of the desired service in the list.

2. Clear the Enable Logging check box.

3. Click Modify.

Delete a Service

To delete a service, highlight the name in the list, and click Delete Service. If multiple entries with the same name exist, delete all entries to remove the service.

Rules

The SonicWALL evaluates the source IP address, the destination IP address, and the service type when determining whether to allow or deny traffic. Custom rules take precedence and override the SonicWALL default rules.

By default, the SonicWALL blocks all traffic from the Internet to the LAN and allows all traffic from the LAN to the Internet. Custom rules can be created to modify the default rules. For example, rules can be created for the following purposes:

• Allow traffic from the Internet to a mail server on the LAN.

• Restrict users on the LAN from using a specified service, such as QuickTime.

• Allow specified IP addresses on the Internet to access a sensitive server on the LAN.

Page 80 SonicWALL Internet Security Appliance User’s Guide

To create custom Network Access Rules, click Access on the left side of the browser window, and then click the Rules tab.

Note: Use extreme caution when creating or deletin g Netw ork Ac cess Rules, beca use yo u can disable firewall protection or block access to the Internet.

Add A New Rule

1. Click Add New Rule... to open the Add Rule window.

2. Select Allow or Deny in the Action list depending upon whether the rule is intended to permit or block IP traffic.

Network Access Rules Page 81

3. Select the name of the service affec ted by the Rule from the Service list. If the service is not listed, you must define the service in the Add Service window. The Default service encompasses all IP services.

4. Select the source of the traffic affected by the rule, either LAN, WAN, DMZ, or * , from the Source Ethernet menu.

If you want to define the source IP addresses that are affected by the rule, such as restricting certain users from accessing the Internet, enter the starting IP addresses of the address range in the Addr Range Begin field and the ending IP address in the Addr Range End field. To include all IP addresses, enter * in the Addr Range Begin field.

5. Select the destination of the traffic affected by the rule, either LAN, WAN, DMZ, or *, from the Destination Ethernet menu.

If you want to define the destination IP addresses that are affected by the rule, for example, to allow inbound Web access to several Web servers on your LAN, enter the starting IP addresses of the address range in the Addr Range Begin field and the ending IP address in the Addr Range End field. To include all IP addresses, enter * in the Addr Range Begin field.

6. Select always from the Apply this rule menu if the rule is always in effect. Select from the Apply this rule to define the specific time and day of week to enforce

the rule. Enter the time of day (in 24-hour format) to begin and end enforcement. Then select the day of week to begin and end enforcement.

Note: If you want to enable the rule at different times depending on the day of the week, you have to make additional rules for each time period.

7. If you would like for the rule to timeout after a period of inactivity, set the amount of time, in minutes, in the Inactivity Timeout in Minutes field. The default value is 5 minutes.

8. Do not select the Allow Frag mented Packet s chec k box. Lar ge IP pack ets are oft en divided into fragments before they are routed over the Internet and then reassembled at a destination host. Because hackers exploit IP fragmentation in Denial of Service attacks, the SonicWALL blocks fragmented packets by default. You can override the default configuration to allow fragmented packets over PPTP or IPSec.

9. Click Update. Once the SonicWALL has been updated, the new rule appears in the list of Current Network Access Rules.

Note: Although custom rules can be created that allow inbound IP traffic, the SonicWALL does not disable protection from Denial of Service attacks, such as the SYN Flood and Ping of Death attacks.

Page 82 SonicWALL Internet Security Appliance User’s Guide

For example, to configure the SonicWALL to allow Internet traffic to your web server with an IP address of 208.5.5.5 (Standard mode), create the following rule:

1. Verify that HTTP has been added as a Service as outlined previously.

2. Click the Rules tab, and click Add New Rule....

3. Select Allow, then Web (HTTP) from the Service menu.

4. Select WAN from the Ethernet Source menu, and leave the Addr Range Begin and Addr Range End as they appear.

5. Select LAN from the Ethernet Destination menu, and type in the IP address of the web server, 208. 5 .5. 5 i n the Addr Range Begin field. No IP address is added in the Addr Range End since the destination is not a range of IP addresses.

