SonicWALL SonicOS 5.8.1.2 User Manual

Page 1
SonicOS
SonicOS 5.8.1.2 Release Notes for the NSA 220/250M Series Appliances
SonicOS 5.8.1.2 Release Notes for the NSA 220/250M Series Appliances

Contents

Contents ..................................................................................................................................................................1
Platform Compat ibility ..............................................................................................................................................1
Brows er Support ......................................................................................................................................................1
New Features in SonicOS 5.8.1.2 ............................................................................................................................2
Sup ported Features by Applian ce Model ..................................................................................................................3
Known Issues ..........................................................................................................................................................4
Upgradi ng Soni cOS Image Proced ures ....................................................................................................................8
Related Techni cal Docum entation..........................................................................................................................13

Platform Compatibility

The SonicOS 5.8.1.2 release is suppor ted on the following SonicWALL Deep Packet Inspection ( D PI) security appliances:
SonicWALL NSA 250M / 250 M Wireless
SonicWALL NSA 220 / 220 Wireless
The SonicWALL WAN Acceleration App liance Series (WXA 500 Live CD, WXA 2000 appliance, WXA 4000 appliance, WXA 5000 Virtual Ap pliance) are al so supported for use with NSA appliances running 5.8.1.2. The minimum recommend ed Firmware vers ion fo r WX A Series i s 1.0.12.

Browser Support

SonicOS with Visualization uses advanced browser technologies such as HTML5, which are supported in most recent br owsers. SonicWALL recommends us i ng the l atest Chrome, Firefox, Internet Explorer, or Safar i browsers for ad ministration of SonicOS.
This release supports the following Web browsers:
Chrome 11 .0 and high er ( r ecommend ed browse r for dashboard r eal-time gra phi cs di spl a y)
Firefox 4.0 and higher
Internet Explorer 8.0 and higher (do not use compatibility m ode)
Safari 5.0 and higher
Mobil e device browsers are not recomm ended for SonicW ALL appliance system adm i nistration.
Page 2
2
SonicOS 5.8.1.2 Release Notes for the NSA 220/250M Series Appliances

New Features in SonicOS 5.8.1.2

This s ection describes the new features supported in the SonicOS 5.8.1.2 release.

SonicWALL NSA Module Support

SonicOS 5.8.1.2 introduces support for the follo wing SonicWALL NSA modules on the NSA 250M series appliances:
WARNING: You MUST power down the appl iance before instal ling or replacing the modules.
1 Port ADSL (RJ-11) Annex A– Provides As ymmetric D igital Subscriber Lin e ( ADSL) over plai n old telephone service (POTS) with a downstream rate of 12.0 Mbit/s and an upstream rate of 1.3 Mbit/s.
1 Port ADSL (RJ-45) Annex B– Provides A symmetric Digital Subscr iber Line (A DSL) over an In tegr ated Services Di git al Network (ISDN) with a down stream r ate of 12.0 Mbit/s and an upstream rate of 1.8 Mbit/s.
1-port T1/E1 Module – Provides th e connect i on of a T1 or E1 (di git ally multip l exed telecomm unication s carrier system) circuit to a SonicWALL firewall using a RJ-45 jack.
2-port LAN Bypass Module – Rem oves a single poin t of failure so that essential business communication can cont inue whi l e a netwo r k fail ure is diagnosed and r esol ved.
2-Port SFP Module – A smal l form-factor pluggabl e ( SFP) network interface module.
Page 3
3
SonicOS 5.8.1.2 Release Notes for the NSA 220/250M Series Appliances

