Dell SonicWALL Global Management System (GMS) 8.1 Service Pack 1

Transcription

1 Dell SonicWALL Global Management System (GMS) 8.1 Service Pack 1 May 2016 These release notes provide information about the Dell SonicWALL Global Management System (GMS) 8.1 Service Pack 1 (SP1) release. Topics: About Dell SonicWALL GMS 8.1 SP1 New features Resolved issues Known issues Supported platforms System requirements Product licensing Upgrading to GMS 8.1 SP1 Technical support resources Online training materials About Dell About Dell SonicWALL GMS 8.1 SP1 GMS 8.1 SP1 is a Service Pack release that applies to versions and , unifying these releases and their hotfixes. See Resolved issues. Dell SonicWALL GMS can be used in a variety of roles in a wide range of networks. Network administrators can use Dell SonicWALL GMS in a Management Console role in an Enterprise network containing a single Dell SonicWALL NSA, TZ, or SuperMassive appliance and also in a Remote Management System role for managing multiple unit deployments for Enterprise and Service Provider networks consisting of hundreds and thousands of firewalls, Secure Mobile Access (SMA), and Security (ES) appliances. Before upgrading to GMS 8.1 SP1 CAUTION: If you have an UMA EM5000 appliance or a Windows 32-bit GMS Server currently in your deployment, you must migrate them first to a Windows 64-bit GMS server or decommission these systems, before upgrading to 8.1. See the Upgrading to GMS 8.1 SP1 section for more information. Dell SonicWALL GMS 8.1 SP1 1

2 NOTE: With the releases of GMS and Analyzer 8.1, the reporting database engine is changed from a MySQL engine to a Postgres engine for data storage. New features This section describes the new features in the GMS 8.1 SP1 release. Dell X-Series switch integration DPI-SSL enhancements DPI-SSL session capacities DPI-SSL Strengthened Encryption Methods Disable DPI Option for Firewall Access Rules Unified Capabilities Approved Product List (UC-APL) enhancements Firewall Sandwich support Wire Mode VLAN translation mapping Numbered VPN tunnel interfaces Change Auditor Support in AppFlow Botnet Source Identification in AppFlow Monitor Gateway Anti-Virus Detection Only Mode Control Plane Flood Protection Shutdown Port Option Port based network monitoring Disable Source Port Remapping option for NAT Suffix Option for HA/Clustered Firewalls Source/Destination IP address binding for Round Robin/Spillover load balancing SonicPoint ACe/ACi/N2 FCC new rule certification for DFS channels Feature support on TZ Series and SOHO Wireless appliances Dell X-Series switch integration Dell X-Series switches can now be managed easily within TZ series firewalls to offer a single pane of glass management of the entire network security infrastructure. This feature is supported on the following TZ series platforms: TZ600 TZ500/TZ500 W TZ400/TZ400 W TZ300/TZ300 W Supported X-Series switch models include: X1008/X1008P X1018/X1018P Dell SonicWALL GMS 8.1 SP1 2

3 X1026/X1026P X1052/X1052P X4012 This feature allows unified management of both the firewall and the switch using the SonicOS management interface and Dell SonicWALL GMS. IMPORTANT: GMS management of both the firewall and the switch requires GMS 8.1 Service Pack 1. This feature is not supported by lower versions of GMS. The maximum number of interfaces available on the supported Dell SonicWALL TZ models range from 5 (TZ300) to 10 (TZ600). In certain deployments, the number of ports required might easily exceed the maximum number of interfaces available on the TZ. With the TZ/X-Series solution, ports on the X-Series switch can be viewed as extended interfaces of the firewall, thereby increasing the number of interfaces available for use. Provisioning of an X-series switch is performed from GMS on the Network > PortShield Groups page. Below is the key set of features supported with the TZ/X-Series solution: Provisioning of X-Series switch as Extended Switch PortShield functionality and protection propagated to the Extended Switch Configuration of Extended Switch interface settings Manageability of basic Extended Switch global parameters Manageability of Extended Switch using GMS High Availability and PortShield Diagnostics support for Extended Switch For more information about Dell X-Series switch integration, see these Knowledge Base articles: Dell SonicWALL X-Series Solution: Dell SonicWALL integration with Dell X-Series Switches FAQ (KB ) Dell SonicWALL X-Series Solution Overview (KB ) Dell SonicWALL TZ - X solution: How to provision X-Series switches on SonicWALL TZ series firewalls (KB ) Dell SonicWALL X-Series Solution: How to provision Dell X-Series Switches on a SonicWALL TZ High Availability (HA) system (KB ) Dell SonicWALL X- Series Solution - How to manage Dell X-Series switch's admin credentials and management IP through the Dell X-Switch's UI (KB ) Dell SonicWALL X-Series Solution: Which models of Dell X-Switches has support for POE+ (KB ) Dell SonicWALL TZ Series and Dell SonicWALL X-Series solution managing SonicPoint ACe/ACi/N2 access points (SW13970) DPI-SSL enhancements The DPI-SSL enhancements in GMS 8.1 SP1 include: Enhancement CFS category-based exclusion/inclusion Dynamic Exclusions Description This feature enables DPI-SSL to use the CFS category list to exclude or include specific categories from or for DPI-SSL inspection. The CFS categories are provided on the DPI-SSL > Client SSL page and work in the same fashion. This feature is available when DPI-SSL is licensed. DPI-SSL dynamically determines if a connection should be intercepted (included) or excluded, based on policy or configuration. When DPI- Dell SonicWALL GMS 8.1 SP1 3

