SonicWALL Home Security System 3500 User Manual

SonicWALL Network Security Appliances  
NETWORK SECURITY  
NSA 5000/4500/3500  
Getting Started Guide  
Download from Www.Somanuals.com. All Manuals Search And Download.  
SonicWALL NSA Series  
Front  
Network Security Appliance  
NSA  
Form Factor 1U rack-mountable  
Dimensions 17 x 13.25 x 1.75 in  
43.18 x 33.65 x 4.44 cm  
Weight 11.30 lbs/5.14 kg  
WEEE Weight 11.30 lbs/5.14 kg  
Back  
PML  
I
o
Note: Always observe proper safety and regulatory guidelines when removing administrator-serviceable parts from the SonicWALL  
NSA appliance. Proper guidelines can be found in the Safety and Regulatory Information section, on page 66 of this guide.  
Page 2 SonicWALL NSA Series  
Download from Www.Somanuals.com. All Manuals Search And Download.  
1
Pre-Configuration Tasks  
In this Section:  
This section provides pre-configuration information. Review this section before setting up your SonicWALL NSA Series appliance.  
SonicWALL NSA 5000/4500/3500 Getting Started Guide Page 3  
Download from Www.Somanuals.com. All Manuals Search And Download.  
 
Check Package Contents  
Before setting up your SonicWALL NSA appliance, verify that your  
package contains the following parts:  
Any Items Missing?  
If any items are missing from your package, please contact  
SonicWALL support.  
1
2
3
4
5
6
7
8
9
NSA Appliance  
Release Notes  
A listing of the most current support options is available online at:  
DB9 -> RJ45 (CLI) Cable  
Standard Power Cord*  
Ethernet Cable  
Global Support Services Guide  
Thank You Card  
Getting Started Guide  
*The included power cord is intended for use in North America only. For  
European Union (EU) customers, a power cord is not included.  
Red Crossover Cable  
1
Network Security Appliance  
SonicOS Release Notes  
Contents  
2
3
6
7
9
SonicWALL Network Security Appliances  
NETWORK SECURIT  
Y
NSA 5000/4500/3500  
Thank You  
4
5
Getting Started Guide  
8
Page 4 Check Package Contents  
Download from Www.Somanuals.com. All Manuals Search And Download.  
 
Administrator Information  
Obtain Configuration Information  
Please record and keep for future reference the following setup  
information:  
Admin Name:  
Select an administrator account name.  
(default is admin)  
Registration Information  
Admin Password:  
Select an administrator password.  
(default is password)  
Serial Number:  
Record the serial number found on the  
bottom panel of your SonicWALL  
appliance.  
Obtain Internet Service Provider (ISP) Information  
Record the following information about your current Internet service:  
Authentication Code:  
Record the authentication code found on  
the bottom panel of your SonicWALL  
appliance.  
If you connect Please record  
using  
Networking Information  
DHCP  
No information is usually required: Some providers  
LAN IP Address:  
Select a static IP address for your  
SonicWALL appliance that is within the  
range of your local subnet. If you are  
unsure, you can use the default IP  
address (192.168.168.168).  
may require a Host name:  
Static IP  
IP Address:  
.
.
.
.
.
.
Subnet Mask:  
Default Gateway:  
Primary DNS:  
.
.
.
.
.
.
Subnet Mask:  
Record the subnet mask for the local  
subnet where you are installing your  
SonicWALL appliance.  
.
.
.
.
.
.
.
.
.
.
Ethernet WAN IP  
Address:  
Select a static IP address for your  
Ethernet WAN. This setting only applies  
if you are already using an ISP that  
assigns a static IP address.  
DNS 2 (optional):  
DNS 3 (optional):  
.
.
.
.
.
Note: If you are not using one of the network configurations  
above, refer to the SonicOS Enhanced Administrator’s  
Guide. You can locate this document online at  
<http://www.sonicwall.com/us/support.html>.  
SonicWALL NSA 5000/4500/3500 Getting Started Guide Page 5  
Download from Www.Somanuals.com. All Manuals Search And Download.  
 
The Front Panel  
Network Security Appliance  
A
A
B
D
C
E
Icon  
Feature  
Description  
Console Port  
Used to access the SonicOS Command Line Interface (CLI) via the DB9 -> RJ45 cable.  
USB Ports (2)  
Reset Button  
Future extension.  
Press and hold the button for a few seconds to manually reset the appliance using SafeMode.  
LED (from left to right)  
-Power LED: Indicates the SonicWALL NSA appliance is powered on.  
-Test LED: Flickering: Indicates the appliance is initializing. Steady blinking: Indicates the  
appliance is in SafeMode. Solid: Indicates that the appliance is in test mode.  
-Alarm LED: Indicates an alarm condition.  
X0-X5 (Copper)  
Gigabit Ethernet ports.  
Page 6 The Front Panel  
Download from Www.Somanuals.com. All Manuals Search And Download.  
 
The Back Panel  
I
o
B
A
Icon  
Feature  
Fans (2)  
Description  
The SonicWALL NSA Series includes two fans for system temperature control.  
Power Supply  
The SonicWALL NSA Series power supply.  
SonicWALL NSA 5000/4500/3500 Getting Started Guide Page 7  
Download from Www.Somanuals.com. All Manuals Search And Download.  
 
Page 8 The Back Panel  
Download from Www.Somanuals.com. All Manuals Search And Download.  
2
Registering Your Appliance on mysonicwall.com  
In this Section:  
This section provides instructions for registering your SonicWALL NSA Series appliance.  
Note: Registration is an important part of the setup process and is necessary in order to receive the benefits of SonicWALL security  
services, firmware updates, and technical support.  
SonicWALL NSA 5000/4500/3500 Getting Started Guide Page 9  
Download from Www.Somanuals.com. All Manuals Search And Download.  
 
Before You Register  
Note: After registering a new SonicWALL appliance on  
mysonicwall.com, you must also register the appliance  
from the SonicOS management interface. This allows  
the unit to synchronize with the SonicWALL License  
Server and to share licenses with the associated  
appliance, if any. See Accessing the Management  
You need a mysonicwall.com account to register the  
SonicWALL NSA appliance. You can create a new  
mysonicwall.com account on www.mysonicwall.com or directly  
from the SonicWALL management interface. This section  
describes how to create an account by using the Web site.  
You can use mysonicwall.com to register your SonicWALL  
appliance and activate or purchase licenses for Security  
Services, ViewPoint Reporting and other services, support, or  
software before you even connect your device. This allows you  
to prepare for your deployment before making any changes to  
your existing network.  
If you already have a mysonicwall.com account, go to  
to register your appliance on mysonicwall.com.  
For a High Availability configuration, you must use  
mysonicwall.com to associate a backup unit that can share the  
Security Services licenses with your primary SonicWALL.  
Note: Your SonicWALL NSA appliance does not need to be  
powered on during account creation or during the  
mysonicwall.com registration and licensing process.  
Page 10 Before You Register  
Download from Www.Somanuals.com. All Manuals Search And Download.  
 
Creating a mysonicwall.com Account  
Registering and Licensing Your Appliance  
on mysonicwall.com  
To create a mysonicwall.com account, perform the following  
steps:  
This section contains the following subsections:  
1. In your browser, navigate to www.mysonicwall.com.  
2. In the login screen, If you are not a registered user, click  
Not a registered user?  
Product Registration  
You must register your SonicWALL security appliance on  
mysonicwall.com to enable full functionality.  
1. Login to your mysonicwall.com account. If you do not have  
an account, you can create one at sonicwall.com  
<http://www.sonicwall.com/us/support.html>.  
2. On the main page, in the Register A Product field, type  
the appliance serial number and then click Next.  
3. On the My Products page, under Add New Product,  
type the friendly name for the appliance, select the  
Product Group if any, type the authentication code into  
the appropriate text boxes, and then click Register.  
3. Complete the Registration form and then click Register.  
4. Verify that the information is correct and then click Submit.  
5. In the screen confirming that your account was created,  
4. On the Product Survey page, fill in the requested  
information and then click Continue.  
click Continue.  
SonicWALL NSA 5000/4500/3500 Getting Started Guide Page 11  
Download from Www.Somanuals.com. All Manuals Search And Download.  
     
Support Services:  
Licensing Security Services and Software  
Dynamic Support 8x5  
Dynamic Support 24x7  
Software and Firmware Updates  
The Service Management - Associated Products page in  
www.mysonicwall.com lists security services, support options,  
and software such as ViewPoint that you can purchase or try  
with a free trial. For details, click the Info button. Your current  
licenses are indicated in the Status column with either a license  
key or an expiration date. You can purchase additional services  
now or at a later time.  
The following products and services are available for the  
SonicWALL NSA Series:  
Service Bundles:  
Client/Server Anti-Virus Suite  
Comprehensive Gateway Security Suite  
Gateway Services:  
Gateway AV/ Anti-Spyware/ Intrusion Prevention/  
Application Firewall  
Content Filtering: Premium Edition  
Stateful High Availability Upgrade (Standard for NSA  
5000/4500 appliances, subscription upgrade required  
for NSA 3500 Appliances)  
Desktop and Server Software:  
Enforced Client Anti-Virus and Anti-Spyware  
Global VPN Client/ Global VPN Client Enterprise  
Global Management System  
ViewPoint  
Page 12 Registering and Licensing Your Appliance on mysonicwall.com  
Download from Www.Somanuals.com. All Manuals Search And Download.  
 
To manage your licenses, perform the following tasks:  
4. To license a product of service, do one of the following:  
To try a Free Trial of a service, click Try in the Service  
Management page. A 30-day free trial is immediately  
activated. The Status page displays relevant  
information including the activation status, expiration  
date, number of licenses, and links to installation  
instructions or other documentation. The Service  
Management page is also updated to show the status  
of the free trial.  
1. In the mysonicwall.com Service Management - Associated  
Products page, check the Applicable Services table for  
services that your SonicWALL appliance is already  
licensed for. Your initial purchase may have included  
security services or other software bundled with the  
appliance. These licenses are enabled on  
mysonicwall.com when the SonicWALL appliance is  
delivered to you.  
2. If you purchased a service subscription or upgrade from a  
sales representative separately, you will have an  
Activation Key for the product. This key is emailed to you  
after online purchases, or is on the front of the certificate  
that was included with your purchase. Locate the product  
on the Services Management page and click Enter Key in  
that row.  
To purchase a product or service, click Buy Now.  
5. In the Buy Service page, type the number of licenses you  
want in the Quantity column for either the 1 year, 2 year, or  
3 year license row and then click Add to Cart.  
6. In the Checkout page, follow the instructions to complete  
your purchase.  
3. In the Activate Service page, type or paste your key into the  
Activation Key field and then click Submit. Depending on  
the product, you will see an Expire date or a license key  
string in the Status column when you return to the Service  
Management page.  
The mysonicwall.com server will generate a license key for the  
product. The key is added to the license keyset. You can use  
the license keyset to manually apply all active licenses to your  
SonicWALL appliance.  
SonicWALL NSA 5000/4500/3500 Getting Started Guide Page 13  
Download from Www.Somanuals.com. All Manuals Search And Download.  
6. On the Service Management - Associated Products page,  
scroll down to the Associated Products section to verify  
that your product registered successfully. You should see  
the HA Primary unit listed in the Parent Product section, as  
well as a Status value of 0 in the Associated Products /  
Child Product Type section.  
7. Although the Stateful High Availability Upgrade and all the  
Security Services licenses can be shared with the HA  
Primary unit, you must purchase a separate ViewPoint  
license for the backup unit. This will ensure that you do not  
miss any reporting data in the event of a failover. Under  
DESKTOP & SERVER SOFTWARE, click Buy Now for  
ViewPoint. Follow the instructions to complete the  
purchase.  
Registering a Second Appliance as a Backup  
To ensure that your network stays protected if your SonicWALL  
appliance has an unexpected failure, you can associate a  
second SonicWALL of the same model as the first in a high  
availability (HA) pair. You can associate the two appliances as  
part of the registration process on mysonicwall.com. This  
feature is enabled on the NSA 5000 and NSA 4500 appliances,  
but requires a separate license to be enabled on the NSA 3500.  
The second SonicWALL will automatically share the Security  
Services licenses of the primary appliance.  
To register a second appliance and associate it with the  
primary, perform the following steps:  
To return to the Service Management - Associated Products  
page, click the serial number link for this appliance.  
1. Login to your mysonicwall.com account.  
2. On the main page, in the Register A Product field, type  
the appliance serial number and then click Next.  
Registration Next Steps  
3. On the My Products page, under Add New Product, type  
the friendly name for the appliance, select the Product  
Group if any, type the authentication code into the  
appropriate text boxes, and then click Register.  
Your SonicWALL NSA HA Pair is now registered and licensed  
on mysonicwall.com. To complete the registration process in  
SonicOS and for more information, see:  
4. On the Product Survey page, fill in the requested  
information and then click Continue. The Create  
Association Page is displayed.  
5. On the Create Association Page, click the radio button to  
select the primary unit for this association, and then click  
Continue. The screen only displays units that are not  
already associated with other appliances.  
Page 14 Registering and Licensing Your Appliance on mysonicwall.com  
Download from Www.Somanuals.com. All Manuals Search And Download.  
   
