Contents. Platform Compatibility. Browser Support. SonicOS NSA 220/250M, TZ 215 Series Release Notes. SonicOS

Transcription

1 SnicOS Cntents Platfrm Cmpatibility... 1 Brwser Supprt... 1 Supprted Features by Appliance Mdel... 2 Key Features in SnicOS Knwn Issues Reslved Issues Upgrading SnicOS Image Prcedures Related Technical Dcumentatin Platfrm Cmpatibility The SnicOS release is supprted n the fllwing SnicWALL Deep Packet Inspectin (DPI) security appliances: SnicWALL NSA 250M Series SnicWALL NSA 220 Series SnicWALL TZ 215 Series The SnicOS release als includes the SnicPint release fr the fllwing platfrms: SnicPint Ne SnicPint Ni The SnicWALL WXA series appliances (WXA 500 Live CD, WXA 5000 Virtual Appliance, WXA 2000/4000 Appliances) are als supprted fr use with SnicWALL NSA, and TZ prducts running The minimum recmmended firmware versin fr the WXA series appliances is Brwser Supprt SnicOS with Visualizatin uses advanced brwser technlgies such as HTML5, which are supprted in mst recent brwsers. SnicWALL recmmends using the latest Chrme, Firefx, Internet Explrer, r Safari brwsers fr administratin f SnicOS. This release supprts the fllwing Web brwsers: Chrme 11.0 and higher (recmmended brwser fr dashbard real-time graphics display) Firefx 4.0 and higher Internet Explrer 8.0 and higher (d nt use cmpatibility mde) Safari 5.0 and higher Mbile device brwsers are nt recmmended fr SnicWALL appliance system administratin. If yu are using a custm Lgin Authenticatin page, please refer t issue # in the Knwn Issues sectin f this dcument.

2 Supprted Features by Appliance Mdel The fllwing table lists the key features in SnicOS 5.8 and shws which appliance mdels supprt them. Feature / Enhancement NSA 220 Series NSA 250M Series TZ 215 Series Link Aggregatin Prt Redundancy Wire Mde NSA Mdules Supprted DPI-SSL Supprted Supprted SnicPint Ne/Ni Supprted Supprted Supprted Wireless Client Bridge Supprt Supprted Supprted Supprted App Flw Mnitr Supprted Supprted Supprted Real-Time Mnitr Supprted Supprted Supprted Tp Glbal Malware Supprted Supprted Supprted Lg Mnitr Supprted Supprted Supprted Cnnectin Mnitr Supprted Supprted Supprted Packet Mnitr Supprted Supprted Supprted Lg > Flw Reprting Supprted Supprted Supprted App Cntrl Advanced Supprted Supprted Supprted App Rules Supprted Supprted Supprted Clud GAV Supprted Supprted Supprted NTP Auth Type Supprted Supprted Supprted CFS Enhancements Supprted Supprted Supprted IPFIX & NetFlw Reprting Supprted Supprted Supprted VLAN Supprted Supprted Supprted SnicPint VAPs Supprted Supprted Supprted CASS 2.0 Supprted Supprted Supprted Enhanced Cnnectin Limit Supprted Supprted Supprted Dynamic WAN Scheduling Supprted Supprted Supprted Brwser NTLM Auth Supprted Supprted Supprted SSO Imprt frm LDAP Supprted Supprted Supprted SSL VPN NetExtender Update Supprted Supprted Supprted DHCP Scalability Enhancements Supprted Supprted Supprted SIP Applicatin Layer Gateway Enhancements Supprted Supprted Supprted SnicPint-N DR Supprted Supprted Supprted Accept Multiple Prpsals fr Clients Supprted Supprted Supprted 2

3 Feature / Enhancement NSA 220 Series NSA 250M Series TZ 215 Series WAN Acceleratin Supprt Supprted Supprted Supprted App Cntrl Plicy Cnfiguratin via App Flw Mnitr Supprted Supprted Supprted Glbal BWM Ease f Use Enhancements Supprted Supprted Supprted Applicatin Usage and Risk Reprt Supprted Supprted Supprted Ge-IP Filtering and Btnet Cmmand & Cntrl Filtering Supprted Supprted Supprted Custmizable Lgin Page Supprted Supprted Supprted LDAP Primary Grup Attribute Supprted Supprted Supprted Preservatin f Anti-Virus Exclusins After Upgrade Supprted Supprted Supprted Management Traffic Only Optin fr Netwrk Interfaces Supprted Supprted Supprted Current Users and Detail f Users Optins fr TSR Supprted Supprted Supprted User Mnitr Tl Supprted Supprted Supprted Aut-Cnfiguratin f URLs t Bypass User Authenticatin Supprted Supprted Supprted 3

4 Key Features in SnicOS 5.8 The fllwing are the key features intrduced in SnicOS 5.8: Real-Time Mnitr The real-time visualizatin dashbard mnitring feature allws administratrs t respnd quickly t netwrk security vulnerabilities and netwrk bandwidth issues. Administratrs can see what websites their users are accessing, what applicatins and services are being used in their netwrks and t what extent, in rder t plice cntent transmitted in and ut f their rganizatins. New appliances running SnicOS 5.8 receive an autmatic 30-day free trial fr App Visualizatin upn registratin. SnicWALL appliances upgrading t SnicOS 5.8 and already licensed fr GAV/IPS/AS, Ttal Secure, r Cmprehensive Gateway Security Suite (CGSS) autmatically receive a cmplimentary App Visualizatin license fr the Real-Time Visualizatin Dashbard. 4

5 T ppulate the Real-Time Mnitr with data, navigate t the Lg > Flw Reprting page, then click the Enable Real-Time Data Cllectin and Enable AppFlw T Lcal Cllectr checkbxes. In the Cllect Real-Time Data Fr drp-dwn list, click the checkbxes fr the types f data yu wish t cllect. Yu can then view real-time applicatin traffic n the Dashbard > Real-Time Mnitr page. Nte: Clicking the Enable AppFlw t Lcal Cllectr checkbx may require rebting the device. All Real-Time Mnitr applicatin legends are hidden by default frm the Applicatin and Bandwidth charts. T view the legends, click the icn. T relcate the legends int the Applicatin r Bandwidth charts, click the checkbx(s). icn, then select the desired 5

