User manual SONICWALL INTERNET SECURITY APPLIANCE - ADMINISTRATORS GUIDE

COMPREHENSIVE INTERNET SECURITY TM SonicWALL Internet Security Appliances ADMINISTRATOR'S GUIDE Contents Copyright Notice ..................................................................................................11 About this Guide ..................................................................................................12 SonicWALL Technical Support ...........................................................................13 Firmware Version ................................................................................................13 1 Introduction ...................................................................................... 14 SonicWALL Internet Security Appliance Features .............................................15 2 Configuring the Network Mode on the SonicWALL ........................... 18 Configuring the SonicWALL in Standard Mode .................................................19 Configuring the SonicWALL in NAT Enabled Mode ...........................................20 Configuring NAT with PPPoE Client ....................................................................26 Configuring NAT with DHCP Client .....................................................................32 Configuring NAT with L2TP Client .......................................................................37 Configuring NAT with PPTP Client ......................................................................38 Logging into the SonicWALL Management Interface .......................................44 3 Registering at mySonicWALL.com .................................................... 46 Creating a New User Account .............................................................................46 Problems Creating a MysonicWALL.com User Account? ..................................51 User Name and Password Functions .................................................................51 Registering Your SonicWALL Internet Security Appliance ................................51 Click Here Registration .......................................................................................51 Quick Registration ...............................................................................................52 Status and Options .............................................................................................53 Managing Your SonicWALL .................................................................................54 Renaming Your SonicWALL ................................................................................54 Transferring a SonicWALL Product ....................................................................55 Delete Product ....................................................................................................56 Managing Services for SonicWALL Internet Security Appliances ....................57 Activating Services Using mySonicWALL.com ...................................................58 4 Configuring the TELE3 SP Modem Connection .................................. 60 Configuring the TELE3 SP WAN Failover Feature .............................................60 Configuring Modem Profiles ...............................................................................61 Dial-Up Configuration ..........................................................................................61 ISP Settings .........................................................................................................62 Location Settings ................................................................................................62 TELE3 SP Modem Configuration ........................................................................64 Modem Settings ..................................................................................................64 Contents Page 1 Primary Interface .................................................................................................65 Failover Settings .................................................................................................65 Configuring a Modem Profile for Manual Dial-Up .............................................66 Status ...................................................................................................................69 Modem Status .....................................................................................................69 Chat Scripts .........................................................................................................70 Custom Chat Scripts ...........................................................................................71 5 Managing Your SonicWALL Internet Security Appliance .................. 72 Status ...................................................................................................................73 CLI Support and Remote Management .............................................................75 6 General and Network Settings .......................................................... 76 Network Settings .................................................................................................76 Network Addressing Mode .................................................................................76 LAN Settings ........................................................................................................77 Multiple LAN Subnet Mask Support ..................................................................77 WAN Settings .......................................................................................................78 DNS Settings .......................................................................................................78 Standard Configuration ......................................................................................79 NAT Enabled Configuration ................................................................................79 NAT with DHCP Client Configuration ..................................................................81 NAT with PPPoE Configuration ...........................................................................82 Restarting the SonicWALL ..................................................................................83 NAT with L2TP Client Configuration ...................................................................84 Restarting the SonicWALL ..................................................................................85 NAT with PPTP Client Configuration ...................................................................86 