3
Deployment Scenarios  
In this Section:  
This section provides detailed overviews of advanced deployment scenarios as well as configuration instructions for connecting your  
SonicWALL NSA Series.  
Tip: Before completing this section, fill out the information in Obtain Configuration Information - page 5. You will need to enter this  
information during the Setup Wizard.  
SonicWALL NSA 5000/4500/3500 Getting Started Guide Page 15  
Download from Www.Somanuals.com. All Manuals Search And Download.  
 
Selecting a Deployment Scenario  
Before continuing, select a deployment scenario that best fits your network scheme. Reference the table below and the diagrams on the  
pages for help in choosing a scenario.  
Current Gateway Configuration  
New Gateway Configuration  
Use Scenario  
No gateway appliance  
Single SonicWALL NSA as a primary gateway.  
A - NAT/Route Mode Gateway  
B - NAT with State Sync Pair  
Pair of SonicWALL NSA appliances for high  
availability.  
Existing Internet gateway appliance  
SonicWALL NSA as replacement for an existing A - NAT/Route Mode Gateway  
gateway appliance.  
SonicWALL NSA in addition to an existing  
gateway appliance.  
C - L2 Bridge Mode  
Existing SonicWALL gateway appliance  
SonicWALL NSA in addition to an existing  
SonicWALL gateway appliance.  
B - NAT with State Sync Pair  
Page 16 Selecting a Deployment Scenario  
Download from Www.Somanuals.com. All Manuals Search And Download.  
 
Scenario A: NAT/Route Mode Gateway  
For new network installations or installations where the  
SonicWALL NSA Series is replacing the existing network  
gateway.  
In this scenario, the SonicWALL NSA Series is configured in  
NAT/Route mode to operate as a single network gateway. Two  
Internet sources may be routed through the SonicWALL  
appliance for load balancing and failover purposes. Because  
only a single SonicWALL appliance is deployed, the added  
benefits of high availability with a stateful synchronized pair are  
not available.  
To set up this scenario, follow the steps covered in the Initial  
Setup section. If you have completed setup procedures in that  
section, on page 37 to complete configuration.  
SonicWALL NSA 5000/4500/3500 Getting Started Guide Page 17  
Download from Www.Somanuals.com. All Manuals Search And Download.  
 
Scenario B: State Sync Pair in NAT/Route Mode  
For network installations with two SonicWALL NSA Series  
appliances of the same model configured as a stateful  
synchronized pair for redundant high-availability networking.  
In this scenario, one SonicWALL NSA Series operates as the  
primary gateway device and the other SonicWALL NSA Series  
is in passive mode. All network connection information is  
synchronized between the two devices so that the backup  
appliance can seamlessly switch to active mode without  
dropping any connections if the primary device loses  
connectivity.  
To set up this scenario, follow the steps covered in the Initial  
Mode sections. If you have completed setup procedures in  
those sections, continue to the Additional Deployment  
Page 18 Selecting a Deployment Scenario  
Download from Www.Somanuals.com. All Manuals Search And Download.  
 
Scenario C: L2 Bridge Mode  
For network installations where the SonicWALL NSA Series is  
running in tandem with an existing network gateway.  
In this scenario, the original gateway is maintained. The  
SonicWALL NSA Series is integrated seamlessly into the  
existing network, providing the benefits of deep packet  
inspection and comprehensive security services on all network  
traffic.  
L2 Bridge Mode employs a secure learning bridge architecture,  
enabling it to pass and inspect traffic types that cannot be  
handled by many other methods of transparent security  
appliance integration. Using L2 Bridge Mode, a SonicWALL  
security appliance can be non-disruptively added to any  
Ethernet network to provide in-line deep-packet inspection for  
all traversing IPv4 TCP and UDP traffic. L2 Bridge Mode can  
pass all traffic types, including IEEE 802.1Q VLANs, Spanning  
Tree Protocol, multicast, broadcast and IPv6.  
To set up this scenario, follow the steps covered in the Initial  
Setup and the Configuring L2 Bridge Mode sections. If you  
have completed setup procedures in those sections, continue to  
complete configuration.  
SonicWALL NSA 5000/4500/3500 Getting Started Guide Page 19  
Download from Www.Somanuals.com. All Manuals Search And Download.  
 
Initial Setup  
Accepted  
Browser  
Browser Version  
Number  
This section provides initial configuration instructions for  
connecting your SonicWALL NSA Series. Follow these steps if  
you are setting up Scenario A, B, or C.  
Internet Explorer  
6.0 or higher  
2.0 or higher  
9.0 or higher  
Firefox  
This section contains the following sub-sections:  
Netscape  
Opera  
9.10 or higher for  
Windows  
Safari  
2.0 or higher for MacOS  
Connecting the WAN Port  
1. Connect one end of an Ethernet cable to your Internet  
connection.  
2. Connect the other end of the cable to the X1 (WAN) port on  
your SonicWALL NSA Series appliance.  
System Requirements  
Before you begin the setup process, check to verify that you  
have:  
SonicWALL NSA  
An Internet connection  
A Web browser supporting Java Script and HTTP uploads  
Network Security Appliance  
NSA  
Internet  
X1  
X0  
Management  
Station  
Page 20 Initial Setup  
Download from Www.Somanuals.com. All Manuals Search And Download.  
     
Connecting the LAN Port  
1. Connect one end of the provided Ethernet cable to the  
computer you are using to manage the  
SonicWALL NSA Series.  
2. Connect the other end of the cable to the X0 port on your  
SonicWALL NSA Series.  
The Power LEDs  
plug in the SonicWALL NSA . The Alarm  
and the Test LED will light up and may blink while the  
on the front panel light up blue when you  
LED may light up  
appliance performs a series of diagnostic tests.  
When the Power LEDs are lit and the Test LED is no longer lit,  
the SonicWALL NSA is ready for configuration. This typically  
occurs within a few minutes of applying power to the appliance.  
The Link LED above the X0 (LAN) port will light up in green  
or amber depending on the link throughput speed,  
indicating an active connection:  
-
-
-
Amber indicates 1 Gbps  
Green indicates 100 Mbps  
Unlit while the right (activity) LED is illuminated  
indicates 10 Mbps  
Note: If the Test or Alarm LEDs remain lit after the  
SonicWALL NSA appliance has been booted, restart  
the appliance by cycling power.  
Applying Power  
1. Plug the power cord into an appropriate power outlet.  
2. Turn on the power switch on the rear of the appliance next  
to the power cords.  
I
o
To power  
source  
SonicWALL NSA 5000/4500/3500 Getting Started Guide Page 21  
Download from Www.Somanuals.com. All Manuals Search And Download.  
   
Accessing the Management Interface  
Accessing the Setup Wizard  
The computer you use to manage the SonicWALL NSA Series  
must be set up to accept a dynamic IP address, or it must have  
an unused IP address on the 192.168.168.x/24 subnet, such as  
192.168.168.20.  
If you cannot connect to the SonicWALL NSA appliance or the  
Setup Wizard does not display, verify the following  
configurations:  
Did you correctly enter the management IP address in your  
Web browser?  
To access the SonicOS Enhanced Web-based management  
interface:  
1. Start your Web browser.  
Are the Local Area Connection settings on your computer  
set to use DHCP or set to a static IP address on the  
192.168.168.x/24 subnet?  
Do you have the Ethernet cable connected to your  
computer and to the X0 (LAN) port on your SonicWALL?  
Is the connector clip on your network cable properly seated  
in the port of the security appliance?  
Some browsers may not launch the Setup Wizard  
automatically. In this case:  
Note: Disable pop-up blocking software or add the  
pop-up blocker’s allow list.  
2. Enter http://192.168.168.168 (the default LAN  
management IP address) in the Location or Address field.  
3. The SonicWALL Setup Wizard launches and guides you  
through the configuration and setup of your SonicWALL  
NSA appliance.  
Log into SonicWALL NSA appliance using “admin” as  
the user name and “password” as the password.  
Click the Wizards button on the System > Status  
page.  
Select Setup Wizard and click Next to launch the  
Setup Wizard.  
Some pop-up blockers may prevent the launch of the  
Setup Wizard. You can temporarily disable your pop-  
up blocker, or add the management IP address of your  
SonicWALL (192.168.168.168 by default) to your pop-  
up blocker's allow list.  
The Setup Wizard launches only upon initial loading of the  
SonicWALL NSA management interface.  
4. Follow the on-screen prompts to complete the Setup  
Wizard.  
Depending on the changes made during your setup  
configuration, the SonicWALL may restart.  
Page 22 Initial Setup  
Download from Www.Somanuals.com. All Manuals Search And Download.  
   
Connecting to Your Network  
Testing Your Connection  
1. After you exit the Setup Wizard, the login page reappears.  
Log back into the Management Interface and verify your IP  
and WAN connection.  
SonicWALL NSA  
Internet  
2. Ping a host on the Internet, such as sonicwall.com.  
3. Open another Web browser and navigate to:  
If you can view the SonicWALL home page, you have  
configured your SonicWALL NSA appliance correctly.  
If you cannot view the SonicWALL home page, renew your  
management station DHCP address.  
4. If you still cannot view a Web page, try one of these  
solutions:  
The SonicWALL NSA Series ships with the internal DHCP  
server active on the LAN port. However, if a DHCP server is  
already active on your LAN, the SonicWALL will disable its own  
DHCP server to prevent conflicts.  
Restart your Management Station to accept new  
network settings from the DHCP server in the  
SonicWALL security appliance.  
Restart your Internet Router to communicate with  
the DHCP Client in the SonicWALL security appliance.  
As shown in the illustration on this page, ports X1 and X0 are  
preconfigured as WAN and LAN respectively. The remaining  
ports (X2-X5) can be configured to meet the needs of your  
network. In the graphical example on this page, the zones are:  
X1: WAN, X0: LAN, X2: WLAN, X4: DMZ.  
Refer to the SonicOS Enhanced Administrator’s Guide for  
advanced configuration deployments.  
SonicWALL NSA 5000/4500/3500 Getting Started Guide Page 23  
Download from Www.Somanuals.com. All Manuals Search And Download.  
   