4 Enhancement TLS 1.2 support Increased default CA cert database Management audit of default bypass behaviors Troubleshoot connection failures with one-click exclude Granular policies per common name/domain name Customized default exemption database Server certificate authentication (for exclusions and decryption) Proxy environment support (exclusions) Subject alternate name support *.google.com vs. youtube.com Refreshed UI Description SSL extracts the domain name for the connection, exclusion information is readily available for subsequent connections to the same server/domain. DPI-SSL supports TLS 1.2, SHA-256 and Perfect Forward Secrecy. The default, or Built-In, CA-certificate database has been increased to 39 domains. A new option on the General tab of the DPI-SSL > Client SSL page allows new built-in domain names to be examined before they are added to the Built-In, CA-certificate database for exclusion. GMS keeps a list of all client SSL connection failures and the reason for failure. This Connection Failure List allows quick inspection of connection failures and provides a one-click option to exclude a failed domain. This feature allows the administrator to exclude individual domains from the global authentication policy. To reduce the CPU impact of DPI-SSL and to prevent the appliance from reaching the maximum number of concurrent DPI-SSL inspected connections, trusted domains can be added to the Built-In exclusion database. Options on the DPI-SSL > DPI Client page allow server certificates to always be authenticated or before applying exclusion policies. DPI-SSL supports proxy environments, where all client browsers redirect to a proxy server, including if an appliance sits between the client browsers and the proxy server. All DPI-SSL features are supported, including domain exclusions when the domain is part of a virtual hosting server, as part of a server farm fronted with a load balancer, or in some cloud deployments, wherein the same server IP can be used by multiple domains. DPI-SSL can be customized to support individual exclusion/inclusion of alternate names for a domain that is part of a list of domains supported by the same server (certificate). For example, excluding youtube.com while including *.google.com. A new UI is available at DPI-SSL > Client SSL and System > Licenses pages to support all the new DPI SSL enhancements listed. DPI-SSL session capacities With GMS 8.1 SP1, DPI-SSL session capacities have been increased significantly on the 6th generation NSA and SM series appliances: Platform Max sessions Platform Max sessions Platform Max sessions SuperMassive ,000 NSA ,000 TZ SuperMassive ,000 NSA ,000 TZ500/500W 250 SuperMassive ,000 NSA ,000 TZ400/400W 250 NSA ,000 TZ300/300W 250 NSA ,000 SOHO W 100 Dell SonicWALL GMS 8.1 SP1 4

5 DPI-SSL Strengthened Encryption Methods DPI-SSL now supports SHA-256 and TLS 1.2. All the re-signed server certificates are now signed with the SHA-256 hash algorithm. The TLS 1.2 communication protocol is now supported during SSL inspection/decryption between the firewall and the server (previously, TLS 1.2 was only supported between client and firewall) in DPI-SSL deployments. GMS already supports TLS 1.2 in other areas, as well. Disable DPI Option for Firewall Access Rules A new Disable DPI checkbox is provided on the Advanced tab when creating an access rule from the Firewall > Access Rules page. This allows the administrator to disable Deep Packet Inspection on a per-rule basis. Unified Capabilities Approved Product List (UC-APL) enhancements In addition to all FIPS and NDPP features from SonicOS 5.9.0/6.2.0, the UC-APL enhancements in GMS include: Enhancement New FIPS 2K certificate signing support Role-based administrator support OpenSSL 1.0.1h support Description FIPS (Federal Information Processing Standards) 112 bits of security strength (2048 bits key) is supported while maintaining backward compatibility with previous signature modes. Adds these DoD UCR defined administrator roles in addition to those already supported: System Administrator Cryptographic Administrator Audit Administrator To support these new administrator roles, three new, editable user groups have been added, and an option has been added to the Multiple Administrator section of the System > Administration page. Open-source implementation for SSL and TLS protocols is supported. Dell SonicWALL GMS 8.1 SP1 5

