SonicWALL Update. Jean-Marc Baumann Regional Manager Switzerland / Austria

Transcription

1 SonicWALL Update Jean-Marc Baumann Regional Manager Switzerland / Austria

2 SonicWALL s Future SonicWALL will be an independant company Day «One» is 1. November 2016 Channel of distribution will stay the same 2

3 SonicWALL Selling Models Classic Sell-out - Offer Hardware and Services to your customer and sell it - The customer is the owner MSP - Offer Managed Security Services to your customer - Sell or lease the appliance to the customer - Offer additonal Service which makes you as a partner unique - Manage Renewals over Flexspend - Use GMS to managed centrally SECaaS - Offer security solution on a monthly payment to the customer - Combine this model with the MSP model Unique selling model offer from one Vendor DELL SonicWALL 3

4 SonicWALL News Price Increase by 1. November 2016 On Gen5 Services and Support (TZ215, NSA 220, NSA 2400, NSA 3500 etc.) Potential to upgrade to Gen 6 Secure Upgrade Promo Renewal today The prices online are already higher 4

5 SonicWALL Partner Event 4. November to 5 GDI Gottlieb Duttweiler Institute, Langhaldenstrasse 21, 8803 Rüschlikon/Zürich Technical Update / Sales Infos Free participation Registration: 5

6 SonicWALL Global Management System and Analyzer Technical Training Daniel Bühler

7 Module 1.1 Overview

8 What is GMS? Dell SonicWALL Global Management System, or GMS, provides a comprehensive architecture for centrally creating and managing security policies, providing real-time monitoring and alerts, and delivering intuitive compliance and usage reports, all from a single management interface 8

9 GMS Reports Web Site access denied This site is blocked by the content Filter Service. URL: Reason for restriction: «Search Engines and Portals» Syslog Summarized data Reporting database GMS agent 9

10 The Value of Global Management Business Owner IT Staff Integrated Management, Reporting, Monitoring Suite SonicWALL Solution Simplified inventory management Incremental node license model Integrated service licensing Service contract co-termination Reporting for auditors User activity reporting Customer Benefit Greater efficiencies via a single platform Relevant data for auditors Adherence to compliance controls Elimination of wasteful network usage Prevent lapse in support coverage One vendor to procure from SonicWALL Solution Granular control of SNWL devices Role based management Policy automation for multiple sites Inheritance rules and filters Customizable network alarms High availability architecture Customer Benefit Increased staff productivity Streamlined Mgmt and provisioning Adherence to compliance controls Rapid response to network disruptions High service and network uptime Scheduled policy changes 10

11 ... and Analyzer? Dell SonicWALL Analyzer is a web-based traffic analytics and reporting tool that provides realtime and historical insight into the health, performance and security of the network. 11

12 GMS versus Analyzer GMS Analyzer Reporting Policies Monitoring 12

13 Why customers choose GMS over Analyzer Multi-device policy management capabilities Role based access control Reporting and Analytics Policy Management Scheduled policy changes Monitoring Automated backup of preferences files on a daily/weekly schedule Third party application integration (web services API, CLI, etcetera) 13

14 Available Platforms Software (Windows application) Windows Server 2008/ bit or 64-bit Windows 7, Vista, XP (Analyzer) Virtual Appliance (VA) Same as the UMA5000, only in a virtualized state for VMWare ESX or ESXi 4.x/5.0 GMS can operate with a mix of software and VA components 14

15 System Requirements: Software GMS Windows Operating System Requirements Windows Server 2008 SBS 64-bit Windows Server 2008 Standard 32-bit and 64-bit (SP1) Windows Server bit and 64-bit (SP2) All listed operating systems are supported in both virtualized and non virtualized (VMware ESXi 4.1) environments. Virtual Appliance Hardware Resource Requirements ESX/ESXi 4 Update 1 or ESXi 5 RAM 3168 MB max RAM supported by SonicLinux - 32-bit OS. CPU 2 (SonicWALL recommends allocating 4 CPUs for best performance.) Hard disk space (Thin Provisioning is not recommended) For the 40 GB image Up to 40 GB For the 250 GB image Up to 250 GB For the 950 GB image Up to 950 GB - either a 4 MB or 8 MB block size 15