Manual upgrade using the license keyset is useful when your  
appliance is not connected to the Internet. The license keyset  
includes all license keys for services or software enabled on  
mysonicwall.com. It is available on mysonicwall.com at the top  
of the Service Management page for your SonicWALL NSA  
appliance.  
Activating Licenses in SonicOS  
After completing the registration process in SonicOS, you must  
perform the following tasks to activate your licenses and enable  
your licensed services from within the SonicOS user interface:  
Activate licenses  
Enable security services  
Apply services to network zones  
To activate licenses in SonicOS:  
1. Navigate to the System > Licenses page.  
2. Scroll down to Manage Security Services Online and do  
This section describes how to activate your licenses. For  
instructions on how to enable security services and apply  
services to network zones, see the following sections:  
one of the following:  
Enter your mysonicwall.com credentials and click OK,  
Then click the Synchronize button to synchronize  
licenses with mysonicwall.com. The UI will prompt you  
to click Accept for each of these services.  
Paste the license keyset into the Manual Upgrade  
Keyset field.  
To activate licensed services in SonicOS, you can enter the  
license keyset manually, or you can synchronize all licenses at  
once with mysonicwall.com.  
3. Click Submit.  
The Setup Wizard automatically synchronizes all licenses with  
mysonicwall.com if the appliance has Internet access during  
initial setup. If initial setup is already complete, you can  
synchronize licenses from the System > Licenses page.  
Page 24  
Download from Www.Somanuals.com. All Manuals Search And Download.  
 
Saving a Backup Copy of Your Preferences  
Upgrading Firmware on Your SonicWALL  
Before beginning the update process, make a system backup of  
your SonicWALL security appliance configuration settings. The  
backup feature saves a copy of the current configuration  
settings on your SonicWALL security appliance, protecting all  
your existing settings in the event that it becomes necessary to  
return to a previous configuration state. The System Backup  
shows you the current configuration and firmware in a single,  
clickable restore image.  
The following procedures are for upgrading an existing  
SonicOS Enhanced image to a newer version:  
Obtaining the Latest Firmware  
In addition to using the backup feature to save your current  
configuration state to the SonicWALL security appliance, you  
can export the configuration preferences file to a directory on  
your local management station. This file serves as an external  
backup of the configuration preferences, and can be imported  
back into the SonicWALL security appliance.  
1. To obtain a new SonicOS Enhanced firmware image file for  
your SonicWALL security appliance, connect to your  
mysonicwall.com account at  
2. Copy the new SonicOS Enhanced image file to a  
convenient location on your management station.  
Perform the following procedures to save a backup of your  
configuration settings and export them to a file on your local  
management station:  
1. On the System > Settings page, click Create Backup.  
Your configuration preferences are saved. The System  
Backup entry is displayed in the Firmware Management  
table.  
2. To export your settings to a local file, click Export Settings.  
A popup window displays the name of the saved file.  
SonicWALL NSA 5000/4500/3500 Getting Started Guide Page 25  
Download from Www.Somanuals.com. All Manuals Search And Download.  
     
Upgrading the Firmware with Current Settings  
Upgrading the Firmware with Factory Defaults  
Perform the following steps to upload new firmware to your  
SonicWALL appliance and use your current configuration  
settings upon startup.  
Perform the following steps to upload new firmware to your  
SonicWALL appliance and start it up using the default  
configuration:  
1. Download the SonicOS Enhanced firmware image file from  
mysonicwall.com and save it to a location on your local  
computer.  
2. On the System > Settings page, click Create Backup.  
3. Click Upload New Firmware.  
4. Browse to the location where you saved the SonicOS  
Enhanced firmware image file, select the file and click the  
Upload button.  
5. On the System > Settings page, click the Boot icon in the  
row for Uploaded Firmware with Factory Default  
Settings.  
Tip: The appliance must be properly registered before it can  
be upgraded. Refer to Registering and Licensing Your  
information.  
1. Download the SonicOS Enhanced firmware image file from  
mysonicwall.com and save it to a location on your local  
computer.  
2. On the System > Settings page, click Upload New  
Firmware.  
6. In the confirmation dialog box, click OK. The SonicWALL  
restarts and then displays the login page.  
3. Browse to the location where you saved the SonicOS  
Enhanced firmware image file, select the file and click the  
Upload button.  
7. Enter the default user name and password (admin /  
password) to access the SonicWALL management  
interface.  
4. On the System > Settings page, click the Boot icon in the  
row for Uploaded Firmware.  
5. In the confirmation dialog box, click OK. The SonicWALL  
Using SafeMode to Upgrade Firmware  
If you are unable to connect to the SonicWALL security  
appliance’s management interface, you can restart the  
SonicWALL security appliance in SafeMode. The SafeMode  
feature allows you to recover quickly from uncertain  
configuration states with a simplified management interface that  
includes the same settings available on the System > Settings  
page.  
restarts and then displays the login page.  
6. Enter your user name and password. Your new SonicOS  
Enhanced image version information is listed on the  
System > Settings page.  
Page 26 Upgrading Firmware on Your SonicWALL  
Download from Www.Somanuals.com. All Manuals Search And Download.  
     
To use SafeMode to upgrade firmware on the SonicWALL  
security appliance, perform the following steps:  
6. Select the boot icon in the row for one of the following:  
Uploaded Firmware - New!  
Use this option to restart the appliance with your  
current configuration settings.  
Uploaded Firmware with Factory Defaults - New!  
Use this option to restart the appliance with default  
configuration settings.  
1. Connect your computer to the X0 port on the SonicWALL  
appliance and configure your IP address with an address  
on the 192.168.168.0/24 subnet, such as 192.168.168.20.  
2. Use a narrow, straight object, like a straightened paper clip  
or a toothpick, to press and hold the reset button on the  
front of the security appliance for one second. The reset  
button is in a small hole next to the USB ports.  
7. In the confirmation dialog box, click OK to proceed.  
8. After successfully booting the firmware, the login screen is  
displayed. If you booted with factory default settings, enter  
the default user name and password (admin / password) to  
access the SonicWALL management interface.  
The Test light starts blinking when the SonicWALL security  
appliance has rebooted into SafeMode.  
3. Point the Web browser on your computer to  
192.168.168.168. The SafeMode management interface  
displays.  
4. If you have made any configuration changes to the security  
appliance, select the Create Backup On Next Boot  
checkbox to make a backup copy of your current settings.  
Your settings will be saved when the appliance restarts.  
5. Click Upload New Firmware, and then browse to the  
location where you saved the SonicOS Enhanced firmware  
image, select the file and click the Upload button.  
If You Are Following  
Scenario...  
Proceed to Section:  
A - NAT/Route Mode  
Gateway  
B - NAT with State Sync Pair Configuring a State Sync Pair in NAT/  
C - L2 Bridge Mode  
SonicWALL NSA 5000/4500/3500 Getting Started Guide Page 27  
Download from Www.Somanuals.com. All Manuals Search And Download.  
Initial High Availability Setup  
Configuring a State Sync Pair in  
NAT/Route Mode  
Before you begin the configuration of HA on the Primary  
SonicWALL security appliance, perform the following setup:  
This section provides instructions for configuring a pair of  
SonicWALL NSA appliances for high availability (HA). This  
section is relevant to administrators following deployment  
scenario B.  
1. On the bottom panel of the Backup SonicWALL security  
appliance, locate the serial number and write the number  
down. You need to enter this number in the High  
Availability > Settings page.  
This section contains the following sub-sections:  
2. Verify that the Primary SonicWALL and Backup  
SonicWALL security appliances are registered, running the  
same SonicOS Enhanced versions, and running the same  
SonicWALL Security services.  
3. Make sure the Primary SonicWALL and Backup  
SonicWALL security appliances’ LAN, WAN and other  
interfaces are properly configured for failover.  
4. Connect the X5 ports on the Primary SonicWALL and  
Backup SonicWALL appliances with a CAT6-rated  
crossover cable (red crossover cable). The Primary and  
Backup SonicWALL security appliances must have a  
dedicated connection. SonicWALL recommends cross-  
connecting the two together using a CAT6 crossover  
Ethernet cable, but a connection using a dedicated hub/  
switch is also valid.  
SonicWALL NSA 2  
SonicWALL  
HA / Failover Pair  
X5 HA Link  
SonicWALL NSA 1  
l
5. Power up the Primary SonicWALL security appliance, and  
then power up the Backup SonicWALL security appliance.  
Internet  
6. Do not make any configuration changes to the Primary’s  
HA interface; the High Availability configuration in an  
upcoming step takes care of this issue. When done,  
disconnect the workstation.  
Page 28 Configuring a State Sync Pair in NAT/Route Mode  
Download from Www.Somanuals.com. All Manuals Search And Download.  
   
Configuring High Availability  
Configuring Advanced HA Settings  
1. Navigate to the High Availability > Advanced page.  
The first task in setting up HA after initial setup is configuring the  
High Availability > Settings page on the Primary SonicWALL  
security appliance. Once you configure HA on the Primary  
SonicWALL security appliance, it communicates the settings to  
the Backup SonicWALL security appliance.  
2. To configure Stateful HA, select Enable Stateful  
Synchronization. A dialog box is displayed with  
recommended settings for the Heartbeat Interval and  
Probe Interval fields. The settings it shows are minimum  
recommended values. Lower values may cause  
To configure HA on the Primary SonicWALL, perform the  
following steps:  
unnecessary failovers, especially when the SonicWALL is  
under a heavy load. You can use higher values if your  
SonicWALL handles a lot of network traffic. Click OK.  
1. Navigate to the High Availability > Settings page.  
2. Select the Enable High Availability checkbox.  
3. Under SonicWALL Address Settings, type in the serial  
number for the Backup SonicWALL appliance.  
Tip: Preempt mode is automatically disabled after enabling  
Stateful Synchronization. This is because preempt  
mode can be over-aggressive about failing over to the  
backup appliance. For example if both devices are idle,  
preempt mode may prompt a failover.  
You can find the serial number on the back of the  
SonicWALL security appliance, or in the System > Status  
screen of the backup unit. The serial number for the  
Primary SonicWALL is automatically populated.  
4. Click Apply to retain these settings.  
3. To backup the firmware and settings when you upgrade the  
firmware version, select Generate/Overwrite Backup  
Firmware and Settings When Upgrading Firmware.  
4. Select the Enable Virtual MAC checkbox. Virtual MAC  
allows the Primary and Backup appliances to share a  
single MAC address. This greatly simplifies the process of  
updating network ARP tables and caches when a failover  
occurs. Only the WAN switch that the two appliances are  
connected to needs to be notified. All outside devices will  
continue to route to the single shared MAC address.  
SonicWALL NSA 5000/4500/3500 Getting Started Guide Page 29  
Download from Www.Somanuals.com. All Manuals Search And Download.  
   