Supported Features by Appliance Model

The follo wing table l ists the key fe atures in the SonicOS 5.8. 0.x, 5.8.1.0, 5.8.1.2 releases, and whi ch are supported on the Soni cWALL NSA 220 and 250M ser i es appliances.
Features Supported on NSA 220 and NSA 250M Series
DPI-SSL Link Aggregation NSA Modules (supported only on NSA 250M Series ) Port R edun dancy Wirel ess Cli ent Bridge Support Wire M ode App Flow Monitor Real-Time Monit or Top Global Malware Log M onit or Connection Monitor Packet Moni tor Log > Flow Reporting App C ontr ol Advanced App R ules Cloud GAV NTP Auth Type CFS Enhancements
Features Not Supported on NSA 220 and NSA 250M Series
IPFIX & NetFlow Reporting VLAN SonicPoint VAPs CASS 2.0 Enhanced Connection Limit Dynamic WAN Scheduling Browser NTLM Auth SSO Import from LDAP SSL VPN NetExtender Updat e DHCP Scalability Enhancements SIP Application Layer Gateway Enhancements SonicPoint-N DR Acc ept Mu l tip le Proposals for C lients WAN Acceleration Support App C ontr ol Polic y Config uration via App Flow Monitor Global BWM Ease of Us e Enhan cements
Page 4
4
SonicOS 5.8.1.2 Release Notes for the NSA 220/250M Series Appliances
Features Supported on
NSA 220 and NSA 250M Series
NSA 220 and NSA 250M Series
App l icati on Usage and Risk Report
Geo-IP Filtering an d Botnet Command & Control Filter i ng
Custo miz a bl e Login Page
LDAP Prim ary Group Attribute
Preservation of Anti-Virus Exclusions After Upgrade
Management Traf fic Only Op tion for Network In terfaces
Current U sers and Detail of Us er s Options for TSR
User Monitor Tool
Auto-Configurati on of URLs to Bypas s User Authentic ation
Symptom
Condition / Workaround
Issue
App C ontr ol advanc ed signatures are applied to
Occurs when enabling the App Control service on
107296
App rules remain in effect even when disabled
Occurs when the Enable App Rules checkbox is
action is applied.
101194
Related traffic confi gur ed in an application r ule
Occ urs wh en an application rul e is created us ing
Enable App Rules
100120
Features Not Supported on

Known Issues

This section contains a list of known issues in t he SonicOS 5.8.1.2 release.

Application Control

traffi c from and to the VPN zone, r ather than the WAN zone only.
globally.
is b l ocked even though the Enable App Rules checkbox is not selected.
the WAN zone, and then enabl ing th e logging or bloc king action for any si gnatur e. Aft er traffi c is gen er ated from the LAN to the VPN, the App control si gnatur es are applied to VP N traffic.
cleared t o disable t hese policies globall y, then an app r ule is created. When traffic on the WAN interface mat ches the rule, the configur ed polic y
Create Rule on th e App Flow Monitor page and the Enabl e App Rules checkb ox is not selected, which is the factory default setting. The app rule is created and functions properly, even though the
checkbox is disabled.
Page 5
5
SonicOS 5.8.1.2 Release Notes for the NSA 220/250M Series Appliances

Bandwidth Management

Symptom
Condition / Workaround
Issue
Traffic is dropped when the ingress or egress
Occurs when modifying the ingress or egress
101286
Bandwidt h manag emen t appl icati on rules are
Occurs when creating a bandwidth management
High
100116
Symptom
Condition / Workaround
Issue
The Bot net Service is incorrectly listed on the
Botnet C om mand & C ontr ol Filter ing is not
page should be ignored.
108038
An iP ad cli ent fails to connect to the L2TP
Occurs when GroupVPN is enabled and
Down Arrow button).
106801 The err or message “This request is blocked by
Occurs when navigating to the S ecurity Services
server.
105889
The Geo-IP and Botnet Exclusion Objects do
Occurs when enabling the checkbox for Block All
packets are dropped by the Geo-IP filter.
100010
values for an in terface are modified and traffic is passing through that interface.
sometimes mapped t o the wrong global BWM priority queue.