16 GMS Licensing Information Licensed by Node - which is ANY unit under management 5, 10, or 25 licenses are offered GMS Licenses are stackable Incremental licenses range from 1, 5, 10, 25, 100, 250 & 1000 bundles. Support 24x7 based on the number of nodes under management 16

17 Analyzer Licensing Information Licensed per appliance Price point depends on the type of appliance TZ, NSA, SuperMassive, etc Support is covered by the appliance under management 17

18 Version Requirements: Managed Units SonicWALL Platforms Firewall / Network Security SonicWALL SuperMassive Series SonicWALL NSA Series SonicWALL TZ Series SonicWALL Pro Series Security / Anti-Spam SonicWALL Securtiy Series Secure Mobile Access SonicWALL SMA 100 Series (SMB, SRA) SonicWALL SMA 1000 Series Note: Always check the Release Notes for the most up to date information SonicWALL Firmware Version SonicOS 6.0 or newer SonicOS Enhanced 5.0 or newer SonicOS Enhanced 3.2 or newer SonicOS Standard 3.2 or newer SonicOS Enhanced 3.2 or newer SonicWALL Securtiy 7.2 or newer (management only) SonicOS SSL-VPN 2.1 or newer Avantail 9.0 or newer 18

19 User Interface All-In-One WebServer Update Manager Syslog Collector Scheduler Reports Summarizer Reports Scheduler Event Manager Monitoring Manager Database Reporting Database /login 19

20 System Interface 20

21 User Interfaces WebServer Update Manager Syslog Collector Scheduler Reports Summarizer Reports Scheduler Event Manager Monitoring Manager Console Database Agent2 Summarizer Reporting Database Syslog Collector Scheduler Reports Summarizer Event Manager Monitoring Manager Reporting Database Reports Summarizer Reporting Database Application Interface - System Interface - /login System Interface /login System Interface /login 21

22 Application Interface Policies Panel 22

23 Unit Status Provisioned the unit has been added to GMS, but has not yet been acquired. Up the unit is acquired and the GMS agent is receiving heartbeats from the appliance. Task(s) pending the unit is up, and there are one or more tasks pending for immediate execution. Task(s) scheduled the unit is up, and there are one or more tasks scheduled. Down the GMS agent is no longer receiving heartbeats from the unit. The small symbol in the upper-left corner of the icon indicates that when the unit was added to GMS, the Managed Address was specified manually. 23

24 Application Interface Reports Panel 24

25 Applications Interface - Monitor 25

26 Application Interface - Console 26

27 Module 1.2 Deployment Scenarios

28 Managed Service Provider Environment GMS GMS can be deployed as software (on a third party Windows server) or as a virtual appliance 28

29 Distributed Enterprise Deployment GMS GMS can be deployed as software (on a third party Windows server) or as a virtual appliance 29

30 Single Tier Deployment or All in One Home Office GMS Gateway Car Dealership Law Firm GMS SERVER Agent-Database-Console Agent, Console, and Database on the same server Recommended for small deployments without redundancy requirements 30

31 Multi-Tier Deployment: Example 1 Distributed agents behind single GMS Gateway Primary: Agent 2 Secondary: Agent 1 Home Office GMS Gateway Primary: Agent 1 Secondary: Agent 2 Car Dealership Primary: Agent 1 Secondary: Agent 2 Law Firm SQL GMS Console 1 2 Agent Agent 31

32 VPN Multi-Tier Deployment: Example 2 2 Agent Primary: Agent 2 GMS Gateway Secondary: Agent 1 Home Office Primary: Agent 1 Secondary: Agent 2 Car Dealership GMS Gateway Primary: Agent 1 Secondary: Agent 2 Law Firm SQL GMS Console 1 Agent Agents behind separate GMS Gateway 32

33 GMS Roles All-in-One All GMS services, including the database using MySQL. Database Only GMS database using MySQL Server. Console All GMS services, no database. Agent Syslog Collector, Scheduler, Reports Summarizer, Event Manager, Web sever (for System Interface) and Monitoring Manager Reports Summarizer Reports Summarizer and Web sever (for System Interface) Reports Scheduler Reports Scheduler and Web sever (for System Interface) Monitor Monitoring Manager and Web sever (for System Interface) Event Manager 33 Event Manager and Web sever (for System Interface)