6 Enhancement TLS 1.1+ enforcement support Web UI and E-CLI Login Banner compliance support Two factor authentication (CAC) enhancement LDAP TLS MS-CHAPv2 support MS-CHAPv2 RADIUS authentication enforcement ICMPv6 Packet detection report and log support Firewall obscures display after administrator times out OOBM (Out-Of-Band- Management) support Certificate expiration notification Client certificate cache control Core Distribution Performance Enhancement Description A new option in the Web Management Settings section on the System > Administration page allows enforcement of TLS 1.1 and above. A new option in the User Web Login Settings section on the Users> Settings page enables display of a policy banner when a user logs in. The displayed policy must be accepted before the user can log in. The option has template and preview features. GMS had already provided client certificate status checking during the user login process. To support Common Access Card (CAC), GMS now also periodically performs an expiration check on a customerimported certificate. To support this feature, a new option has been added to the System > Administration page. To support MS-CHAPv2 LDAP authentication, a new option has been added to the Users > Settings > LDAP Configuration dialog. Selecting this option enforces use of MS-CHAPv2 authentication. If a RADIUS server is also configured, it will provide authentication if LDAP authentication fails. To support MS-CHAPv2 RADIUS authentication, a new option has been added to the Users > Settings > RADIUS Configuration dialog. Selecting this option enforces use of MS-CHAPv2 authentication. GMS now validates packet extension headers and logs each invalid extension header in accordance with RFC2460. This function is configurable by two new options on the Firewall Settings > Advanced page. The management UI now logs out the administrator automatically when the administrator s session times out. A new option in the Advanced Management section of the System > Administration page enables automatic creation of a route policy for the MGMT interface, which works as an out-of-band interface. To avoid conflicts when deleting/creating route policies, enabling/disabling the OOBM option causes the appliance to reboot. This MGMT interface provides a trusted interface to manage the appliance. Network connections to this interface are very limited. If the NTP, DNS, and SYSLOG servers are configured in the MGMT subnet, the appliance uses the MGMT IP as the source IP and creates MGMT address object and route policies automatically. All traffic from the MGMT interface is routed by this policy. Created routes display on the Network > Routing page. The MGMT address object and route policies are created and updated using the IPv4 MGMT address IP. As the IPv6 management IP address object is created by default, this feature doesn t work with IPv6 management IP address object creation. A new section on the System > Administration page, Check certificate expiration settings, enables periodic checking for expired certificates and allows the interval to be specified. In support of UC-APL, a Client Certificate Cache can be activated on the System > Administration page with a new option, Enable Client Certificate Cache. Core Distribution Performance Enhancement will improve Firewall performance, depending on network conditions and activated services. IPv6 Network Monitoring support Network Monitoring now supports monitoring of any remote host status in the local or remote network. GMS now checks the availability of the traffic between the appliance and the target host in real time, thus ensuring the target host can receive network traffic. GMS also displays the status of the monitored host on the Network > Network Monitor page. Dell SonicWALL GMS 8.1 SP1 6

7 Enhancement Extension header detection report and log support Extension header order check enforcement Hop-By-Hop Extension Header support Site-local address control to allow or disallow SLU Inbound type 0 routing header packet check DDNS support UDP/ICMP Flood Protection support Description GMS now validates packet extension headers and logs each invalid extension header in accordance with RFC2460. This function is configurable by two new options on the Firewall Settings > Advanced page. An option on the Firewall Settings > Advanced page enables a check of the extension header order to ensure a packet with multiple extension headers have a valid order, in compliance with RFC2460. When this option is enabled, packets with an invalid extension order are dropped. GMS provides an IPv6 hop-by-hop extension headers check. A hop limit can be configured through an option on the Firewall Settings > Advanced page. By default, IPv6 Site Local Unicast (SLU) addresses are used. As the nature of these addresses may adversely affect network security through leaks, ambiguity, and potential misrouting, an option on the Firewall Settings > Advanced page disables use of SLU addresses for IPv6 interfaces and router advertisement daemon (RADVD) prefixes. GMS provides a check of IPv6 extension routing headers of type 0 and can be configured to drop these headers through enabling an option on the Firewall Settings > Advanced page. GMS supports dynamic DNS (DDNS) for IPv6 as well as IPv4. GMS defends against UDP/ICMP flood attacks by monitoring IPv6 UDP/ICMP traffic flows to defined destinations. UDP/ICMP packets to a specified destination are dropped if one or more sources exceeds a configured threshold. The new option on the Firewall Settings > Flood Protection page enables this support. Dell SonicWALL GMS 8.1 SP1 7

