Manuals / SonicWALL / Computer Equipment / Network Router

SonicWALL Internet Security Appliances manual 232- 000291 Rev a 11

Models: Internet Security Appliances

1 293

Download 293 pages 54.59 Kb

Page 293

SonicWALL,Inc.
1143 Borregas Avenue	T: 408.745.9600	www.sonicwall.com
Sunnyvale,CA 94089-1306	F: 408.745.9300

© 2002 SonicWALL, Inc. SonicWALL is a registered trademark of SonicWALL, Inc. Other product and company names mentioned herein may be trademarks and/ or registered trademarks of their respective companies. Specifications and descriptions subject to change with out notice.

P/ N 232- 000291- 01

Rev A 11/ 02

Image 293

SonicWALL Internet Security Appliances manual 232- 000291 Rev a 11

Contents

ADMINISTRATOR’S Guide Contents Status CLI Support and Remote Management NAT with PPPoE Configuration Restarting the SonicWALL100 Restrict Web Features 100101 103Add a Known Service 130 Add a Custom Service Viewing Network Access Rules 127 Services 128Delete a Service 131 Rules Network Access Rule Logic List 133Proxy Relay 148 Web Proxy Forwarding Intranet Settings 151149 Bypass Proxy Servers Upon Proxy Failure 149 Intranet 150Allow Dhcp Pass Through in Standard Mode 173 Allow Dhcp Pass Through in Standard Mode 166Configure Tab 181 Add/Modify IPSec Security Associations 166Configuration Changes 228 Advanced Settings for VPN Configurations 191Configuration Notes 233 190234 SonicWALL Authentication Service 235235 236Limited Warranty Organization of this Guide About this GuideIcons Used in this Manual SonicWALL Technical Support Firmware VersionYour SonicWALL Internet Security Appliance IntroductionInternet Security Logging and Reporting Content FilteringIPSec VPN Dynamic Host Configuration Protocol DhcpEasy Installation and Configuration Standard Mode Configuring the Network Mode on the SonicWALLNetwork Address Translation NAT Enabled NAT with PPPoE ClientNAT with Dhcp Client Select Standard from the Network Addressing Mode menuNAT with L2TP Client NAT with Pptp ClientAccessing the Wizard Configuring the SonicWALL in NAT Enabled ModeSetting the Password Selecting Your Internet Connection Connecting to the InternetSelecting NAT Enabled Mode Confirming Network Address Translation NAT ModeConfiguring LAN Network Settings Configuring WAN Network SettingsCongratulations Configuration SummaryRestarting Configuring NAT with PPPoE ClientSetting the Password Connecting to the Internet Setting the User Name and Password for PPPoE Configuring the SonicWALL Dhcp Server Congratulations Accessing the Installation Wizard Configuring NAT with Dhcp ClientSetting the Time and Date Selecting Your Internet Connection Configuring LAN Network Settings Configuration Summary Configuring NAT with L2TP Client Configuring NAT with Pptp Client Setting the Time and Date Connecting to the Internet Setting the User Name and Password for Pptp Configuring the SonicWALL Dhcp Server Congratulations Logging into the SonicWALL Management Interface Configuring the Network Mode on the SonicWALL Creating a New User Account Registering at mySonicWALL.comAccount Information Personal Information Registering at mySonicWALL.com Page Click Here Registration Quick Registration Status and Options Renaming Your SonicWALL Managing Your SonicWALLTransferring a SonicWALL Product Delete Product Managing Services for SonicWALL Internet Security Appliances Activating Services Using mySonicWALL.com Registering at mySonicWALL.com Configuring the TELE3 SP WAN Failover Feature Configuring the TELE3 SP Modem ConnectionDial-Up Configuration Configuring Modem ProfilesLocation Settings ISP SettingsConfiguring the TELE3 SP Modem Connection Modem Settings TELE3 SP Modem ConfigurationPreempt Mode Failover SettingsSelect Enable WAN Failover Select Enable Probing Primary InterfaceConfiguring a Modem Profile for Manual Dial-Up Select None as the Secondary Profile Configure Modem SettingsTested Internet Service Providers Configuring the Modem SettingsModem Status StatusChat Scripts Custom Chat Scripts Https Management Managing Your SonicWALL Internet Security ApplianceManaging Your SonicWALL Internet Security Appliance 74 SonicWALL Internet Security Appliance User’s Guide 9600 bps