Restarting the SonicWALL ..................................................................................87 Setting the Time and Date .................................................................................88 NTP Settings ........................................................................................................88 Configuring the Administrator Settings .............................................................89 Administrator Name ............................................................................................89 Change the Administrator Password .................................................................89 Setting the Administrator Inactivity Timeout .....................................................90 Login Failure Handling ........................................................................................90 Page 2 SonicWALL Internet Security Appliance Administrator's Guide 7 Logging and Alerts ............................................................................ 91 View Log ...............................................................................................................91 SonicWALL Log Messages ..................................................................................92 Log Settings .........................................................................................................93 Configure the following settings: ........................................................................93 Log Categories .....................................................................................................95 Alerts/SNMP Traps .............................................................................................96 Reports ................................................................................................................96 Web Site Hits .......................................................................................................97 Bandwidth Usage by IP Address ........................................................................97 Bandwidth Usage by Service ..............................................................................97 SonicWALL ViewPoint .........................................................................................98 8 Content Filtering and Blocking ......................................................... 99 Configuring SonicWALL Content Filtering ........................................................100 Restrict Web Features ......................................................................................100 URL List ..............................................................................................................101 Customizing the Content Filtering List .............................................................103 Consent ..............................................................................................................105 Mandatory Filtered IP Addresses .....................................................................106 Configuring N2H2 Internet Filtering .................................................................107 Restrict Web Features ......................................................................................107 Configuring the Websense Enterprise Content Filter .....................................110 Restrict Web Features ......................................................................................110 Configuring the Websense Content Filter List .................................................112 Websense Server Status ..................................................................................112 Settings ..............................................................................................................112 URL Cache .........................................................................................................113 9 Web Management Tools ................................................................. 114 Restarting the SonicWALL ................................................................................114 Preferences .......................................................................................................115 Exporting the Settings File ................................................................................115 Importing the Settings File ...............................................................................116 Restoring Factory Default Settings ..................................................................116 Updating Firmware ............................................................................................117 Updating Firmware Manually ...........................................................................118 Upgrade Features .............................................................................................119 Diagnostic Tools ................................................................................................120 DNS Name Lookup ...........................................................................................120 Contents Page 3 Ping ....................................................................................................................122 Packet Trace ......................................................................................................123 Trace Route .......................................................................................................126 10 Network Access Rules ................................................................... 127 Viewing Network Access Rules ........................................................................127 Services .............................................................................................................128 LAN Out ..............................................................................................................128 DMZ In (Optional) ..............................................................................................128 LAN In .................................................................................................................128 Public LAN Server ..............................................................................................129 Windows Networking (NetBIOS) Broadcast Pass Through .............................129 Windows Messenger Support ..........................................................................129 Detection Prevention ........................................................................................129 Network Connection Inactivity