Contents. Platform Compatibility. Browser Support. SonicOS NSA 220/250M, TZ 215 Series Release Notes. SonicOS

Transcription

1 SnicOS Cntents Platfrm Cmpatibility...1 Brwser Supprt...1 Knwn Issues...2 Reslved Issues...3 Supprted Features...4 Key Features in SnicOS Upgrading SnicOS Image Prcedures...36 Related Technical Dcumentatin...41 Platfrm Cmpatibility The SnicOS release is supprted n the fllwing SnicWALL Deep Packet Inspectin (DPI) security appliances: SnicWALL NSA 250M Series SnicWALL NSA 220 Series SnicWALL TZ 215 Series The SnicWALL WXA series appliances (WXA 6000 Sftware, WXA 500 Live CD, WXA 5000 Virtual Appliance, WXA 2000/4000 Appliances) are als supprted fr use with SnicWALL NSA E-Class, NSA, and TZ prducts running The minimum recmmended firmware versin fr the WXA series appliances is 1.3. SnicOS is nly cmpatible with WXA and newer. Earlier versins f WXA are nt supprted. Brwser Supprt SnicOS with Visualizatin uses advanced brwser technlgies such as HTML5, which are supprted in mst recent brwsers. SnicWALL recmmends using the latest Chrme, Firefx, Internet Explrer, r Safari brwsers fr administratin f SnicOS. This release supprts the fllwing Web brwsers: Chrme 18.0 and higher (recmmended brwser fr dashbard real-time graphics display) Firefx 16.0 and higher Internet Explrer 8.0 and higher (d nt use cmpatibility mde) Safari 5.0 and higher Mbile device brwsers are nt recmmended fr SnicWALL appliance system administratin.

2 Knwn Issues This sectin cntains a list f knwn issues in the SnicOS release. DPI-SSL Symptm Cnditin / Wrkarund Issue Excluding a User Object r User Grup fr Server DPI-SSL causes Client DPI-SSL t nt wrk prperly. Occurs when accessing HTTPS websites frm a client cmputer withut lgging in as a user n the client cmputer. Client DPI-SSL des nt change the site certificate t the SnicWALL certificate Netwrking Symptm Cnditin / Wrkarund Issue FTP r HTTP traffic cannt pass thrugh a pair f interfaces cnfigured in Wire Mde and set t Secure. Occurs when using a Stateful High Availability pair and Active-Active DPI is enabled VPN Symptm Cnditin / Wrkarund Issue The tunnel interface is bund t X0, but IKE traffic is allwed n X1 thrugh the remte firewall that is reachable n X1. Occurs when trying t establish a tunnel interface VPN between tw firewalls discvered by the ruter. When trying t cnnect Firewall1 X0 t Firewall2 X0, when the IPsec Phase2 security assciatin (SA) is accepted, but the VPN is dwn, the plicy is bund t X0. Althugh the remte firewall is reachable thrugh X1, n IKE packet shuld g thrugh the X1 interface

3 Reslved Issues The fllwing issues are reslved in the SnicOS release: Appflw Symptm Cnditin / Wrkarund Issue Sme devices and URLs are nt shwn n Flw Server. Occurs when trying t view devices n the Flw Server DPI-SSL Symptm Cnditin / Wrkarund Issue HTTPS Web sites cannt be accessed in Wire Occurs when Wire mde is in secure mde and mde. Client DPI-SSL enabled. Security Services Symptm Cnditin / Wrkarund Issue N inbund s are received. Occurs when Anti-Spam is enabled User Interface Symptm Cnditin / Wrkarund Issue The SnicOS management interface is slw t respnd, r des nt respnd fr a brief perid f time. Occurs when the WebListener task is in a lp waiting fr mre SSL data until it eventually times ut. During this perid, the tweblisten task may take 100% f the CPU time. Nte: As a best practice, cnfigure Access Cntrl f the management interface n the WAN VPN Symptm Cnditin / Wrkarund Issue NAT traffic is sent t WXA n the remte nde. Occurs when NAT traffic is sent ver a VPN tunnel interface. 3

4 Supprted Features This sectin shws SnicOS 5.8 feature supprt by mdel and lists features that are affected by licensing status. Supprted Features by Appliance Mdel The fllwing table lists the key features in SnicOS 5.8 and which appliance mdels supprt them. Feature / Enhancement NSA 220 Series NSA 250M Series TZ 215 Series Accept Multiple Prpsals fr Clients Supprted Supprted Supprted App Cntrl Advanced Supprted Supprted Supprted App Cntrl Plicy Cnfiguratin via AppFlw Mnitr Supprted Supprted Supprted App Rules Supprted Supprted Supprted AppFlw > Flw Reprting Supprted Supprted Supprted AppFlw Dash Supprted Supprted Supprted AppFlw Mnitr Supprted Supprted Supprted AppFlw Reprts Supprted Supprted Supprted Applicatin Usage and Risk Reprt Supprted Supprted Supprted Aut-Cnfiguratin f URLs t Bypass User Authenticatin Supprted Supprted Supprted Brwser NTLM Authenticatin Supprted Supprted Supprted CASS 2.0 Supprted Supprted Supprted CFS Enhancements Supprted Supprted Supprted Clud GAV Supprted Supprted Supprted Cnnectin Mnitr Supprted Supprted Supprted Current Users and Detail f Users Optins fr TSR Supprted Supprted Supprted Custmizable Lgin Page Supprted Supprted Supprted DHCP Scalability Enhancements Supprted Supprted Supprted DPI-SSL Supprted Supprted Dynamic WAN Scheduling Supprted Supprted Supprted Enhanced Cnnectin Limit Supprted Supprted Supprted Ge-IP Filtering and Btnet Cmmand & Cntrl Filtering Supprted Supprted Supprted Glbal BWM Ease f Use Enhancements Supprted Supprted Supprted 4

5 Feature / Enhancement NSA 220 Series NSA 250M Series TZ 215 Series IKEv2 Supprted Supprted Supprted IPFIX & NetFlw Reprting Supprted Supprted Supprted LDAP Primary Grup Attribute Supprted Supprted Supprted Link Aggregatin Lg Mnitr Supprted Supprted Supprted Management Traffic Only Optin fr Netwrk Interfaces NSA Mdules Supprted Supprted Supprted Supprted NTP Authenticatin Type Supprted Supprted Supprted Packet Mnitr Enhancements Supprted Supprted Supprted Prt Redundancy Preservatin f Anti-Virus Exclusins After Upgrade Supprted Supprted Supprted Real-Time Mnitr Supprted Supprted Supprted SIP Applicatin Layer Enhancements Supprted Supprted Supprted SnicPint Ne/Ni Supprted Supprted Supprted SnicPint VAPs Supprted Supprted Supprted SnicPint-N DR Supprted Supprted Supprted SSL VPN NetExtender Client Update Supprted Supprted Supprted SSO User Imprt frm LDAP Supprted Supprted Supprted Tp Glbal Malware Supprted Supprted Supprted User Mnitr Tl Supprted Supprted Supprted VLAN Subinterfaces Supprted Supprted Supprted WAN Acceleratin Supprt Supprted Supprted Supprted Wire and Tap Mde Wireless Client Bridge Supprt Supprted Supprted Supprted YuTube fr Schls Supprted Supprted Supprted 5