6 T view individual applicatin infrmatin, hver the muse ver the real-time visualizatin graph t display a tltip. By default, the Multi-Cre Mnitr displays as a stack chart, rather than as a bar graph, t easily shw its relatin t the ther charts n this screen. Nte: In SnicOS , the Multi-Cre Mnitr nly shws the prcessr lad fr the cres f the managing firewall. If perating in Active-Active DPI mde, the cre lad fr the standby firewall des nt display. App Flw Mnitr The tlbar categries display Ttal Packets, Ttal Bytes, and Average Rate, prviding the user with a specific view f data being transferred. In the Flw Table, clicking n the number specified under the Sessins categry f any Applicatin, a Flw Table displays with Applicatin-specific data, including the Rate in KBps. 6

7 Mdule Supprt The fllwing SnicWALL NSA mdules are supprted n the NSA 250M series appliance: WARNING: Yu MUST pwer dwn the appliance befre installing r replacing the mdules. 1 Prt ADSL (RJ-11) Annex A Prvides Asymmetric Digital Subscriber Line (ADSL) ver plain ld telephne service (POTS) with a dwnstream rate f 12.0 Mbit/s and an upstream rate f 1.3 Mbit/s. 1 Prt ADSL (RJ-45) Annex B Prvides Asymmetric Digital Subscriber Line (ADSL) ver an Integrated Services Digital Netwrk (ISDN) with a dwnstream rate f 12.0 Mbit/s and an upstream rate f 1.8 Mbit/s. 1-prt T1/E1 Mdule Prvides the cnnectin f a T1 r E1 (digitally multiplexed telecmmunicatins carrier system) circuit t a SnicWALL firewall using a RJ-45 jack. 2-prt LAN Bypass Mdule Remves a single pint f failure s that essential business cmmunicatin can cntinue while a netwrk failure is diagnsed and reslved. 2-Prt SFP Mdule This small frm-factr pluggable (SFP) netwrk interface mdule ffers a fiber alternative t the 4-Prt GbE Mdule, enabling mre flexible and scalable deplyments in a wide range f envirnments. Nte that prt 0 (802.3at) is disabled by default and shuld be enabled manually frm the SnicOS management interface. 4-Prt Gigabit Ethernet Mdule Expands prt density f a SnicWALL NSA 250M Series firewall by adding fur 1-Gbps Ethernet netwrking interfaces that negtiate the best Ethernet speeds available. 7

8 Lg > Flw Reprting Page The Lg > Flw Reprting page displays detailed external and internal flw reprting statistics. The Settings area prvides ptins t enable AppFlw t Lcal Cllectr and Real-Time Data Cllectin, as well as t allw the selectin f data type fr real-time cllectin. Reprt Settings are split int tw sectins, ne fr Cnnectin Reprt Settings with ptins fr reprts abut cnnectins, and the ther fr Other Reprt Settings with additinal ptins, including a way t specify URL types t include and an ptin t cntrl the gruping f flws by dmain r cuntry. 8

9 Pp-Up Visualizatin Dashbard Displays Several f the SnicWALL Visualizatin Dashbard pages cntain a blue pp-up buttn that will display the dashbard in a standalne brwser windw that allws fr a wider display. Click n the blue pp-up icn t the right f the page name in the left-hand navigating bar t display a dashbard page as a standalne page. The pp-up buttn is als available at the tp right f the individual dashbard pages, as shwn belw: 9

10 Applicatin Intelligence + Cntrl This feature has tw cmpnents fr mre netwrk security: (a) Identificatin: Identify applicatins and track user netwrk behavirs in real-time. (b) Cntrl: Allw/deny applicatin and user traffic based n bandwidth limiting plicies. Administratrs can easily create netwrk plicy bject-based cntrl rules t filter netwrk traffic flws based n: Blcking signature-matching Applicatins, which are ntriusly dangerus and difficult t enfrce Viewing the real-time netwrk activity f trusted Users and User Grups and guest services Matching Cntent-rated categries Netwrk security administratrs nw have applicatin-level, user-level, and cntent-level real-time visibility int the traffic flwing thrugh their netwrks. Administratrs can take immediate actin t re-traffic engineer their netwrks, quickly identify Web usage abuse, and prtect their rganizatins frm infiltratin by malware. Administratrs can limit access t bandwidth-hgging websites and applicatins, reserve higher pririty t critical applicatins and services, and prevent sensitive data frm escaping the SnicWALL secured netwrks. New appliances running SnicOS 5.8 receive an autmatic 30-day free trial fr App Cntrl upn registratin. SnicWALL appliances upgrading t SnicOS 5.8 and already licensed fr GAV/IPS/AS, Ttal Secure, r Cmprehensive Gateway Security Suite (CGSS) autmatically receive a cmplimentary App Cntrl license, required fr creating Applicatin Cntrl plicies. Select the Enable App Cntrl ptin n the Firewall > App Cntrl Advanced page t begin using the App Cntrl feature. T create plicies using App Rules (included with the App Cntrl license), select Enable App Rules n the Firewall > App Rules page. 10

11 Glbal Bandwidth Management Glbal Bandwidth Management imprves ease f use fr bandwidth management (BWM) cnfiguratin, and increases thrughput perfrmance f managed packets fr ingress and egress traffic n all interfaces, nt just WAN. The new Firewall Settings > BWM page allws netwrk administratrs t specify guaranteed minimum bandwidth, maximum bandwidth, and cntrl the number f different pririty levels fr traffic. These glbal settings are used in firewall access rules and applicatin cntrl plicies. Glbal BWM prvides: Simple bandwidth management n all interfaces. Bandwidth management f bth ingress and egress traffic. Supprt fr specifying bandwidth management pririty per firewall rules and applicatin cntrl rules. Default bandwidth management queue fr all traffic. Supprt fr applying bandwidth management directly frm the Dashbard > App Flw Mnitr page. Glbal bandwidth management prvides 8 pririty queues, which can be applied t each physical interface. The new Firewall Settings > BWM page is shwn belw: Yu can select either WAN r Glbal as the Bandwidth Management Type. Nte: When switching between bandwidth management mdes, all bandwidth management settings in firewall access rules are set back t defaults and any custm settings must be recnfigured. Default BWM actins in Applicatin Cntrl plicies are autmatically cnverted t WAN BWM r Glbal BWM, using default pririty levels. In the glbal pririty queue table, yu can cnfigure the Guaranteed and Maximum\Burst rates fr each Pririty queue. The rates are specified as a percentage. The actual rate is determined dynamically while applying BWM n an interface. The cnfigured bandwidth n an interface is used in calculating the abslute value. The sum f all guaranteed bandwidth must nt exceed 100%, and guaranteed bandwidth must nt be greater than maximum bandwidth per queue. 11