Timeout ...........................................................129 Add Service ........................................................................................................130 Add a Known Service ........................................................................................130 Add a Custom Service .......................................................................................130 Enable Logging ..................................................................................................131 Delete a Service ................................................................................................131 Rules ..................................................................................................................131 Maximum Number of Rules by Product ...........................................................132 Network Access Rule Logic List .......................................................................133 Bandwidth Management ..................................................................................133 Add A New Rule .................................................................................................134 Add New Rule Examples ...................................................................................136 Current Network Access Rules Table ...............................................................137 Users ..................................................................................................................139 Global User Settings .........................................................................................139 User Login ..........................................................................................................142 RADIUS ...............................................................................................................143 Management ....................................................................................................145 SonicWALL SNMP Support ...............................................................................145 SonicWALL Management Protocol ...................................................................146 Additional Management ...................................................................................146 Page 4 SonicWALL Internet Security Appliance Administrator's Guide 11 Advanced Features ....................................................................... 148 Proxy Relay ........................................................................................................148 Web Proxy Forwarding ......................................................................................148 Configuring Web Proxy Relay ............................................................................149 Bypass Proxy Servers Upon Proxy Failure .......................................................149 Intranet ..............................................................................................................150 Installation .........................................................................................................150 Intranet Configuration .......................................................................................151 Intranet Settings ...............................................................................................151 VPN Single-Armed Mode (stand-alone VPN gateway) .....................................152 Configuring a SonicWALL for VPN Single Armed Mode ..................................153 Routes ................................................................................................................154 LAN Route Advertisement ................................................................................155 RIPv2 Authentication ........................................................................................156 DMZ Route Advertisement ...............................................................................156 DMZ Addresses .................................................................................................156 DMZ in Standard Mode ....................................................................................157 DMZ in NAT Mode .............................................................................................157 Delete a DMZ Address Range ..........................................................................158 HomePort Configuration ...................................................................................158 HomePort in Standard Mode ...........................................................................158 HomePort in NAT Mode ....................................................................................159 Delete a HomePort Address Range .................................................................159 One-to-One NAT .................................................................................................160 One-to-One NAT Configuration Example ..........................................................161 Ethernet .............................................................................................................162 WAN Link Settings .............................................................................................162 Enable Bandwidth Management .....................................................................162 DMZ/WorkPort Link Settings ...........................................................................163 LAN/HomePort Link Settings ...........................................................................163 Proxy Management workstation ethernet address on WAN ..........................163 MTU Settings .....................................................................................................163 SonicWALL Bandwidth Management ..............................................................164 Contents Page 5 12 DHCP Server .................................................................................. 