8 Firewall Sandwich support Dell SonicWALL firewalls running GMS are compatible with Dell Force 10 switches in a configuration known as a firewall sandwich. A firewall sandwich deployment provides redundancy and improves availability, scalability, and manageability across the IT infrastructure. Firewall Sandwich topology Wire Mode VLAN translation mapping This feature allows traffic arriving on a VLAN to a Wire Mode Interface operating in Secure mode to be mapped to a different VLAN on the outgoing paired interface. This feature, which is supported on all wire modecapable devices, allows for easy rerouting of traffic for further analysis or processing. The GMS administrator can create a VLAN mapping for a pair of interfaces that are not yet a wire mode pair, to pre-provision the VLAN mapping. This allows the admin to have the mapping in place before the traffic hits the interface. The admin can also add and delete mapping on an active wire mode interface. The VLAN map created for a pair of interfaces is persistant over reload and is stored as part of the configuration. This feature also allows the creation of VLAN mapping for multiple pairs of interfaces at the same time. These interfaces may or may not form part of a wire mode pair at the time of the VLAN mapping Dell SonicWALL GMS 8.1 SP1 8

9 creation. If the paired interface is changed and this new pair has pre-created mapping, those will go into effect immediately on the pair change. Creating and managing VLAN mapping is done on the Network > VLAN Translation page. VLAN mapping can be created in two modes: Using a uni-directional map Applications of uni-directional traffic include: Secure printing from a less secure network to a high secure network (reducing print costs) Transferring application and operating system updates from a less secure network to a high secure network Monitoring multiple networks in a SOC (security operations center) Time synchronization in high secure networks File transfer Providing alerts in a high secure network, from a less secure network Using a bi-directional map Bi-directional mapping is used when setting up a two way connection to and from devices through the firewall (TCP). Numbered VPN tunnel interfaces Routing protocols now can use a numbered tunnel interface to establish routing sessions. After a numbered tunnel interface is added to the interface list, a static route policy can use it as the interface in a static route policy configuration for a static route based VPN. Routing protocols (OSPF, RIP, and BGP) can use it for dynamic route-based VPN. Numbered tunnel interfaces, as well as unnumbered tunnel interfaces, are supported on all platforms running GMS. Change Auditor Support in AppFlow AppFlow now includes support for Dell Change Auditor for SonicWALL, the automated auditing module that allows you to collect data on Internet web site and cloud activity. For more information about using Change Auditor with GMS appliances, see the Change Auditor for SonicWALL User Guide, available at Botnet Source Identification in AppFlow Monitor A Botnet filtering option and Botnet reporting columns is added to the Dashboard > AppFlow Monitor page to allow the administrator to filter for botnet traffic and view the individual user or IP address and associated detected applications. A Botnet tab is added to the Dashboard > AppFlow Reports page. In Dashboard > AppFlow Monitor (and AppFlow > AppFlow Monitor), Botnet can now be selected for the Group option on the Threats tab. Dell SonicWALL GMS 8.1 SP1 9

10 Gateway Anti-Virus Detection Only Mode A new Enable detection-only mode checkbox is available in the Gateway AV settings. Click the Configure Gateway AV Settings button to access this option. When selected, this option causes traffic containing viruses to be logged, but not blocked. Enable detection-only mode option Control Plane Flood Protection The Control Plane Flood Protection section of the Firewall Settings > Flood Protection page provides a new Enable Control Plane Flood Protection checkbox together with a Control Plane Flood Protection threshold (CPU %) field in which you can enter a percentage of CPU capacity (default 75%). Dell SonicWALL GMS 8.1 SP1 10