12 Bandwidth Management Mnitr Page The new BWM Mnitr page displays per-interface bandwidth management fr ingress and egress netwrk traffic. The BWM mnitr graphs are available fr real-time, highest, high, medium high, medium, medium lw, lw and lwest plicy settings. The view range is cnfigurable in 60 secnds, 2 minutes, 5 minutes, and 10 minutes (default). The refresh interval rate is cnfigurable frm 3 t 30 secnds. The bandwidth management pririty is depicted by guaranteed, maximum, and drpped. 12

13 Ge-IP Filter The Ge-IP Filter includes several ptins, including the Blck Cnnectins t/frm Fllwing Cuntries checkbx and a checkbx fr Enable Lgging. The Blck Cnnectins t/frm Fllwing Cuntries checkbx prvides ptins t blck All r blck Firewall Rule-Based. 13

14 WAN Acceleratin SnicOS prvides supprt fr the SnicWALL WXA series appliances which are deplyed in ne-arm mde with SnicWALL firewalls. WAN Acceleratin appliances emply techniques such as TCP acceleratin and Windws File Sharing (WFS) acceleratin t ptimize WAN traffic between multiple lcatins cnnected by VPN r dedicated links. In this deplyment, the SnicWALL appliance prvides netwrking and security services, such as applicatin cntrl, intrusin preventin, anti-malware prtectin, VPN, ruting, anti-spam, and cntent filtering while the WAN acceleratin appliance eliminates redundant traffic and eliminates prtcl latency. The fllwing diagram illustrates the basic netwrk tplgy fr the SnicWALL WXA series appliances and the SnicWALL netwrk security appliances. WAN acceleratin using a SnicWALL WXA series appliance can prvide an increase in applicatin perfrmance respnse time withut purchasing a higher quality service r larger prvisin f bandwidth. This is especially nticeable n WAN cnnectins such with high latency, which causes sme applicatins t perfrm prly. SnicPint-N Dual Radi Supprt The SnicWALL SnicPint-N Dual Radi appliance (SnicPint-N DR) is supprted by all SnicWALL NSA and TZ platfrms when running SnicOS r higher. With supprt fr tw wireless radis at the same time, yu can use SnicPint-N DR Clean Wireless access pints t create an enterprise-class secure wireless netwrk. The SnicPint-N DR uses six antennas t cmmunicate with wireless clients n tw frequency ranges: 2.4 GHz and 5 GHz. Yu can install and cnfigure a SnicPint-N DR access pint in abut an hur. Nte: The SnicPint-N DR cannt bradcast the same Service Set Identifiers (SSID) when using Virtual Access Pints (VAP) n 2.4 and 5 Ghz frequency ranges. Fr mre infrmatin, see the SnicWALL SnicPint-N DR Getting Started Guide, at: 14

15 Accept Multiple Prpsals fr Clients Optin The Accept Multiple Prpsals fr Clients checkbx allws multiple VPN r L2TP clients using different security plicies t cnnect t a firewall running SnicOS r higher The ptin is n the Advanced tab when cnfiguring a GrupVPN plicy frm the VPN > Settings page in SnicOS. The client plicy is still strictly checked against the cnfigured prpsal in the Prpsals tab, as with clients cnnecting with SnicWALL GVC. This ptin has n effect n GVC. If the Accept Multiple Prpsals fr Clients ptin is selected, SnicOS will allw cnnectins frm ther L2TP clients, such as Apple OS, Windws, r Andrid clients whse ffered prpsal is different frm what is cnfigured n the Prpsals tab. The prpsal is accepted if it meets the fllwing cnditins: If the ffered algrithm matches ne f the pssible algrithms available in SnicOS. If the ffered algrithm is strnger and mre secure than the cnfigured algrithm in the SnicOS prpsal. If this ptin is nt selected, SnicOS will require the client t strictly match the cnfigured plicy. This ptin allws SnicWALL t supprt hetergeneus envirnments fr Apple, Windws, and Andrid clients. Using this ptin, SnicOS can wrk with these clients if their prpsal includes a cmbinatin f algrithms which are supprted in SnicOS, but are nt cnfigured in the plicy t prevent ther clients like GVC frm failing. Deep Packet Inspectin f SSL encrypted data (DPI-SSL) Prvides the ability t transparently decrypt HTTPS and ther SSL-based traffic, scan it fr threats using SnicWALL s Deep Packet Inspectin technlgy, then re-encrypt (r ptinally SSL-fflad) the traffic and send it t its destinatin if n threats r vulnerabilities are fund. This feature wrks fr bth client and server deplyments. It prvides additinal security, applicatin cntrl, and data leakage preventin functinality fr analyzing encrypted HTTPS and ther SSL-based traffic. The fllwing security services and features are capable f utilizing DPI-SSL: Gateway Anti-Virus, Gateway Anti-Spyware, Intrusin Preventin, Cntent Filtering, Applicatin Cntrl, Packet Mnitr and Packet Mirrr. DPI-SSL is supprted n SnicWALL NSA mdels 240 and higher. Gateway Anti-Virus Enhancements (Clud GAV) The Clud Gateway Anti-Virus feature intrduces an advanced malware scanning slutin that cmpliments and extends the existing Gateway AV scanning mechanisms present n SnicWALL firewalls t cunter the cntinued grwth in the number f malware samples in the wild. Clud Gateway Anti-Virus expands the Reassembly Free Deep Packet Inspectin engine capabilities by cnsulting with the data center based malware analysis servers. This apprach keeps the fundatin f RFDPI-based malware detectin by prviding a lw-latency, real-time slutin that is capable f scanning unlimited numbers f files f unlimited size n all prtcls that are presently supprted withut adding any significant incremental prcessing verhead t the appliances themselves. With this additinal layer f security, SnicWALL s Next Generatin Firewalls are able t extend their current prtectin t cver multiple millins f pieces f malware. 15

