SonicWALL OS 2.x Bedienungsanleitung

SonicWALL

SonicOS 2.x Enhanced

Quick Start Guide

Rev 1.1

February 2004

Sonic OS 2.x Quick Start Guide

Introduction

This guide walks you through the steps required to configure a typical customer network using the

new SonicOS 2.x Enhanced firmware. If you are familiar with Sonicwall’s existing products and

firmware, this guide will help you make the transition from those products to the next generation of

Sonicwall firmware.

The example network used throughout this guide is illustrated below:

192.168.1.1 / 24

Default Gateway

192.168.1.1

192.168.168.1 / 24

Default Gateway

192.168.168.168

SonicWALL

PRO 4060

Remote User with Global

VPN Client

LAN (X0)

WAN 1 (X1)

Router IP: 208.48.32.1 / 29

WAN 2 (X2)

DMZ

(

)

Public WWW Server

10.0.0.2 / 24 (208.48.32.3)

Mail Server

192.168.168.4 / 24

192.168.168.168 /

208.48.32.2 / 29

SonicWALL

TZ 170e

WAN

10.0.0.1 / 24

Default Gateway 10.0.0.1

PPPoE DSL

0.0.0.

PPPoE DSL

LAN

192.168.1.1/24

Sonic OS 2.x Quick Start Guide

Basic WAN & LAN Configuration

Refer to the Sonicwall Quick Start Guide included on the product CD.

Security Zones and Objects

There are several new concepts introduced with SonicOS 2.x Enhanced firmware. In this section,

we’ll discuss the Security Zones and Objects. When configuring the new products, you will need to

define your Security Zones early in the setup process so that your rules, NAT entries, and objects

will be easier to work with.

Security Zones - Overview

Sonicwall’s fourth generation appliances extend the previous architecture beyond the LAN, WAN,

and DMZ. The new products, when loaded with the Enhanced firmware, have six user-definable

interfaces. The first two interfaces (X0 and X1) are fixed interfaces, permanently bound to the LAN

and WAN zones, respectively. The remaining four interfaces, X2-X5, can be configured and bound

to any Zone.

The multiple interfaces allow the user to segment their network into a more manageable, secure

infrastructure. It also allows the user to have multiple physical segments grouped together.

This concept of multiple segments, or interfaces, logically grouped together is called Security

Zones. The Security Zone permits the user to name the Zone in a user-friendly way and to write

security rules that apply to all the segments in a Zone, without needing to address each physical

interface individually. In our example, we have two interfaces (X1 and X2), used for WAN load-

balancing and failover. If we group the two interfaces in the WAN Zone, we will only need to write

one set of firewall rules that will apply regardless of which interface is active. This greatly

simplifies the firewall rule base. The pre-defined Security Zones are not modifiable and are defined

as follows:

WAN – This Zone can consist of either one or two interfaces. If using the WAN-WAN

capability, you need to add the second Internet interface to the WAN Zone.

LAN – This Zone can consist of one to five interfaces, depending on your network design.

Even though each interface will have a different network subnet attached to it, when

grouped together they can be managed as a single entity.

DMZ – This is the Demilitarized Zone you are probably familiar with from the existing

Sonicwall product line. This Zone is normally used for publicly accessible servers.

This Zone can consist of one to four interfaces, depending on you network design.

VPN - This predefined Zone is used for simplifying secure, remote connectivity. It is the

only Zone that does not have an assigned physical interface.

NOTE – Even though you may group interfaces together into one Security Zone, this does not

preclude you from addressing a single interface within the Zone.

Sonic OS 2.x Quick Start Guide

Creating a Custom Zone

There are four fixed Zone types: Trusted, Untrusted, Public and Encrypted. Only the number of

interfaces limits the number of Zone instances for Trusted and Public Zone types. The Untrusted

Zone type (i.e. the WAN) is reserved for the WAN interface(s). The Encrypted Zone type is a

special system Zone comprising all VPN traffic and doesn’t have any associated interface.

To create a custom zone, proceed as follows:

1. Select the Zones option under the Network

button of the GUI.

2. Click the Add button and the Add Zone

pop-up is displayed.

3. Name your Zone as desired.

4. Select whether the Zone is Trusted or

Public.

5. If Content Filtering is desired, select the

checkbox.

6. If AV enforcement is desired, select the

checkbox.

7. If multiple interfaces are assigned to this

zone, selecting the Allow Interface Trust

option automatically adds the required access rules to allow hosts on those interfaces to

communicate with one another.