166 Setup ..................................................................................................................166 Allow DHCP Pass Through in Standard Mode .................................................166 Configuring the SonicWALL DHCP Server ........................................................167 Deleting Dynamic Ranges and Static Entries .................................................168 DHCP over VPN .................................................................................................168 DHCP Relay Mode .............................................................................................168 Configuring the Central Gateway for VPN over DHCP .....................................169 Configuring the Remote Gateway for VPN over DHCP ....................................169 DHCP Status ......................................................................................................172 DHCP Server on the SonicWALL TELE3 TZ and TZX .......................................173 Setup ..................................................................................................................173 Allow DHCP Pass Through in Standard Mode .................................................173 Configuring the SonicWALL DHCP Server ........................................................174 Deleting Dynamic Ranges and Static Entries .................................................175 DHCP Status ......................................................................................................176 13 SonicWALL VPN ............................................................................ 177 VPN Management Interface .............................................................................178 Summary Tab ....................................................................................................178 Global VPN Settings ..........................................................................................178 VPN Bandwidth Management ..........................................................................179 VPN Policies .......................................................................................................179 Currently Active VPN Tunnels ...........................................................................179 SonicWALL NAT Traversal Support ..................................................................180 AES (Advanced Encryption Standard) Support ...............................................180 Configure Tab ....................................................................................................181 Add/Modify IPSec Security Associations .........................................................181 Security Policy Settings .....................................................................................182 Destination Networks .......................................................................................186 Advanced Settings ............................................................................................187 Enable Keep Alive .............................................................................................187 Try to bring up all possible SAs ........................................................................187 Require authentication of local users .............................................................188 Require authentication of remote users .........................................................188 Enable Windows Networking (NetBIOS) broadcast ........................................188 Apply NAT and firewall rules .............................................................................188 Forward Packets to Remote VPNs ...................................................................188 Route all internet traffic through this SA .........................................................189 Page 6 SonicWALL Internet Security Appliance Administrator's Guide Enable Perfect Forward Secrecy ......................................................................189 Phase 2 DH Group ............................................................................................189 Default LAN Gateway ........................................................................................189 VPN Terminated at the LAN, DMZ, or LAN/DMZ .............................................190 Advanced Settings for VPN Configurations .....................................................191 Configuring SonicWALL VPN .............................................................................192 Group VPN Configuration for the SonicWALL and VPN Client ........................193 Configuring Group VPN on the SonicWALL ......................................................193 Group VPN Client Setup ....................................................................................195 Manual Key Configuration for the SonicWALL and VPN Client ......................199 Configuring the SonicWALL ..............................................................................199 Configuring the VPN Client ...............................................................................200 IKE and Manual Key Configuration for Two SonicWALLs ...............................206 Manual Key for Two SonicWALLs .....................................................................206 Configuring the Second SonicWALL Appliance ...............................................208 Example of Manual Key Configuration for Two SonicWALLs .........................208 IKE Configuration for Two SonicWALLs ...........................................................211 Example of IKE Configuration for Two SonicWALLs ........................................213 SonicWALL Third Party Digital Certificate Support ..........................................216 Overview of Third Party Digital Certificate Support .........................................217 Creating a Certificate Signing Request ............................................................219 SonicWALL Enhanced VPN Logging .................................................................220 Testing a VPN Tunnel Connection Using PING ................................................221 Configuring Windows Networking ....................................................................222 14 High Availability ............................................................................ 225 Before Configuring High Availability .................................................................225 Network Configuration for High Availability Pair .............................................225 Configuring High Availability on the Primary SonicWALL ................................226 Configuration Changes .....................................................................................228 Synchronizing Changes between the Primary and Backup SonicWALLs ......229 High Availability Status .....................................................................................229 High Availability Status Window .......................................................................230 E-mail Alerts Indicating Status Change ...........................................................231 View Log .............................................................................................................232 Forcing Transitions ............................................................................................232 Configuration Notes ..........................................................................................233 Contents Page 7 15 SonicWALL Options and Upgrades ................................................ 