6 Supprted Features and Licensing Sme pages in the SnicOS management interface d nt display if the license is nt activated fr the feature n that page. Here is an example f the Dashbard > Real-Time Mnitr page with App Visualizatin nt licensed: The fllwing table lists the key features in SnicOS 5.8 that depend n licenses and ther settings fr the related management interface pages t display and functin prperly: SnicOS Feature N license (SGSS) With license Disabled in flw reprting With license and enabled in flw reprting Dashbard > Real-Time Mnitr Blcks the page with a license ppup windw. All charts are independently enabled r disabled frm the AppFlw > Flw Reprting page. It is nt dependent n Visualizatin being enabled. All charts are enabled. The App charts cntent depends n whether Visualizatin r App Cntrl Advanced is enabled with zne settings. Dashbard > AppFlw Mnitr/Dash/Reprts Blcks the page with a license ppup windw. The AppFlw Mnitr page displays the message flw reprting and visualizatin is disabled. Cntent is nt shwn. All tabs are visible and fully peratinal. Dashbard > BWM Mnitr Blcks the page with a license ppup windw. Always n if Glbal BWM and Interface are enabled. Always n if Glbal BWM and Interface are enabled. AppFlw > Flw Reprting Available and displays a statement that App Visualizatin is nt licensed. Available Available Security Services > GeIP Filter Blcks the page with a license ppup windw. Nt available Available Security Services > Btnet Filter Blcks the page with a license ppup windw. Available Available * This is a separate license and is nt part f the Cmprehensive Gateway Security Suite (CGSS). 6

7 Key Features in SnicOS 5.8 The fllwing are the key features in SnicOS 5.8: YuTube fr Schls Cntent Filtering Supprt YuTube fr Schls is a service that allws fr custmized YuTube access fr students, teachers, and administratrs. YuTube Educatin (YuTube EDU) prvides schls access t hundreds f thusands f free educatinal vides. These vides cme frm a number f respected rganizatins. Yu can custmize the cntent available in yur schl. All schls get access t all f the YuTube EDU cntent, but teachers and administratrs can als create playlists f vides that are viewable nly within their schl's netwrk. Befre cnfiguring yur SnicWALL security appliance fr YuTube fr Schls, yu must first sign up: The cnfiguratin f YuTube fr Schls depends n the methd f Cntent Filtering yu are using, which is cnfigured n the Security Services > Cntent Filter page. Membership in Multiple Grups If a user is a member f multiple grups where ne plicy allws access t any part f YuTube and the ther plicy has a YuTube fr Schls restrictin, the user will be filtered by the YuTube fr Schls plicy and nt be allwed unrestricted access t YuTube. A user cannt be a member f multiple grups that have different YuTube fr Schl IDs. While the firewall will accept the cnfiguratin, this is nt supprted. Nte: Fr mre infrmatin n the general cnfiguratin f CFS, refer t the Security Services > Cntent Filter sectin in the SnicOS Administratr s Guide. Cnfiguring YuTube fr Schls as an App Cntrl Plicy When the CFS Plicy Assignment drp-dwn menu is set t Via Applicatin Cntrl, YuTube fr Schls is cnfigured as an App Cntrl Plicy. 1. Navigate t Firewall > Match Objects and click Add New Match Object. 2. Type in a descriptive name, and then select CFS Allw/Frbidden List as the Match Object Type. 3. Select Partial Match fr the Match Type. 4. In the Cntent field, type in yutube.cm and then click Add. 5. Type in ytimg.cm and then click Add. 6. Click OK t create the Match Object. 7

8 7. Navigate t the Firewall > App Rules page and click Add New Plicy. 8. Type in a descriptive Plicy Name. 9. Fr the Plicy Type, select CFS. 10. Select the apprpriate settings fr Match Object and Actin Object, based n yur envirnment. 11. Fr CFS Allw/Excluded List, select the Match Object yu just created (ur example uses CFS Allw YT4S ). 12. Select the Enable YuTube fr Schls checkbx. 13. Paste in yur Schl ID, which is btained frm Click OK t create the plicy. NOTE: Once the plicy has been applied, any existing brwser cnnectins will be unaffected until the brwser has been clsed and repened. Als, if yu have a brwser pen as administratr n the firewall, yu will be excluded frm CFS plicy enfrcement unless yu cnfigure the firewall specifically nt t exclude yu (select the D nt bypass CFS blcking fr the Administratr checkbx n the Security Services > Cntent Filter page). 8

9 Cnfiguring YuTube fr Schls as a Cntent Filter Plicy When the CFS Plicy Assignment drp-dwn menu is set t Via User and Zne Screens, YuTube fr Schls is cnfigured as part f the Cntent Filter plicy. 1. On the Security Services > Cntent Filter page, select Cntent Filter Service fr the Cntent Filter Type drp-dwn menu. 2. Click the Cnfigure buttn. 3. On the Plicy tab, click the Cnfigure icn fr the CFS plicy n which yu want t enable YuTube fr Schls. 4. Click n the Settings tab, and select the Enable YuTube fr Schls checkbx. 5. Paste in yur Schl ID, which is btained frm 6. Click OK. 7. On the Custm List tab, click the Add buttn fr Allwed Dmains. 8. In the dialg bx, type yutube.cm int the Dmain Name field and click OK. 9. Click Add again. 9

10 10. Type ytimg.cm int the Dmain Name field and click OK. 11. Click OK. These settings will verride any CFS categry that blcks YuTube. NOTE: Once the plicy has been applied, any existing brwser cnnectins will be unaffected until the brwser has been clsed and repened. Als, if yu have a brwser pen as administratr n the firewall, yu will be excluded frm CFS plicy enfrcement unless yu cnfigure the firewall specifically nt t exclude yu (select the D nt bypass CFS blcking fr the Administratr checkbx n the Security Services > Cntent Filter page). IKEv2 Supprt Beginning in SnicOS , Internet Key Exchange versin 2 (IKEv2) is the default prpsal type fr new Site-t-Site VPN plicies when clicking the Add buttn frm the VPN > Settings screen. IKEv2 is a prtcl fr negtiating and establishing a security assciatin (SA). IKEv2 prvides imprved security and a simplified architecture. Cmpared t IKEv1 Main Mde, using IKEv2 greatly reduces the number f message exchanges needed t establish an SA, while IKEv2 is mre secure and flexible than IKEv1 Aggressive Mde. This reduces the delays during re-keying. IPsec Secndary Gateway is supprted with IKEv2. DHCP ver VPN is nt supprted with IKEv2. IKEv2 is nt cmpatible with IKEv1. When IKEv2 is used, all ndes in the VPN must use IKEv2 t establish the tunnels. IKEv2 has the fllwing advantages ver IKEv1: Mre secure Mre reliable Simpler Faster Extensible Fewer message exchanges t establish cnnectins EAP Authenticatin supprt MOBIKE supprt Built-in NAT traversal Keep Alive is enabled as default SNMP fr VLAN Interfaces In SnicOS and higher, SNMP MIB-II statistic cunters are supprted fr VLAN interfaces. 10

11 SnicOS Web-based Management Interface HTTP access t the SnicOS web-based management interface is disabled by default. When running SnicOS with factry defaults, the administratr can lg int the management interface using HTTPS at HTTP management is still allwed when upgrading frm prir firmware versins, when already enabled in the previus cnfiguratin settings. Nte: HTTP management must be enabled when the firewall is being managed by SnicWALL GMS via a VPN tunnel. This applies when using either a GMS Management Tunnel r an existing VPN tunnel. The System > Administratin page has a Allw management via HTTP checkbx t allw the administratr t enable/disable HTTP management glbally. 11