16 NTP Authenticatin Type When adding a Netwrk Time Prtcl server, the Add NTP Server dialg bx prvides a field t specify the NTP authenticatin type, such as MD5. Fields are als available t specify the trust key ID, the key number and the passwrd. Cntent Filtering Enhancements The CFS enhancements prvide plicy management f netwrk traffic based n Applicatin usage, User activity, and Cntent type. Administratrs can create multiple CFS plicies per user grup and set restrictive Bandwidth Management Plicies based n CFS categries. IPFIX and NetFlw Reprting This feature enables administratrs t gain visibility int traffic flws and vlume thrugh their netwrks, helping them with tracking, auditing and billing peratins. This feature prvides standards-based supprt fr NetFlw Reprting, IPFIX, and IPFIX with extensins. The data exprted thrugh IPFIX with extensins cntains infrmatin abut netwrk flws such as applicatins, users, and URLs extracted thrugh Applicatin Intelligence, alng with standard attributes such as surce/destinatin IP address (includes supprt fr IPv6 netwrks), surce/destinatin prt, IP prtcl, ingress/egress interface, sequence number, timestamp, number f bytes/packets, and mre. VLAN Supprt SnicOS 5.8 prvides VLAN supprt fr SnicWALL NSA 220/250M/TZ 215 Series appliances, including wireless mdels. SnicPint Virtual Access Pint Supprt Virtual Access Pints (VAPs) are supprted when ne r mre SnicWALL SnicPints are cnnected t a SnicWALL NSA 220/250M/TZ 215 Series appliance. LDAP Primary Grup Attribute T allw Dmain Users t be used when cnfiguring plicies, membership f the Dmain Users grup can be lked up via an LDAP "Primary grup" attribute. SnicOS prvides an attribute setting in the LDAP schema cnfiguratin fr using this feature. Preservatin f Anti-Virus Exclusins After Upgrade SnicOS includes the ability t detect if the starting IP address in an existing range cnfigured fr exclusin frm anti-virus enfrcement belngs t either LAN, WAN, DMZ r WLAN znes. After upgrading t a newer firmware versin, SnicOS applies the IP range t a newly created address bject. Detecting addresses fr ther znes nt listed abve, including custm znes, is nt supprted. Anti-virus exclusins which existed befre the upgrade and which apply t hsts residing in custm znes will nt be detected. IP address ranges nt falling int the supprted znes will default t the LAN zne. Cnversin t the LAN zne ccurs during the restart prcess. There is n message in the SnicOS management interface at lgin time regarding the cnversin. 16

17 Cmprehensive Anti-Spam Service (CASS) 2.0 The Cmprehensive Anti-Spam Service (CASS) feature prvides a quick, efficient, and effective way t add anti-spam, anti-phishing, and anti-virus capabilities t yur SnicWALL security appliance. This feature increases the efficiency f yur SnicWALL security appliance by prviding yu the ability t cnfigure user view settings and filter junk messages befre users see it in their inbxes. The fllwing capabilities are available with CASS 2.0: The Security Junk Stre applicatin can reside utside the Exchange Server system, such as n a remte server. Dynamic discvery f Junk Stre user interface pages feature allws the Junk Stre t infrm SnicOS f a list f pages t display under Anti-Spam in the SnicOS left hand navigatin pane. Fr example, the pane might shw Junk Bx View, Junk Bx Settings, Junk Summary, User View Setup, and/r Address Bks. User-defined Allw and Deny Lists can be cnfigured with FQDN and Range address bjects in additin t Hst bjects. A GRID IP Check tl is available in the Anti-Spam > Status page. The SnicWALL administratr can specify (n-demand) an IP address t check against the SnicWALL GRID IP server. The result will either be LISTED r UNLISTED. Cnnectins frm a LISTED hst will be blcked by the SnicWALL security appliance running CASS (unless verridden in the Allw List). A parameter t specify the Prbe Respnse Timeut is available in the Anti-Spam > Settings page Advanced Optins sectin. This ptin supprts deplyment scenaris where a lnger timeut is needed t prevent a target frm frequently being marked as Unavailable. The default value is 30 secnds. Enhanced Cnnectin Limiting Cnnectin Limiting enhancements expand the riginal Cnnectin Limiting feature which prvided glbal cntrl f the number f cnnectins fr each IP address. This enhancement is designed t increase the granularity f this kind f cntrl s that the SnicWALL administratr can cnfigure cnnectin limitatin mre flexibly. Cnnectin Limiting uses Firewall Access Rules and Plicies t allw the administratr t chse which IP address, which service, and which traffic directin when cnfiguring cnnectin limiting. Dynamic WAN Scheduling SnicOS 5.8 supprts scheduling t cntrl when Dynamic WAN clients can cnnect. A Dynamic WAN client cnnects t the WAN interface and btains an IP address with the PPPE, L2TP, r PPTP. This enhancement allws the administratr t bind a schedule bject t Dynamic WAN clients s that they can cnnect when the schedule allws it and they are discnnected at the end f the cnfigured schedule. In the SnicOS management interface, a Schedule ptin is available n the WAN interface cnfiguratin screen when ne f the abve prtcls is selected fr IP Assignment. Once a schedule is applied, a lg event is recrded upn start and stp f the schedule. NTLM Authenticatin with Mzilla Brwsers As an enhancement t Single Sign-On, SnicOS can nw use NTLM authenticatin t identify users wh are brwsing using Mzilla-based brwsers (including Internet Explrer, Firefx, Chrme and Safari). NTLM is part f a brwser authenticatin suite knwn as Integrated Windws Security and shuld be supprted by all Mzilla-based brwsers. It allws a direct authenticatin request frm the SnicWALL appliance t the brwser with n SSO agent invlvement. NTLM authenticatin wrks with brwsers n Windws, Linux and Mac PCs, and prvides a mechanism t achieve Single Sign-On with Linux and Mac PCs that are nt able t interperate with the SSO agent. Single Sign-On Imprt Users frm LDAP Optin An Imprt frm LDAP buttn n the Users > Lcal Users page allws yu t cnfigure lcal users n the SnicWALL by retrieving the user names frm yur LDAP server. This allws SnicWALL user privileges t be granted upn successful LDAP authenticatin. Fr ease f use, ptins are prvided t reduce the list t a manageable size and then select the users t imprt. SSL VPN NetExtender Update This enhancement supprts passwrd change capability fr SSL VPN users, alng with varius fixes. When the passwrd expires, the user is prmpted t change it when lgging in via the NetExtender client r SSL VPN prtal. It is supprted fr bth lcal users and remte users (RADIUS and LDAP). 17