Firmware

Secu r i ty Services > Summary page and the System > St atus page of t he SonicWALL TZ 200 wireless appliance, even though the ser vice is n ot supp or ted on thi s platform.
server if MS C HAP v2 authenticat i on is set as the first or der au thenti cation method.
interface values while the interface is passing traffic. Workaround: Stop traffic on the interfac e, and then mod ify the values.
rule on the App Flow Monitor page and sett ing the priori ty to High. The App Flow Monitor page displays the created rule with a Medium priority setting, even though
supported on the SonicWALL TZ 100 and TZ 200 series app liances (as al so reflected in the Sup ported Features by Applian ce Model tabl e of the Release Notes). The Botnet service listing indicating 'Not Licensed' on th e System > St atus
configured for an L2TP. The i Pad can su ccessfully connect if PAP authentication is set as the firs t order authenticat ion method, but fails if MSCHAPv2 is prefered. A Windows XP cli ent can succesfully connect using MSCHAPv2. Workaround: Move MS C HAP v2 to t he bottom of the authentication protocol list (by clicking on the
was selected.
the sonicwall gateway botnet service. B otnet Responder IP: 125.39.127.25" is displayed.
not take effect, caus ing DN S quer y packets to be incorrectly dropped.
> Geo-IP & Botnet F ilter page and enabling the “Bloc k con nections to/ from Botnet C om mand and Control System s” option. For example, when trying to view the qq.com web site, the site is bloc ked even though it is n ot consi dered a Botnet
Connections to/from Following Countries, selecting all c oun tries, and enteri ng DNS Servers into th e Exclusion Object. When a web page is accessed and the packet monitor is used to capture pack ets, you can see that all DNS query
Page 6
6
SonicOS 5.8.1.2 Release Notes for the NSA 220/250M Series Appliances

High Availability

Symptom
Condition / Workaround
Issue
With Acti ve/ Pass i ve High Availability enabled
Occurs when HA is enabled with probing and th e
Load Balan cing or HA probing.
97883
Symptom
Condition / Workaround
Issue
The LAN Bypass modul e’s Bypass Status LED
in which bypass is ready, but not active.
Occurs when configu r ing an SFP module in Layer
108416
The ADSL card cannot connect in DHCP mode.
Occurs when configuring an ADSL card with the
106473
Symptom
Condition / Workaround
Issue
On the X1 interface, 1G bps traffic someti mes
Occurs when passing traffic through the X1
auto-negotiate l i nk s peed.
105890 Configuri ng m or e than one remote ap pliance dropped routes.
Occ urs wh en an addit ional remot e appliance is enabled.
102961
with probing, and the pri mary W AN interface configured with a redundant port, the primary WA N interfac e and all routes t o thi s subn et are mark ed as down when the primary port stops working.

Module

indicates that byp ass mode is active during the boot process, then changes to the norm al mode
primary WAN interface is configur ed with a redundant port. If the link for the active port goes down, L oad Balancing (enabled by default) will change the status of t he p r imary WAN inter face to “Failover”. All routes to the primary WAN subnet will be mar ked as down and traffic destined to the subnet will fail. However, traffic will st ill s ucceed to any destin ation that is on the far side of the defaul t gatewa y of the p r i mary WA N interfac e, b y using the redundant port. Workaround: Disable
2 Br idge Mode, then replacing it with a LAN Bypas s module.
WA N in DHCP mode. Th e Status mode, P oint-to­Point Tunneling Protocol (PPTP) , and Layer 2 Tunne l i ng Pr o t o col (L2TP) do not work with this configuration.

Networking

does not reach the WAN. Aft er configuring the link speed, the link status displays the previously configured speed.
with a tunnel interface and OSPF could r esult in
interface with a 1Gbps swit ch and forcing the X1 interface’s link speed to 1000Mbps or 100Mbps. Workaround: Configure the SonicOS to
configur ed with a tunnel i nterface and OSP F is
Page 7
7
SonicOS 5.8.1.2 Release Notes for the NSA 220/250M Series Appliances

System

Symptom
Condition / Workaround
Issue
The MO/M1 status LED does not indi cate t he
Occ urs wh en inser tin g a modu le into the
107620 The syst em p r eferen ces d o not i m port correctly. 192 .168.168.168 and the user cannot l og in.
Occ urs wh en importing preferences from a then performing a restarting.
107209 Symptom
Condition / Workaround
Issue
The NetFlow EndTime timestamp results in
Occ urs wh en the N etFlow collector’s l ogging is
timestam p displays as 0.00000.
102961
Symptom
Condition / Workaround
Issue
Sometimes, the sec ondary IPSec gatewa y is
Occ urs wh en there ar e two S onicWALL devices
103935
Having multip le tun nel interface p olicies with the
tunnel t o be active.
Occ urs wh en there ar e two or more tunnel
103398
presence of a module.
The LAN IP address is changed to