12 Mdule Supprt The fllwing SnicWALL NSA mdules are supprted n the NSA 250M series appliance: WARNING: Yu MUST pwer dwn the appliance befre installing r replacing the mdules. 1 Prt ADSL (RJ-11) Annex A Prvides Asymmetric Digital Subscriber Line (ADSL) ver plain ld telephne service (POTS) with a dwnstream rate f 12.0 Mbit/s and an upstream rate f 1.3 Mbit/s. 1 Prt ADSL (RJ-45) Annex B Prvides Asymmetric Digital Subscriber Line (ADSL) ver an Integrated Services Digital Netwrk (ISDN) with a dwnstream rate f 12.0 Mbit/s and an upstream rate f 1.8 Mbit/s. 1-prt T1/E1 Mdule Prvides the cnnectin f a T1 r E1 (digitally multiplexed telecmmunicatins carrier system) circuit t a SnicWALL firewall using a RJ-45 jack. 2-prt LAN Bypass Mdule Remves a single pint f failure s that essential business cmmunicatin can cntinue while a netwrk failure is diagnsed and reslved. 2-Prt SFP Mdule This small frm-factr pluggable (SFP) netwrk interface mdule ffers a fiber alternative t the 4-Prt GbE Mdule, enabling mre flexible and scalable deplyments in a wide range f envirnments. Nte that prt 0 (802.3at) is disabled by default and shuld be enabled manually frm the SnicOS management interface. 4-Prt Gigabit Ethernet Mdule Expands prt density f a SnicWALL NSA 250M Series firewall by adding fur 1-Gbps Ethernet netwrking interfaces that negtiate the best Ethernet speeds available. 12

13 Real-Time Mnitr The real-time visualizatin dashbard mnitring feature allws administratrs t respnd quickly t netwrk security vulnerabilities and netwrk bandwidth issues. Administratrs can see what websites their users are accessing, what applicatins and services are being used in their netwrks and t what extent, in rder t plice cntent transmitted in and ut f their rganizatins. New appliances running SnicOS receive an autmatic 30-day free trial fr App Visualizatin upn registratin. SnicWALL appliances upgrading frm a pre-snicos 5.8 release and already licensed fr GAV/IPS/AS, Ttal Secure, r Cmprehensive Gateway Security Suite (CGSS) autmatically receive a cmplimentary App Visualizatin license fr the Real-Time Visualizatin Dashbard. T ppulate the Real-Time Mnitr with data, navigate t the AppFlw > Flw Reprting page, then click the Enable Real-Time Data Cllectin and Enable AppFlw T Lcal Cllectr checkbxes. In the Cllect Real-Time Data Fr drp-dwn list, click the checkbxes fr the types f data yu wish t cllect. Yu can then view real-time applicatin traffic n the Dashbard > Real-Time Mnitr page. 13

14 Nte: Clicking the Enable AppFlw t Lcal Cllectr checkbx may require rebting the device. All Real-Time Mnitr applicatin legends are hidden by default frm the Applicatin and Bandwidth charts. T view the legends, click the icn. T relcate the legends int the Applicatin r Bandwidth charts, click the checkbx(s). icn, then select the desired 14

15 T view individual applicatin infrmatin, hver the muse ver the real-time visualizatin graph t display a tltip. By default, the Multi-Cre Mnitr displays as a stack chart, rather than as a bar graph, t easily shw its relatin t the ther charts n this screen. Nte: The Multi-Cre Mnitr nly shws the prcessr lad fr the cres f the managing firewall. If perating in Active-Active DPI mde, the cre lad fr the standby firewall des nt display. Link t Flw Reprting The Dashbard > Real-Time Mnitr page prvides a link t the AppFlw > Flw Reprting page, where yu can enable/disable each chart in the Real-Time Mnitr page. T enable/disable each chart in the Real-Time Mnitr page, use the Enable Real-Time Data Cllectin ptin and assciated drp-dwn list. 15

16 Real-Time Mnitr Tltips The Dashbard > Real-Time Mnitr page prvides a tltip with useful infrmatin next t each chart title. Real-Time Mnitr Cllapse/Expand Optins The Dashbard > Real-Time Mnitr page prvides a cllapse/expand buttn fr each chart. This allws the administratr t juxtapse tw charts fr cmparisn, even if they are nrmally far apart n the page. 16

17 Standalne Dashbard Page Several f the SnicWALL Visualizatin Dashbard pages cntain a blue pp-up buttn that will display the dashbard in a standalne brwser windw that allws fr a wider display. Click n the blue pp-up icn t the right f the page name in the left-hand navigating bar t display a dashbard page as a standalne page. The pp-up buttn is als available at the tp right f the individual dashbard pages, as shwn belw: 17

18 AppFlw > Flw Reprting The AppFlw > Flw Reprting page prvides the infrmatin previusly displayed in the Lg > Flw Reprting page, such as detailed external and internal flw statistics. In SnicOS and higher, the Lg > Flw Reprting page is remved, and its elements are nw displayed in the AppFlw > Flw Reprting page. The AppFlw menu in the left navigatin pane cntains five pages. The lwer fur AppFlw pages display the crrespnding Dashbard pages f the same names. A number f enhancements have been added t the AppFlw and Dashbard pages. Mre sectins have been added t the AppFlw > Flw Reprting page, and sme elements have been rearranged and placed under ne f the three tabs: Statistics Settings External Cllectr The Statistics sectin is shwn belw. 18

19 The Settings sectin is shwn belw. The ptins frm the previus Cnnectin Reprt Settings sectin are merged int the External Cllectr Settings sectin, except fr the Reprt Cnnectins ptin which is mved t the Settings sectin f the AppFlw > Flw Reprting page. The Settings sectin prvides ptins t cntrl the reprting cntent by interface r rules, t cntrl which graphs t display n the Real-Time Mnitr page, and t cntrl which graphs t display n the AppFlw Mnitr page. The Settings area has an Enable Aggregate AppFlw Reprt Data Cllectin ptin and assciated Cllect Reprt Data Fr drp-dwn list. This allws the administratr t select the specific reprt types t be included in AppFlw reprts. The functinality is very similar t the cntrl ver the Real-Time Mnitr charts prvided by the Enable Real-Time Data Cllectin ptin and drp-dwn list, als in the Settings sectin. Sme ther ptins under Settings are: Enable Ge-IP Reslutin AppFlw Mnitr grups flws based n cuntry under initiatr and respnder tabs. AppFlw Reprt Uplad Timeut (sec) Specifies the timeut in secnds when cnnecting t the AppFlw uplad server. The minimum value is 5, the maximum is 120, and the default is 30. The Enable Dmain Reslutin ptin and the Enable Dmain Reslutin fr Private IPs ptin have been remved frm the Settings sectin. 19

20 The frmer Generate All Templates and Generate Static AppFlw Data buttns, which were at the tp f the Lg > Flw Reprting page, have been mved t the Actins ptin at the bttm f the External Cllectr Settings sectin f the page. 20