6. Select always from the Apply this rule menu.

7. Enter a value (in minutes) in the Activity Timeout in Minutes field.

8. Do not select the Allow Fragmented Packets check box.

9. Click Update to add the rule to the SonicWALL.

Note: The source part (WAN, LAN, DMZ) can be limited to certain parts of the Internet using a range of IP addresses on the WAN, LAN or DMZ. Fo r example, the following rule can be used to configure the same web server to be only visible from a single C class subnet on the Internet: Allow HTT P, Source WAN 216 .77.88.1 - 216.7 7.88.254, Dest ination LAN

208.5.5.5.

Creating Public Servers using NAT mode

It is possible to run a single Internet server per protocol on the LAN, using NAT, with only a single IP address from your ISP. You can set up and run an e-mail server, a web server, and an FTP server on different computers and configure them to be visible from the Internet. The following example shows how to configure public servers using NAT mode.

Let’s assume that you have a SonicWALL conf igured in the NAT mode, with IP addresse s on the LAN in t he range 192.1 68.1.1 to 192.168.1.2 54, and a WAN IP address of 208.1.2.3. The web server has an IP address of 192.168.1.10; the e-mail server has an IP address of

Network Access Rules Page 83

192.168.1.11; and the FTP server has an IP address of 192.168.1.12. To enable the servers, click Access on the left side of the Management interface, and then the Services tab.

1. Type in the IP address of the web server in the Public LAN Server field on the Web (HTTP) line.

2. Type in the IP address of the FTP server in the Public L AN Ser ver field on the File Transfer (FTP) line.

3. Type in the IP address of the e-mail server in the Public LAN Server field on the Send Email (POP3) line.

4. Click Update and Restart the unit.

All three servers are visible from the outside using the public IP address 208.1.2.3, and any associated domain names that translate to that address. From the LAN, the servers can only be accessed using the private IP addresses, 192 .168. 1.x o f th e serv ers, n ot th e pub lic IP addresses or domain names.

The public LAN server configuration method described above does not allow a server to be visible at public IP addresses other than the NAT Public IP address of the firewall. Nor does it allow the server to be visible only from certain parts of the Internet. You cannot have two servers using the same port numbers configured in this manner. For more flexible configurations of servers in a NAT environment, you must to use a One-to-One NAT configuration.

This “Public LAN Server” method works because the SonicWALL sees a request for a particular service as a request for a particular port, and routes the request to the host associated with the service.

Note: An IP address on the LAN (e.g. 192.168.1 .x) cannot be used in both Public LAN Server configurations and in One-to-One NAT configurations.

Creating a Public LAN Ser ver

A Public LAN Server is a server on your LAN that is accessible to users on the Internet. Creating a Public LAN Se rver in the Services window is the easiest way to set up a mail server, Web server or other public server, on your LAN.

To create a Public LAN Server, complete the following instructions.

1. Determine what type of service your server uses, such as FT P, Web, or Mail. Locate this service in the Services window. If the service does not appear in the Services window, you must define it in the Add Service window.

2. Enter the server's IP address in the Public LAN Server field for the appropriate service.

Note: If NAT is enabled, this IP address should be a private LAN address. Users on the Internet access the Public LAN Server at the SonicWALL WAN IP (NAT Public) Address.

Page 84 SonicWALL Internet Security Appliance User’s Guide

3. You do not have to remove the Deny Default * to LAN Rule in the Rules window to allow inbound access to a Public LAN Server.

4. Click Update. Once the SonicWALL has been updated, a message confirming the update is displayed at the bottom of the browser window.

Repeat these instructions to configure additional Public LAN Servers.