18 DHCP Scalability Enhancements The DHCP server in SnicWALL appliances has been enhanced t prvide between 2 t 4 times the number f leases previusly supprted. T enhance the security f the DHCP infrastructure, the SnicOS DHCP server nw prvides server side cnflict detectin t ensure that n ther device n the netwrk is using the assigned IP address. Cnflict detectin is perfrmed asynchrnusly t avid delays when btaining an address. SIP Applicatin Layer Gateway Enhancements SIP peratinal and scalability enhancements are prvided in SnicOS 5.8. The SIP feature-set remains equivalent t previus SnicOS releases, but prvides drastically imprved reliability and perfrmance. The SIP Settings sectin under the VIP > Settings page is unchanged. SIP ALG supprt has existed within SnicOS firmware since very early versins n legacy platfrms. Changes t SIP ALG have been added ver time t supprt ptimized media between phnes, SIP Back-t-Back User Agent (B2BUA), additinal equipment vendrs, and peratin n a multi-cre system. The SIP prtcl is nw in a psitin f business critical imprtance prtecting the vice infrastructure, including VIP. T accmmdate the demands f this mdern vice infrastructure, SIP ALG enhancements include the fllwing: SIP Endpint Infrmatin Database The algrithm fr maintaining the state infrmatin fr knwn endpints is redesigned t use a database fr imprved perfrmance and scalability. Endpint infrmatin is n lnger tied t the user ID, allwing multiple user IDs t be assciated with a single endpint. Endpint database access is flexible and efficient, with indexing by NAT plicy as well as by endpint IP address and prt. Autmatically Added SIP Endpints User-cnfigured endpints are autmatically added t the database based n user-cnfigured NAT plicies, prviding imprved perfrmance and ensuring crrect mappings, as these endpints are pre-ppulated rather than learnt. SIP Call Database A call database fr maintaining infrmatin abut calls in prgress is implemented, prviding imprved perfrmance and scalability t allw SnicOS t handle a much greater number f simultaneus calls. Call database entries can be assciated with multiple calls. B2BUA Supprt Enhancements SIP Back-t-Back User Agent supprt is mre efficient with varius algrithm imprvements. Cnnectin Cache Imprvements Much f the data previusly held in the cnnectin cache is ffladed t either the endpint database r the call database, resulting in mre efficient data access and crllary perfrmance increase. Graceful Shutdwn Allws SIP Transfrmatins t be disabled withut requiring the firewall t be restarted r waiting fr existing SIP endpint and call state infrmatin t time ut. Management Traffic Only Optin fr Netwrk Interfaces SnicOS prvides a Management Traffic Only ptin n the Advanced tab f the interface cnfiguratin windw, when cnfiguring an interface frm the Netwrk > Interfaces page. When selected, this ptin priritizes all traffic arriving n that interface. The administratr shuld enable this ptin ONLY n interfaces intended t be used exclusively fr management purpses. If this ptin is enabled n a regular interface, it will still priritize the traffic, but that may nt be the desired result. It is up t the administratr t limit the traffic t just management; the firmware des nt have the ability t prevent pass- thrugh traffic. The purpse f this ptin is t prvide the ability t access the SnicOS management interface even when the appliance is running at 100% utilizatin. Aut-Cnfiguratin f URLs t Bypass User Authenticatin SnicOS includes a new autcnfiguratin utility t temprarily allw traffic frm a single, specified IP address t bypass authenticatin. The destinatins that traffic accesses are then recrded and used t allw that traffic t bypass user authenticatin. Typically this is used t allw traffic such as anti-virus updates and Windws updates. T use this feature, navigate t Users > Settings and click the Aut-cnfigure buttn in the Other Glbal User Settings sectin. 18

19 Knwn Issues This sectin cntains a list f knwn issues in the SnicOS release. Applicatin Cntrl Symptm Cnditin / Wrkarund Issue Applicatin Categry List, Applicatin List, and Applicatin Signature List are nt prperly updated when cnfiguring a Match Object fr use in an App Rules plicy. Occurs when using Internet Explrer t access the SnicOS management interface and cnfiguring a Match Object. When Applicatin Categry List is selected as the Match Object Type, after ne Applicatin Categry is selected, selecting a different categry and clicking Update des nt change the categry s are received with attachments even thugh an App Rules plicy is created t blck attachments. App Cntrl Advanced plicies are applied t traffic frm and t the VPN zne, rather than within the WAN zne nly. App Rules plicies remain in effect even when disabled glbally. Related traffic cnfigured in an App Rules plicy is blcked even thugh the Enable App Rules checkbx is nt selected. Bandwidth Management Occurs when creating an App Rules plicy t blck POP3 incming s with.exe attachments, then cnnecting a PC t a firewall s LAN interface, and sending an with an.exe attachment. Occurs when enabling the App Cntrl service n the WAN zne, and then enabling the lgging r blcking actin fr any signature. After traffic is generated frm the LAN t the VPN, the App Cntrl Advanced plicy is applied t VPN traffic. Occurs when the Enable App Rules checkbx is cleared t disable these plicies glbally, then an App Rules plicy is created. When traffic n the WAN interface matches the rule, the cnfigured plicy actin is applied. Wrkarund: Clear the Enable App Rules checkbx and rebt the appliance. Occurs when an App Rules plicy is created using the Create Rule buttn n the App Flw Mnitr page and the Enable App Rules checkbx is nt selected, which is the factry default setting. The App Rules plicy is created and functins prperly, even thugh the Enable App Rules checkbx is disabled. Wrkarund: Clear the Enable App Rules checkbx and rebt the appliance Symptm Cnditin / Wrkarund Issue Traffic is drpped when the ingress r egress values fr an interface are mdified and traffic is passing thrugh that interface. Occurs when mdifying the ingress r egress interface values while the interface is passing traffic. Wrkarund: Stp traffic n the interface, and then mdify the values Bandwidth management applicatin rules are smetimes mapped t the wrng glbal BWM pririty queue. Occurs when creating a bandwidth management rule n the App Flw Mnitr page and setting the pririty t High. The App Flw Mnitr page displays the created rule with a Medium pririty setting, even thugh High was selected