21 Dashbard > AppFlw Dash The Dashbard > AppFlw Dash page prvides graphs fr Tp Applicatins, Tp Users, Tp Viruses, Tp Intrusins, Tp Spyware, Tp URL Ratings, Tp Lcatins, and Tp IP Addresses that are tracked with AppFlw. The tp fur graphs frm the AppFlw Dash page are shwn belw: The bttm fur graphs frm the AppFlw Dash page are shwn belw: 21

22 Dashbard > AppFlw Mnitr The tlbar categries display Ttal Packets, Ttal Bytes, and Average Rate, prviding the user with a specific view f data being transferred. In the Flw Table, clicking n the number specified under the Sessins categry f any Applicatin, a Flw Table displays with Applicatin-specific data, including the Rate in KBps. The Dashbard > AppFlw Mnitr page has several updates fr enhanced usability. AppFlw Mnitr Filter A Filter text bx prvide a way t enter a text string t use fr filtering the displayed infrmatin. The Filter field is used t search fr specific values in the main clumn, similar t this functin n the Dashbard > AppFlw Reprts page. The main clumn is the clumn t the right f the number (#) clumn, and its cntents change depending n which tab is selected. Fr example, when the Applicatins tab is selected, yu can filter n text strings that appear in the Applicatin clumn. If anther tab is selected, the main clumn changes accrdingly and the search values wuld be different. 22

23 Link t AppFlw > Flw Reprting A link t the AppFlw > Flw Reprting page is prvided at the bttm f the Dashbard > AppFlw Mnitr page. Lcal Cllectr Status A green r red status line at the bttm f the Dashbard > AppFlw Mnitr page shws whether AppFlw t Lcal Cllectr is enabled (green) r disabled (red). Tltips Additinal tltips are available n the Dashbard > AppFlw Mnitr page fr the Create Rule buttn, Filter View buttn, and ther elements. Numbering and Aut-Scrlling Numbering is added in the left-mst clumn f each table n the Dashbard > AppFlw Mnitr page, alng with an aut-scrll feature, which autmatically lads mre rws as yu scrll dwn. This allws yu t keep track f where yu are in the list while scrlling dwn, and avids delays frm lading large amunts f data at nce. The ttal number f items is always displayed. 23

24 Dashbard > AppFlw Reprts The Dashbard > AppFlw Reprts page prvides aggregate AppFlw reprts fr the fllwing cases: Since the last firewall restart Since the last reset f the cunter; administratrs can reset the cunter manually Scheduled reprts; administratrs can set a start and end time fr data t be cllected, and can cnfigure the reprts t be sent either via r t an FTP server nce the perid ends. This is dne via scheduled bjects. 24

25 The Filter String field at the tp f the page is used t search fr specific values in the main clumn. The main clumn is the clumn t the right f the number (#) clumn, and its cntents change depending n which tab is selected. Fr example, when the Applicatins tab is selected, yu can filter n text strings that appear in the Name clumn: When the IP tab is selected, the cntents in the Filter String bx are cleared, and yu can enter an apprpriate value t search fr in the IP Address clumn: 25

26 Applicatin Intelligence + Cntrl This feature has tw cmpnents fr mre netwrk security: (a) Identificatin: Identify applicatins and track user netwrk behavirs in real-time. (b) Cntrl: Allw/deny applicatin and user traffic based n bandwidth limiting plicies. Administratrs can easily create netwrk plicy bject-based cntrl rules t filter netwrk traffic flws based n: Blcking signature-matching Applicatins, which are ntriusly dangerus and difficult t enfrce Viewing the real-time netwrk activity f trusted Users and User Grups and guest services Matching Cntent-rated categries Netwrk security administratrs nw have applicatin-level, user-level, and cntent-level real-time visibility int the traffic flwing thrugh their netwrks. Administratrs can take immediate actin t re-traffic engineer their netwrks, quickly identify Web usage abuse, and prtect their rganizatins frm infiltratin by malware. Administratrs can limit access t bandwidth-hgging websites and applicatins, reserve higher pririty t critical applicatins and services, and prevent sensitive data frm escaping the SnicWALL secured netwrks. New appliances running SnicOS and higher receive an autmatic 30-day free trial fr App Cntrl upn registratin. SnicWALL appliances upgrading frm a pre-snicos 5.8 release and already licensed fr GAV/IPS/AS, Ttal Secure, r Cmprehensive Gateway Security Suite (CGSS) autmatically receive a cmplimentary App Cntrl license, required fr creating Applicatin Cntrl plicies. Select the Enable App Cntrl ptin n the Firewall > App Cntrl Advanced page t begin using the App Cntrl feature. T create plicies using App Rules (included with the App Cntrl license), select Enable App Rules n the Firewall > App Rules page. Glbal Bandwidth Management Glbal Bandwidth Management imprves ease f use fr bandwidth management (BWM) cnfiguratin, and increases thrughput perfrmance f managed packets fr ingress and egress traffic n all interfaces, nt just WAN. The Firewall Settings > BWM page allws netwrk administratrs t specify guaranteed minimum bandwidth, maximum bandwidth, and cntrl the number f different pririty levels fr traffic. These glbal settings are used in firewall access rules and applicatin cntrl plicies. Glbal BWM prvides: Simple bandwidth management n all interfaces. Bandwidth management f bth ingress and egress traffic. Supprt fr specifying bandwidth management pririty per firewall rules and applicatin cntrl rules. Default bandwidth management queue fr all traffic. Supprt fr applying bandwidth management directly frm the Dashbard > App Flw Mnitr page. 26

27 Glbal bandwidth management prvides 8 pririty queues, which can be applied t each physical interface. The Firewall Settings > BWM page has usability enhancements. An Interface BWM Settings tltip displays all netwrk interfaces and shws whether bandwidth management is enabled fr them. Yu can select either WAN r Glbal as the Bandwidth Management Type. Nte: When switching between bandwidth management mdes, all bandwidth management settings in firewall access rules are set back t defaults and any custm settings must be recnfigured. Default BWM actins in Applicatin Cntrl plicies are autmatically cnverted t WAN BWM r Glbal BWM, using default pririty levels. The fllwing nte is displayed at the bttm f the Firewall Settings > BWM page: In the glbal pririty queue table, yu can cnfigure the Guaranteed and Maximum\Burst rates fr each Pririty queue. The rates are specified as a percentage. The actual rate is determined dynamically while applying BWM n an interface. The cnfigured bandwidth n an interface is used in calculating the abslute value. The sum f all guaranteed bandwidth must nt exceed 100%, and guaranteed bandwidth must nt be greater than maximum bandwidth per queue. 27

28 Bandwidth Management Mnitr Page The BWM Mnitr page displays per-interface bandwidth management fr ingress and egress netwrk traffic. The BWM mnitr graphs are available fr real-time, highest, high, medium high, medium, medium lw, lw and lwest plicy settings. The view range is cnfigurable in 60 secnds, 2 minutes, 5 minutes, and 10 minutes (default). The refresh interval rate is cnfigurable frm 3 t 30 secnds. The bandwidth management pririty is depicted by guaranteed, maximum, and drpped. The Dashbard > BWM Mnitr page displays a chart fr each pssible BWM setting fr the selected interface, and displays [Disabled] unless BWM is enabled. A text line is added near the tp f the page shwing the available bandwidth fr the interface selected in the drp-dwn list at the tp left. In each chart, an infrmatin bx nw shws the values fr Current bandwidth, Drpped bandwidth, Guaranteed bandwidth, and Max bandwidth fr the interface selected at the tp f the page. 28