11 Enable Control Plane Flood Protection option When the Enable Control Plane Flood Protection option is enabled, if traffic on the Control Plane (Core 0) exceeds the threshold specified in Control Plane Flood Protection threshold (CPU %), the firewall forwards only control traffic destined to the firewall to the system Control Plane core. To give precedence to legitimate control traffic, excess data traffic is dropped. This restriction prevents too much data traffic from reaching the Control Plane core, which can cause slow system response and potential network connection drops. The percentage configured for control traffic is guaranteed. Shutdown Port Option On SuperMassive 9000 and NSA series appliances, a new Shutdown Port option is available in the Advanced tab when editing an interface on the Network > Interfaces page. You can select the Shutdown Port checkbox to temporarily take the interface offline for maintenance or other reasons. A confirmation displays; click OK. If connected, the link will go down. Clear the checkbox to activate the interface and allow the link to come back up. You cannot shut down the management interface or the interface you are currently using. You can also shut down an interface by clicking the green checkmark icon in the Enabled column for the interface in the Interface Settings table. A confirmation message displays, such as Do you wish to administratively shut down port X4? If you click OK, the checkmark icon turns to a red x icon (Disabled icon). To enable the interface, click the Disabled icon, and then click OK when the confirmation message displays. Port-based network monitoring New checkboxes are available on the Advanced tab while editing a NAT policy: Enable Port Probing RST Response Counts As Miss This feature enhances network monitoring to provide port information in addition to IP addresses. NAT uses this information to mark eligibility for an IP address and port combination for translation. This feature also enhances NAT to consider the port while load balancing. This is disabled by default and is configurable. Dell SonicWALL GMS 8.1 SP1 11

12 Disable Source Port Remapping option for NAT When editing a NAT policy from the Network > NAT Policies page, a new Disable Source Port Remap checkbox on the Advanced tab of the Add/Edit dialog provides a way to disable source port remapping on the policy. Disable Source Port Remap option When this option is selected, GMS preserves the source port of the connection while executing other NAT mapping. This option is available when adding or editing a NAT policy if the source IP address is being translated. The checkbox cannot be selected if the Translated Source is set to Original. Dell SonicWALL GMS 8.1 SP1 12

13 Suffix Option for HA/Clustered Firewalls A new Auto-Append HA/Clustering suffix to Firewall Name checkbox is provided on the System > Administrator page under Firewall Name. Auto-Append HA/Clustering suffix to Firewall Name option When enabled, this option automatically appends an appropriate suffix to the firewall name in the Dashboard > Log Monitor: Primary Secondary Primary Node <n> Secondary Node <n> This option facilitates recognition of the primary/secondary firewalls in the log. Source/Destination IP address binding for Round Robin/Spillover load balancing When configuring a load balancing group from the Network > Failover & LB page, the Use Source and Destination IP Address binding checkbox is now available for the Round Robin and Spill-over load balancing types. In previous releases, this was only available when Type was set to Ratio. Dell SonicWALL GMS 8.1 SP1 13

14 Use Source and Destination IP Address binding option The option is especially useful when using HTTP/HTTPS redirection or in a similar situation. For example, Connection A and Connection B need to be on the same WAN interface, the source and destination IP addresses in Connection A are the same as those for Connection B, but a different service is being used. In this case, source and destination IP address binding is required to keep both the connections on the same WAN interface so that the transactions do not fail. SonicPoint ACe/ACi/N2 FCC new rule certification for DFS channels FCC U-NII (Unlicensed National Information Infrastructure) New Rule (Report and Order ET Docket No ) for DFS channels is supported on SonicPoint ACe/ACi/N2 running firmware version FCC U-NII New Rule compliance helps to ensure that your Dell SonicWALL wireless appliance does not interfere with other types of users in U-NII bands. SonicPoint ACe/ACi/N2 wireless access points manufactured with FCC New Rule compliant firmware are only supported with GMS 8.1 SP1 and higher. Older SonicPoint ACe/ACi/N2 access points are automatically updated to the FCC New Rule compliant firmware when connected to a firewall running GMS 8.1 SP1 or higher. Dell SonicWALL GMS 8.1 SP1 14

15 Feature support on TZ Series and SOHO Wireless appliances Dell SonicWALL SOHO Wireless and TZ series appliances running GMS 8.1 SP1 support most of the features available for other platforms in earlier GMS releases, but not all. The following features are not supported on the TZ series or SOHO Wireless appliances: Active/Active Clustering Advanced Switching Jumbo Frames Link Aggregation Port Redundancy Wire Mode In addition, SOHO Wireless appliances do not support the following features: App Visualization (Real-Time Monitor and AppFlow) Geo-IP Filtering Botnet Filtering High Availability Resolved issues The following is a list of issues addressed in this release. Policies Panel Resolved issue Updating the priority of Access Rules does not function correctly. Occurs at the Group level under the LAN > WAN view. GMS cannot change the priority of Access Rules. Occurs after loading GMS and attempting to modify the Access Rules priority settings. Issue ID Reports Panel Resolved issue The GMS 8.1 Top Initiators Report shows 0 bytes transferred for all firewalls on any firmware in the Applications > Initiators report. Occurs after upgrading to GMS 8.1. Under Authentication > User Login, the Authenticated User Logins report is limited to a duration of 9:06:07. Occurs when you authenticate by way of an SMA device against the SSL VPN portal or the SMA authentication login. The Configuration > Syslog Filter page is not available. Occurs after migrating to GMS 8 with previously created user-created Syslog Filters. The GMS user interface logs out after approximately five minutes. Occurs when the user is still working in the Log Analyzer page. Issue ID Dell SonicWALL GMS 8.1 SP1 15