8. Click OK to save your settings. The new custom Zone is displayed in the Zones window.

Sonic OS 2.x Quick Start Guide

Security Zones - Configuration

The following will guide you through the process of configuring and assigning interfaces to

Security Zones:

1. We start out with the LAN and WAN interfaces as previously defined.

2. Click the configure icon ( ) associated with the X2 interface.

3. Select the ZONE as WAN and the IP

assignment as PPPoE.

4. Add the User Name and Password

assigned to the PPPoE DSL account.

5. Enter a Comment if desired.

6. Decide if you want to allow

Management and User Logins on

this interface.

7. If the ISP provided you with a Static

IP address, select ‘Specify IP

Address’ and enter the assigned

Static IP.

8. If you want to set your own DNS

servers, as opposed to the DNS

servers automatically provided by

the PPPoE connection, click ‘

DNS Servers’ and enter the values.

Select th

Specify

9. e Ethernet tab.

NOTE – Even though the Sonicwall auto-negotiates the Ethernet settings, you should make it a

0. Select the ‘Force’ checkbox and enter the

11. te changes to

12. , enter the .

13. :

14. r d

habit to force the settings to match the connected network equipment.

1appropriate values for the DSL modem

connected to the X2 interface.

If required, make the appropria

the MTU and fragment settings based on your

configuration. For normal installations,

changes should not be required.

If using Bandwidth Management

available bandwidth for this DSL connection

Click OK to save your settings. The new

WAN interface is displayed in the settings

We will also need a DMZ configured for ou

installation. Click the configure icon associate with the X3 interface.

Sonic OS 2.x Quick Start Guide

15.

ed to the X3 interface. Enter the network mask assigned to the

17. Enter your comments as applicable.

ent and User Logins on this interface.

quipment to be

20. Click OK to save your settings. The new DMZ interface is displayed in the settings.

Select the Zone as DMZ.

16. Enter the IP address assign

interface.

18. Decide if you want to allow Managem

19. Select the Ethernet tab. As above, make the appropriate entries based on the e

installed on the DMZ Zone.

Objects/Groups - Overview

Sof Objects to your security policy. Objects are either o

e 2 – We would like to block users from accessing Instant Messengers during work hours.

e concept of creating an IP address object or group also works for Users and Services.

onic OS Enhanced introduces the concept

pre-defined or user-defined elements that can be used by themselves or in groups. Objects relate t

network elements (hosts, subnets or ranges), users, and services. Throughout the new Enhanced

firmware, we will need to define objects and groups in order to create the desired security policy.

Example 1 - We want to write firewall rules to allow mail in to and out from our mail server.

Instead of just using the mail server’s IP address, we’ll create an Address Object called ‘Mail

Server’ and write our firewall rules using this object. If we ever change the address of our mail

server, just a simple change of the object will ensure that the address is changed wherever it may be

in use.

Exampl

We know that the IM services need to connect to certain servers and we know what the IP address

ranges are for those servers. The problem is, there are a lot of ranges! The solution: create address

objects for each of the IP ranges. Add those address objects to a group called ‘Instant Messengers’,

and write a rule that denies all access to the Instant Messenger group. You’ll see later on that this

will result in a single firewall rule, instead of the six or more that would have been required without

groups.

The sam

Sonic OS 2.x Quick Start Guide

Objects and Groups - Configuration

Tting objects and groups. We will use the

Instant Messenger example from above.

ss Objects option under the

of the GUI.

ct.

NO gs will be slightly different for

other objects. For the Mail Server in the

5. Enter

eps above for the other Instant Messenger

orks. When completed, you will have a list of

he following will guide you through the process of crea

Define the Objects:

1. Select the Addre

Network button

2. Click the Add button under Address

Objects.

3. Enter an applicable name for the obje

4. Select the object type (Host, Range, or

Network).

TE – Settin

example, select the Host type. For the

VPN, select the Network type.

the Starting and Ending IP addresses.

6. Select which Zone the range is located on.

7. Click OK to save your entries. Repeat the st

services, defining all IP addresses and netw

Address Objects displayed.

Sonic OS 2.x Quick Start Guide

8. Repeat the steps above to define other address objects required for your installation. In the

case of our example, you’ll need to create objects for:

a. Web Server (10.0.0.2/32)

b. Mail Server (192.168.168.4/32)

c. Local Pro 4060 LAN for the VPN (192.168.168.0/24)

d. Remote TZ170 LAN for the VPN (192.168.1.0/24)

Define the Group:

1. Click the Add Group b

under Address Groups.

Enter a n

utton

2. ame for the

3. ress ned

4. cted,

to save your

That’s it! Later, we’ll make use of this group in a rule to block IM access.