Bits No parity No hand-shaking CLI Support and Remote ManagementNetwork Settings General and Network SettingsNetwork Addressing Mode Network Time AdministratorMultiple LAN Subnet Mask Support LAN SettingsSonicWALL LAN IP Address LAN Subnet MaskDNS Settings WAN SettingsWAN Gateway Router Address WAN/LAN Subnet MaskNAT Enabled Configuration Standard ConfigurationSonicWALL WAN Gateway Router Address is NAT with Dhcp Client Configuration Select NAT with PPPoE from the Network Addressing Mode menu NAT with PPPoE ConfigurationRestarting the SonicWALL NAT with L2TP Client Configuration Restarting the SonicWALL NAT with Pptp Client Configuration Restarting the SonicWALL NTP Settings Setting the Time and DateChange the Administrator Password Configuring the Administrator SettingsAdministrator Name Login Failure Handling Setting the Administrator Inactivity TimeoutView Log View Log Log Settings ReportsLogging and Alerts TCP, UDP, or Icmp packets dropped SonicWALL Log MessagesWeb, FTP, Gopher, or Newsgroup blocked ActiveX, Java, Cookie or Code Archive blockedConfigure the following settings Log SettingsPage Log Categories VPN Tunnel Status Alerts/SNMP TrapsReports Bandwidth Usage by IP Address Bandwidth Usage by ServiceWeb Site Hits SonicWALL ViewPoint Configure URL List Customize Consent Content Filtering and BlockingBlock Configuring SonicWALL Content FilteringRestrict Web Features List Updates Message to display when a site is blockedURL List Trusted DomainsSelect Categories to Block SettingsDownload Automatically every Custom Filter Customizing the Content Filtering ListFilter Block Action Time of DayConsent User Idle Timeout is 5 minutes configure hereMaximum Web usage Consent page URL Optional FilteringConsent Accepted URL Filtering Off Mandatory Filtered IP AddressesConsent Accepted URL Filtering On Consent page URL Mandatory FilteringConfiguring N2H2 Internet Filtering Trusted Domains N2H2 Server Status Settings Server Host Name or IP AddressListen Port Reply PortConfiguring the Websense Enterprise Content Filter Trusted Domains Settings Configuring the Websense Content Filter ListWebsense Server Status Server PortURL Cache Web Management Tools Restart Preferences Firmware DiagnosticPreferences Exporting the Settings FileClick Import in the Preferences tab Importing the Settings FileRestoring Factory Default Settings Updating Firmware Updating Firmware Manually Upgrade Features DNS Name Lookup Diagnostic ToolsFind Network Path Ping Select Ping from the Choose a diagnostic tool menuPacket Trace Tech Support Report Select Packet Trace from the Choose a diagnostic tool menuGenerating a Tech Support Report Trace Route Viewing Network Access Rules Network Access RulesLAN Out ServicesNetwork Connection Inactivity Timeout Windows Networking NetBIOS Broadcast Pass ThroughPublic LAN Server Windows Messenger SupportAdd a Custom Service Add ServiceAdd a Known Service Rules Enable LoggingDelete a Service Product Maximum Rules Maximum Number of Rules by ProductBandwidth Management Network Access Rule Logic ListAdd a New Rule Select always from the Apply this rule menu Add New Rule Examples Blocking LAN Access for Specific ServicesEnabling Ping Select WAN from the Destination Ethernet menuEnable/Disable a Rule Current Network Access Rules TableRestore the Default Network Access Rules Edit a RuleUnderstanding the Access Rule Hierarchy Users Global User SettingsHighlight -Add New User- in the Current User list box Adding and Removing a UserCurrent Users Users Currently Locked Out After Login FailuresUser Login Radius Servers RadiusRadius Client Test Radius UsersManagement SonicWALL Snmp Support Configuration of the Service and Rules Pages Configuration of the Log/Log Settings for SnmpSonicWALL Management Protocol Additional ManagementNetwork Access Rules Proxy Relay Web Proxy Forwarding Advanced FeaturesBypass Proxy Servers Upon Proxy Failure Configuring Web Proxy RelayIntranet InstallationIntranet Settings Intranet ConfigurationVPN Single-Armed Mode stand-alone VPN gateway Remote SonicWALL Corporate SonicWALL Configuring a SonicWALL for VPN Single Armed ModeVPN Single Armed Mode SonicWALL Routes Tip There is no route advertisement