16 Resolved issue Data Deletion is not working correctly. Occurs when the disk space utilization is greater than 70 percent. Issue ID Tree Control Resolved issue A view name cannot be changed or added to the View template. Occurs when the View template is in GlobalView. Delete View does not function correctly. Occurs when attempting to delete the current view type. The Assign Privileges feature of Tree Control is not functioning correctly. Occurs during the Add Unit operation. Mix-up in management modes. Occurs when reassigning a unit to the same agent and then changing the management mode. The modes are switched and the wrong one is being used. Issue ID Known issues The following is a list of issues known to exist at the time of the GMS 8.1 SP1 release. Policies panel Known issue The settings on the Administration tab are not being updated. Occurs when configuring and then saving the Users > Local Groups User Local Groups page. There are no group level switch ports listed beneath the selected node on the PortShield Groups page. Occurs when trying to add a switch (at the group level) with the same settings for switches against the units under the selected group on the Port Config tab of Network > PortShield Groups. On the Network > PortShield Groups Restart tab, the external switch feature is not working in GMS. Occurs when adding and configuring an external switch to the firewall and then restarting the switch from GMS. The Dependent Address objects of the Firewall Settings > Flood Protection settings are not being added at the Unit level. Occurs when the settings are updated at the group level. Issue ID Reporting Known issue Data migration fails with an error message that reads: ERROR: TrackableObject locked too many times. Object type: 6. Occurs when the migration system does not have enough memory. Some column and heading text does not display on the PDF/XML report. Occurs when making a PDF or XML page of a Scheduled or Export report. Issue ID Dell SonicWALL GMS 8.1 SP1 16

17 Workflow Known issue An internal server error shows in the policy engine. Occurs when adding a custom service object at the group level. Issue ID Supported platforms The Dell SonicWALL GMS 8.1 SP1 release can be hosted in two deployment scenarios as follows: Microsoft Windows Server Software VMware ESX/ESXi Virtual Appliance Deployment Considerations: Topics: Before selecting a platform to use for your GMS deployment, use the Capacity Calculator 2. This helps you set up the correct GMS system for your deployment. CAUTION: Dell SonicWALL recommends that you take steps to minimize abrupt shutdowns of the server hosting GMS, as this can cause corruption of the Reporting database, potentially leading to loss of data for the current month. A possible solution includes using an Uninterrupted Power Supply (UPS). Supported Windows Server versions for GMS Software GMS Virtual Appliance supported platforms Virtual Appliance deployment requirements Dell SonicWALL appliances supported with GMS Supported Windows Server versions for GMS Software The GMS Software platform is supported for deployment on the Windows Server versions listed in this section. NOTE: A Windows 64-bit operating system with at least 16GB of RAM is highly recommended for better performance. Dell SonicWALL GMS supports the following Microsoft Windows operating systems: NOTE: Support for MS Windows Server 2008 will end in an upcoming release of GMS. Please make plans to upgrade to Windows Server Windows Server 2012 Standard 64-bit Windows Server 2012 R2 Standard 64-bit (English and Japanese language versions) Windows Server 2012 R2 Datacenter Windows Server 2008 R2 Datacenter Windows Server 2008 SBS R2 64-bit Windows Server 2008 R2 Standard 64-bit These Windows systems can either run in physical standalone hardware platforms, or as a virtual machine under Windows Server 2008 and 2012 Hyper-V or ESXi. Dell SonicWALL GMS 8.1 SP1 17