29 Ge-IP Filter The Ge-IP Filter page has a Diagnstics sectin cntaining a Shw Reslved Lcatins buttn and a table displaying cache statistics. The Ge-IP Filter page includes several ptins, including Blck Cnnectins t/frm Fllwing Cuntries, Blck all cnnectins t public IPs if GeIP DB is nt dwnladed, Blck ALL UNKNOWN cuntries, and a checkbx fr Enable Lgging. The Blck Cnnectins t/frm Fllwing Cuntries checkbx prvides ptins t blck All Cnnectins r blck Firewall Rule-Based Cnnectins. Select the Blck all cnnectins t public IPs if GeIP DB is nt dwnladed ptin if yu want all cuntries t be blcked whenever the firewall cannt dwnlad the Ge-IP database that cntains the list f cuntries t be blcked. Fr selected cuntries t be blcked, the Ge-IP database must be dwnladed frm the internet. The firewall must be able t reslve the address "gbdata.glbal.snicwall.cm" t dwnlad the cuntry database. If the Ge-IP database is nt dwnladed successfully, the firewall cannt blck selected cuntries. Sme cuntries may nt be listed in the Ge-IP database. Select the Blck ALL UNKNOWN cuntries ptin if yu want all cuntries nt listed in the Ge-IP database t be blcked. 29

30 Btnet Filter The Btnet Filter feature is available as a free trial and can be activated by navigating t the Security Services > Btnet Filter page. The Btnet Filter page prvides cnfiguratin ptins fr Blck cnnectins t/frm Btnet Cmmand and Cntrl Services, Blck all cnnectins t public IPs if BOTNET DB is nt dwnladed, Enable Lgging, defining Btnet exclusin bjects, and checking Btnet server lkup. Select the Blck all cnnectins t public IPs if BOTNET DB is nt dwnladed ptin if yu want all public IP addresses t be blcked whenever the firewall cannt dwnlad the Btnet database that cntains the list f Btnet IP addresses t be blcked. Fr selected IP addresses t be blcked, the Btnet database must be dwnladed frm the internet. If the Btnet database is nt dwnladed successfully, the firewall cannt blck Btnet IP addresses. The Btnet page als has a Diagnstics sectin cntaining a Shw Reslved Lcatins buttn and a table displaying cache statistics. 30

31 WAN Acceleratin SnicOS and higher, the WAN Acceleratin service allws netwrk administratrs t accelerate WAN traffic between a central site and a branch site by using Transmissin Cntrl Prtcl (TCP), Windws File Sharing (WFS), and a Web Cache. The Dell SnicWALL WXA series appliance is deplyed in cnjunctin with a Dell SnicWALL NSA/TZ series appliance. In this type f deplyment, the NSA/TZ series appliance prvides dynamic security services, such as attack preventin, Virtual Private Netwrk (VPN), ruting, and Web Cntent Filtering. The WAN Acceleratin service can increase applicatin perfrmance. WXA 1.2 Supprt SnicOS and higher supprts SnicWALL WXA 1.2, which cntains several enhancements ver WXA 1.1.1: Unsigned SMB Acceleratin In previus versins f WXA, SMB signing was the nly supprted methd fr shared access t files, which required jining the WXA series appliance t the dmain and manually cnfiguring shares. Hwever, sme netwrks d nt need t use SMB signing. Fr these types f netwrk envirnments, WXA 1.2 intrduces supprt fr Unsigned SMB, which allws the WXA series appliance t accelerate traffic withut jining the dmain. This greatly simplifies the cnfiguratin prcedure fr WFS Acceleratin. Just click the Unsigned SMB checkbx, apply the changes, and shared files start accelerating between sites. If yur netwrk uses unsigned and signed SMB traffic, the Unsigned SMB and Supprt SMB Signing checkbxes can be enabled t use bth features simultaneusly. Web Cache The Web Cache feature stres cpies f frequently and recently requested Web cntent as it passes thrugh the netwrk. When a user requests this Web cntent, it is retrieved frm the lcal web cache instead f the Internet, which can result in significant reductins in dwnladed data and bandwidth usage. YuTube Web Caching The Web Cache feature als prvides caching fr YuTube cntent. This feature is nly available when using Mderate (default) and Aggressive web caching strategies. Fr mre infrmatin abut WAN Acceleratin and these WXA 1.2 features, see the WXA 1.2 User s Guide. 31

32 SnicPint-N Dual Radi Supprt The SnicWALL SnicPint-N Dual Radi appliance (SnicPint-N DR) is supprted by all SnicWALL NSA and TZ platfrms when running SnicOS r higher. With supprt fr tw wireless radis at the same time, yu can use SnicPint-N DR Clean Wireless access pints t create an enterprise-class secure wireless netwrk. The SnicPint-N DR uses six antennas t cmmunicate with wireless clients n tw frequency ranges: 2.4 GHz and 5 GHz. Yu can install and cnfigure a SnicPint-N DR access pint in abut an hur. Nte: The SnicPint-N DR cannt bradcast the same Service Set Identifiers (SSID) when using Virtual Access Pints (VAP) n 2.4 and 5 Ghz frequency ranges. Fr mre infrmatin, see the SnicWALL SnicPint-N DR Getting Started Guide, at: Accept Multiple Prpsals fr Clients Optin The Accept Multiple Prpsals fr Clients checkbx allws multiple VPN r L2TP clients using different security plicies t cnnect t a firewall running SnicOS r higher. This ptin is n the Advanced tab when cnfiguring a GrupVPN plicy frm the VPN > Settings page in SnicOS. The client plicy is still strictly checked against the cnfigured prpsal in the Prpsals tab, as with clients cnnecting with SnicWALL GVC. This ptin has n effect n GVC. If the Accept Multiple Prpsals fr Clients ptin is selected, SnicOS allws cnnectins frm ther L2TP clients, (such as Apple OS, Windws, r Andrid), whse prpsals are different frm the cnfigured prpsal in the Prpsals tab. These prpsals are accepted under the fllwing cnditins: If the ffered algrithm matches ne f the pssible algrithms available in SnicOS. If the ffered algrithm is mre secure than the cnfigured algrithm in the SnicOS prpsal. If this ptin is nt selected, SnicOS requires the client t strictly match the cnfigured plicy. This ptin allws SnicWALL t supprt hetergeneus envirnments fr Apple, Windws, and Andrid clients. Using this ptin, SnicOS can wrk with these clients if their prpsal includes a cmbinatin f algrithms which are supprted in SnicOS, but are nt cnfigured in the plicy t prevent ther clients like GVC frm failing. 32