Additional Notes:

•In Standard Network Addressing Mode , users on the Internet access Public LAN Servers at their valid, LAN IP addresses.

• If NAT is enabled, users on the Internet access Public LAN Servers at the SonicWALL WAN IP (NAT Public) Address.

• If users on the Internet cannot access Public LAN Servers, make sure that the Public LAN Servers have been c o nfigured properly and have Internet connectivity. Also, confirm that the DNS MX record points to the correct IP address--the WAN IP (NAT Public) Address, if NAT is enabled.

• If you have multiple LAN servers of the same service, such as multiple Web servers, and your SonicWALL has been configured for Standard Networ k Addressing Mode, you must to create additional rules in the Rules window for the remaining Public LAN Servers.

• If you have multiple LAN servers of the same service, such as multiple Web servers, and you have enabl ed NA T, you must c onfi gure On e-to- One NA T. Go to Chap ter 9 for more information about One-to-One NAT.

Network Access Rules Page 85

Current Network Access Rules List

All Network Access Rules are listed in the Current Network Access Rules table. The rules are listed from most to least specific. The rules at the top of Current Network

Access Rules list take precedence over rules at the bottom of the list. Edit a Rule

To edit a rule, click the Note Pad icon on the right side of the browser window. A new Web browser window appears, displaying the current configuration of the rule. Make the desired changes and click Update to update the rule. The modified rule is displayed in the list of Current Network Access Rules.

Delete a Rule

To delete a rule, click the Trash Can icon at the right side of the browser window. A dialog box appears with the message “Do you want to remove this rule?”. Click OK. Once the SonicWALL has been updated, a message confirming the update is displayed at the bottom of the browser window.

Enable/Disable a Rule

To disable a rule without permanently removing it, clear th e Enable check box to the right of the rule. To enable a disabled rule, select the Enable check box. The configuration is updated automatically, and a message confirming the update is displayed at the bottom of the browser window.

Restore the Default Network Access Rules

If the Soni cWALL Network Access Rules have been modified or deleted, you ca n restore the Default Rules. The Default Rules prevent malicious intrusions and attacks, block all inbound IP traffic and allow all outbound IP traffic. Click Restore Rules to Defaults to reset the Network Access Rules. Once the SonicWALL has been updated, a message confirming the update is displayed at the bottom of the browser window.

Understanding the Access Rule Hierarchy

The rule hierarchy has two basic concepts:

1. Specific rules override general rules.

• An individual service is more specific than the Default service.

• A single Ethernet link, such as LAN or WAN, is more specific than * (all).

• A single IP address is more specific than an IP address range.

2. Equally specific Deny rules override Allow rules. Rules are displayed in the Current Network Access Rules list from the most specific to

the least specific, and rules at the top override rules listed below. For example, consider the section of the Rules window shown below.

Page 86 SonicWALL Internet Security Appliance User’s Guide

The Default Allow Rule (#7) at the bottom of the page allows all traffic from the LAN to the WAN. However, Rule #1 blocks IRC (Chat) traffic from a computer on the LAN to a server on the WAN.

The Default Deny Rule (#6) blocks all traffic from the WAN to the LAN, however, Rule #2 overrides this rule by allowing Web traffic from the WAN to the LAN.

Examples The following examples illustrate methods for creating Network Access Rules. Blocking LAN access for specific services

This example shows how to block LAN access to NNTP servers on the Internet during business hours.

1. Click Add New Rule in the Rules window to launch the Add Network Access Rule Web browser window.

2. Select Deny from the Action menu.

3. Select NNTP fr om the Service menu. If the service is not listed in the list, you must to add it in the Add Service window.