5. Optionally adjust the Heartbeat Interval to control how  
often the two units communicate. The default is 5000  
milliseconds; the minimum recommended value is 1000  
milliseconds. Less than this may cause unnecessary  
failovers, especially when the SonicWALL is under a heavy  
load.  
6. Set the Probe Level for the interval in seconds between  
communication with upstream or downstream systems.  
SonicWALL recommends that you set the interval for at  
least 5 seconds. You can set the Probe IP Address(es) on  
the High Availability > Monitoring screen.  
7. Typically, SonicWALL recommends leaving the Failover  
Trigger Level (missed heartbeats), Election Delay Time  
(seconds), and Dynamic Route Hold-Down Time fields  
to their default settings. These fields can be tuned later as  
necessary for your specific network environment.  
old routes and implements the new routes it has  
learned from RIP or OSPF. The default value is  
45 seconds. In large or complex networks, a larger  
value may improve network stability during a failover.  
8. Click the Include Certificates/Keys checkbox to have the  
appliances synchronize all certificates and keys.  
9. Click Synchronize Settings to synchronize the settings  
between the Primary and Backup appliances.  
10. Click Synchronize Firmware if you previously uploaded  
new firmware to your Primary unit while the Secondary unit  
was offline, and it is now online and ready to upgrade to the  
new firmware. Synchronize Firmware is typically used  
after taking your Secondary appliance offline while you test  
a new firmware version on the Primary unit before  
upgrading both units to it.  
11. Click Apply to retain the settings on this screen.  
-
The Failover Trigger Level sets the number of  
heartbeats that can be missed before failing over.  
The Election Delay Time is the number of seconds  
allowed for internal processing between the two units in  
the HA pair before one of them takes the primary role.  
The Dynamic Route Hold-Down Time setting is used  
when a failover occurs on a HA pair that is using either  
RIP or OSPF dynamic routing. When a failover occurs,  
Dynamic Route Hold-Down Time is the number of  
seconds the newly-active appliance keeps the dynamic  
routes it had previously learned in its route table.  
During this time, the newly-active appliance relearns  
the dynamic routes in the network. When the Dynamic  
Route Hold-Down Time duration expires, it deletes the  
-
-
Page 30 Configuring a State Sync Pair in NAT/Route Mode  
Download from Www.Somanuals.com. All Manuals Search And Download.  
To verify that Primary and Backup SonicWALL security  
appliances are functioning correctly, wait a few minutes, then  
trigger a test failover by logging into the primary unit and doing  
a restart. The Backup SonicWALL security appliance should  
quickly take over.  
Synchronizing Settings  
Once you have configured the HA setting on the Primary  
SonicWALL security appliance, click the Synchronize Settings  
button. You should see a HA Peer Firewall has been updated  
message at the bottom of the management interface page. Also  
note that the management interface displays Logged Into:  
Primary SonicWALL Status: (green ball) Active in the upper-  
right-hand corner.  
From your management workstation, test connectivity through  
the Backup SonicWALL by accessing a site on the public  
Internet – note that the Backup SonicWALL, when active,  
assumes the complete identity of the Primary, including its IP  
addresses and Ethernet MAC addresses.  
By default, the Include Certificate/Keys setting is enabled.  
This specifies that Certificates, CRLs and associated settings  
(such as CRL auto-import URLs and OCSP settings) are  
synchronized between the Primary and Backup units. When  
Local Certificates are copied to the Backup unit, the associated  
Private Keys are also copied. Because the connection between  
the Primary and Backup units is typically protected, this is  
generally not a security concern.  
Log into the Backup SonicWALL’s unique LAN IP address. The  
management interface should now display Logged Into:  
Backup SonicWALL Status: (green ball) Active in the upper-  
right-hand corner.  
Now, power the Primary SonicWALL back on, wait a few  
minutes, then log back into the management interface. If  
stateful synchronization is enabled (automatically disabling  
preempt mode), the management GUI should still display  
Logged Into: Backup SonicWALL Status: (green ball)  
Active in the upper-right-hand corner.  
Tip: A compromise between the convenience of  
synchronizing Certificates and the added security of not  
synchronizing Certificates is to temporarily enable the  
Include Certificate/Keys setting and manually  
synchronize the settings, and then disable Include  
Certificate/Keys.  
If you are using the Monitor Interfaces feature, experiment with  
disconnecting each monitored link to ensure correct  
configuration.  
SonicWALL NSA 5000/4500/3500 Getting Started Guide Page 31  
Download from Www.Somanuals.com. All Manuals Search And Download.  
 
Adjusting High Availability Settings  
Synchronizing Firmware  
On the High Availability > Settings page, there are four user-  
configurable timers that can be adjusted to suit your network’s  
needs:  
Checking the Synchronize Firmware Upload and Reboot  
checkbox allows the Primary and Backup SonicWALL security  
appliances in HA mode to have firmware uploaded on both  
devices at once, in staggered sequence to ensure security is  
always maintained. During the firmware upload and reboot, you  
are notified via a message dialog box that the firmware is  
loaded on the Backup SonicWALL security appliance, and then  
the Primary SonicWALL security appliance. You initiate this  
process by clicking on the Synchronize Firmware button.  
Heartbeat Interval (seconds) – This timer is the length of  
time between status checks. By default this timer is set to 5  
seconds; using a longer interval will result in the  
SonicWALL taking more time to detect when/if failures  
have occurred.  
Failover Trigger Level (missed heartbeats) – This timer  
is the number of heartbeats the SonicWALL will miss  
before failing over. By default, this time is set to 5 missed  
heartbeats.This timer is linked to the Heartbeat Interval  
timer – for example, if you set the Heartbeat Interval to 10  
seconds, and the Failover Trigger Level timer to 5, it will be  
50 seconds before the SonicWALL fails over.  
Probe Interval – This timer controls the path monitoring  
speed. Path monitoring sends pings to specified IP  
addresses to monitor that the network critical path is still  
reachable. The default is 20 seconds, and the allowed  
range is from 5 to 255 seconds.  
Election Delay Time – This timer can be used to specify  
an amount of time the SonicWALL will wait to consider an  
interface up and stable, and is useful when dealing with  
switch ports that have a spanning-tree delay set.  
Page 32 Configuring a State Sync Pair in NAT/Route Mode  
Download from Www.Somanuals.com. All Manuals Search And Download.  
   
License synchronization is used during HA so that the Backup  
appliance can maintain the same level of network protection  
provided before the failover. To enable HA, you can use the  
SonicOS UI to configure your two appliances as a HA pair in  
Active/Idle mode.  
HA License Configuration Overview  
You can configure HA license synchronization by associating  
two SonicWALL security appliances as HA Primary and HA  
Secondary on mysonicwall.com. Note that the Backup  
appliance of your HA pair is referred to as the HA Secondary  
unit on mysonicwall.com.  
Mysonicwall.com provides several methods of associating the  
two appliances. You can start by registering a new appliance,  
and then choosing an already-registered unit to associate it  
with. You can associate two units that are both already  
registered, or you can select a registered unit and then add a  
new appliance with which to associate it.  
You must purchase a single set of security services licenses for  
the HA Primary appliance. To use Stateful HA, you must first  
activate the Stateful High Availability Upgrade license for the  
primary unit in SonicOS. This is automatic if your appliance is  
connected to the Internet. See Registering and Licensing Your  
Note: After registering new SonicWALL appliances on  
mysonicwall.com, you must also register each  
appliance from the SonicOS management interface by  
clicking the registration link on the System > Status  
page. This allows each unit to synchronize with the  
SonicWALL license server and share licenses with the  
associated appliance.  
SonicWALL NSA 5000/4500/3500 Getting Started Guide Page 33  
Download from Www.Somanuals.com. All Manuals Search And Download.  
 
7. Select the group from the Product Group drop-down list.  
The product group setting specifies the mysonicwall users  
who can upgrade or modify the appliance.  
Associating Pre-Registered Appliances  
To associate two already-registered SonicWALL security  
appliances so that they can use HA license synchronization,  
perform the following steps:  
8. Click Register.  
1. Login to mysonicwall.com.  
2. In the left navigation bar, click My Products.  
If You Are Following  
Scenario...  
Proceed to Section:  
3. On the My Products page, under Registered Products,  
scroll down to find the appliance that you want to use as  
the parent, or primary, unit. Click the product name or  
serial number.  
B - NAT with State Sync Pair Additional Deployment Configuration -  
4. On the Service Management - Associated Products page,  
scroll down to the Associated Products section.  
5. Under Associated Products, click HA Secondary.  
6. On the My Product - Associated Products page, in the text  
boxes under Associate New Products, type the serial  
number and the friendly name of the appliance that you  
want to associate as the child/secondary/backup unit.  
Page 34 Configuring a State Sync Pair in NAT/Route Mode  
Download from Www.Somanuals.com. All Manuals Search And Download.  
 
Configuring the Primary Bridge Interface  
Configuring L2 Bridge Mode  
The primary bridge interface is your existing Internet gateway  
device. The only step involved in setting up your primary bridge  
interface is to ensure that the WAN interface is configured for a  
static IP address. You will need this static IP address when  
configuring the secondary bridge.  
This section provides instructions to configure the SonicWALL  
NSA appliance in tandem with an existing Internet gateway  
device. This section is relevant to users following deployment  
scenario C.  
This section contains the following sub-sections:  
Note: The primary bridge interface must have a static IP  
assignment.  
Connection Overview  
Connect the X1 port on your SonicWALL NSA Series to the  
LAN port on your existing Internet gateway device. Then  
connect the X0 port on your SonicWALL to your LAN.  
Network Gateway  
LAN  
SonicWALL NSA  
Internet or  
LAN Segment 2  
L2 Bridge Link  
SonicWALL NSA 5000/4500/3500 Getting Started Guide Page 35  
Download from Www.Somanuals.com. All Manuals Search And Download.  
     
Configuring the Secondary Bridge Interface  
Note: Do not enable Never route traffic on the bridge-pair  
unless your network topology requires that all packets  
entering the L2 Bridge remain on the L2 Bridge  
segments.  
Complete the following steps to configure the SonicWALL  
appliance:  
1. Navigate to the Network > Interfaces page from the  
navigation panel.  
2. Click the Configure icon in the right column of the X0  
You may optionally enable the Block all non-IPv4  
traffic setting to prevent the L2 bridge from passing  
non-IPv4 traffic.  
(LAN) interface.  
If You Are Following  
Scenario...  
Proceed to Section:  
C - L2 Bridge Mode  
3. In the IP Assignment drop-down, select Layer 2 Bridged  
Mode.  
4. In the Bridged to drop-down, select the X1 interface.  
5. Configure management options (HTTP, HTTPS, Ping,  
SNMP, SSH, User logins, or HTTP redirects).  
Page 36 Configuring L2 Bridge Mode  
Download from Www.Somanuals.com. All Manuals Search And Download.  
 
4
Additional Deployment Configuration  
In this Section:  
This section provides basic configuration information to begin building network security policies for your deployment. This section also  
contains several SonicOS diagnostic tools and a deployment configuration reference checklist.  
SonicWALL NSA 5000/4500/3500 Getting Started Guide Page 37  
Download from Www.Somanuals.com. All Manuals Search And Download.  
 
To create an access rule:  
Creating Network Access Rules  
1. On the Firewall > Access Rules page in the matrix view,  
click the arrow connecting the two zones that need a rule.  
2. On the Access Rules page, click Add.  
A zone is a logical grouping of one or more interfaces designed  
to make management, such as the definition and application of  
access rules, a simpler and more intuitive process than  
following a strict physical interface scheme.  
By default, the SonicWALL security appliance’s stateful packet  
inspection allows all communication from the LAN to the  
Internet, and blocks all traffic from the Internet to the LAN. The  
following behaviors are defined by the “Default” stateful  
inspection packet access rule enabled in the SonicWALL  
security appliance:  
Originating Zone  
LAN, WLAN  
DMZ  
Destination Zone  
WAN, DMZ  
WAN  
Action  
Allow  
Allow  
Deny  
Deny  
The access rules are sorted from the most specific at the  
top to the least specific at the bottom of the table. At the  
bottom of the table is the Any rule.  
WAN  
DMZ  
WAN and DMZ  
LAN or WLAN  
Page 38 Creating Network Access Rules  
Download from Www.Somanuals.com. All Manuals Search And Download.  
 