20 DPI-SSL Symptm Cnditin / Wrkarund Issue DPI-SSL interrupts the Remte Desktp Prtcl (RDP) traffic passing frm a WLAN t a LAN. Occurs when running Windws 7 and passing traffic frm a WLAN t a LAN. The LAN side cannt establish an RDP sessin with the WLAN as an initiatr Firmware Symptm Cnditin / Wrkarund Issue Cannt lgin t the firewall s management interface with a previusly custmized Lgin Authenticatin page. Occurs when running SnicOS firmware and lgging int the management interface using a custm Lgin Authenticatin page created in SnicOS r earlier. Wrkarund: Use defauth.html t lgin, if yur current Lgin Authenticatin page des nt allw yu t access the management interface. Navigate t the Users > Settings page and click the Default buttn in the Custmized Lgin Pages sectin. Use this template t custmize the management interface Lgin Authenticatin page, then click the Accept buttn Netwrking Symptm Cnditin / Wrkarund Issue Intermittent drpped rutes fr Rute Based VPN r Tunnel Interfaces. Occurs when cnfiguring mre than ne Rute Based VPN (r Tunnel Interface) t remte units with OSPF enabled Users Symptm Cnditin / Wrkarund Issue The wrng Cntent Filtering plicy can be applied t Terminal Services Agent users. Occurs when a default CFS plicy is cnfigured t blck all website categries and is applied t the LAN zne, and a mre permissive CFS plicy is applied t the LDAP grup t which the TSA user belngs. After the TSA user accesses the terminal server and begins t brwse t websites, permitted sites will smetimes be blcked The Lg page displays the message UDP Packet Drpped after pinging a hst r accessing a website using a Dmain Name. Occurs when navigating t the Users > Settings page and selecting SSO Agent frm the Single Sign On Methd drp-dwn list, then cnfiguring the TSA agent and setting the default LAN t WAN Access Rule t Trusted Users

21 VPN Symptm Cnditin / Wrkarund Issue Smetimes, the secndary IPSec gateway is unable t establish a tunnel with a peer if the primary gateway is unreachable. Occurs when an IPsec VPN tunnel is cnfigured between tw SnicWALL appliances, ne f which prvides dual WAN interfaces (X1 and X4). If the primary WAN interface is discnnected, the tunnel cannt be established using the secndary interface Reslved Issues The fllwing issues are reslved in the SnicOS release: Cntent Filtering System Symptm Cnditin / Wrkarund Issue Only the first 100 dmains are filtered by the Cntent Filtering System (CFS), even thugh the Allwed List is set t 100+ dmains. Occurs when creating a custm CFS plicy, setting the allwed dmains t Per Plicy, and adding 100+ dmains t the Allw List. Reslutin: The user is nw warned when 100 dmains are exceeded, and a nte has been added in the management interface t infrm the user that the dmain limit is DPI-SSL Symptm Cnditin / Wrkarund Issue Newly added Cmmn Name Exclusins are nt ppulated in the DPI-SSL Cmmn Name Exclusins list, r existing exclusins are lst. Occurs when adding r editing URLs in the DPI-SSL Cmmn Name Exclusins list Firmware Symptm Cnditin / Wrkarund Issue The firewall may repeatedly restart after cnfiguring GMS management. Occurs when running SnicOS , cnfiguring the DNS server and GMS hstname, then enabling GMS management After imprting cnfiguratin settings, an NSA 250M has the default LAN IP address instead f the cnfigured value, and lgin des nt wrk after first restart. Occurs when cnfiguratin settings are imprted frm a TZ 200 int an NSA 250M appliance, and then the NSA is restarted. After a secnd rebt, the admin can lg in using IP

22 High Availability Symptm Cnditin / Wrkarund Issue The firewall is nt able t pass traffic n X1 with High Availability and Virtual MAC enabled. SnicOS cannt be managed frm the LAN. On a Stateful HA pair, the secndary unit des nt display an active VPN tunnel in the management interface. Lg Occurs when a unit f mdel type NSA 220/220W, NSA 250M/250MW r TZ 215/215W has a serial number that begins with C0EAE4. Occurs when Virtual MAC is enabled n a High Availability pair. Occurs when Stateful HA is enabled n a pair f NSA 220 r 250M series appliances, and a site-tsite VPN plicy is cnfigured with a matching plicy n a remte firewall. While cntinuus pings are ccurring, the cnsle f bth HA appliances shws the active tunnel, but the VPN > Settings page n the secndary unit des nt display it Symptm Cnditin / Wrkarund Issue After deselecting all the lg categries, an errr message is received if the Next Page buttn is clicked n the Lg > View tab. Occurs when viewing a lg page ther than page 1, clicking the Categries tab, and then deselecting all the lg categries Mdules Symptm Cnditin / Wrkarund Issue Management and user lgin ptins cannt be enable fr the mdule interface M0:ADSL0. Occurs when an ADSL mdule is inserted int an NSA 250M series appliance and cnfigured fr PPPA mde, and then attempting t enable HTTP, HTTPS, r ICMP (ping) access Failver t the 3G cnnectin r failback t the Ethernet WAN des nt wrk crrectly if the firewall is restarted right after the failver, but requires a secnd restart f the firewall. Occurs when the firewall has an Ethernet WAN cnnectin and a 3G persistent prfile with 3G cnfigured fr failver, the Ethernet cable is unplugged, and within a few secnds f receiving the 3G WAN IP, the firewall is restarted frm the System > Restart page. After the firewall cmes back up, the 3G cnnectin des nt wrk. The firewall must be restarted again

23 Netwrking Symptm Cnditin / Wrkarund Issue The firewall may repeatedly restart if a prbe target is selected fr the static rute. Occurs when creating a netwrk mnitr bject, then selecting that bject under Static Rute, and restarting the firewall The U0 prt cntinues t be displayed n the Netwrk > Interfaces page after a mdem is discnnected frm the USB prt. The NAT table is nt crrectly updated, causing the SnicWALL t respnd t t many ARP requests. The Netwrk > NAT Plicies page in the management interface can display duplicate plicies and extra characters n sme plicy names. Pint-t-Pint Tunneling Prtcl (PPTP) clients cannt cnnect t the PPTP server via the firewall WAN interface. The firewall may repeatedly restart. SnicPint Occurs when a 56K mdem is cnnected t a USB prt n the SnicWALL appliance, the appliance is pwered n and bted up using factry defaults, the U0 prt appears n the page, the appliance is pwered ff within a shrt time and the mdem is unplugged, and the U0 prt still appears after the unit cmes back up. Occurs when enabling the Web Prxy feature with an IP n the WAN, then restarting the appliance. Occurs when the WAN interface IP Assignment is set t PPTP. Occurs when a Fully Qualified Dmain Name (FQDN) is used fr GMS instead f an IP address. Symptm Cnditin / Wrkarund Issue The status f a SnicPint Ne/Ni may display as Nn-Respnsive in the user interface f the managing appliance. In ther cases, althugh the user interface might indicate that the SnicPint Ne/Ni is Operatinal, it may be underging a rebt, r the SSID may stp bradcasting temprarily. User Interface Occurs when ne r mre SnicPint(s) temprarily cannt cmmunicate with the managing firewall Symptm Cnditin / Wrkarund Issue The Match Object r Applicatin List Object windws have duplicate entries fr applicatins inside categries (e.g., Facebk), and exhibit incnsistent behavir fr expanding duplicated applicatins. Occurs when clicking Add Applicatin List Object n the Firewall > Match Objects page and attempting t add multiple signatures t the bject The Clear Statistics and Restre Defaults buttns are displayed in the wrng lcatin at ne side f the page. Occurs when viewing the Firewall > Access Rules page in the SnicOS management interface