234 SonicWALL VPN Client ......................................................................................234 SonicWALL Network Anti-Virus .........................................................................234 Content Filter List Subscription ........................................................................235 Vulnerability Scanning Service .........................................................................235 SonicWALL Authentication Service ..................................................................235 SonicWALL ViewPoint Reporting ......................................................................236 SonicWALL Global Management System ........................................................236 Contact Your Reseller or SonicWALL ...............................................................236 16 Hardware Descriptions ................................................................. 237 SonicWALL PRO 230 and PRO 330 .................................................................237 SonicWALL PRO 200 and PRO 300 ..................................................................239 SonicWALL PRO 100..........................................................................................241 SonicWALL TELE3 SP ........................................................................................243 SonicWALL TELE3 TZ .........................................................................................245 SonicWALL TELE3 TZX .......................................................................................247 SonicWALL SOHO3 and TELE3..........................................................................249 SonicWALL GX 250 and GX 650 .......................................................................251 17 Troubleshooting Guide .................................................................. 254 The Link LED is off ............................................................................................254 A computer on the LAN cannot access the Internet .......................................254 The SonicWALL does not establish authenticated sessions ..........................254 The SonicWALL does not save changes that you have made ........................255 Duplicate IP address errors ..............................................................................255 Machines on the WAN are not reachable ........................................................255 VPN tunnel problems ........................................................................................255 18 Appendices .................................................................................... 256 Appendix A - Technical Specifications .............................................................256 Appendix B - SonicWALL Support Solutions ....................................................257 Appendix C - Introduction to Networking .........................................................263 Appendix D - IP Port Numbers ..........................................................................268 Appendix E - Configuring TCP/IP Settings .......................................................269 Appendix F - Basic VPN Terms and Concepts .................................................274 Appendix G- Erasing the Firmware ...................................................................278 Appendix H- Mounting the SonicWALL PRO 200 and PRO 300 .....................279 Appendix I - Configuring RADIUS and ACE Servers .........................................280 Page 8 SonicWALL Internet Security Appliance Administrator's Guide Copyright Notice © 2002 SonicWALL, Inc. All rights reserved. Under the copyright laws, this manual or the software described within, can not be copied, in whole or part, without the written consent of the manufacturer, except in the normal use of the software to make a backup copy. The same proprietary and copyright notices must be affixed to any permitted copies as were affixed to the original. This exception does not allow copies to be made for others, whether or not sold, but all of the material purchased (with all backup copies) can be sold, given, or loaned to another person. Under the law, copying includes translating into another language or format. SonicWALL is a registered trademark of SonicWALL, Inc. Other product and company names mentioned herein can be trademarks and/or registered trademarks of their respective companies. Specifications and descriptions subject to change without notice. LIMITED WARRANTY SonicWALL, Inc. warrants the SonicWALL Internet Security Appliance (the Product) for one (1) year from the date of purchase against defects in materials and workmanship. If there is a defect in the hardware, SonicWALL will replace the product at no charge, provided that it is returned to SonicWALL with transportation charges prepaid. A Return Materials Authorization (RMA) number must be displayed on the outside of the package for the product being returned for replacement or the product will be refused. The RMA number can be obtained by calling SonicWALL Customer Service between the hours of 8:30 AM and 5:30 PM Pacific Standard Time, Monday through Friday. Phone:(408) 752-7819 Fax:(408) 745-9300 Web: This warranty does not apply if the Product has been damaged by accident, abuse, misuse, or misapplication or has been modified without the written permission of SonicWALL. In no event shall SonicWALL, Inc. or its suppliers be liable for any damages whatsoever (including, without limitation, damages for loss of profits, business interruption, loss of information, or other pecuniary loss) arising out of the use of or inability to use the Product. Some states do not allow the exclusion or limitation of implied warranties or liability for incidental or consequential damages, so the above limitation or exclusion can not apply to you. Where liability can not be limited under applicable law, the SonicWALL liability shall be limited to the amount you paid for the Product. This warranty gives you specific legal rights, and you can have other rights which vary from state to state. By using this Product, you agree to these limitations of