on the WAN LAN Route AdvertisementDMZ Addresses RIPv2 AuthenticationDMZ Route Advertisement DMZ in NAT Mode DMZ in Standard ModeDelete a DMZ Address Range HomePort ConfigurationHomePort in Standard Mode Delete a HomePort Address Range HomePort in NAT ModeOne-to-One NAT Select the Enable One-to-One NAT check boxSelect Enable One-to-One NAT and click Update One-to-One NAT Configuration ExampleEthernet WAN Link SettingsEnable Bandwidth Management LAN/HomePort Link Settings DMZ/WorkPort Link SettingsMTU Settings Proxy Management workstation ethernet address on WANHow SonicWALL Bandwidth Management Works SonicWALL Bandwidth ManagementExamples of Bandwidth Management Rules Rule Service Priority Guaranteed MaximumAllow Dhcp Pass Through in Standard Mode SetupSetup Dhcp over VPN Status Dhcp ServerSelect the Enable Dhcp Server Configuring the SonicWALL Dhcp ServerDhcp over VPN Dhcp Relay ModeDeleting Dynamic Ranges and Static Entries Select Central Gateway from the Dhcp Relay Mode menu Configuring the Central Gateway for VPN over DhcpConfiguring the Remote Gateway for VPN over Dhcp LAN IP Addresses Select Remote Gateway from the Dhcp Relay Mode menuLAN Device Configuration Dhcp Status Dhcp Server on the SonicWALL TELE3 TZ and TZX Configuring the SonicWALL Dhcp Server Deleting Dynamic Ranges and Static Entries Dhcp Status SonicWALL VPN VPN Management Interface Summary Tab Global VPN SettingsCurrently Active VPN Tunnels VPN Bandwidth ManagementVPN Policies AES Advanced Encryption Standard Support SonicWALL NAT Traversal SupportDisabling Security Associations Configure Tab Add/Modify IPSec Security AssociationsSecurity Policy Settings for Group VPN Security Policy SettingsSecurity Policy Settings for IKE using Pre-shared Secret AES support is available only on the PRO 230 and PRO Security Policy Settings using Manual Key Destination Networks Accessing Remote Resources across a Virtual Private NetworkAdding Destination Networks Modifying and Deleting Existing Security AssociationsTry to bring up all possible SAs Advanced SettingsEnable Keep Alive Require authentication of remote users Require authentication of local usersEnable Windows Networking NetBIOS broadcast Apply NAT and firewall rulesPhase 2 DH Group Enable Perfect Forward SecrecyDefault LAN Gateway Route all internet traffic through this SAVPN Terminated at the LAN, DMZ, or LAN/DMZ IKE using Advanced Settings for VPN ConfigurationsConfiguring SonicWALL VPN SonicWALL VPN Page Group VPN Client Configuration Group VPN Client SetupInstalling the VPN Client Software Page SonicWALL VPN Verifying the VPN Tunnel as Active SonicWALL VPN Configuring the VPN Client Launching the SonicWALL VPN Client Configuring VPN Security and Remote IdentitySelect the Connect using Secure Gateway Tunnel check box Select None from the Select Certificate menu Configuring VPN Client IdentityConfiguring VPN Client Security Policy Select the Encapsulation Protocol ESP check box Configuring VPN Client Key Exchange ProposalConfiguring Outbound VPN Client Keys Configuring Inbound VPN Client KeysSaving SonicWALL VPN Client Settings Click Inbound Keys. The Inbound Keying Material box appearsVerifying the VPN Client Icon in the System Tray Manual Key for Two SonicWALLs IKE and Manual Key Configuration for Two SonicWALLsSonicWALL VPN Select Strong Encrypt ESP 3DES as the Encryption Method Configuring the Second SonicWALL ApplianceExample of Manual Key Configuration for Two SonicWALLs Enter the Encryption Key from the Main Office configuration Configuring the Remote SonicWALLPage Select Group 1 from the Phase 1 DH Group menu IKE Configuration for Two SonicWALLsPage Select 3DES & SHA1 from the Phase 1 DH Group menu Example of IKE Configuration for Two SonicWALLsConfiguring a SonicWALL PRO 200 in Chicago Configuring a SonicWALL TELE3 in San Francisco Select Group 2 from the Phase 1 DH Group menu VeriSign Entrust SonicWALL Third Party Digital Certificate SupportVersion 3 Certificate Standard Overview of Third Party Digital Certificate SupportImporting CA Certificates into the SonicWALL Certificate DetailsCertificate Revocation List CRL Importing Certificate with private keyImporting a Signed Local Certificate