3. In the Add Rule page in the General tab, select Allow |  
Deny | Discard from the Action list to permit or block IP  
traffic.  
Select the from and to zones from the From Zone and  
To Zone menus.  
Select the service or group of services affected by the  
access rule from the Service list. If the service is not  
listed, you must define the service in the Add Service  
window. Select Create New Service or Create New  
Group to display the Add Service window or Add  
Service Group window.  
Select the source of the traffic affected by the access  
rule from the Source list. Selecting Create New  
Network displays the Add Address Object window.  
Select the destination of the traffic affected by the  
access rule from the Destination list. Selecting Create  
New Network displays the Add Address Object  
window.  
From the Users Allowed menu, add the user or user  
group affected by the access rule.  
Select a schedule from the Schedule menu. The  
default schedule is Always on.  
Enter any comments to help identify the access rule in  
the Comments field.  
SonicWALL NSA 5000/4500/3500 Getting Started Guide Page 39  
Download from Www.Somanuals.com. All Manuals Search And Download.  
4. Click on the Advanced tab.  
5. Click on the QoS tab if you want to apply DSCP or 802.1p  
Quality of Service coloring/marking to traffic governed by  
this rule. See the SonicOS Enhanced Administrator’s  
Guide for more information on managing QoS marking in  
access rules.  
6. Click OK to add the rule.  
Creating a NAT Policy  
The Network Address Translation (NAT) engine in SonicOS  
Enhanced allows users to define granular NAT policies for their  
incoming and outgoing traffic. By default, the SonicWALL  
security appliance has a preconfigured NAT policy to allow all  
systems connected to the LAN interface to perform Many-to-  
One NAT using the IP address of the WAN interface, and a  
policy to not perform NAT when traffic crosses between the  
other interfaces.  
If you would like for the access rule to timeout after a  
different period of TCP inactivity, set the amount of  
time, in minutes, in the TCP Connection Inactivity  
Timeout (minutes) field. The default value is 15  
minutes.  
If you would like for the access rule to timeout after a  
different period of UDP inactivity, set the amount of  
time, in minutes, in the UDP Connection Inactivity  
Timeout (minutes) field. The default value is 30  
minutes.  
Specify the number of connections allowed as a  
percent of maximum number of connections allowed  
by the SonicWALL security appliance in the Number  
of connections allowed (% of maximum  
connections) field.  
Select Create a reflexive rule if you want to create a  
matching access rule to this one in the opposite  
direction--from your destination zone or address  
object to your source zone or address object.  
You can create multiple NAT policies on a SonicWALL running  
SonicOS Enhanced for the same object – for instance, you can  
specify that an internal server use one IP address when  
accessing Telnet servers, and to use a totally different IP  
address for all other protocols. Because the NAT engine in  
SonicOS Enhanced supports inbound port forwarding, it is  
possible to hide multiple internal servers off the WAN IP  
address of the SonicWALL security appliance. The more  
granular the NAT Policy, the more precedence it takes.  
Page 40 Creating a NAT Policy  
Download from Www.Somanuals.com. All Manuals Search And Download.  
 
Before configuring NAT Policies, you must create all Address  
Objects associated with the policy. For instance, if you are  
creating a One-to-One NAT policy, first create Address Objects  
for your public and private IP addresses.  
MAC Address – MAC Address Objects allow for the  
identification of a host by its hardware address or MAC  
(Media Access Control) address.  
FQDN Address – FQDN Address Objects allow for the  
identification of a host by its Fully Qualified Domain Names  
Address Objects are one of four object classes (Address, User,  
Service and Schedule) in SonicOS Enhanced. These Address  
Objects allow for entities to be defined one time, and to be re-  
used in multiple referential instances throughout the SonicOS  
interface. For example, take an internal Web server with an IP  
address of 67.115.118.80. Rather than repeatedly typing in the  
IP address when constructing Access Rules or NAT Policies,  
Address Objects allow you to create a single entity called “My  
Web Server” as a Host Address Object with an IP address of  
67.115.118.80. This Address Object, “My Web Server”, can then  
be easily and efficiently selected from a drop-down menu in any  
configuration screen that employs Address Objects as a  
defining criterion.  
SonicOS Enhanced provides a number of Default Address  
Objects that cannot be modified or deleted. You can use the  
Default Address Objects when creating a NAT policy, or you can  
create custom Address Objects to use. All Address Objects are  
available in the drop-down lists when creating a NAT policy.  
Since there are multiple types of network address expressions,  
there are currently the following Address Objects types:  
Host – Host Address Objects define a single host by its IP  
address.  
Range – Range Address Objects define a range of  
contiguous IP addresses.  
Network – Network Address Objects are like Range  
objects in that they comprise multiple hosts, but rather than  
being bound by specified upper and lower range delimiters,  
the boundaries are defined by a valid netmask.  
SonicWALL NSA 5000/4500/3500 Getting Started Guide Page 41  
Download from Www.Somanuals.com. All Manuals Search And Download.  
4. Select the zone to assign to the Address Object from the  
Configuring Address Objects  
Zone Assignment drop-down list.  
The Network > Address Objects page allows you to create  
and manage your Address Objects. You can view Address  
Objects in the following ways using the View Style menu:  
5. Select Host, Range, Network, MAC, or FQDN from the  
Type menu.  
-
If you selected Host, enter the IP address in the IP  
Address field.  
All Address Objects - displays all configured Address  
Objects.  
Custom Address Objects - displays Address Objects with  
custom properties.  
Default Address Objects - displays Address Objects  
configured by default on the SonicWALL security  
appliance.  
-
If you selected Range, enter the starting and ending IP  
addresses in the Starting IP Address and Ending IP  
Address fields.  
If you selected Network, enter the network IP address  
and netmask in the Network and Netmask fields.  
If you selected MAC, enter the MAC address and  
netmask in the Network and MAC Address field.  
If you selected FQDN, enter the domain name for the  
individual site or range of sites (with a wildcard) in the  
FQDN field.  
-
-
-
To add an Address Object:  
1. Navigate to the Network > Address Objects page.  
2. Below the Address Objects table, click Add.  
3. In the Add Address Object dialog box, enter a name for the  
6. Click OK.  
Address Object in the Name field.  
Page 42 Creating a NAT Policy  
Download from Www.Somanuals.com. All Manuals Search And Download.  
 
For other NAT configurations, see the SonicOS Enhanced  
Administrator’s Guide.  
Configuring NAT Policies  
NAT policies allow you the flexibility to control Network Address  
Translation based on matching combinations of Source IP  
address, Destination IP address and Destination Services.  
Policy-based NAT allows you to deploy different types of NAT  
simultaneously. The following NAT configurations are available  
in SonicOS Enhanced:  
An example configuration illustrates the use of the fields in the  
Add NAT Policy procedure. To add a Many-to-One NAT policy  
that allows all systems on the X1 interface to initiate traffic using  
the SonicWALL security appliance’s WAN IP address, perform  
the following steps:  
1. Navigate to the Network > NAT Policies page. Click Add.  
The Add NAT Policy dialog box displays.  
2. For Original Source, select Any.  
Many-to-One NAT Policy  
Many-to-Many NAT Policy  
One-to-One NAT Policy for Outbound Traffic  
One-to-One NAT Policy for Inbound Traffic (Reflexive)  
One-to-Many NAT Load Balancing  
Inbound Port Address Translation via One-to-One NAT  
Policy  
3. For Translated Source, select WAN Interface IP.  
4. For Original Destination, select Any.  
5. For Translated Destination, select Original.  
6. For Original Service, select Any.  
7. For Translated Service, select Original.  
8. For Inbound Interface, select X1.  
9. For Outbound Interface, select X1.  
10. For Comment, enter a short description.  
11. Select the Enable NAT Policy checkbox.  
12. Leave Create a reflexive policy unchecked.  
13. Click Add.  
Inbound Port Address Translation via WAN IP Address  
This section describes how to configure a Many-to-One NAT  
policy. Many-to-One is the most common NAT policy on a  
SonicWALL security appliance, and allows you to translate a  
group of addresses into a single address. Most of the time, this  
means that you are taking an internal “private” IP subnet and  
translating all outgoing requests into the IP address of the  
SonicWALL security appliance WAN port, such that the  
destination sees the request as coming from the IP address of  
the SonicWALL security appliance WAN port, and not from the  
internal private IP address.  
This policy can be duplicated for subnets behind the other  
interfaces of the SonicWALL security appliance – just replace  
the Original Source with the subnet behind that interface,  
adjust the source interface, and add another NAT policy.  
SonicWALL NSA 5000/4500/3500 Getting Started Guide Page 43  
Download from Www.Somanuals.com. All Manuals Search And Download.  
 
Enabling Gateway Anti-Virus  
Enabling Security Services in SonicOS  
To enable Gateway Anti-Virus in SonicOS:  
You must enable each security service individually in the  
SonicOS user interface. See the following procedures to enable  
and configure the three security services that must be enabled:  
1. Navigate to the Security Services > Gateway Anti-Virus  
page. Select the Enable Gateway Anti-Virus checkbox.  
2. Select the Enable Inbound Inspection checkboxes for the  
protocols to inspect. By default, SonicWALL GAV inspects  
all inbound HTTP, FTP, IMAP, SMTP and POP3 traffic.  
CIFS/NetBIOS can optionally be enabled to allow shared  
access to files. Generic TCP Stream can optionally be  
enabled to inspect all other TCP based traffic, such as non-  
standard ports of operation for SMTP and POP3, and IM  
and P2P protocols.  
Page 44 Enabling Security Services in SonicOS  
Download from Www.Somanuals.com. All Manuals Search And Download.  
   
3. The Enable Outbound Inspection feature is available for  
SMTP traffic, such as for a mail server that might be hosted  
on the DMZ. Enabling outbound inspection for SMTP scans  
mail that is delivered to the internally hosted SMTP server  
for viruses.  
5. Click Configure Gateway AV Settings. The Gateway AV  
Settings window allows you to configure clientless  
notification alerts and create a SonicWALL GAV exclusion  
list.  
4. For each protocol you can restrict the transfer of files with  
specific attributes by clicking on the Settings button under  
the protocol. In the Settings dialog box, you can configure  
the following:  
Restrict Transfer of password-protected Zip files -  
Disables the transfer of password protected ZIP files  
over any enabled protocol. This option only functions  
on protocols that are enabled for inspection.  
Restrict Transfer of MS-Office type files containing  
macros (VBA 5 and above) - Disables the transfers of  
any MS Office 97 and above files that contain VBA  
macros.  
Restrict Transfer of packed executable files (UPX,  
FSG, etc.) - Disables the transfer of packed  
executable files. Packers are utilities that compress  
and sometimes encrypt executables. Although there  
are legitimate applications for these, they may be used  
with the intent of obfuscation, and this makes the  
executables less detectable by anti-virus applications.  
The packer adds a header that expands the file in  
memory, and then executes that file. SonicWALL  
Gateway Anti-Virus currently recognizes the most  
common packed formats: UPX, FSG, PKLite32, Petite,  
and ASPack.  
6. In the Gateway AV Config View window, to suppress the  
sending of email messages (SMTP) to clients from  
SonicWALL GAV when a virus is detected in an email or  
attachment, check the Disable SMTP Responses box.  
SonicWALL NSA 5000/4500/3500 Getting Started Guide Page 45  
Download from Www.Somanuals.com. All Manuals Search And Download.  
7. Select Enable HTTP Clientless Notification Alerts and  
customize the message. This feature informs the user that  
GAV detected a threat from the HTTP server.  
8. Select Enable Gateway AV Exclusion List and then click  
Add to define a range of IP addresses whose traffic will be  
excluded from SonicWALL GAV scanning.  
2. In the Signature Groups table, select the Prevent All and  
Detect All checkbox for each attack priority that you want  
to prevent. Selecting the Prevent All and Detect All check  
boxes for High Priority Attacks and Medium Priority  
Attacks protects your network against the most dangerous  
and disruptive attacks.  
3. To log all detected attacks, leave the Log Redundancy  
Filter field set to zero. To enforce a delay between log  
entries for detections of the same attack, enter the  
number of seconds to delay.  
4. Click Configure IPS Settings to enable IP packet  
reassembly before inspection and create a SonicWALL IPS  
exclusion list.  
5. In the IPS Config View window, select Enable IPS  
Exclusion List and then click Add to define a range of IP  
addresses whose traffic will be excluded from SonicWALL  
IPS scanning.  
9. When finished in the Add GAV Range dialog box, click OK.  
10. In the Gateway AV Config View window, click OK.  
11. In the Security Services > Gateway Anti-Virus page,  
click Accept.  
Enabling Intrusion Prevention Services  
To enable Intrusion Prevention Services in SonicOS:  
1. Navigate to the Security Services > Intrusion Prevention  
page. Select the Enable Intrusion Prevention checkbox.  
6. When finished in the Add IPS Range dialog box, click OK.  
7. In the IPS Config View window, click OK.  
8. In the Security Services > Intrusion Prevention page,  
click Accept.  
Page 46 Enabling Security Services in SonicOS  
Download from Www.Somanuals.com. All Manuals Search And Download.  
 