18 NOTE: When upgrading with Windows, the Settings screen appears as blank or white. Reboot the system to complete the upgrade process. TIP: For best performance and scalability, it is recommended to use a 64-bit Windows operating system. Bundled databases run in 64-bit mode on 64-bit Windows operating systems. All listed operating systems are supported in both virtualized and non-virtualized environments. In a Hyper-V virtualized environment, Windows Server is a guest operating system running on Hyper-V. GMS is then installed on the Windows Server virtual machine that is layered over Hyper-V. NOTE: GMS is not supported on MS-Windows Server virtual machines running on cloud services such as Microsoft Azure and Amazon Web Services EC2. GMS Virtual Appliance supported platforms The elements of basic VMware structure must be implemented prior to deploying the Dell SonicWALL GMS Virtual Appliance. The GMS Virtual Appliance runs on the following VMware platforms: NOTE: Support for ESXi 4.0, 4.1, 5.0, and 5.1 will end in an upcoming release of GMS. Please make plans to upgrade to ESXi 5.5 or ESXi 6.0 when that support change is announced. ESXi 4.1, 5.0, 5.1 and 5.5 ESXi 4.0 Update 1 (Build and newer) ESX 4.1 ESX 4.0 Update 1 (Build and newer) NOTE: GMS is not supported on VMware virtual machines running on cloud services such as Amazon Web Services EC2. Virtual Appliance deployment requirements Consider the following before deploying the GMS Virtual Appliance: GMS management is not supported on Apple MacOS. All modules are 64-bit. Using the Flow Server Agent role requires a minimum of: Quad Core 16GB of memory 300GB available disk space Use the Capacity Calculator 2 to determine the hardware requirements for your deployment. The performance of GMS Virtual Appliance depends on the underlying hardware. It is highly recommended to dedicate all the resources that are allocated to the Virtual Appliance, especially the hard-disk (datastore). In environments with high volumes of syslogs or AppFlow (IPFIX), you will need to dedicate local datastores to the GMS Virtual Appliance. Read the Capacity Planning and Performance Tuning appendix in the Dell SonicWALL GMS Administration Guide. Dell SonicWALL GMS 8.1 SP1 18

19 Unsupported platforms NOTE: GMS 8.1 SP1 does not support legacy SonicWALL appliances, including: Firewall appliances running firmware earlier than SonicOS 5.0 CSM Series CDP Series The following platforms have been dropped from support: CDP management and reporting UMA EM5000 as part of the GMS deployment Windows 32-bit as part of the GMS deployment Firewalls with firmware older than SonicOS 5.0 Gen4 or older Firewalls Dell SonicWALL appliances supported with GMS Dell SonicWALL GMS 8.1 SP1 supports the following Dell SonicWALL appliances and firmware versions: Supported appliances and firmware versions Dell SonicWALL platforms Dell SonicWALL firmware version Network security appliance SuperMassive Series SonicOS 6.0 or newer NOTE: Only partial policy management and reporting support is currently available. The following SuperMassive specific features are not supported for centralized policy management in GMS 8.1 SP1: Multi-blade Comprehensive Anti-Spam Service (CASS) High Availability/Clustering Support for Management Interface Flow Reporting Configurations Multi-blade VPN Advanced Switching Restart: SonicOS versus Chassis Contact your Dell SonicWALL Sales representative for more information. SuperMassive 9000 Series NSA Series TZ Series and TZ Wireless Dell SonicWALL SOHO and SOHO Wireless SonicOS 6.1 or newer SonicOS 5.0 or newer SonicOS 5.0 or newer SonicOS or newer Security/Anti-Spam Security Series Security 7.2 or newer (management only) Secure Mobile Access SMA 100 Series (SMA 200/400) SMA 8.1 or newer Dell SonicWALL GMS 8.1 SP1 19

20 Dell SonicWALL platforms SRA/SSL-VPN Series SMA 1000 Series (SMA 6200/7200) E-Class SRA Series Dell SonicWALL firmware version SSL-VPN 2.0 or newer (management) SSL-VPN 2.1 or newer (management and reporting) SMA or newer E-Class SRA 9.0 or newer Notes: GMS 8.1 SP1 supports Dell SonicWALL firewall App Control policy management and App Control reporting support. Refer to the SonicOS documentation for information on the supported SonicOS firmware versions. Appliances running firmware newer than the release of this GMS release can still be managed and reports can still be generated. However, the new features in the firmware will be supported in an upcoming release of GMS. Non-Dell SonicWALL appliance support Dell SonicWALL GMS provides monitoring support for non-dell SonicWALL TCP/IP and SNMP-enabled devices and applications. System requirements Before installing or upgrading to GMS 8.1 SP1, ensure that your system meets the following minimum hardware and software requirements. Hardware requirements MySQL requirements Microsoft SQL server requirements Java support Browser requirements Hardware requirements Use the Capacity Calculator 2 to determine the hardware requirements for your deployment. NOTE: A Windows 64-bit operating system with at least 16GB of RAM is highly recommended for better performance of reporting modules. For more information, read the Capacity Planning and Performance Tuning appendix in the Dell SonicWALL GMS Administration Guide. Dell SonicWALL GMS 8.1 SP1 20