Creating a Certificate Signing RequestClick VPN, then Local Certificates Click Import CertificateSonicWALL Enhanced VPN Logging Testing a VPN Tunnel Connection Using Ping Configuring Windows Networking SonicWALL VPN Page High Availability Before Configuring High AvailabilityNetwork Configuration for High Availability Pair Configuring High Availability on the Primary SonicWALL High Availability Configuration Changes High Availability Status High Availability Status Window Mail Alerts Indicating Status Change Forcing Transitions Configuration Notes SonicWALL Network Anti-Virus SonicWALL Options and UpgradesSonicWALL VPN Client SonicWALL Authentication Service Content Filter List SubscriptionVulnerability Scanning Service Contact Your Reseller or SonicWALL SonicWALL ViewPoint ReportingSonicWALL Global Management System SonicWALL PRO 230 and PRO 330 Front Panel Description Hardware DescriptionsSonicWALL PRO 230 and PRO 330 Front Panel Power Switches Reset SwitchPower Inputs SonicWALL PRO 230 and PRO 330 Rear Panel DescriptionSonicWALL PRO 200 and PRO 300 Front Panel Description SonicWALL PRO 200 and PRO 300 Front PanelPower Switch Power InputSonicWALL PRO 200 and PRO 300 Back Panel SonicWALL PRO 200 and PRO 300 Back Panel Description100 SonicWALL PRO 100 Front PanelSonicWALL PRO 100 Front Panel Description SonicWALL PRO 100 Back Panel Description SonicWALL PRO 100 Back PanelModem SonicWALL TELE3 SP Front PanelSonicWALL TELE3 SP Front Panel Description SonicWALL TELE3 SP Back Panel CLI Command Line Interface PortSonicWALL TELE3 SP Back Panel Description TELE3 SP Modem PortSonicWALL TELE3 TZ Front Panel Description SonicWALL TELE3 TZ Front PanelSonicWALL TELE3 TZ Back Panel Description SonicWALL TELE3 TZ Back PanelSonicWALL TELE3 TZX Front Panel Description SonicWALL TELE3 TZX Front PanelSonicWALL TELE3 TZX Back Panel Description SonicWALL TELE3 TZX Back Panel lSonicWALL SOHO3 and TELE3 Front Panel Description SonicWALL SOHO3 and TELE3 Front PanelSonicWALL SOHO3 and TELE3 Back Panel Description SonicWALL SOHO3 and TELE3 Back PanelSonicWALL GX250 and GX 650 Front Panel Description SonicWALL GX 250 and GX 650 Front PanelSonicWALL GX 650 Front Panel SonicWALL GX250 Front PanelSonicWALL GX 250 and GX 650 Back Panel Description Alarm Reset ButtonComputer on the LAN cannot access the Internet Troubleshooting GuideSonicWALL does not establish authenticated sessions Link LED is offVPN tunnel problems Duplicate IP address errorsSonicWALL does not save changes that you have made Machines on the WAN are not reachableAppendices Appendix a Technical SpecificationsKnowledge Base Appendix B SonicWALL Support SolutionsInternet Security Expertise SonicWALL SupportSonicWALL Super SonicWALL Warranty Support SonicWALL Support Services Features and BenefitsWarranty Support North America Warranty Support International SonicWALL Support SonicWALL Support Network Hardware Components Appendix C Introduction to NetworkingNetwork Types FirewallsNetwork Protocols IP Address IP address Subnet mask Default gatewayIP Addressing Network Address Translation NAT Default GatewayNodes Subnet MaskAppendices Registered Port Numbers Appendix D IP Port NumbersWell Known Port Numbers Windows Appendix E Configuring TCP/IP SettingsClick DNS Configuration Windows NT Windows Open the Local Area Connection Properties window Windows XPMacintosh OS Appendix F Basic VPN Terms and Concepts Internet Key Exchange IKE Authentication Header AHManual Key Shared SecretPage ARCFour Data Encryption Standard DESStrong Encryption Triple DES Security Parameter Index SPIErasing the Firmware for all Models Locating the Reset button on your SonicWALLAppendix G- Erasing the Firmware Appendix H- Mounting the SonicWALL PRO 200 and PRO Steel Belted Radius Funk Software Appendix I Configuring Radius and ACE ServersACE Server RSA Configuring User PrivilegesOpen the ACE Server Database Administrator program ACS Server Cisco Internet Authentication Service Windows NT/2000 ServerOpen IAS, and select Remote Access Policies Radius Attributes Dictionary Page Appendices Page Appendices Page Appendices Index Dynamic Host Configuration Protocol Dhcp Dynamic Ranges 167 Page Index 232- 000291 Rev a 11