3. To log all spyware attacks, leave the Log Redundancy  
Filter field set to zero. To enforce a delay between log  
entries for detections of the same attack, enter the  
number of seconds to delay.  
Enabling Anti-Spyware  
To enable Anti-Spyware in SonicOS:  
1. Navigate to the Security Services > Anti-Spyware page.  
4. Click Configure Anti-Spyware Settings to configure  
clientless notification alerts and create a SonicWALL Anti-  
Spyware exclusion list.  
Select the Enable Anti-Spyware checkbox.  
5. In the Anti-Spyware Config View window, to suppress the  
sending of e-mail messages (SMTP) to clients from  
SonicWALL Anti-Spyware when spyware is detected in an  
e-mail or attachment, check the Disable SMTP  
Responses box.  
6. Select Enable HTTP Clientless Notification Alerts and  
customize the message. This feature informs the user that  
SonicWALL Anti-Spyware detected a threat from the HTTP  
server.  
7. Select Enable Anti-Spyware Exclusion List and then  
click Add to define a range of IP addresses whose traffic  
will be excluded from SonicWALL Anti-Spyware scanning.  
8. When finished in the Add Anti-Spyware Range dialog box,  
click OK.  
9. In the Anti-Spyware Config View window, click OK.  
10. Select the Enable Inbound Inspection checkboxes for the  
protocols to inspect. By default, SonicWALL GAV inspects  
all inbound HTTP, FTP, IMAP, SMTP and POP3 traffic.  
11. Select the Enable Inspection of Outbound  
Communication checkbox to enable scanning of traffic  
that originates internally.  
2. In the Signature Groups table, select the Prevent All and  
Detect All checkbox for each spyware danger level that  
you want to prevent.  
12. On the Security Services > Anti-Spyware page, click  
Accept.  
SonicWALL NSA 5000/4500/3500 Getting Started Guide Page 47  
Download from Www.Somanuals.com. All Manuals Search And Download.  
 
4. On the Edit Zone page, select the checkboxes for the  
security services that you want to enable.  
Applying Security Services to Network  
Zones  
A network zone is a logical group of one or more interfaces to  
which you can apply security rules to regulate traffic passing  
from one zone to another zone.  
Security services such as Gateway Anti-Virus are automatically  
applied to the LAN and WAN network zones when you activate  
the license and enable the service. To protect other zones such  
as the DMZ or Wireless LAN (WLAN), you must apply the  
security services to the network zones. For example, you can  
configure SonicWALL Intrusion Prevention Service for incoming  
and outgoing traffic on the WLAN zone to add more security for  
internal network traffic.  
To apply services to network zones:  
1. Navigate to the Network > Zones page.  
2. In the Zone Settings table, click the Configure icon for the  
5. Click OK.  
zone where you want to apply security services.  
6. To enable security services on other zones, repeat steps 2  
through 4 for each zone.  
3. In the Edit Zone dialog box on the General tab, select the  
checkboxes for the security services to enable on this  
zone.  
Page 48 Applying Security Services to Network Zones  
Download from Www.Somanuals.com. All Manuals Search And Download.  
 
Updating SonicPoint Firmware  
Deploying SonicPoints for Wireless  
Access  
If your SonicWALL appliance has Internet connectivity, it will  
automatically download the correct version of the SonicPoint  
image from the SonicWALL server when you connect a  
SonicPoint device. Otherwise, see the SonicOS Enhanced  
Administrator’s Guide for the correct procedure.  
This section describes how to configure SonicPoints with the  
SonicWALL NSA Series. See the following sub-sections:  
Configuring SonicPoint Provisioning Profiles  
SonicPoint Profile definitions include all of the settings that can  
be configured on a SonicPoint, such as radio settings for the  
2.4GHz and 5GHz radios, SSID’s and channels of operation.  
SonicWALL SonicPoints are wireless access points specially  
engineered to work with SonicWALL security appliances to  
provide wireless access throughout your enterprise. The  
SonicPoint section of the Management Interface lets you  
manage the SonicPoints connected to your system.  
Once you have defined a SonicPoint profile, you can apply it to  
a Wireless zone. Each Wireless zone can be configured with  
one SonicPoint profile. Any profile can apply to any number of  
zones. Then, when a SonicPoint is connected to a zone, it is  
automatically provisioned with the profile assigned to that zone.  
SonicOS includes a default SonicPoint profile, named  
Before you can manage SonicPoints in the Management  
Interface, you must first:  
SonicPoint. You can modify this profile or create a new one.  
Verify that the SonicPoint image is downloaded to your  
SonicWALL security appliance.  
Configure your SonicPoint provisioning profiles.  
Configure a Wireless zone.  
Assign profiles to wireless zones. This step is optional. If  
you do not assign a default profile for a zone, SonicPoints  
in that zone will use the first profile in the list.  
Assign an interface to the Wireless zone.  
Attach the SonicPoints to the interfaces in the Wireless  
zone and test.  
SonicWALL NSA 5000/4500/3500 Getting Started Guide Page 49  
Download from Www.Somanuals.com. All Manuals Search And Download.  
     
To add a new profile click Add below the list of SonicPoint  
provisioning profiles. To edit an existing profile, select the profile  
and click the Configure icon in the same line as the profile you  
are editing.  
Enter a recognizable string for the SSID of each  
SonicPoint using this profile. This is the name that will  
appear in clients’ lists of available wireless  
connections.  
Under ACL Enforcement, select Enable MAC Filter  
List to enforce Access Control by allowing or denying  
traffic from specific devices. Select a MAC address  
object group from the Allow List to automatically allow  
traffic from all devices with MAC addresses in the  
group. Select a MAC address group from the Deny  
List to automatically deny traffic from all devices with  
MAC addresses in the group. The Deny List is  
enforced before the Allow List.  
1. In the Add/Edit SonicPoint Profile window on the General  
tab:  
Select Enable SonicPoint.  
Enter a Name Prefix to be used as the first part of the  
name for each SonicPoint provisioned.  
Select the Country Code for where the SonicPoints  
are operating.  
2. In the 802.11g Radio tab:  
Select Enable Radio.  
Under WEP/WPA Encryption, select the  
Select a schedule for the radio to be enabled from the  
drop-down list.  
Authentication Type for your wireless network.  
SonicWALL recommends using WPA2 as the  
authentication type.  
For Radio Mode, select the speed that the SonicPoint  
will operate on. You can choose from the following:  
11Mbps - 802.11b  
54 Mbps - 802.11g  
108 Mbps - Turbo G  
Note: WPA2 is a more secure replacement for the older  
WEP and WPA standards.  
If you choose Turbo Mode, all users in your company  
must use wireless access cards that support Turbo  
mode.  
For Channel, use AutoChannel unless you have a  
reason to use or avoid specific channels.  
Fill in the fields specific to the authentication type that  
you selected. The remaining fields change depending  
on the selected authentication type.  
3. In the 802.11g Adv tab, configure the advanced radio  
settings for the 802.11g radio. For most 802.11g advanced  
options, the default settings give optimum performance.  
For a full description of the fields on this tab, see the  
SonicOS Enhanced Administrator’s Guide.  
Page 50 Deploying SonicPoints for Wireless Access  
Download from Www.Somanuals.com. All Manuals Search And Download.  
4. In the 802.11a Radio and 802.11a Adv tabs, configure the  
settings for the operation of the 802.11a radio bands. The  
SonicPoint has two separate radios built in. Therefore, it  
can send and receive on both the 802.11a and 802.11g  
bands at the same time.  
5. The settings in the 802.11a Radio and 802.11a Advanced  
tabs are similar to the settings in the 802.11g Radio and  
802.11g Advanced tabs.  
4. Click the Wireless tab.  
• In the Wireless Settings section, select Only allow  
traffic generated by a SonicPoint to allow only traffic  
from SonicWALL SonicPoints to enter the WLAN zone  
interface. This allows maximum security on your  
WLAN. Uncheck this option if you want to allow any  
traffic on your WLAN zone regardless of whether or  
not it is from a wireless connection. Uncheck Only  
allow traffic generated by a SonicPoint and use the  
zone on a wired interface to allow guest services on  
that interface.  
6. When finished, click OK.  
Configuring a Wireless Zone  
Select SSL VPN Enforcement to require that all traffic  
that enters into the WLAN zone be authenticated  
through a SonicWALL SSL VPN appliance.  
You can configure a wireless zone on the Network > Zones  
page. Typically, you will configure the WLAN zone for use with  
SonicPoints.  
1. On the Network > Zones page in the WLAN row, click the  
icon in the Configure column.  
Note: SSL VPN Enforcement allows the added security of  
one-time passwords when using a SonicWALL SSL  
VPN appliance.  
2. In the Edit Zone dialog box on the General tab, the Allow  
Interface Trust setting automates the creation of Access  
Rules to allow traffic to flow between the interfaces of a  
zone instance. For example, if the WLAN zone has both  
the X2 and X3 interfaces assigned to it, checking Allow  
Interface Trust on the WLAN zone creates the necessary  
Access Rules to allow hosts on these interfaces to  
communicate with each other.  
3. Select the checkboxes for the security services to enable  
on this zone. Typically you would enable Gateway Anti-  
Virus, IPS, and Anti-Spyware. If you are running  
SonicWALL Client Anti-Virus, select Enable Client AV  
Enforcement Service.  
In the SSL VPN Server list, select an address object  
to direct traffic to the SonicWALL SSL VPN appliance.  
In the SSL VPN Service list, select the service or  
group of services that you want to allow for clients  
authenticated through the SSL VPN.  
If your wireless network is already running WiFiSec,  
you can select WiFiSec Enforcement to require that  
all traffic that enters into the WLAN zone interface be  
either IPsec traffic, WPA traffic, or both.  
SonicWALL NSA 5000/4500/3500 Getting Started Guide Page 51  
Download from Www.Somanuals.com. All Manuals Search And Download.  
 
Assigning an Interface to the Wireless Zone  
Note: If you have configured WPA2 as your authentication  
Once the wireless zone is configured, you can assign an  
interface to it. This is the interface where you will connect the  
SonicPoint.  
type, you do not need to enable WiFiSec.  
If you have enabled WiFiSec Enforcement, you can  
specify the following:  
1. On the Network > Interfaces page, click the Configure  
icon in the row for the interface that you want to use, for  
example, X3. The interface must be unassigned.  
2. In the Edit Interface dialog box on the General tab, select  
WLAN or the zone that you created from the Zone drop-  
down list. Additional fields are displayed.  
3. Enter the IP address and subnet mask of the zone in the IP  
Address and Subnet Mask fields.  
4. In the SonicPoint Limit field, select the maximum number  
Select WiFiSec Exception Service to select  
services that are allowed to bypass the WiFiSec  
enforcement.  
Select Require WiFiSec for Site-to-Site VPN  
Tunnel Traversal to require WiFiSec security for  
all wireless connections through the WLAN zone  
that are part of a Site-to-Site VPN.  
of SonicPoints allowed on this interface.  
If you wish to run WPA or WPA2 in addition to  
WiFiSec, you can select Trust WPA/WPA2 traffic  
as WiFiSec to accept WPA and WPA2 as  
allowable alternatives to IPsec.  
5. If you want to enable remote management of the  
SonicWALL security appliance from this interface, select  
the supported management protocol(s): HTTP, HTTPS,  
SSH, Ping, SNMP, and/or SSH.  
6. If you want to allow selected users with limited  
management rights to log in to the security appliance,  
select HTTP and/or HTTPS in User Login.  
Under SonicPoint Settings, select the SonicPoint  
Provisioning Profile you want to apply to all  
SonicPoints connected to this zone. Whenever a  
SonicPoint connects to this zone, it will automatically  
be provisioned by the settings in the SonicPoint  
Provisioning Profile, unless you have individually  
configured it with different settings.  
7. Click OK.  
5. Optionally configure the settings on the Guest Services  
tab. For information about configuring Guest Services, see  
the SonicOS Enhanced Administrator’s Guide.  
6. When finished, click OK.  
Page 52 Deploying SonicPoints for Wireless Access  
Download from Www.Somanuals.com. All Manuals Search And Download.  
 