Address Group.

Select the IM add

objects previously defi

and click the -> button to

move them into your grou

When they are all sele

click OK

selections.

Sonic OS 2.x Quick Start Guide

Firewall Access Rules

W uch more functionality and flexibility when configuring

Firewall Access Rules. However, rule configuration requires advance planning and depends on the

ith Sonic OS Enhanced, you will find m

proper configuration of Interfaces, Zones, NAT Policies, Network Address Objects, Service

Objects, and Schedules. Now that we’ve covered Interfaces, Zones, and Address Objects, let’s

compare rule creation on SonicOS Enhanced to Sonicwall 6.x firmware.

“Public LAN Server”

The most common access rule

created in 6.x firmware is the

istrator

ublic access to an SMTP server

ss of

task with SonicOS Enhanced requires a few more steps. First, we must ensure

at we have a Network Address Object defined that contains the actual IP address of the SMTP

“Public LAN Server”.

Specifying a “Public LAN

Server” in 6.x firmware

automatically took care of

everything for the admin

behind the scenes – NAT,

service (protocol/port)

definition, firewall rule, etc

Referring to the screen shot, if

was required, you could simply

supply the private IP addre

that server next to “Send Email”

in the “Public LAN Server”

field.

Completing the same

server. From our work in previous sections, we see that the “Mail Server” object does indeed exist.

Next, we must establish a NAT policy for the mail server:

Sonic OS 2.x Quick Start Guide

Mail Server NAT Policy:

To create an Inbound NAT policy for our Mail Server:

1. Select the NAT Policies option

under the Network button of the

GUI.

2. Click the ADD button.

3. For Original Source, select ANY.

Allow E-Mail from anywhere on

the Internet.

4. For Translated Source, select

Original. We want to leave the

original source IP address alone.

5. For Original Destination, select

WAN Primary IP. Incoming mail

is being sent to the routable WAN

IP of the Sonicwall.

6. For Translated Destination, select

the Mail Server address object.

This causes the incoming mail to

be routed to the private IP address (192.168.168.4) defined by the Mail Server address

object.

7. For Original Service, select SMTP (Send E-Mail). We only want this translation to work for

E-Mail.

8. For Translated Service, select Original. Our mail server is expecting SMTP on port 25, so

we leave the service as the original, no service translations required.

9. For Inbound Interface, select X1 (the primary WAN).

10. For Outbound Interface, select ANY.

11. Click OK to add the NAT policy.

Mail Server Firewall Policy:

This NAT policy will take any TCP packets coming in on the primary WAN interface that are

destined for port 25, and redirect them to the IP address of the Mail Server. This is a great start to

allowing access to our mail server, but we’re not done yet – next we must specify an Access Rule

allowing the traffic to pass through the firewall.

First, we must ensure that we place the access rule correctly in the Zone matrix. The Zone concept

essentially creates a matrix of rulesets, with each ruleset applying to traffic from one zone to

another. Since this rule will apply to traffic coming in from the WAN zone and destined for the

LAN zone, we’ll need to edit the appropriate rules as follows:

Dieses Handbuch passt für folgende Modelle

Inhaltsverzeichnis

Andere SonicWALL Software Handbücher

SonicWALL

SonicWALL ViewPoint Bedienungsanleitung

Beliebte Software Handbücher anderer Marken

COMPRO

COMPRO COMPROFM Bedienungsanleitung

Muratec

Muratec OFFICEBRIDGE ONLINE Bedienungsanleitung

Oracle

Oracle Contact Center Anywhere 8.1 Bedienungsanleitung

Adobe

Adobe 65007312 - Photoshop Lightroom Handbuch

Avaya

Avaya NULL One-X for RIM Blackberry Bedienungsanleitung

HP ProLiant BL420c Bedienungsanleitung

PS Audio

PS Audio PowerPlay Betriebsanleitung

Brady

Brady LOCKOUT PRO 3.0 Service-Handbuch

Avaya

Avaya Interaction Center Bedienungsanleitung

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Handbuch

Novell

Novell GROUPWISE 8 - INTERNET AGENT Bedienungsanleitung

Oracle

Oracle Application 9i Bedienungsanleitung

Acer

Acer RDM Bedienungsanleitung

Canon

Canon Vixia HF21 Bedienungsanleitung

Canon

Canon ZR950 Bedienungsanleitung

Samsung

Samsung Auto Backup Bedienungsanleitung

Polycom

Polycom Vortex EF2201 Montage- und Bedienungsanleitung

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Bedienungsanleitung