liability. THIS WARRANTY AND THE REMEDIES SET FORTH ABOVE ARE EXCLUSIVE AND IN LIEU OF ALL OTHER WARRANTIES, ORAL OR WRITTEN, EXPRESS OR IMPLIED. No dealer, agent, or employee of SonicWALL is authorized to make any extension or addition to this warranty. Page 11 About this Guide Thank you for purchasing the SonicWALL Internet Security appliance. The SonicWALL protects your PC from attacks and intrusions, filters objectional Web sites, provides private VPN connections to business partners and remote offices, and offers a centrally-managed defense against software viruses. This manual covers the configuration of the SonicWALL Internet Security appliance installation and features. Organization of this Guide Chapter 1, Introduction - describes the features and applications of the SonicWALL. Chapter 2, Configuring the Network Mode on the SonicWALL - describes the installation of the SonicWALL and configuring network settings for the SonicWALL. Chapter 3, Registering at mySonicWALL.com - provides details on registering your SonicWALL appliance in the product registration database. Chapter 4, Configuring the TELE3 SP Modem - contains detailed instructions on modem configuration for the TELE3 SP. Chapter 5, Managing Your SonicWALL Internet Security Appliance - provides a brief overview of the SonicWALL Web Management Interface. Chapter 6, General and Network Settings - describes the configuration of the SonicWALL IP settings, time, and password. Chapter 7, Logging and Alerts - illustrates the SonicWALL logging, alerting, and reporting features. Chapter 8, Content Filtering and Blocking - describes SonicWALL Web content filtering, including subscription updates and customized Web blocking. Chapter 9, Web Management Tools - provides directions to restart the SonicWALL, import and export settings, upload new firmware, and perform diagnostic tests. Chapter 10, Network Access Rules - explains how to permit and block traffic through the SonicWALL, set up servers, and enable remote management. Chapter 11, Advanced Features - describes advanced SonicWALL settings, such as One-to-One NAT and Automatic Web Proxying. Chapter 12, DHCP Server - describes the configuration and setup of the SonicWALL DHCP server. Chapter 13, SonicWALL VPN - explains how to create a VPN tunnel between two SonicWALLs and creating a VPN tunnel from the VPN client to the SonicWALL. Chapter 14, High Availability - describes the configuration of two SonicWALLs (one primary and one backup) as a High Availability pair. Chapter 15, SonicWALL Options and Upgrades - presents a brief summary of the SonicWALL's subscription services, firmware upgrades and other options. Page 12 SonicWALL Internet Security Appliance User's Guide Chapter 16, Hardware Descriptions - provides a description of the front and back of SonicWALL Internet security appliances, including LED lights and ports. Chapter 17, Troubleshooting Guide - shows solutions to commonly encountered problems. Appendix A, Technical Specifications - lists the SonicWALL specifications. Appendix B, SonicWALL Support Solutions - describes available support packages from SonicWALL. Appendix C, Introduction to Networking - provides an overview of the Internet, TCP/IP settings, IP security, and other general networking topics. Appendix D, IP Port Numbers - offers information about IP port numbering. Appendix E, Configuring TCP/IP Settings - provides instructions for configuring your Management Station's IP address. Appendix F, Basic VPN Terms and Concepts - covers VPN terminology and configuration concepts. Appendix G, Erasing the Firmware - describes the firmware erase procedure. Appendix H, Mounting the SonicWALL PRO 200 and PRO 300 - describes how to rack mount the SonicWALL appliance. Appendix I, Configuring RADIUS and ACE Servers - provides vendor-specific configuration instructions for RADIUS and ACE servers. The appendix also includes a RADIUS Attributes Dictionary. SonicWALL Technical Support For fast resolution of technical questions, please visit the SonicWALL Tech Support Web site at . There, you will find resources to resolve most technical issues and a Web request form to contact one of the SonicWALL Technical Support engineers. Firmware Version This manual is updated and released with firmware version 6.4.0.0. Always check for the latest version of this manual and other upgrade manuals as well. Icons Used in this Manual Alert - Important information about features that can affect firewall performance, security features, or cause potential problems with your SonicWALL. TIP - Useful information about security features and configurations on your SonicWALL. Page 13 1 Introduction Your SonicWALL Internet Security Appliance The SonicWALL Internet Security Appliance provides a complete security solution that protects your network from attacks, intrusions, and malicious tampering. In addition, the SonicWALL filters objectionable Web content and logs security threats. SonicWALL VPN provides secure, encrypted communications to business partners and branch offices. The SonicWALL Internet Security Appliance uses stateful packet inspection to ensure secure firewall filtering. Stateful packet inspection is widely considered to be the most effective method of filtering IP traffic. MD5 authentication is used to encrypt communications between your Management Station and the SonicWALL Web Management Interface. MD5 Authentication prevents unauthorized users from detecting and stealing the SonicWALL password as it is sent over your network. SonicWALL Internet Security Appliance Functional Diagram The following figure illustrates the SonicWALL Internet security appliance functions. By default, the SonicWALL Internet security appliance allows outbound access from the LAN to the Internet and blocks inbound access from the Internet to the LAN. Users on the Internet are restricted from accessing resources on the LAN unless they are authorized remote users or Network Access Rules were created to allow inbound access. If the SonicWALL includes a DMZ port, users on the LAN and the Internet have access to the devices on the DMZ. Page 14 SonicWALL Internet Security Appliance Administrator's Guide SonicWALL Internet Security Appliance Features Internet Security · ICSA-Certified Firewall After undergoing a rigorous suite of tests to expose security vulnerabilities, SonicWALL Internet security appliances have received Firewall Certification from ICSA, the internationally-accepted authority on network security. The SonicWALL uses stateful packet inspection, the most effective method of packet filtering, to protect your LAN from hackers and vandals on the