Visualization

0.00000 for valid and allowed TCP packets.
VPN
un able t o establish a tunnel with a peer i f the primary gatewa y is unreach able.
appliance and booting the system. The M0/M1 status LED should be on when a valid mod ule is detected in the slot and bl i nk if a modu l e is present but not supp or ted.
TZ 200 appliance into a NSA 250M appliance,
enab l ed on App l icable Inter faces and Rules, and TCP traffic is sent to the all owed desti nati on. Up on checking the p acket capture details, the EndTime
with VPN configured and the cable from the secondary gateway is unplugged.
same IPSec gateway but different ports configured on the firewall can cause only one
interface policies using th e same IPSec g ateway and those interfac es are bound to different ports.
Page 8
8
SonicOS 5.8.1.2 Release Notes for the NSA 220/250M Series Appliances

Upgrading SonicOS Image Procedures

The following procedures are for upgrading an existing SonicOS image to a newer versi on:
Obtaining the Latest SonicOS Image Version...........................................................................................................8
Savi ng a Back up Copy of Your Configuration Pr ef er ences .......................................................................................8
Upgrading a SonicOS Image with Current Preferences ............................................................................................9
Importing Preferences to SonicOS 5.8 .....................................................................................................................9
Importing Preferences from SonicOS Standard to SonicOS 5.8 Enhanced .............................................................10
Support Matrix for Importing Preferences ...............................................................................................................11
Upgrading a SonicOS Image with Factory Defaults ................................................................................................12
Using Saf eM ode to Upgrade Firmware ..................................................................................................................12

Obtaining the Latest SonicOS Image Version

To obtain a new Son i cOS firm ware imag e file f or your Soni cWALL security appliance:
1. Connect to your myson i cwall.com account at http://www.mysonicwall.com
2. Copy the new S onicOS image file to a di r ectory on your management stati on.
You can update the SonicOS image on a SonicWALL security appl iance r emot ely if the LAN interface or the W AN interface is configured for man agement access.
.

Saving a Backup Copy of Your Configuration Preferences

Befor e beginning the update process, mak e a system back up of your SonicWALL securi ty applian ce con fi gur ation settings. The backup feature saves a cop y of your current configuration sett ings on your SonicWALL s ecuri ty app l iance, pr otect ing all your exis tin g settings in the event that it becomes necess ar y to return to a previous configur ation stat e.
In addit ion t o using the backup feature to s ave you r curr ent configuration settings to th e SonicWALL security app l iance, you can export the con fi gur ation preferences file to a direc tory on you r local managemen t s tation. This file s erves as an e xt er nal backup of the config uration preferences, and can be im por ted back int o the SonicWALL security appliance.
Perform the following steps to save a backu p of your configuration settings and export them to a file on you r l ocal management station :
1. On the System > Settings page, click Create Backup. Your config uration preferences ar e sav ed. The System B ackup entry is displayed in the Firmware Managem ent table.
2. To expo r t your s ettings to a local file, cl i ck Export Setting s. A popup window displays the nam e of the saved file.
Page 9
9
SonicOS 5.8.1.2 Release Notes for the NSA 220/250M Series Appliances

Upgrading a SonicOS Image with Current Preferences

Perform the following steps to upload new firmware to your Soni cWALL appl i ance and use your current configur ation sett ings upon startup:
1. Downl oad the SonicOS firm ware imag e fi le f r om mysoni cwall.com and save it to a l ocation on your local computer.
2. On the System > Settings page, click Upload Ne w Firmw are.
3. Brows e to the location wh ere you saved the Soni cOS firmware imag e fi l e, select the file, an d click Upload.
4. On the System > Settings page, click the Boot icon in the row for Uploaded Firmware.
5. In the confirm ation dialog box, cli ck OK. The S onicWALL r estarts an d then displays t he log in page.
6. En ter your user name and pass word. You r new SonicO S image versi on information is lis ted on the System > Settings page.