4. Select LAN from the Source Ethernet menu.

5. Since all computers on the LAN are to be affected, enter * in the Source Addr Range Begin field.

6. Select WAN from the Destination Ethernet menu.

7. Enter * in the Destination Ad dr Range Begin field to block access to all NNTP servers.

8. Select Apply this rule "from" to configure the time of enforcement.

9. Enter "8:30" and "17:30" in the hour fields.

10. Select Mon to Fri from the menu.

11. Click Update to add your new Rule.

Network Access Rules Page 87

Enabling Ping

By default, your SonicWALL does not respond to ping requests from the Internet. This Rule allows ping requests from your ISP servers to your SonicWALL.

1. Click Add New Rule in the Rules window to launch the "Add Network Access Rule" window.

2. Select Allow from the Action menu .

3. Select Ping from the Service menu.

4. Select WAN from the Source Ethernet menu.

5. Enter the starting IP address of the ISP network in the Source Addr Rang e Begin field and the ending IP address of the ISP network in the Source Addr Range End field.

6. Select LAN from the Destination Ethernet menu.

7. Since the intent is to allow a ping only to the SonicWALL, enter the SonicWALL LAN IP Address in the Destination Addr Range Begin field.

8. Select Always from the Apply this rule menu to ensure continuous enforcement.

9. Click Update to add your new Rule.

Page 88 SonicWALL Internet Security Appliance User’s Guide

SonicWALL TELE3 and SOHO3 IP Address Management

The SonicWALL TELE3 has a five node license which is cannot be upgraded. The SonicWALL SOHO3 10-user license and 50-user license allow a maximum of 10 and 50 LAN IP addresses to access the Internet, respectively. The SonicWALL cannot differentiate between IP addresses designated for Internet access and IP addresses intended for LAN access only. You can defin e a Rule to prevent IP addresses from counting toward the SonicWALL SOHO3 IP license limit.

1. Click Add New Rule in the Rules window to launch the "Add Network Access Rule" window.

2. Select Deny from the Action menu.

3. Select Default from the Service menu to block all outbound connections.

4. Select LAN from the Source Ethernet menu.

5. Enter the starting IP address of the range to be blocked in the Source Addr Range Begin field and the ending IP address of the range in the So urce Addr Range End field. For instance, if you are using the 192.168.168.101 through 192.168.168.150 for IP addresses on the LAN, enter 192.168.168.101 as the beginning address and

192.168.168.150 as the ending address.

6. Select * from the Destination Ethernet menu.

7. Enter * from the Destination A ddr Ran ge Beg in field.

8. Select always from the Apply this rule menu to ensure continuous enforcement.

9. Click Update to add your new rule.

Network Access Rules Page 89

Users

The SonicWALL provides an authentication method giving authorized Internet users access to LAN reso u r ces and allows u s er s o n the LAN to bypass Web content filtering. The Users tab allows you to configure the user settings.

User Settings

Click Access on the left side of the browser window, and then click on the Users tab.

• User Idle Timeout This sets the maximum period of inactivity before a user is required to re-establish an

Authenticated Session. The inactivity timeout applies to both Remote Access and Bypass Filters. This value can range from 5 to 99 minutes.

• Current User List The Current User List is a list that displays all currently defined users.

To add a new user, complete the following instructions.

1. Highlight the -Add New User- entry in the Current User List box.

2. Enter the user log in name in the User Name field.

3. Enter the user password in the Password and Confirm Password fields. It is important to use a password that could not be guessed by someone else. Avoid using names of friends, family, pets, etc. The password should consist of random characters, such as “a*$#7fe2j%42”. The password is case sensitive.

Page 90 SonicWALL Internet Security Appliance User’s Guide

4. Choose the privileges to be enabled for the user by selecting one or both check boxes. Two options are available:

• Remote Access - This option provides unrestricted access to the LAN from a remote location on the Internet. Only Standard mode supports Remote Access. If NAT is enabled, VPN client remote access is recomme nded.

• Bypass Filters - This option provides unrestricted access to the Internet from the LAN, bypassing Web, News, Java, and ActiveX blocking.

5. Click Update Use r.

Note: The SonicWALL supports up to 100 users.