33 Deep Packet Inspectin f SSL encrypted data (DPI-SSL) Prvides the ability t transparently decrypt HTTPS and ther SSL-based traffic, scan it fr threats using SnicWALL s Deep Packet Inspectin technlgy, then re-encrypt (r ptinally SSL-fflad) the traffic and send it t its destinatin if n threats r vulnerabilities are fund. This feature wrks fr bth client and server deplyments. It prvides additinal security, applicatin cntrl, and data leakage preventin functinality fr analyzing encrypted HTTPS and ther SSL-based traffic. The fllwing security services and features are capable f utilizing DPI-SSL: Gateway Anti-Virus, Gateway Anti-Spyware, Intrusin Preventin, Cntent Filtering, Applicatin Cntrl, Packet Mnitr and Packet Mirrr. DPI-SSL is supprted n SnicWALL NSA mdels 240 and higher. Gateway Anti-Virus Enhancements (Clud GAV) The Clud Gateway Anti-Virus feature intrduces an advanced malware scanning slutin that cmpliments and extends the existing Gateway AV scanning mechanisms present n SnicWALL firewalls t cunter the cntinued grwth in the number f malware samples in the wild. Clud Gateway Anti-Virus expands the Reassembly Free Deep Packet Inspectin engine capabilities by cnsulting with the data center based malware analysis servers. This apprach keeps the fundatin f RFDPI-based malware detectin by prviding a lw-latency, real-time slutin that is capable f scanning unlimited numbers f files f unlimited size n all prtcls that are presently supprted withut adding any significant incremental prcessing verhead t the appliances themselves. With this additinal layer f security, SnicWALL s Next Generatin Firewalls are able t extend their current prtectin t cver multiple millins f pieces f malware. NTP Authenticatin Type When adding a Netwrk Time Prtcl server, the Add NTP Server dialg bx prvides a field t specify the NTP authenticatin type, such as MD5. Fields are als available t specify the trust key ID, the key number and the passwrd. Cntent Filtering Enhancements The CFS enhancements prvide plicy management f netwrk traffic based n Applicatin usage, User activity, and Cntent type. Administratrs can create multiple CFS plicies per user grup and set restrictive Bandwidth Management Plicies based n CFS categries. IPFIX and NetFlw Reprting This feature enables administratrs t gain visibility int traffic flws and vlume thrugh their netwrks, helping them with tracking, auditing and billing peratins. This feature prvides standards-based supprt fr NetFlw Reprting, IPFIX, and IPFIX with extensins. The data exprted thrugh IPFIX with extensins cntains infrmatin abut netwrk flws such as applicatins, users, and URLs extracted thrugh Applicatin Intelligence, alng with standard attributes such as surce/destinatin IP address (includes supprt fr IPv6 netwrks), surce/destinatin prt, IP prtcl, ingress/egress interface, sequence number, timestamp, number f bytes/packets, and mre. VLAN Supprt SnicOS 5.8 prvides VLAN supprt fr SnicWALL NSA 220, NSA 250M, and TZ 215 series appliances, including wireless mdels. SnicPint Virtual Access Pint Supprt Virtual Access Pints (VAPs) are supprted when ne r mre SnicWALL SnicPints are cnnected t a SnicWALL NSA 220/250M/TZ 215 Series appliance. LDAP Primary Grup Attribute T allw Dmain Users t be used when cnfiguring plicies, membership f the Dmain Users grup can be lked up via an LDAP "Primary grup" attribute. Beginning in , SnicOS prvides an attribute setting in the LDAP schema cnfiguratin fr using this feature. Preservatin f Anti-Virus Exclusins After Upgrade SnicOS includes the ability t detect if the starting IP address in an existing range cnfigured fr exclusin frm anti-virus enfrcement belngs t either LAN, WAN, DMZ r WLAN znes. After upgrading t a newer firmware versin, SnicOS applies the IP range t a newly created address bject. Detecting addresses fr ther znes nt listed abve, including custm znes, is nt supprted. Anti-virus exclusins which existed befre the upgrade and which apply t hsts residing in custm znes will nt be detected. IP address ranges nt falling int the supprted znes will default t the LAN zne. Cnversin t the LAN zne ccurs during the restart prcess. There is n message in the SnicOS management interface at lgin time regarding the cnversin. 33

34 Cmprehensive Anti-Spam Service (CASS) 2.0 The Cmprehensive Anti-Spam Service (CASS) feature prvides a quick, efficient, and effective way t add anti-spam, anti-phishing, and anti-virus capabilities t yur SnicWALL security appliance. This feature increases the efficiency f yur SnicWALL security appliance by prviding yu the ability t cnfigure user view settings and filter junk messages befre users see it in their inbxes. The fllwing capabilities are available with CASS 2.0: The Security Junk Stre applicatin can reside utside the Exchange Server system, such as n a remte server. Dynamic discvery f Junk Stre user interface pages feature allws the Junk Stre t infrm SnicOS f a list f pages t display under Anti-Spam in the SnicOS left hand navigatin pane. Fr example, the pane might shw Junk Bx View, Junk Bx Settings, Junk Summary, User View Setup, and/r Address Bks. User-defined Allw and Deny Lists can be cnfigured with FQDN and Range address bjects in additin t Hst bjects. A GRID IP Check tl is available in the Anti-Spam > Status page. The SnicWALL administratr can specify (n-demand) an IP address t check against the SnicWALL GRID IP server. The result will either be LISTED r UNLISTED. Cnnectins frm a LISTED hst will be blcked by the SnicWALL security appliance running CASS (unless verridden in the Allw List). A parameter t specify the Prbe Respnse Timeut is available in the Anti-Spam > Settings page Advanced Optins sectin. This ptin supprts deplyment scenaris where a lnger timeut is needed t prevent a target frm frequently being marked as Unavailable. The default value is 30 secnds. Enhanced Cnnectin Limiting Cnnectin Limiting enhancements expand the riginal Cnnectin Limiting feature which prvided glbal cntrl f the number f cnnectins fr each IP address. This enhancement is designed t increase the granularity f this kind f cntrl s that the SnicWALL administratr can cnfigure cnnectin limitatin mre flexibly. Cnnectin Limiting uses Firewall Access Rules and Plicies t allw the administratr t chse which IP address, which service, and which traffic directin when cnfiguring cnnectin limiting. Dynamic WAN Scheduling SnicOS 5.8 supprts scheduling t cntrl when Dynamic WAN clients can cnnect. A Dynamic WAN client cnnects t the WAN interface and btains an IP address with the PPPE, L2TP, r PPTP. This enhancement allws the administratr t bind a schedule bject t Dynamic WAN clients s that they can cnnect when the schedule allws it and they are discnnected at the end f the cnfigured schedule. In the SnicOS management interface, a Schedule ptin is available n the WAN interface cnfiguratin screen when ne f the abve prtcls is selected fr IP Assignment. Once a schedule is applied, a lg event is recrded upn start and stp f the schedule. NTLM Authenticatin with Mzilla Brwsers As an enhancement t Single Sign-On, SnicOS can nw use NTLM authenticatin t identify users wh are brwsing using Mzilla-based brwsers (including Internet Explrer, Firefx, Chrme and Safari). NTLM is part f a brwser authenticatin suite knwn as Integrated Windws Security and shuld be supprted by all Mzilla-based brwsers. It allws a direct authenticatin request frm the SnicWALL appliance t the brwser with n SSO agent invlvement. NTLM authenticatin wrks with brwsers n Windws, Linux and Mac PCs, and prvides a mechanism t achieve Single Sign-On with Linux and Mac PCs that are nt able t interperate with the SSO agent. Single Sign-On Imprt Users frm LDAP Optin An Imprt frm LDAP buttn n the Users > Lcal Users page allws yu t cnfigure lcal users n the SnicWALL by retrieving the user names frm yur LDAP server. This allws SnicWALL user privileges t be granted upn successful LDAP authenticatin. Fr ease f use, ptins are prvided t reduce the list t a manageable size and then select the users t imprt. SSL VPN NetExtender Update This enhancement supprts passwrd change capability fr SSL VPN users, alng with varius fixes. When the passwrd expires, the user is prmpted t change it when lgging in via the NetExtender client r SSL VPN prtal. It is supprted fr bth lcal users and remte users (RADIUS and LDAP). 34