Internet. Hacker Attack Prevention The SonicWALL automatically detects and thwarts Denial of Service (DoS) attacks such as Ping of Death, SYN Flood, LAND Attack, and IP Spoofing. Network Address Translation (NAT) Network Address Translation (NAT) translates the IP addresses used on your private LAN to a single, public IP address that is used on the Internet. NAT allows multiple computers to access the Internet, even if only one IP address has been provided by your ISP. Network Access Rules The default Network Access Rules allow traffic from the LAN to the Internet and block traffic from the Internet to the LAN. You can create additional Network Access Rules that allow inbound traffic to network servers, such as Web and e-mail servers, or that restrict outbound traffic to certain destinations on the Internet. Autoupdate The SonicWALL maintains the highest level of security by automatically notifying you when new firmware is released. When new firmware is available, the SonicWALL Web Management Interface displays a link to download and install the latest firmware. DMZ Port The SonicWALL PRO 100, PRO 200, PRO 300, PRO 230, and the SonicWALL PRO 330 include a DMZ port allowing users to access public servers, such as Web and FTP servers. While Internet users have unlimited access to the DMZ, the servers on the DMZ are still protected against DoS attacks. HomePort The TELE3 TZ and TELE3 TZX include a HomePort that allows you to separate company computers from home computers on your home network yet share the same Internet connection. WorkPort The TELE3 TZ and TELE3 TZX include a WorkPort that allows you to isolate your IPSec VPN and secures your corporate connections with a stateful packet inspection firewall. SNMP (Simple Network Management Protocol) Support SNMP is a network protocol used over User Datagram Protocol (UDP) that allows network administrators to monitor the status of the SonicWALL Internet Security Appliances and receive notification of any critical events as they occur on the network. Introduction Page 15 · · · · · · · · Content Filtering · SonicWALL Content Filtering You can use the SonicWALL Web content filtering to enforce your company's Internet access policies. The SonicWALL blocks specified categories, such as violence or nudity, using an optional Content Filter List. Users on your network can bypass the Content Filter List by authenticating with a unique user name and password. Content Filter List Updates (optional) Since content on the Internet is constantly changing, the SonicWALL automatically updates the optional Content Filter List every week to ensure that access restrictions to new and relocated Websites and newsgroups are properly enforced. Log and Block or Log Only You can configure the SonicWALL to log and block access to objectional Web sites, or to log inappropriate usage without blocking Web access. Filter Protocols In addition to filtering access to Web sites, the SonicWALL can also block Newsgroups, ActiveX, Java, Cookies, and Web Proxies. Log Categories You can select the information you wish to display in the SonicWALL event log. You can view the event log from the SonicWALL Web Management Interface or receive the log as an e-mail file. Syslog Server Support In addition to the standard screen log, the SonicWALL can write detailed event log information to an external Syslog server. Syslog is the industry-standard method to capture information about network activity. ViewPoint Reporting (optional) Monitoring critical network events and activity, such as security threats, inappropriate Web use, and bandwidth levels, is an essential component of network security. SonicWALL ViewPoint complements the SonicWALL security features by providing detailed and comprehensive reports of network activity. SonicWALL ViewPoint is a software application that creates dynamic, Web-based network reports. ViewPoint reporting generates both real-time and historical reports to offer a complete view of all activity through your SonicWALL Internet Security Appliance. · E-mail Alerts The SonicWALL can be configured to send alerts of high-priority events, such as attacks, system errors, and blocked Web sites. When these events occur, alerts can be immediately sent to an e-mail address or e-mail pager. · · · Logging and Reporting · · · Page 16 SonicWALL Internet Security Appliance Administrator's Guide Dynamic Host Configuration Protocol (DHCP) · DHCP Server The DHCP Server offers centralized management of TCP/IP client configurations, including IP addresses, gateway addresses, and DNS addresses. Upon startup, each network client receives its TCP/IP settings automatically from the SonicWALL DHCP Server. DHCP Client The DHCP Client allows the SonicWALL to acquire TCP/IP settings (such as IP address, gateway address, DNS address) from your ISP. This is necessary if your ISP assigns you a dynamic IP address. DHCP over VPN DHCP over VPN allows a Host (DHCP Client) behind a SonicWALL obtain an IP address lease from a DHCP server at the end of a VPN tunnel. In some network deployments, it is desirable to have all VPN networks residing in one IP subnet address space. This facilitates address administration for the networks using VPN tunnels. · · Easy Installation and Configuration · · Installation Wizard The SonicWALL Installation Wizard helps you quickly install and configure the SonicWALL. Online help SonicWALL help documentation is built into the SonicWALL Web Management Interface for easy access during installation and management. IPSec VPN · SonicWALL VPN SonicWALL VPN provides a simple, secure tool that enables corporate offices and business partners to connect securely over the Internet. By encrypting data, SonicWALL VPN provides private communications between two or more sites without the expense of leased site-to-site lines. VPN Client Software for Windows Mobile users with dial-up Internet accounts can securely access remote network resources with the SonicWALL VPN Client. The SonicWALL VPN Client establishes a private, encrypted VPN tunnel to the SonicWALL, allowing users to transparently access network servers from any location. · Contact SonicWALL, Inc. for information about the Content Filter List, Network Anti-Virus subscriptions, and other upgrades. Web: E-mail: Phone: Fax: http://www.sonicwall.com sales@sonicwall.com (408) 745-9600 (408) 745-9300 Introduction Page 17 2 Configuring the Network Mode on the SonicWALL The SonicWALL Internet security appliance allows the following common network configurations: Standard, NAT Enabled, NAT with PPPoE Client, NAT with DHCP Client, NAT with L2TP Client, and NAT with PPTP Client are included