To connect the SonicPoint:  
Connecting the SonicPoint  
1. Using a Cat-5 Ethernet cable, connect the SonicPoint to  
the interface that you configured, and connect the  
SonicPoint to a power source.  
2. In the SonicOS user interface on the SonicPoint >  
SonicPoints page, click the Synchronize SonicPoints  
button. The SonicWALL appliance downloads a SonicPoint  
image from the SonicWALL back-end server.  
3. Follow the instructions in the SonicPoint wizard. Be sure to  
select the same authentication type and enter the same  
keys or password that you configured in SonicOS.  
When a SonicPoint unit is first connected and powered up, it will  
have a factory default configuration (IP Address 192.168.1.20,  
username: admin, password: password). Upon initializing, it  
will attempt to find a SonicOS device with which to peer. If it is  
unable to find a peer SonicOS device, it will enter into a stand-  
alone mode of operation with a separate stand-alone  
configuration allowing it to operate as a standard Access Point.  
If the SonicPoint locates a peer SonicOS device via the  
SonicWALL Discovery Protocol, an encrypted exchange  
between the two units will occur and the profile assigned to the  
relevant wireless zone will be used to automatically configure  
(provision) the newly added SonicPoint unit.  
For more information about wireless configuration, see the  
As part of the provisioning process, SonicOS will assign the  
discovered SonicPoint device a unique name, and it will record  
its MAC address and the interface and zone on which it was  
discovered. It can also automatically assign the SonicPoint an  
IP address, if so configured, so that the SonicPoint can  
communicate with an authentication server for WPA-EAP  
support. SonicOS will then use the profile associated with the  
relevant zone to configure the 2.4GHz and 5GHz radio settings.  
SonicWALL NSA 5000/4500/3500 Getting Started Guide Page 53  
Download from Www.Somanuals.com. All Manuals Search And Download.  
 
Using Packet Capture  
Troubleshooting Diagnostic Tools  
Packet Capture allows you to capture and examine the  
contents of individual data packets that traverse your  
SonicWALL firewall appliance. The captured packets contain  
both data and addressing information. The System > Packet  
Capture page provides a way to configure the capture criteria,  
display settings and file export settings, and displays the  
captured packets.  
SonicOS provides a number of diagnostic tools to help you  
maintain your network and troubleshoot problems. Several  
tools can be accessed on the System > Diagnostics page,  
and others are available on other screens.  
This section contains the following subsections:  
The Packet Capture screen has buttons for starting and  
stopping a packet capture. If you simply click Start without any  
configuration, the SonicWALL appliance will capture all packets  
except those for internal communication, and will stop when the  
buffer is full or when you click Stop.  
Page 54 Troubleshooting Diagnostic Tools  
Download from Www.Somanuals.com. All Manuals Search And Download.  
   
The SonicOS user interface provides three windows to display  
different views of the captured packets:  
Display Filter - interfaces, packet types, source/  
destination  
Logging - automatic transfer of buffer to FTP server  
Advanced - generated packets, GMS, syslog,  
management  
Captured Packets  
Packet Detail  
Hex Dump  
Using Ping  
Ping is available on the System > Diagnostics page.  
Click the Configure button to customize the settings for the  
capture. Once the configuration is complete, click Start to begin  
capturing packets. The settings available in the five main areas  
of configuration are summarized below:  
The Ping test bounces a packet off a machine on the Internet  
and returns it to the sender. This test shows if the SonicWALL  
security appliance is able to contact the remote host. If users on  
the LAN are having problems accessing services on the  
Internet, try pinging the DNS server, or another machine at the  
ISP location. If the test is unsuccessful, try pinging devices  
outside the ISP. If you can ping devices outside of the ISP, then  
the problem lies with the ISP connection.  
General - number of bytes to capture, wrap capture buffer  
Capture Filter - interfaces, packet types, source/  
destination  
SonicWALL NSA 5000/4500/3500 Getting Started Guide Page 55  
Download from Www.Somanuals.com. All Manuals Search And Download.  
 
You can filter the results to display only connections matching  
certain criteria. You can filter by Source IP, Destination IP,  
Destination Port, Protocol, Src Interface and Dst Interface.  
Enter your filter criteria in the Active Connections Monitor  
Settings table.  
Using the Active Connections Monitor  
The Active Connections Monitor displays real-time,  
exportable (plain text or CSV), filterable views of all connections  
to and through the SonicWALL security appliance. This tool is  
available on the Systems > Diagnostics page.  
The fields you enter values into are combined into a search  
string with a logical AND. Select the Group Filters box next to  
any two or more criteria to combine them with a logical OR.  
Page 56 Troubleshooting Diagnostic Tools  
Download from Www.Somanuals.com. All Manuals Search And Download.  
 
Using Log > View  
The SonicWALL security appliance maintains an Event log for  
tracking potential security threats. You can view the log in the  
Log > View page, or it can be automatically sent to an email  
address for convenience and archiving. The log is displayed in  
a table and can be sorted by column.  
You can filter the results to display only event logs matching  
certain criteria. You can filter by Priority, Category,  
Source (IP or Interface), and Destination (IP or Interface).  
The fields you enter values into are combined into a search  
string with a logical AND. Select the Group Filters box next to  
any two or more criteria to combine them with a logical OR.  
SonicWALL NSA 5000/4500/3500 Getting Started Guide Page 57  
Download from Www.Somanuals.com. All Manuals Search And Download.  
 
Deployment Configuration Reference Checklist  
Use this checklist to find more information about various deployment tasks within the SonicOS Enhanced Administrator’s Guide.  
For this Task...  
See this Chapter...  
Inspecting the rule base for inbound and outbound rules  
Setting logging levels  
Configuring Access Rules  
Configuring Log Categories (“Logging Level” section)  
Configuring threat prevention on all used zones  
Configuring Zones  
(“Enabling SonicWALL Security Services on Zones” section)  
Configuring Web filtering protection  
Changing administrator login  
Configuring SonicWALL Content Filtering Service  
Configuring Administration Settings  
("Administrator Name & Password“ section)  
Setting administrator email  
Configuring Log Automation (“Email Log Automation“ section)  
Disabling HTTP and ping access  
Configuring Interfaces  
(“Configuring Advanced Settings for the Interfaces“ section)  
Disabling or enabling DHCP  
Configuring user management  
Configuring VPN policies  
Securing wireless access  
Setting Up the DHCP Server  
Managing Users and Authentication Settings  
Configuring VPN Policies  
Managing SonicPoints  
Page 58 Deployment Configuration Reference Checklist  
Download from Www.Somanuals.com. All Manuals Search And Download.  
 
5
Support and Training Options  
In this Section:  
This section provides overviews of customer support and training options for the SonicWALL NSA Series.  
SonicWALL NSA 5000/4500/3500 Getting Started Guide Page 59  
Download from Www.Somanuals.com. All Manuals Search And Download.  
 
Customer Support  
Support Services  
SonicWALL offers Web-based and telephone support to  
customers who have a valid Warranty or who purchased a  
Support Contract. Please review our Warranty Support Policy  
for product coverage. SonicWALL also offers a full range of  
consulting services to meet your needs, from our innovative  
implementation services to traditional statement of work-based  
services.  
SonicWALL support services are designed not only to keep  
your security infrastructure current, but also to react swiftly to  
any problem that may occur. However, that is not enough to  
keep your network safe these days. So our support services  
also include crucial updates and upgrades, the finest technical  
support, access to extensive electronic tools and timely  
hardware replacement.  
For further information, visit:  
For further information, visit:  
<http://www.sonicwall.com/us/support/contact.html>  
<http://www.sonicwall.com/us/support/3870.html>  
Page 60 Customer Support  
Download from Www.Somanuals.com. All Manuals Search And Download.  
   
SonicWALL Live Product Demos  
Knowledge Portal  
Get an interactive insight into SonicWALL security products and  
services with the following series of live product demos:  
The Knowledge Portal is a resource that allows users to search  
for SonicWALL documents, and set alerts when new content is  
available, based on the following types of search tools:  
Unified Threat Management Platform  
Secure Cellular Wireless  
Continuous Data Protection  
SSL VPN Secure Remote Access  
Content Filtering  
Mandatory Remote Assist  
Secure Wireless Solutions  
Email Security  
Browse  
Bookmarks and alerts  
Search for keywords  
Full-text search  
Top 25 categories  
For further information, visit:  
<http://www.sonicwall.com/us/support.html>  
GMS and ViewPoint  
For further information, visit: <http://livedemo.sonicwall.com/>  
SonicWALL NSA 5000/4500/3500 Getting Started Guide Page 61  
Download from Www.Somanuals.com. All Manuals Search And Download.  
   
User Forums  
The SonicWALL User Forums is a resource that provides users  
the ability to communicate and discuss a variety of security and  
appliance subject matters. In this forum, the following  
categories are available for users:  
Content Security Manager topics  
Continuous Data Protection topics  
Email Security related topics  
Firewall related topics  
Network Anti-Virus related topics  
Security Services and Content Filtering topics  
GMS and Viewpoint related topics  
SonicPoint and Wireless related topics  
SSL VPN related topics  
TZ 190 / Wireless WAN - 3G Capability  
VPN Client related topics  
VPN site-to-site and interoperability topics  
For further information, visit:  
<https://forum.sonicwall.com/>  
Page 62 User Forums  
Download from Www.Somanuals.com. All Manuals Search And Download.  
 
Training  
SonicWALL offers an extensive sales and technical training  
curriculum for Network Administrators, Security Experts and  
SonicWALL Medallion Partners who need to enhance their  
knowledge and maximize their investment in SonicWALL  
Products and Security Applications. SonicWALL Training  
provides the following resources for its customers:  
E-Training  
Instructor-Led Training  
Custom Training  
Technical Certification  
Authorized Training Partners  
For further information, visit:  
<http://www.sonicwall.com/us/support/training.html>  
SonicWALL NSA 5000/4500/3500 Getting Started Guide Page 63  
Download from Www.Somanuals.com. All Manuals Search And Download.  
 
Related Documentation  
See the following related documents for more information:  
SonicOS Enhanced Administrator’s Guide  
SonicOS Enhanced Release Notes  
SonicOS Enhanced Feature Modules  
Application Firewall  
Dashboard  
HF License Sync  
Multiple Admin  
NAT Load Balancing  
Packet Capture  
RF Management  
Single Sign On  
SSL Control  
Virtual Access Points  
SonicWALL GVC 4.0 Administrator’s Guide  
SonicWALL ViewPoint 4.1 Administrator’s Guide  
SonicWALL GAV 2.1 Administrator’s Guide  
SonicWALL IPS 2.0 Administrator’s Guide  
SonicWALL Anti-Spyware Administrator’s Guide  
SonicWALL CFS Administrator’s Guide  
For further information, visit:  
<http://www.sonicwall.com/us/support/289.html>  
Page 64 Related Documentation  
Download from Www.Somanuals.com. All Manuals Search And Download.  
 