24 Users Symptm Cnditin / Wrkarund Issue The Plicy Access Barred, Plicy Access Dwn, and Plicy Access Unavailable lgin page types cannt be saved and errr messages might be received. Occurs when attempting t save changes when these lgin page types are selected in the Select Lgin Page drp-dwn list in the Custmized Lgin Pages sectin f the Users > Settings page The redirect fr frced authrizatin by SnicWALL des nt wrk with Internet Explrer 8 r 9. Visualizatin Occurs when using a User Level Authenticatin (ULA) rule t frce authrizatin by SnicWALL n an interface in Layer 2 Bridge Mde Symptm Cnditin / Wrkarund Issue The NetFlw EndTime timestamp results in fr valid and allwed TCP packets. Occurs when the NetFlw cllectr s lgging is enabled n Applicable Interfaces and Rules, and TCP traffic is sent t the allwed destinatin. Upn checking the packet capture details, the EndTime timestamp displays as WAN Acceleratin Symptm Cnditin / Wrkarund Issue WFS Acceleratin cannt be enabled and the errr message An errr has ccurred saving the hstname displays. Occurs when disabling WFS Acceleratin, upgrading r dwngrading the WXA firmware versin, then re-enabling WFS Acceleratin. WXA hstnames were allwed t be edited after WFS Acceleratin was disabled, causing the errr message when trying t re-enable WFS Acceleratin Wireless Symptm Cnditin / Wrkarund Issue An NSA 220W smetimes fails t initialize the wireless radi. The SnicPint Ne becmes unrespnsive during an Intrusin Detectin Services (IDS) scan. Occurs when the radi band is cnfigured t perate in 5GHZ n Only mde r when the Regulatry Dmain is changed t Canada. Occurs when cnfiguring a SnicPint Ne t an interface n the WLAN zne, then perfrming a manual IDS scan. This may als ccur n bt up, when the appliance perfrms an initial scan

25 Upgrading SnicOS Image Prcedures The fllwing prcedures are fr upgrading an existing SnicOS image t a newer versin: Obtaining the Latest SnicOS Image Versin Saving a Backup Cpy f Yur Cnfiguratin Preferences Upgrading a SnicOS Image with Current Preferences Imprting Preferences t SnicOS Imprting Preferences frm SnicOS Standard t SnicOS 5.8 Enhanced Supprt Matrix fr Imprting Preferences Upgrading a SnicOS Image with Factry Defaults Using SafeMde t Upgrade Firmware Obtaining the Latest SnicOS Image Versin T btain a new SnicOS firmware image file fr yur SnicWALL security appliance: 1. Cnnect t yur mysnicwall.cm accunt at 2. Cpy the new SnicOS image file t a directry n yur management statin. Yu can update the SnicOS image n a SnicWALL security appliance remtely if the LAN interface r the WAN interface is cnfigured fr management access. Saving a Backup Cpy f Yur Cnfiguratin Preferences Befre beginning the update prcess, make a system backup f yur SnicWALL security appliance cnfiguratin settings. The backup feature saves a cpy f yur current cnfiguratin settings n yur SnicWALL security appliance, prtecting all yur existing settings in the event that it becmes necessary t return t a previus cnfiguratin state. In additin t using the backup feature t save yur current cnfiguratin settings t the SnicWALL security appliance, yu can exprt the cnfiguratin preferences file t a directry n yur lcal management statin. This file serves as an external backup f the cnfiguratin preferences, and can be imprted back int the SnicWALL security appliance. Perfrm the fllwing steps t save a backup f yur cnfiguratin settings and exprt them t a file n yur lcal management statin: 1. On the System > Settings page, click Create Backup. Yur cnfiguratin preferences are saved. The System Backup entry is displayed in the Firmware Management table. 2. T exprt yur settings t a lcal file, click Exprt Settings. A ppup windw displays the name f the saved file. 3. On the System > Diagnstics page, under Tech Supprt Reprt, select the fllwing checkbxes and then click the Dwnlad Reprt buttn: VPN Keys ARP Cache DHCP Bindings IKE Inf SnicPintN Diagnstics Current users Detail f users The infrmatin is saved t a techsupprt_ file n yur management cmputer. 25

26 Upgrading a SnicOS Image with Current Preferences Perfrm the fllwing steps t uplad new firmware t yur SnicWALL appliance and use yur current cnfiguratin settings upn startup: 1. Dwnlad the SnicOS firmware image file frm mysnicwall.cm and save it t a lcatin n yur lcal cmputer. 2. On the System > Settings page, click Uplad New Firmware. 3. Brwse t the lcatin where yu saved the SnicOS firmware image file, select the file, and click Uplad. 4. On the System > Settings page, click the Bt icn in the rw fr Upladed Firmware. 5. In the cnfirmatin dialg bx, click OK. The SnicWALL restarts and then displays the lgin page. 6. Enter yur user name and passwrd. Yur new SnicOS image versin infrmatin is listed n the System > Settings page. Imprting Preferences t SnicOS 5.8 Preferences imprting t the SnicWALL netwrk security appliances is generally supprted frm the fllwing SnicWALL appliances running SnicOS: NSA Series NSA E-Class Series TZ 210/200/100/190/180/170 Series PRO Series There are certain exceptins t preferences imprting n these appliances running the SnicOS 5.8 release. Preferences cannt be imprted in the fllwing cases: Settings files cntaining Prtshield interfaces created prir t SnicOS 5.x Settings files cntaining VLAN interfaces are nt accepted by the TZ 100/200 Series firewalls Settings files frm a PRO 5060 with ptical fiber interfaces where VLAN interfaces have been created Full supprt fr preferences imprting frm these appliances is targeted fr a future release. At that time, yu will need t upgrade yur firmware t the latest SnicOS maintenance release available n MySnicWALL. 26