34 Module 1.3 Communication and Management Options

35 HTTPS Existing Management Tunnel Encryption Method and Flow GMS Console XP/7/8/10/2000/ 2003/2008/2012 UMA Management G/W Terminates Management Tunnel(s) Managed F/W DES (56-bit) Syslog & Management: HTTP POST DES/3DES/ AES/ETC 3DES (168-bit) Syslog HTTPS (128-bit): Port

36 Management Tunnel Syslog sent securely Secure communication between GMS and appliance Unit is added to GMS. Scheduler service logs into GMS Gateway and creates the Manual Key Management SA using DES/MD5. Management traffic from GMS to the managed appliance is sent securely using the Management SA parameters. Syslog from the managed appliance to the GMS agent is sent securely using the Management SA parameters. GMS Gateway GMS 36

37 HTTPS Management Encrypted Syslog Sent in the clear Secure HTTPS communication between GMS and appliance Management traffic from GMS to the managed appliance is sent securely using HTTPS. Syslog from the managed appliance to the GMS agent is sent in the clear, but the payload is encrypted. Gateway appliance forwards syslog to GMS agent GMS 37

38 Existing Tunnel/ LAN Syslog sent securely Insecure HTTP communication between GMS and appliance No GMS Gateway required. Management from GMS agent to managed appliance is HTTP. Syslog sent in the clear if there is no site-to-site VPN tunnel. Gateway appliance forwards syslog to GMS agent GMS 38

39 HTTPS Existing Management Tunnel Which management method is best? Advantage Disadvantage Most Likely Deployment Scenario VPN License Count: Not counted on the managed device VPN License Count: GMS Gateway must be able to handle number of remotely managed appliances MSSP : GMS deployment where the customer and the MSSP do not need VPN access to each other s networks VPN Tunnel is unidirectional: Managed Device GMS Gateway Manual Key SA: No negotiation of the VPN tunnel since Manual Key SA is created SMB: VPN license count are at or close to the available on the managed device VPN security parameter: Limited options Most amount of configuration VPN access is bidirectional VPN Security Parameters: Fully configurable VPN License Count: Counted against the VPN license on the GMS Gateway and the Managed Device Mixed Traffic: VPN tunnel is used for GMS Management and data exchange between the networks Distributed Enterprise : Existing VPN mesh environments SMB: GMS deployments where VPN tunnels have already been previously configured GMS Gateway is optional: A device other than a SonicWALL appliance can be upstream of the GMS Agent. Closed Remote Network: No need to open remote network to GMS subnet Complex Routing: Can be used in complex NAT environments where IPSEC does not work Decryption: Performed by the GMS Server not by the firewall Encryption: Limited to 3DES Public IP for GMS: Requires GMS server has a public, routable IP address or upstream device forwards syslog packets to the GMS server. Redundant Agents: Agents must each have own unique routable IP address. MSSP: GMS deployment where the customer and the MSSP do not need VPN access to each other s networks Distributed Enterprise or SMB: The device upstream of the GMS Server is not a SonicWALL Appliance. VPN license count are at or close to available on the managed device 39

40 Module 2.1 Adding Appliances

41 Management Tunnel Configuration 41

42 HTTPS Management Configuration 42

43 Existing Tunnel/ LAN Configuration 43

44 Unit Added; Waiting to be Acquired Unit Added Yellow unit with lighting bolt, task indicator 44

45 Module 2.2 Custom Groups, Group Attributes, and Views

46 Custom Groups 46

47 Creating Custom Groups 47

48 Applying Group Attributes to Units 48

49 Modifying Properties when Adding Units 49

50 Views 50

51 Views Custom 51

52 Changing Views 52

53 Module 2.3 Users, User Rights, and Authentication

54 GMS Users 54

55 GMS Users... 55

56 User Screen Permissions 56

57 Configuring Unit Permissions Franks Cheese Shop Evalution Unit NSA3600 Adam2 Demo Unit Franks Cheese Shop POC_do_not_touch_critcase Test 240 PCW SonicWALL Customer 1 Customer 2 57

58 Configuring User GMS Permissions 58

59 Security Settings 59

60 Example User Jeff Logged In 60

61 External User Authentication 61 Note: External Auth Domains will initially create users in the Guest Group

62 Domains 62

63 Domains 63

64 Module 3.1 Tasks: execution options, pending tasks, scheduled tasks and automation

65 Task Definition and Creation Task: Any action taken against a unit under management Examples: Create VPNs Collect ARP table. Firmware Update 65