Importing Preferences to SonicOS 5.8

Prefe r ences i mporting to the SonicWALL UTM appliances is generally supported from the following SonicWALL appli a nc e s run ning SonicO S:
NSA Ser i e s
NSA E-Class Ser ies
TZ 210/200/100/190/180/170 Series
PRO Series
There ar e certain excep tion s to preferences importi ng on these appli ances ru nning the S onicOS 5.8 release. Prefe r ences cannot be imp or ted i n the foll owing cases:
Setting s files c ontai ning Portshield in terfaces created prior to SonicO S 5.x
Settings files contai ni ng V LAN i nte r faces are not accepted by t he TZ 100/200 Series firewalls
Setting s files from a PRO 5060 with optical fiber interfaces where V LAN interfac es have been created
Full support for prefer ences i mporting from these applian ces is tar geted for a future releas e. At that time, you will need to upgrad e your firmware to the latest SonicO S maint enance release available on MySonicWALL.
Page 10
10
SonicOS 5.8.1.2 Release Notes for the NSA 220/250M Series Appliances

Importing Preferences from SonicOS Standard to SonicOS 5.8 Enhanced

The SonicOS Standard to Enhanced S ettings Converter is designed to c onvert a s ource Standard Net work Settings file to be c omp atible with a tar get Soni cOS Enhanced appliance. Due to the more a dvanced n ature of Soni cOS Enhanced, its Network Sett ings file is mor e complex than the one SonicO S Standard uses. They are not compati ble. The Set ting s Converter creat es an entirely new target Enhanced Net work Settings file based on the network sett i ng s found in the sou r ce Standard file. This allows for a rapid upgr ade from a Standard deploym ent to an Enhanced one with no tim e wasted in re-creating network policies. Note: SonicWALL recommend s deploying the converted target Network Settings file in a test ing environment first and always ke eping a backup copy of the origi nal source N etwork Settings file.
The SonicOS Standard to En hanced Sett ings Converter is available at:
https://convert.global.sonicwall.com/
If the preferences conversion fails, email your S onicOS Standard configuration file to
settings_converter@sonicwall.com
manually configuri ng your Soni cWALL appliance. To con vert a Standard Network Setting s file to an Enhanced one:
1. Log i n to the management interface of your SonicOS Stand ar d appliance, n avigate to Sy stem > Settings, and save your netwo r k settin gs to a file on your m anagement computer.
2. On the management computer , poi nt your browser to https://convert.global.sonicwall.com/
3. Click the Settings Converter button.
4. Log i n using your M ySonicWALL credent ials and agree to the security s tatement. The sou r ce Standard Network Setting file must be uploaded to MySonicWAL L as part of t he conversion
process. The Set tin g Conversi on tool uses MySonicWALL authentication to s ecure private network settings. Users should be aware that SonicWALL will retain a copy of their network settings after the conversion process is complete.
5. Upload the source Standar d Net work Settings file:
Click Browse.
Navigate t o and select th e source SonicOS Standar d Settings file.
Click Upload.
Click th e r ight ar r ow t o proceed.
6. Review the s ource Soni cOS Stand ar d Settings Summar y page. This page displays useful network settings information contained in the uploaded source Network Sett ings
file. For testing purposes, the LAN IP and subnet mask of the appliance can be changed on this page in order to deploy it in a testing environment .
(Op tion al) Change the LAN IP address an d subnet mas k of t he source appli ance to that of the targ et appliance.
Click th e r ight ar r ow t o proceed.
7. Select the target SonicWALL appliance for the Enhanced deployment from the avail able li st. Son i cOS En hanced is c onfigu r ed differen tly on various SonicWALL appliances, most l y to support differ ent
interface numbers . As such, th e convert ed Enhanced Network Settings file must be customized to the app l iance targ eted for depl oyment.
8. Complete the conversi on b y clicki ng the righ t arrow to proceed.
9. Optionally click the Warnings link to view an y differences in the settings c r eated for the target appliance.
10. Click the Download button, select Save to Disk, and cli ck OK to s ave the new target Soni cOS En hanced
Network Set tin gs fil e to your managem ent computer.
11. Log in to the management in terface f or your Soni cWALL appliance.
12. Navigate t o System > Settings, and click t he Import Settings bu tton to imp or t the con verted s ettings to
your appliance.
with a short des crip tion of the pr oblem. In this case, you may also consider
.
Page 11
11
SonicOS 5.8.1.2 Release Notes for the NSA 220/250M Series Appliances