6
Product Safety and Regulatory Information  
In this Section:  
This section provides regulatory along with trademark and copyright information.  
SonicWALL NSA 5000/4500/3500 Getting Started Guide Page 65  
Download from Www.Somanuals.com. All Manuals Search And Download.  
 
Consideration must be given to the connection of the equip-  
ment to the supply circuit. The effect of overloading the circuits  
has minimal impact on overcurrent protection and supply wir-  
ing. Appropriate consideration of equipment nameplate rat-  
ings must be used when addressing this concern.  
Reliable grounding of rack-mounted equipment must be main-  
tained. Particular attention must be given to power supply  
connections other than direct connections to the branch cir-  
cuits such as power strips.  
Safety and Regulatory Information  
Regulatory Model/Type  
Product Name  
1RK13-051  
1RK13-051  
1RK13-052  
NSA 5000  
NSA 4500  
NSA 3500  
Rack Mounting the SonicWALL  
The above SonicWALL appliances are designed to be mounted in a  
standard 19-inch rack mount cabinet. The following conditions are  
required for proper installation:  
Lithium Battery Warning  
The Lithium Battery used in the SonicWALL Internet security appliance  
may not be replaced by the user. The SonicWALL must be returned to a  
SonicWALL authorized service center for replacement with the same or  
equivalent type recommended by the manufacturer. If, for any reason,  
the battery or SonicWALL Internet security appliance must be disposed  
of, do so following the battery manufacturer's instructions.  
Use the mounting hardware recommended by the rack manu-  
facturer and ensure that the rack is adequate for the applica-  
tion.  
Four mounting screws, compatible with the rack design, must  
be used and hand tightened to ensure secure installation.  
Choose a mounting location where all four mounting holes line  
up with those of the mounting bars of the 19-inch rack mount  
cabinet.  
Mount in a location away from direct sunlight and sources of  
heat. A maximum ambient temperature of 104º F (40º C) is  
recommended.  
Route cables away from power lines, fluorescent lighting fix-  
tures, and sources of noise such as radios, transmitters and  
broadband amplifiers.  
Cable Connections  
All Ethernet and RS232 (Console) cables are designed for intra-building  
connection to other equipment. Do not connect these ports directly to  
communication wiring or other wiring that exits the building where the  
SonicWALL is located.  
The included power cord is intended for use in North America  
only. For European Union (EU) customers, a power cord is not  
included.  
Ensure that no water or excessive moisture can enter the unit.  
Allow unrestricted airflow around the unit and through the  
vents on the side of the unit. A minimum of 1 inch (25.44mm)  
clearance is recommended.  
Mount the SonicWALL appliances evenly in the rack in order  
to prevent a hazardous condition caused by uneven mechan-  
ical loading.  
Page 66 Safety and Regulatory Information  
Download from Www.Somanuals.com. All Manuals Search And Download.  
 
Prüfen Sie den Anschluss des Geräts an die Stromver-  
sorgung, damit der Überstromschutz sowie die elektrische  
Leitung nicht von einer eventuellen Überlastung der Stromver-  
sorgung beeinflusst werden. Prüfen Sie dabei sorgfältig die  
Angaben auf dem Aufkleber des Geräts.  
Vergewissern Sie sich, dass das Gerät sicher im Rack befes-  
tigt ist. Insbesondere muss auf nicht direkte Anschlüsse an  
Stromquellen geachtet werden wie z. B. bei Verwendung von  
Mehrfachsteckdosen.  
Safety and Regulatory Information in German  
Weitere Hinweise zur Montage  
Die oben genannten SonicWALL-Modelle sind für eine Montage in  
einem standardmäßigen 19-Zoll-Rack konzipiert. Für eine  
ordnungsgemäße Montage sollten die folgenden Hinweise beachtet  
werden:  
Vergewissern Sie sich, dass das Rack für dieses Gerät geeig-  
net ist und verwenden Sie das vom Rack-Hersteller empfoh-  
lene Montagezubehör.  
Hinweis zur Lithiumbatterie  
Verwenden Sie für eine sichere Montage vier passende Be-  
festigungsschrauben, und ziehen Sie diese mit der Hand an.  
Wählen Sie für die Montage einen Ort, der keinem direkten  
Sonnenlicht ausgesetzt ist und sich nicht in der Nähe von  
Wärmequellen befindet. Die Umgebungstemperatur darf nicht  
mehr als 40 °C betragen.  
Die in der Internet Security Appliance von SonicWALL verwendete  
Lithiumbatterie darf nicht vom Benutzer ausgetauscht werden. Zum  
Austauschen der Batterie muss die SonicWALL in ein von SonicWALL  
autorisiertes Service-Center gebracht werden. Dort wird die Batterie  
durch denselben oder entsprechenden, vom Hersteller empfohlenen  
Batterietyp ersetzt. Beachten Sie bei einer Entsorgung der Batterie oder  
der SonicWALL Internet Security Appliance die diesbezüglichen  
Anweisungen des Herstellers.  
Achten Sie darauf, das sich die Netzwerkkabel nicht in der un-  
mittelbaren Nähe von Stromleitungen, Leuchtstoffröhren und  
Störquellen wie Funksendern oder Breitbandverstärkern be-  
finden.  
Das beigefügte Netzkabel ist nur für den Gebrauch in Nor-  
damerikas Vorgesehen. Für Kunden in der Europaïschen Un-  
ion (EU) ist ein Netzkabel nicht im Lieferumfang enthalten.  
Stellen Sie sicher, dass das Gerät vor Wasser und hoher Luft-  
feuchtigkeit geschützt ist.  
Stellen Sie sicher, dass die Luft um das Gerät herum zirkuli-  
eren kann und die Lüftungsschlitze an der Seite des Gehäus-  
es frei sind. Hier ist ein Belüftungsabstand von mindestens 26  
mm einzuhalten.  
Kabelverbindungen  
Alle Ethernet- und RS232-C-Kabel eignen sich für die Verbindung von  
Geräten in Innenräumen. Schließen Sie an die Anschlüsse der  
SonicWALL keine Kabel an, die aus dem Gebäude in dem sich das  
Gerät befindet ,herausgeführt werden.  
Bringen Sie die SonicWALL waagerecht im Rack an, um  
mögliche Gefahren durch ungleiche mechanische Belastung  
zu vermeiden.  
SonicWALL NSA 5000/4500/3500 Getting Started Guide Page 67  
Download from Www.Somanuals.com. All Manuals Search And Download.  
 
FCC Part 15 Class A Notice  
CISPR 22 (EN 55022) Class A  
NOTE: This equipment was tested and found to comply with the limits for a Class A  
digital device, pursuant to Part 15 of the FCC Rules. These limits are designed to  
provide reasonable protection against harmful interference when the equipment is  
operated in a commercial environment. This equipment generates, uses, and can  
radiate radio frequency energy. And if not installed and used in accordance with  
the instruction manual, the device may cause harmful interference to radio  
communications. Operation of this equipment in a residential area is likely to cause  
harmful interference in which case the user is required to correct the interference  
at his own expense.  
Warning: This is a class A product. In a domestic environment, this product may  
cause radio interference in which case the user may be required to take adequate  
measures.  
Declaration of Conformity  
Application of council Directive 2004/108/EC (EMC) and  
2006/95/EC (LVD)  
Standards to which conformity is declared  
EN 55022 (2006) +A2 Class A  
EN 55024 (1998) +A2  
EN 61000-3-2 (2006) +A2  
Complies with EN 55022 Class A and CISPR22 Class A.  
EN 61000-3-3 (1995) +A1  
EN 60950-1 (2001) +A11  
Caution: Modifying this equipment or using this equipment for purposes not shown  
in this manual without the written consent of SonicWALL, Inc. could void the user’s  
authority to operate this equipment.  
National Deviations: AR, AT, AU, BE, BR, CA, CH, CN, CZ,  
DE, DK, FI, FR, GB, GR, HU, IL, IN, IT, JP, KE,  
KR, MY, NL, NO, PL, SE, SG, SI, SK, US  
BMSI Statement  
Regulatory Information for Korea  
Ministry of Information and Telecommunication  
Certification Number  
All products with country code “” (blank) and “A” are made in the USA.  
All products with country code “B” are made in China.  
All products with country code "C" or "D" are made in Taiwan R.O.C.  
All certificates held by Secuwide Corp.  
VCCI Statement  
Canadian Radio Frequency Emissions Statement  
This Class A digital apparatus complies with Canadian ICES-003.  
Cet appareil numérique de la classe A est conforme à toutes la norme NMB-003  
du Canada.  
Page 68 Safety and Regulatory Information  
Download from Www.Somanuals.com. All Manuals Search And Download.  
       
Copyright Notice  
© 2008 SonicWALL, Inc.  
All rights reserved.  
Under the copyright laws, this manual or the software described within,  
cannot be copied, in whole or part, without the written consent of the  
manufacturer, except in the normal use of the software to make a  
backup copy. The same proprietary and copyright notices must be  
affixed to any permitted copies as were affixed to the original. This  
exception does not allow copies to be made for others, whether or not  
sold, but all of the material purchased (with all backup copies) can be  
sold, given, or loaned to another person. Under the law, copying  
includes translating into another language or format.  
Specifications and descriptions subject to change without notice.  
Trademarks  
SonicWALL is a registered trademark of SonicWALL, Inc.  
Microsoft Windows 98, Windows Vista, Windows 2000, Windows XP,  
Windows Server 2003, Internet Explorer, and Active Directory are  
trademarks or registered trademarks of Microsoft Corporation.  
Netscape is a registered trademark of Netscape Communications  
Corporation in the U.S. and other countries. Netscape Navigator and  
Netscape Communicator are also trademarks of Netscape  
Communications Corporation and may be registered outside the U.S.  
Adobe, Acrobat, and Acrobat Reader are either registered trademarks or  
trademarks of Adobe Systems Incorporated in the U.S. and/or other  
countries.  
Firefox is a trademark of the Mozilla Foundation.  
Other product and company names mentioned herein may be  
trademarks and/or registered trademarks of their respective companies  
and are the sole property of their respective manufacturers.  
SonicWALL NSA 5000/4500/3500 Getting Started Guide Page 69  
Download from Www.Somanuals.com. All Manuals Search And Download.  
   
Notes  
Page 70 Notes  
Download from Www.Somanuals.com. All Manuals Search And Download.  
Notes  
SonicWALL NSA 5000/4500/3500 Getting Started Guide Page 71  
Download from Www.Somanuals.com. All Manuals Search And Download.  
Notes  
Page 72 Notes  
Download from Www.Somanuals.com. All Manuals Search And Download.  
SonicWALL, Inc.  
1143 Borregas Avenue  
Sunnyvale CA 94089-1306  
T +1 408.745.9600  
F +1 408.745.9300  
P/N 232-001265-50  
Rev A 01/08  
©2008 SonicWALL, Inc. is a registered trademark of SonicWALL, Inc. Other product names mentioned herein may be trademarks and/or registered trademarks of their respective companies. Specifications and descriptions subject to change without notice.  
Download from Www.Somanuals.com. All Manuals Search And Download.  

Sennheiser Radio 820 S RF User Manual
Sharp Calculator EL S50 User Manual
Singer Sewing Machine 1030 User Manual
Sony Microphone C 800G User Manual
Sony MP3 Docking Station ICF CS15IP User Manual
Sony Photo Printer FVP 1 1E User Manual
Speco Technologies Power Supply PSR 12S User Manual
Spectra GPS Receiver CR600 User Manual
Stiga Lawn Mower 13 2557 13 User Manual
Sunrise Medical Bicycle Shark S User Manual