Edit User Settings To change a user password or user privileges, highlight the name in the Current User

List, make the changes and click Update User. To delete a user, highli ght th e name and click Remove User.

Establishing an Authenticated User Session

To establi sh an Authenticated User Session, a user must enter the SonicWALL LAN IP Address into the Location or Go to field in their Web browser.

Note: The Web browser used to establish an authenticated session must support Java and JavaScript.

The user sees the SonicWALL authentication window, asking for their user name and password. After completing these fields and clicking Login, their password is verified using MD5 authentication. The password is never sent "in the clear" over the Internet, preventing password theft.

Note: User names are not case sensitive (“john” is equivalent to “JOHN” or “John”), but passwords are case sensitive (“password” is not the same as “Password”).

Once authenticated, remote users are able to ac cess all IP resources on the LAN, and users on the LAN are able to bypass the Content Filter Lists. The connec tion closes if use r inactivity on the connection exceeds the configured time-out period. If the connection is closed, the remote user must re-authenticate.

Note: Authenticated Sessions create a log entry when established. However, user activity is not logged.

Network Access Rules Page 91

SonicWALL Management

SonicWALL SNMP Support SNMP (Simple Network Manageme nt Prot ocol ) is a network protocol used over User

Datagram Protocol (UDP) that allows network administrators to monitor the status of the SonicWALL Internet Security appliances and receive notification of any critical events as they occur on the network. SonicWALL Internet security appliances support SNMP v1/v2c and all releva nt Mana gement Information Base II (MIBII) groups except egp and at. The SonicWALL replies to SNM P Get commands for MIBII via any interface and supports a custom SonicWALL MIB for generating trap messages. The custom SonicWALL MIB is available for download from the SonicWALL website and can be loaded into third-party SNMP management software such as HP Openview, Tivoli, or SNMPC.

To configure SNMP in the SonicWALL Internet Security appliance, log into the SonicWALL Management interface. Click Access, then Management. The SNMP configuration panel is displayed.

The SonicWALL SNMP agent generates two traps: Cold Start Trap and Alert Traps. Cold Start Traps indicates that the SonicWALL appliance is re-initializing itself so that the agent configuration or the appliance can be altered. Alert Traps are based on the existing SonicWALL alert messages which allows the trap messages to share a common message string with the alerts. Accordingly, no trap message can exist without a corresponding alert message.

To configure SNMP, type in the necessary information in the following fields:

1. To enable the SNMP agent, select Enable SNMP.

2. Type in the System Name. This is the hostname of the SonicWALL appliance.

Page 92 SonicWALL Internet Security Appliance User’s Guide

3. In the System Contact field, type in the name of the network administrator for the SonicWALL appliance .

4. Type in an e-mail address, telephone number, or pager number in the System Location field.

5. Create a name for a group or community of administrators who can view SNMP data, and type it into the Get Community Name fie ld .

6. Create a name for a group or community of administrators who can view SNMP traps, and type it into the Trap Community Name field.

7. Enter the IP address or hostname of the SNMP management system receiving the SNMP traps into the Host 1 through 4 fields. Up to 4 addresses or hostnames can be specified.

Configuration of the Log/Log Settings for SNMP

Trap messages are generated only for the categories that alert messages are normally sent, i.e. attacks, system errors, blocked web sites. If none of the categories are selected on the

Log Settings page, then none of the trap messages are sent out. Configuration of the Service and Rules Page s

By default, the SonicWALL appliance responds only to SNMP G et messages received on its LAN interface. Appropriate rules must be set up in the SonicWALL to allow SNMP traffic to and from the WAN. SNMP trap messages can be sent via the LAN, WAN, or DMZ interface.

If your SNMP management system supports discovery, the SNMP agent should automatically discover the SonicWALL appliance on the network. Otherwise, you must add the SonicWALL appliance to the list of SNMP manageable devices on the SNMP management system.