35 DHCP Scalability Enhancements The DHCP server in SnicWALL appliances has been enhanced t prvide between 2 t 4 times the number f leases previusly supprted. T enhance the security f the DHCP infrastructure, the SnicOS DHCP server nw prvides server side cnflict detectin t ensure that n ther device n the netwrk is using the assigned IP address. Cnflict detectin is perfrmed asynchrnusly t avid delays when btaining an address. SIP Applicatin Layer Gateway Enhancements SIP peratinal and scalability enhancements are prvided in SnicOS 5.8. The SIP feature-set remains equivalent t previus SnicOS releases, but prvides drastically imprved reliability and perfrmance. The SIP Settings sectin under the VIP > Settings page is unchanged. SIP ALG supprt has existed within SnicOS firmware since very early versins n legacy platfrms. Changes t SIP ALG have been added ver time t supprt ptimized media between phnes, SIP Back-t-Back User Agent (B2BUA), additinal equipment vendrs, and peratin n a multi-cre system. The SIP prtcl is nw in a psitin f business critical imprtance prtecting the vice infrastructure, including VIP. T accmmdate the demands f this mdern vice infrastructure, SIP ALG enhancements include the fllwing: SIP Endpint Infrmatin Database The algrithm fr maintaining the state infrmatin fr knwn endpints is redesigned t use a database fr imprved perfrmance and scalability. Endpint infrmatin is n lnger tied t the user ID, allwing multiple user IDs t be assciated with a single endpint. Endpint database access is flexible and efficient, with indexing by NAT plicy as well as by endpint IP address and prt. Autmatically Added SIP Endpints User-cnfigured endpints are autmatically added t the database based n user-cnfigured NAT plicies, prviding imprved perfrmance and ensuring crrect mappings, as these endpints are pre-ppulated rather than learnt. SIP Call Database A call database fr maintaining infrmatin abut calls in prgress is implemented, prviding imprved perfrmance and scalability t allw SnicOS t handle a much greater number f simultaneus calls. Call database entries can be assciated with multiple calls. B2BUA Supprt Enhancements SIP Back-t-Back User Agent supprt is mre efficient with varius algrithm imprvements. Cnnectin Cache Imprvements Much f the data previusly held in the cnnectin cache is ffladed t either the endpint database r the call database, resulting in mre efficient data access and crllary perfrmance increase. Graceful Shutdwn Allws SIP Transfrmatins t be disabled withut requiring the firewall t be restarted r waiting fr existing SIP endpint and call state infrmatin t time ut. Management Traffic Only Optin fr Netwrk Interfaces Beginning in , SnicOS prvides a Management Traffic Only ptin n the Advanced tab f the interface cnfiguratin windw, when cnfiguring an interface frm the Netwrk > Interfaces page. When selected, this ptin priritizes all traffic arriving n that interface. The administratr shuld enable this ptin ONLY n interfaces intended t be used exclusively fr management purpses. If this ptin is enabled n a regular interface, it will still priritize the traffic, but that may nt be the desired result. It is up t the administratr t limit the traffic t just management; the firmware des nt have the ability t prevent pass- thrugh traffic. The purpse f this ptin is t prvide the ability t access the SnicOS management interface even when the appliance is running at 100% utilizatin. Aut-Cnfiguratin f URLs t Bypass User Authenticatin Beginning in , SnicOS includes an aut-cnfiguratin utility t temprarily allw traffic frm a single, specified IP address t bypass authenticatin. The destinatins that traffic accesses are then recrded and used t allw that traffic t bypass user authenticatin. Typically this is used t allw traffic such as anti-virus updates and Windws updates. T use this feature, navigate t Users > Settings and click the Aut-cnfigure buttn in the Other Glbal User Settings sectin. 35

36 Upgrading SnicOS Image Prcedures The fllwing prcedures are fr upgrading an existing SnicOS image t a newer versin: Obtaining the Latest SnicOS Image Versin...36 Saving a Backup Cpy f Yur Cnfiguratin Preferences...36 Upgrading a SnicOS Image with Current Preferences...37 Upgrading a SnicOS Image with Factry Defaults...37 Imprting Preferences t SnicOS Imprting Preferences frm SnicOS Standard t SnicOS 5.8 Enhanced...38 Supprt Matrix fr Imprting Preferences...39 Using SafeMde t Upgrade Firmware...40 Obtaining the Latest SnicOS Image Versin T btain a new SnicOS firmware image file fr yur SnicWALL security appliance: 1. Cnnect t yur mysnicwall.cm accunt at 2. Cpy the new SnicOS image file t a directry n yur management statin. Yu can update the SnicOS image n a SnicWALL security appliance remtely if the LAN interface r the WAN interface is cnfigured fr management access. Saving a Backup Cpy f Yur Cnfiguratin Preferences Befre beginning the update prcess, make a system backup f yur SnicWALL security appliance cnfiguratin settings. The backup feature saves a cpy f yur current cnfiguratin settings n yur SnicWALL security appliance, prtecting all yur existing settings in the event that it becmes necessary t return t a previus cnfiguratin state. In additin t using the backup feature t save yur current cnfiguratin settings t the SnicWALL security appliance, yu can exprt the cnfiguratin preferences file t a directry n yur lcal management statin. This file serves as an external backup f the cnfiguratin preferences, and can be imprted back int the SnicWALL security appliance. Perfrm the fllwing steps t save a backup f yur cnfiguratin settings and exprt them t a file n yur lcal management statin: 1. On the System > Settings page, click Create Backup. Yur cnfiguratin preferences are saved. The System Backup entry is displayed in the Firmware Management table. 2. T exprt yur settings t a lcal file, click Exprt Settings. A ppup windw displays the name f the saved file. 3. On the System > Diagnstics page, under Tech Supprt Reprt, select the fllwing checkbxes and then click the Dwnlad Reprt buttn: VPN Keys ARP Cache DHCP Bindings IKE Inf SnicPintN Diagnstics Current users Detail f users The infrmatin is saved t a techsupprt_ file n yur management cmputer. 36