Support Matrix for Importing Preferences

Page 12
12
SonicOS 5.8.1.2 Release Notes for the NSA 220/250M Series Appliances

Upgrading a SonicOS Image with Factory Defaults

Perform the following steps to up l oad n ew firmware to your S onicWALL appliance and s tart i t up using the default configuration:
1. Download the SonicOS firmware image fil e from mysonicwall.c om and save it to a location on your local
2. On the System > Settings page, click Create Backup.
3. Click Upload New Firmware.
4. Brows e to the location wh ere you saved the Soni cOS firmware imag e fi l e, select the file, an d click Upload.
5. On the System > Settings page, click the Boot icon in the row for Uploaded Firmware with Factory
6. In the confirm ation dialog box, cli ck OK. The SonicWALL restarts and then displays t he Setup Wi zard, wit h
7. En ter the default user name and password (admin / password) to access the Soni cWALL management
computer.
Defau lt Set tings. a link to the login page. interface.

Using SafeMode to Upgrade Firmware

The SafeMode procedure uses a r eset button in a small pinhole, whose location varies: on the NSA models, the bu tton is near the USB ports on the front; on the TZ mod el s, th e button is next to the power cor d on the back . If you are unable to connec t to the SonicWALL security appliance’s man agement interface, you can restart the Son i cWALL secur i ty applian ce in SafeMode. The S afeM ode feature al lows you to qui ckly recover from uncertain configur ation stat es with a simp l ified managem ent inter face t hat i ncludes the same settings availabl e on the System > Sett in gs page.
To use S afeMode to upgr ade firmware on th e SonicWALL secu r ity appliance, perform the following s teps:
1. Connect your computer to the X0 port on the Son icWALL app l iance and configure your IP address with an
address on the 192.168.168.0/24 subnet, such as 192.168.168.20.
2. Do one of t he fol l owing to restart t he app l iance in SafeMode:
Use a n ar r ow, straig ht object, li ke a str ai gh tened paper clip or a toothpick, to press and hold the reset bu tton on the front of the sec urity appliance for more than 20 seconds.
Use the LCD cont r ol buttons on the fron t bezel to s et the appliance to Safe Mode. Onc e selected, the LCD displ ays a confirmat ion prompt. Select Y and pre ss the Right button to confirm. The SonicWALL security appli ance c hanges to S afeMode.
The Test li ght starts blinking when the SonicWALL security appliance has reb ooted i nto SafeMode.
Note: Holding the reset button for two seconds will send a diagnostic snapshot to the console. Holdi ng t h e reset button for six to eight seconds will reboot the appliance in regular mode.
3. Point th e Web br owser on your computer to 192.168.168.168. The SafeMode management interface displays.
4. If you h ave made any c onfig uration chan ges to t he sec urity appliance, sel ect th e Create Backup On Next Boot checkbox to make a b acku p copy of your current settings. Your settings will be saved when the app l iance r estarts.
5. Click Upload New Firmware, and then browse to t he location where y ou sav ed the Soni cOS firmware image, s elect the fil e, and cli ck Upload.
6. Select the boot icon in the row for one of the following:
Uploaded Firmware – New!
Use this opti on to restart t he app l iance with you r current configuration sett ings.
Uploaded Firmware with Factory Defaults – New!
Use this opti on to restart t he app l iance with default con fi gur ation sett ings.
7. In the confirm ation dialog box, cli ck OK to pr oceed.
8. After suc cessfully booting the firmware, the log in screen i s displayed. If you booted with fact ory defaul t settings, ent er the default user name and pass word (admin / password) t o access th e Soni cWALL management interface.
Page 13
13
SonicOS 5.8.1.2 Release Notes for the NSA 220/250M Series Appliances

Related Technical Documentation

Son i cWALL user guides and reference doc um entation is avail able at t he SonicW ALL Techni cal Documen tati on Online Li br a ry: http://www.sonicwall.com/us/Support.html
For basic and advanced depl oyment examples, r efer to Soni cOS Guides and SonicOS TechNotes availabl e on the Website.
______________________ Last updated: 11/14/2011
Loading...