SonicWALL Remote Management

All SonicWALLs include a Management Security Association (SA) for secure remote management. The Management SA does not permit access to remote network resources. Because the Management SA is a standard feature, SonicWALL SOHO3 and SonicWALL PRO 100 owners can remotely manage the SonicWALL with the purchase of the SonicWALL VPN Client rather than the more expensive VPN Upgrade.

Note: If you have enabled VPN on your SonicWALL, the SonicWALL can be managed remotely using a Management SA or with a VPN SA. See Chapter 11 for VPN configuration instructions and basic VPN terms and concepts.

To enable secure remote management, click Access on the left side of the browser window, and click the Management tab. Then select Managed: "from the LAN interface and remotely from the WAN interface" to enable secure remote management.

Network Access Rules Page 93

When remote management is enabled, a Management SA is automatically generated. The Manage ment SA uses Manual Key ing to set up a VP N tunnel betwe en the SonicWAL L and the VPN client. The Management SA also defines Inbound and Outbound Security Parameter In dic es ( SPIs) wh ich match the last eight digits of the SonicWALL serial number. The preset SPIs are displayed in the Security Association Information section. It is not necessary to configure a VPN connection for Remote Management as the Management SA is automatically configured in this section.

1. Enter a 16-character hexadecimal encryption key in the Encryption Key field. Valid hexadecimal characters include 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, A, B, C, D, E and F. An example of a valid encryption key is 1234567890A-BCDEF. Or you can use the randomly generated key that appears in the Encryption Key field.

2. Enter a 32-character hexadecimal authentication key in the Authen tication Key field. An example of a valid authentication key is 1234567- 890ABCDEF1234567890ABCDEF. Or you can use the randomly generated key that appears in the Aut henticati on Key field.

3. Click Update. Restart the SonicWALL for the change to take effect.

Note: When a Management SA is created, the remote Son icWALL is managed at the SonicWALL WAN IP Address. In contrast, when connecting to a VPN SA, the remote SonicWALL is managed at the SonicWALL LAN IP Address.

4. Click Help in the upper right corner of the SonicWALL Management Interface to access detailed instructions for configuring the VPN client. Additional instructions are available at <http://www.sonicwall.com/products/documentation/VPN_documentation.html>.

Page 94 SonicWALL Internet Security Appliance User’s Guide

Note: The Management Method list also includes the option for management by SonicWALL Global Management System (SonicWALL GMS). Select this option if the

SonicWALL is managed remotely by SonicWALL GMS. Refer to SonicWALL GMS documentation for setup instructions.

Manage Using Internet Explorer check box

The check box labeled Manage Using Internet Explorer is selected by default. It enables the Microsoft Internet Explorer web browser to quickly load the SonicWALL Web Management Authentication web page. With the IE check box enabled, the SonicWALL Internet security appliance LAN port responds to NetBIOS name request on port 137.

Users can disable the LAN port response to port 137 by clearing the IE check box, but the log in process into the SonicWALL Management interface slows dow n.

Network Access Rules Page 95

9 Advanced Features

This chapter d escri bes th e Son icWAL L Ad va nc ed F eat ur e s, such as Web Proxy Forwarding, DMZ Address settings, and One-to-One NAT. The Advanced Features can be accessed in the Advanced section of the SonicWALL Web

Management Interface.There are six t abs in the Advanced section:

• Proxy Relay

• Intranet

• Routes

• DMZ Addresses

• One-to-One NAT

• Ethernet

Proxy Relay

Web Proxy Forwarding

A Web proxy server intercepts HTTP requests and determines if it has stored copies of the requested Web pages. If it does not, the proxy completes the request to the server on the Internet, returning the requested information to the user and also saving it locally for future requests.

Setting up a Web proxy server on a ne twork can be cumbersome, be cause each computer on the network must be configured to direct Web requests to the server.