27 Imprting Preferences frm SnicOS Standard t SnicOS 5.8 Enhanced The SnicOS Standard t Enhanced Settings Cnverter is designed t cnvert a surce Standard Netwrk Settings file t be cmpatible with a target SnicOS Enhanced appliance. Due t the mre advanced nature f SnicOS Enhanced, its Netwrk Settings file is mre cmplex than the ne SnicOS Standard uses. They are nt cmpatible. The Settings Cnverter creates an entirely new target Enhanced Netwrk Settings file based n the netwrk settings fund in the surce Standard file. This allws fr a rapid upgrade frm a Standard deplyment t an Enhanced ne with n time wasted in re-creating netwrk plicies. Nte: SnicWALL recmmends deplying the cnverted target Netwrk Settings file in a testing envirnment first and always keeping a backup cpy f the riginal surce Netwrk Settings file. The SnicOS Standard t Enhanced Settings Cnverter is available at: If the preferences cnversin fails, yur SnicOS Standard cnfiguratin file t settings_cnverter@snicwall.cm with a shrt descriptin f the prblem. In this case, yu may als cnsider manually cnfiguring yur SnicWALL appliance. T cnvert a Standard Netwrk Settings file t an Enhanced ne: 1. Lg in t the management interface f yur SnicOS Standard appliance, navigate t System > Settings, and save yur netwrk settings t a file n yur management cmputer. 2. On the management cmputer, pint yur brwser t 3. Click the Settings Cnverter buttn. 4. Lg in using yur MySnicWALL credentials and agree t the security statement. The surce Standard Netwrk Setting file must be upladed t MySnicWALL as part f the cnversin prcess. The Setting Cnversin tl uses MySnicWALL authenticatin t secure private netwrk settings. Users shuld be aware that SnicWALL will retain a cpy f their netwrk settings after the cnversin prcess is cmplete. 5. Uplad the surce Standard Netwrk Settings file: Click Brwse. Navigate t and select the surce SnicOS Standard Settings file. Click Uplad. Click the right arrw t prceed. 6. Review the surce SnicOS Standard Settings Summary page. This page displays useful netwrk settings infrmatin cntained in the upladed surce Netwrk Settings file. Fr testing purpses, the LAN IP and subnet mask f the appliance can be changed n this page in rder t deply it in a testing envirnment. (Optinal) Change the LAN IP address and subnet mask f the surce appliance t that f the target appliance. Click the right arrw t prceed. 7. Select the target SnicWALL appliance fr the Enhanced deplyment frm the available list. SnicOS Enhanced is cnfigured differently n varius SnicWALL appliances, mstly t supprt different interface numbers. As such, the cnverted Enhanced Netwrk Settings file must be custmized t the appliance targeted fr deplyment. 8. Cmplete the cnversin by clicking the right arrw t prceed. 9. Optinally click the Warnings link t view any differences in the settings created fr the target appliance. 10. Click the Dwnlad buttn, select Save t Disk, and click OK t save the new target SnicOS Enhanced Netwrk Settings file t yur management cmputer. 11. Lg in t the management interface fr yur SnicWALL appliance. 12. Navigate t System > Settings, and click the Imprt Settings buttn t imprt the cnverted settings t yur appliance. 27

28 Supprt Matrix fr Imprting Preferences 28

29 Upgrading a SnicOS Image with Factry Defaults Perfrm the fllwing steps t uplad new firmware t yur SnicWALL appliance and start it up using the default cnfiguratin: 1. Dwnlad the SnicOS firmware image file frm mysnicwall.cm and save it t a lcatin n yur lcal cmputer. 2. On the System > Settings page, click Create Backup. 3. Click Uplad New Firmware. 4. Brwse t the lcatin where yu saved the SnicOS firmware image file, select the file, and click Uplad. 5. On the System > Settings page, click the Bt icn in the rw fr Upladed Firmware with Factry Default Settings. 6. In the cnfirmatin dialg bx, click OK. The SnicWALL restarts and then displays the Setup Wizard, with a link t the lgin page. 7. Enter the default user name and passwrd (admin / passwrd) t access the SnicWALL management interface. Using SafeMde t Upgrade Firmware The SafeMde prcedure uses a reset buttn in a small pinhle, whse lcatin varies: n the NSA mdels, the buttn is near the USB prts n the frnt; n the TZ mdels, the buttn is next t the pwer crd n the back. If yu are unable t cnnect t the SnicWALL security appliance s management interface, yu can restart the SnicWALL security appliance in SafeMde. The SafeMde feature allws yu t quickly recver frm uncertain cnfiguratin states with a simplified management interface that includes the same settings available n the System > Settings page. T use SafeMde t upgrade firmware n the SnicWALL security appliance, perfrm the fllwing steps: 1. Cnnect yur cmputer t the X0 prt n the SnicWALL appliance and cnfigure yur IP address with an address n the /24 subnet, such as D ne f the fllwing t restart the appliance in SafeMde: Use a narrw, straight bject, like a straightened paper clip r a tthpick, t press and hld the reset buttn n the frnt f the security appliance fr mre than 20 secnds. Use the LCD cntrl buttns n the frnt bezel t set the appliance t Safe Mde. Once selected, the LCD displays a cnfirmatin prmpt. Select Y and press the Right buttn t cnfirm. The SnicWALL security appliance changes t SafeMde. The Test light starts blinking when the SnicWALL security appliance has rebted int SafeMde. Nte: Hlding the reset buttn fr tw secnds will send a diagnstic snapsht t the cnsle. Hlding the reset buttn fr six t eight secnds will rebt the appliance in regular mde. 3. Pint the Web brwser n yur cmputer t The SafeMde management interface displays. 4. If yu have made any cnfiguratin changes t the security appliance, select the Create Backup On Next Bt checkbx t make a backup cpy f yur current settings. Yur settings will be saved when the appliance restarts. 5. Click Uplad New Firmware, and then brwse t the lcatin where yu saved the SnicOS firmware image, select the file, and click Uplad. 6. Select the bt icn in the rw fr ne f the fllwing: Upladed Firmware New! Use this ptin t restart the appliance with yur current cnfiguratin settings. Upladed Firmware with Factry Defaults New! Use this ptin t restart the appliance with default cnfiguratin settings. 7. In the cnfirmatin dialg bx, click OK t prceed. 8. After successfully bting the firmware, the lgin screen is displayed. If yu bted with factry default settings, enter the default user name and passwrd (admin / passwrd) t access the SnicWALL management interface. 29

30 Related Technical Dcumentatin SnicWALL user guides and reference dcumentatin is available at the SnicWALL Technical Dcumentatin Online Library: Fr basic and advanced deplyment examples, refer t SnicOS Guides and SnicOS TechNtes available n the Website. Last updated: 4/12/