37 Upgrading a SnicOS Image with Current Preferences Perfrm the fllwing steps t uplad new firmware t yur SnicWALL appliance and use yur current cnfiguratin settings upn startup: 1. Dwnlad the SnicOS firmware image file frm mysnicwall.cm and save it t a lcatin n yur lcal cmputer. 2. On the System > Settings page, click Uplad New Firmware. 3. Brwse t the lcatin where yu saved the SnicOS firmware image file, select the file, and click Uplad. 4. On the System > Settings page, click the Bt icn in the rw fr Upladed Firmware. 5. In the cnfirmatin dialg bx, click OK. The SnicWALL restarts and then displays the lgin page. 6. Enter yur user name and passwrd. Yur new SnicOS image versin infrmatin is listed n the System > Settings page. Upgrading a SnicOS Image with Factry Defaults Perfrm the fllwing steps t uplad new firmware t yur SnicWALL appliance and start it up using the default cnfiguratin: 1. Dwnlad the SnicOS firmware image file frm mysnicwall.cm and save it t a lcatin n yur lcal cmputer. 2. On the System > Settings page, click Create Backup. 3. Click Uplad New Firmware. 4. Brwse t the lcatin where yu saved the SnicOS firmware image file, select the file, and click Uplad. 5. On the System > Settings page, click the Bt icn in the rw fr Upladed Firmware with Factry Default Settings. 6. In the cnfirmatin dialg bx, click OK. The SnicWALL restarts and then displays the Setup Wizard, with a link t the lgin page. 7. Enter the default user name and passwrd (admin / passwrd) t access the SnicWALL management interface. Imprting Preferences t SnicOS 5.8 Preferences imprting t the SnicWALL netwrk security appliances is generally supprted frm the fllwing SnicWALL appliances running SnicOS: NSA Series NSA E-Class Series TZ 215/210/205/200/105/100/190/180/170 Series PRO Series There are certain exceptins t preferences imprting n these appliances running the SnicOS 5.8 release. Preferences cannt be imprted in the fllwing cases: Settings files cntaining Prtshield interfaces created prir t SnicOS 5.x Settings files cntaining VLAN interfaces are nt accepted by the TZ 100/200 Series firewalls Settings files frm a PRO 5060 with ptical fiber interfaces where VLAN interfaces have been created Full supprt fr preferences imprting frm these appliances is targeted fr a future release. At that time, yu will need t upgrade yur firmware t the latest SnicOS maintenance release available n MySnicWALL. 37

38 Imprting Preferences frm SnicOS Standard t SnicOS 5.8 Enhanced The SnicOS Standard t Enhanced Settings Cnverter is designed t cnvert a surce Standard Netwrk Settings file t be cmpatible with a target SnicOS Enhanced appliance. Due t the mre advanced nature f SnicOS Enhanced, its Netwrk Settings file is mre cmplex than the ne SnicOS Standard uses. They are nt cmpatible. The Settings Cnverter creates an entirely new target Enhanced Netwrk Settings file based n the netwrk settings fund in the surce Standard file. This allws fr a rapid upgrade frm a Standard deplyment t an Enhanced ne with n time wasted in re-creating netwrk plicies. Nte: SnicWALL recmmends deplying the cnverted target Netwrk Settings file in a testing envirnment first and always keeping a backup cpy f the riginal surce Netwrk Settings file. The SnicOS Standard t Enhanced Settings Cnverter is available at: If the preferences cnversin fails, yur SnicOS Standard cnfiguratin file t settings_cnverter@snicwall.cm with a shrt descriptin f the prblem. In this case, yu may als cnsider manually cnfiguring yur SnicWALL appliance. T cnvert a Standard Netwrk Settings file t an Enhanced ne: 1. Lg in t the management interface f yur SnicOS Standard appliance, navigate t System > Settings, and save yur netwrk settings t a file n yur management cmputer. 2. On the management cmputer, pint yur brwser t 3. Click the Settings Cnverter buttn. 4. Lg in using yur MySnicWALL credentials and agree t the security statement. The surce Standard Netwrk Setting file must be upladed t MySnicWALL as part f the cnversin prcess. The Setting Cnversin tl uses MySnicWALL authenticatin t secure private netwrk settings. Users shuld be aware that SnicWALL will retain a cpy f their netwrk settings after the cnversin prcess is cmplete. 5. Uplad the surce Standard Netwrk Settings file: Click Brwse. Navigate t and select the surce SnicOS Standard Settings file. Click Uplad. Click the right arrw t prceed. 6. Review the surce SnicOS Standard Settings Summary page. This page displays useful netwrk settings infrmatin cntained in the upladed surce Netwrk Settings file. Fr testing purpses, the LAN IP and subnet mask f the appliance can be changed n this page in rder t deply it in a testing envirnment. (Optinal) Change the LAN IP address and subnet mask f the surce appliance t that f the target appliance. Click the right arrw t prceed. 7. Select the target SnicWALL appliance fr the Enhanced deplyment frm the available list. SnicOS Enhanced is cnfigured differently n varius SnicWALL appliances, mstly t supprt different interface numbers. As such, the cnverted Enhanced Netwrk Settings file must be custmized t the appliance targeted fr deplyment. 8. Cmplete the cnversin by clicking the right arrw t prceed. 9. Optinally click the Warnings link t view any differences in the settings created fr the target appliance. 10. Click the Dwnlad buttn, select Save t Disk, and click OK t save the new target SnicOS Enhanced Netwrk Settings file t yur management cmputer. 11. Lg in t the management interface fr yur SnicWALL appliance. 12. Navigate t System > Settings, and click the Imprt Settings buttn t imprt the cnverted settings t yur appliance. 38

39 Supprt Matrix fr Imprting Preferences 39

40 Using SafeMde t Upgrade Firmware The SafeMde prcedure uses a reset buttn in a small pinhle, whse lcatin varies: n the NSA mdels, the buttn is near the USB prts n the frnt; n the TZ mdels, the buttn is next t the pwer crd n the back. If yu are unable t cnnect t the SnicWALL security appliance s management interface, yu can restart the SnicWALL security appliance in SafeMde. The SafeMde feature allws yu t quickly recver frm uncertain cnfiguratin states with a simplified management interface that includes the same settings available n the System > Settings page. T use SafeMde t upgrade firmware n the SnicWALL security appliance, perfrm the fllwing steps: 1. Cnnect yur cmputer t the X0 prt n the SnicWALL appliance and cnfigure yur IP address with an address n the /24 subnet, such as D ne f the fllwing t restart the appliance in SafeMde: Use a narrw, straight bject, like a straightened paper clip r a tthpick, t press and hld the reset buttn n the frnt f the security appliance fr mre than 20 secnds. Use the LCD cntrl buttns n the frnt bezel t set the appliance t Safe Mde. Once selected, the LCD displays a cnfirmatin prmpt. Select Y and press the Right buttn t cnfirm. The SnicWALL security appliance changes t SafeMde. The Test light starts blinking when the SnicWALL security appliance has rebted int SafeMde. Nte: Hlding the reset buttn fr tw secnds will send a diagnstic snapsht t the cnsle. Hlding the reset buttn fr six t eight secnds will rebt the appliance in regular mde. 3. Pint the Web brwser n yur cmputer t The SafeMde management interface displays. 4. If yu have made any cnfiguratin changes t the security appliance, select the Create Backup On Next Bt checkbx t make a backup cpy f yur current settings. Yur settings will be saved when the appliance restarts. 5. Click Uplad New Firmware, and then brwse t the lcatin where yu saved the SnicOS firmware image, select the file, and click Uplad. 6. Select the bt icn in the rw fr ne f the fllwing: Upladed Firmware New! Use this ptin t restart the appliance with yur current cnfiguratin settings. Upladed Firmware with Factry Defaults New! Use this ptin t restart the appliance with default cnfiguratin settings. 7. In the cnfirmatin dialg bx, click OK t prceed. 8. After successfully bting the firmware, the lgin screen is displayed. If yu bted with factry default settings, enter the default user name and passwrd (admin / passwrd) t access the SnicWALL management interface. 40

41 Related Technical Dcumentatin SnicWALL user guides and reference dcumentatin is available at the SnicWALL Technical Dcumentatin Online Library: Fr basic and advanced deplyment examples, refer t SnicOS Guides and SnicOS TechNtes available n the Website. Last updated: 5/8/