Page 96 SonicWALL Internet Security Appliance User’s Guide

If you have a proxy server on your network, instead of configuring each computer to point to the proxy server, you can move the server to the WAN and enable Web ProxyForwarding. The SonicWALL automatically forwards all Web proxy requests to the proxy server without requiring all the computers on the network to be configured.

Configuring Web Proxy Relay

1. Connect your Web proxy server to a hub, and connect the hub to the SonicWALL WAN port.

Note: The proxy server must be located on the WAN or the DMZ; it can not be located on the LAN.

2. Log into the S onicW ALL Web Ma nage me nt Inte rface . Clic k Adv anced at the left side of the browser window, and then click the Proxy Relay tab at the top of the window.

3. Enter the name or IP address of the proxy server in the Proxy Web Server field, and the proxy IP port in the Proxy Web Server Port field. Click Update.

4. If the Web proxy server is located on the WAN between the SonicWALL and the Internet router, add the Web proxy server address in th e SonicWALL Intranet tab. Click the Intranet tab at the top of the window.

5. To bypass the Proxy Servers if a failure o ccurs, select the Bypass Proxy Servers

Upon Proxy Server Failure check box.

Note: The Intranet settings tab is displayed on page 98.

6. In the Intranet tab, enter the proxy server's IP address in the Add Range field.

7. Select Specifi ed address ran ges are attach ed to the WAN lin k and click Update. Once the SonicWALL has b een updated, a me ssage confirming the update is displayed at the bottom of the browser window.

Bypass Proxy Servers Upon Proxy Failure

If a web proxy server is specified in the Proxy Relay tab of the Advanced section, selecting the Bypass Proxy Servers Upon Proxy Server Failure check box allows clients behind the SonicWALL to bypass the web proxy server in the event it becom es unavailable. Instead, the client’s browser accesses the Internet directly as if a web proxy server is not specified.

Advanced Features Page 97

Intranet

The SonicWALL ca n be configured as an Intranet firewa ll to prevent network users from accessing sensitive servers. By default, users on your LAN can a ccess the In t ernet route r, but not devices connected to the WAN port of the SonicWALL. To enable ac cess to the area between the SonicWALL WAN port and the Internet, you must configure the Intranet settings on the SonicWALL.

Intranet firewalling is achieved by connecting th e SonicWA LL between an unprotec ted and a protected segment, as shown below.

Installation

1. Connect the LAN Ethernet port on the back of the SonicWALL to the net work segment to be protected against unauthorized access.

2. Connect the WAN Ethernet port on the back of the SonicWALL to the rest of the network.

Note: Devices connected to the WAN port do not have firewall protection. It is recommended that you use another SonicWALL Internet security appliance to protect computers on the WAN

3. Connect the SonicWALL to a power outlet. For SonicWALL PRO 200 and SonicWALL PRO 300, press the Power Switch to the ON position.

Page 98 SonicWALL Internet Security Appliance User’s Guide

Intranet Configuration

Click Advanced on the le ft side of the browser window, and then click the Intranet tab.

To enable an Intranet firewall, you must specify which machines are located on the LAN, or you must specify which machines are located on the WAN.

It is best to select the network area with the least number of machines. For example, if only one or two machines are connected to the WAN, select Specified address ranges are attached to the WAN link. That way, you only have to enter one or two IP addresses in the Add Range section. Specify the IP addresses individually or as a range.

Intranet Settings

Select one of the following four options:

• SonicWALL WAN link is con nected directly to the Intern et r outer Select this option if the SonicWALL is protecting your entire network. This is the default

setting.

• Specified address ranges a re at t a ched to the LAN link Select this option if it is easier to specify the devices on your LAN. Then enter your LAN

IP address range(s). If you do not include all computers on your LAN, the computers not included will be unable to send or receive data through the SonicWALL.

Advanced Features Page 99

SonicWALL INTERNET SECURITY APPLIANCE User Manual

Specifications and Main Features

Frequently Asked Questions

User Manual