in this chapter. Standard Mode Configuring the SonicWALL in Standard mode requires a static IP address from your ISP. In this mode, you must have separate static IP addresses for all computers on your network. Instructions for configuring a SonicWALL in Standard mode begin on page 19. Network Address Translation (NAT) Enabled Using NAT to set up your SonicWALL eliminates the need for separate IP addresses for all computers on your LAN. It is a way to conserve IP addresses available from the pool of IPv4 addresses for the Internet. If you do not have enough individual IP addresses for all computers on your network, you can use NAT for your network configuration. Instructions for configuring NAT Enabled mode begin on page 20. NAT with PPPoE Client NAT with PPPoE Client is a network protocol that uses Point to Point Protocol over Ethernet (PPPoE) to connect with a remote site using various Remote Access Service products. This protocol is typically found when using a DSL modem with an ISP requiring a user name and password to log into the remote server. The ISP may then allow you to obtain an IP address automatically or give you a specific IP address. Instructions for configuring NAT with PPPoE Client mode begin on page 26. Page 18 SonicWALL Internet Security Appliance Administrator's Guide NAT with DHCP Client NAT with DHCP Client is a networking mode that allows you to obtain an IP address for a specific length of time from a DHCP server. The length of time is called a lease, which is renewed by the DHCP server typically after a few days. When the lease is ready to expire, the client contacts the server to renew the lease. This is a common network configuration for customers with cable or DSL modems. You are not assigned a specific IP address by your ISP. Instructions for configuring NAT with DHCP Client mode begin on page 32. NAT with L2TP Client NAT with L2TP Client is a networking mode that allows you to connect to a remote L2TP server to obtain IP address settings. L2TP (Layer 2 Tunneling Protocol) is a network protocol using IPSec to encrypt transmitted data, and is only supported by Windows 2000. If you are running other versions of Windows, you must use PPTP as your tunneling protocol. Instructions for configuring NAT with L2TP Client mode begin on page 37. NAT with PPTP Client NAT with PPTP Client is a networking mode supporting PPTP (Point to Point Tunneling Protocol) to connect to a remote server. It uses Microsoft Point to Point Encryption (MPPE) to provide encryption of transmitted data. PPTP typically supports older Microsoft clients that require tunneling connectivity or situations in which a tunnel passes through a firewall performing NAT. Instructions for configuring NAT with PPTP Client begin on page 38. Configuring the SonicWALL in Standard Mode This section describes configuring the SonicWALL in Standard mode. You must have a single, static IP address to begin configuration. Follow the instructions below. TIP Be sure to have your network information including your WAN IP address, subnet mask, and DNS settings ready. This information is obtained from your ISP. 1. Open a Web browser and enter the default SonicWALL IP address, 192.168.168.168, in the Location or Address field. 2. The Login window appears. Enter admin in the User Name field, and password in the Password field. 3. Click Cancel on the initial Installation Wizard page to cancel the wizard. 4. Click Network in the General section. 5. Select Standard from the Network Addressing Mode menu. 6. Enter 192.168.168.1 in the SonicWALL LAN IP Address field. 7. Enter 255.255.255.0 in the LAN Subnet Mask field. 8. Enter your WAN router or default gateway IP address in the WAN Gateway (Router) Address field. If you have DSL or cable, your WAN router is typically located at your ISP. 9. Enter your DNS IP address(es) in the DNS Server fields. 10. Click Update. Once the SonicWALL is updated, you must restart the SonicWALL for the changes to take effect. Configuring the Network Mode on the SonicWALL Page 19 Configuring the SonicWALL in NAT Enabled Mode This section describes configuring the SonicWALL appliance in the NAT mode. Essentially, NAT translates the IP addresses in one network into those for a different network. As a form of packet filtering for firewalls, it protects a network from outside intrusion from hackers by replacing the internal (LAN) IP address on packets passing through a SonicWALL with a "fake" one from a fixed pool of addresses. The actual IP addresses of computers on the LAN are hidden from outside view.If you are assigned a single IP address by your ISP, follow the instructions below. Tip Be sure to have your network information including your WAN IP address, subnet mask, and DNS settings ready. This information is obtained from your ISP. The SonicWALL Installation Wizard simplifies the initial installation and configuration of the SonicWALL. The Wizard provides a series of menu-driven instructions for setting the administrator password and configuring the settings necessary to access the Internet. Accessing the Wizard Alert Your Web browser must be Java-enabled and support HTTP uploads in order to fully manage SonicWALL. Internet Explorer 5.0 and above as well as Netscape Navigator 4.0 and above are recommended. 1. Open a Web Browser. Then enter the default SonicWALL IP address, "192.168.168.168", into the Location or Address field in the Web browser. The first time you access the SonicWALL Management interface, the SonicWALL Installation Wizard automatically launches and begins the installation process.Click Next to continue. Tip To bypass the Wizard, click Cancel. Then log into the SonicWALL Management Interface by entering the User Name "admin" and the Password "password". Page 20 SonicWALL Internet Security Appliance Administrator's Guide Setting the Password 2. To set the password, enter a new password in the New Password and Confirm New Password fields. Alert It is very important to choose a password which cannot be easily guessed by others. This page also displays the Use SonicWALL Global Management System check box. SonicWALL Global Management System (SonicWALL GMS) is a Web browser-based security management system. SonicWALL GMS allows enterprises and service providers to monitor and manage hundreds of remote SonicWALLs from a central location. For more information about SonicWALL GMS, contact SonicWALL Sales at (408) 745-9600. 3. Do not select the Use Global Management System check box unless your SonicWALL is remotely managed by SonicWALL GMS. Click Next to continue. Setting the Time and Date Configuring the Network Mode on the SonicWALL Page 21