66 Default Task Configuration Default Immediate Scheduled 66

67 Default Task Execution Configuration 67

68 Viewing Pending Tasks & Manual Execution 68

69 Automatic Preferences Backup 69

70 Module 3.2 Group management and Inheritance

71 Group Level Configuration 71

72 Inheritance Overview Forward Inheritance Pushes Group Level configurations down to units in that group Reverse Inheritance Pushes Unit Level configurations up to the group 72

73 Inheritance Filters 73

74 Forward Inheritance 74

75 Forward Inheritance Continued 75

76 Reverse Inheritance 76

77 Module 3.3 Mass Deployment Considerations

78 Minimum Configuration Minimum Configuration Needed WAN Connectivity GMS Management Method Encrypted Syslog Sent in the clear Secure HTTPS communication between GMS and appliance Unit with minimal configuration deployed Appliance phone s home to GMS Gateway appliance forwards syslog to GMS agent GMS will send down tasks that have been configured GMS 78

79 AddUnit.XML <FirewallList> <FirewallInfo> <sonicwallname>nsa240</sonicwallname> <serialnumber>0017c52c67dd</serialnumber> <username>admin</username> 79 <sonicwallpassword>9a5da02ce0b95e499d863c b9287</sonicwallpassword> <passwordencrypted>1</passwordencrypted> <typeofunit>1</typeofunit> <port>4240</port> <usevpn>1</usevpn> <standbymanagedatwan>1</standbymanagedatwan> <httpsmgmt>1</httpsmgmt> <SAencryptionKey>cfdc65e9f4b32e12</SAencryptionKey> <SAuthKey>2cfab81eec803cbb821c2da64b3aadca</SAuthKey> <scheduleripaddress> </scheduleripaddress> <standbyschedulerip></standbyschedulerip> <domainname>localdomain</domainname> <CustomInfo> <Country>USA</Country> <Company>SonicWALL</Company> <Department>Engineering</Department> <State>California</State> </CustomInfo> </FirewallInfo> </FirewallList>

80 Module 4 Management of Non- NGFW Appliances

81 Secure Mobile Access Appliances GMS can make manual/scheduled backup of SRA appliances (Policies, General, Settings) Alerts can be generated when GMS detects unit is down (heartbeat) Firmware upgrade can be scheduled Reports can also be generated: 81 Unit Level Reports Data Usage Timeline Users User Activity Access Method Summary Users Authentication User Login Failed Login Web Application Firewall Threats Detected Threats Prevented Apps Detected Apps prevented Users detected Users Prevented Connections Application Users Up/Down Timeline

82 Security Management GMS can only manage ES No reporting data is forwarded by GMS Management of ES uses Heterogeneous Management Same method used to manage CDP units To enable GMS on ES From CLI (SSH or serial access) - use the command gms <interval> <serverip> 82

83 Module 5.1 Reporting

84 A need for off-box application traffic analytics On-box reporting Quick sample Application control For a single device Off-box reporting Historic advanced reporting Trouble shooting, forensics Schedule customer reports Across multiple devices 84

85 Reporting Web Site access denied This site is blocked by the content Filter Service. URL: Reason for restriction: «Search Engines and Portals» Syslog Summarized data Reporting database GMS agent 85

86 Next Generation Reporting Near real-time Granular drill down Modern look and feel 86

87 User Activity Reporting... 87

88 Application Traffic Analytics Trouble shooting, forensics, app usage reports for customers 88

89 Device Uptime Reporting Q: Can you prove the firewall has been up consistently? Q: MSP Do you need to prove you met your Service Level Agreement? 89

90 Data Usage Reporting Q: Are you (or your customers) concerned about mounting bandwidth costs? 90

91 Threat Protection Reporting... 91

92 Universal Report Scheduler Q: Do you need to generate reports for your executive team or as part of a compliance initiative? Q: If you re an MSP, do you need to send out scheduled reports to your customer? 92

93 Adding Templates 93

94 Scheduling Reports 94

95 Manage Scheduled Reports 95

96 Net Monitor 96

97 Net Monitor 97

98 How to differentiate? Talk to the security Expert 25 Years of Expirience