21 Hard drive HDD specifications The following hard drive HDD specifications are required when using GMS Software on a Windows Server or a GMS Virtual Appliance: Hardware requirements Requirement Spindle Speed Cache Transfer rate Average latency Details 10,000 RPM or higher 64 MB or higher 600 MBs or higher 4 microseconds or lower MySQL requirements GMS automatically installs MySQL as part of the base installation package. Separately installed instances of MySQL are not supported with GMS. Microsoft SQL server requirements The following SQL Server versions are supported: NOTE: Support for SQL Server 2005 and 2008 will end in an upcoming release of GMS. Please make plans to upgrade to SQL Server 2012 or SQL Server 2014 when that support change is announced. SQL Server 2012 SQL Server 2008 SQL Server 2005 NOTE: For SQL Server deployments in countries in which English is not the default language, set the default language to English in the Login Properties of the GMS database user in the SQL Server configuration. NOTE: A database user with "DB Creator" privileges must be provided to GMS during the Role Configuration process of any GMS Server. Dell SonicWALL GMS 8.1 SP1 21

22 Java support NOTE: Java is required only when you are using Net Monitor, or if you want to use the "Login to Unit" right-click menu of TreeControl. Chrome no longer supports Java. Use Firefox or Internet Explorer for Java Applets. Download and install the latest version of the Java 8 plug-in on any system that accesses the GMS management interface. This can be downloaded from: or Browser requirements Dell SonicWALL GMS uses advanced browser technologies such as HTML5, which are supported in most recent browsers. Dell SonicWALL recommends using the latest Chrome, Firefox, Internet Explorer, or Safari browsers for administration of the Dell SonicWALL GMS. This release supports the following Web browsers: Chrome 42.0 or higher (recommended browser for dashboard real-time graphics display) Firefox 37.0 or higher Internet Explorer 10.0 or higher (do not use compatibility mode) NOTE: Internet Explorer version 10.0 in Metro interfaces of Windows 8 is not currently supported. NOTE: Turn off Compatibility Mode when accessing the GMS management interface with Internet Explorer. For more information, see the Knowledge Base article located at: Product licensing Dell SonicWALL network security appliances must be registered on MySonicWALL to enable full functionality and the benefits of Dell SonicWALL security services, firmware updates, and technical support. Log in or register for a MySonicWALL account at A number of security services are separately licensed features in GMS. When a service is licensed, full access to the functionality is available. GMS periodically checks the license status with the SonicWALL License Manager. The System > Status page displays the license status for each security service. Dell SonicWALL GMS 8.1 SP1 22

23 Upgrading to GMS 8.1 SP1 This section provides procedures for upgrading an existing Dell SonicWALL GMS or installation to GMS 8.1 SP1. See the for 8.1 for upgrade procedures if upgrading from an earlier version of GMS. GMS can be configured for a single server or in a distributed environment on multiple servers. GMS 8.1 SP1 can be installed as an upgrade from GMS 8.1. If you wish to perform a fresh install of GMS 8.1, refer to the GMS Getting Started Guide that relates to your GMS deployment. Topics: Upgrading considerations Upgrading GMS software Upgrading the GMS Virtual Appliance Upgrading considerations Consider the following before upgrading to GMS 8.1 SP1: GMS or should be running. The 40GB GMS Virtual Appliance should be installed in non-production environments only. Examples of non-production environments include those for Proof of Concept (POC), pilot, and demo deployments. Only the 250GB and 950GB Virtual Appliances are supported in production environments. It is not possible to upgrade a 40GB Virtual Appliance to a 250GB or 950GB Virtual Appliance. You need to download the 250GB or 950GB Virtual Appliance if you are planning to use this software now or in the future for a production environment. In non-production environments, the amount of syslog data collected by the Virtual Appliance may exceed the 40GB limit, in which case Dell SonicWALL will be unable to support the 40GB Virtual Appliance. You must disable the User Account Control (UAC) feature on Windows before running the GMS installer. In addition, disable Windows Firewall or your personal firewall before running this installer. For appliances under management using a GMS Management Tunnel or Existing Tunnel, make sure that HTTPS management is allowed from the GMS servers. This is because GMS 8.1 SP1 logs into the appliances using HTTPS only. The scheduled reports created in GMS 8.1 continue to work properly after upgrading to 8.1 SP1. However, the Legacy reports created in GMS 6.0 or earlier versions are not migrated. For more information on viewing legacy reports, refer to the GMS Administration Guide. When performing a fresh installation of GMS on Windows, the installer prompts for an IPv6 address of the server if it detects an IPv6 network. In a distributed environment, stop all GMS services on all GMS servers before performing an upgrade. You must upgrade all GMS servers in your deployment to the same version of GMS. You cannot have some servers running version 8.1 SP1 and others running 8.1. Upgrading GMS software You must currently be running GMS or To upgrade to GMS 8.1 SP1, download the Service Pack: 1 Navigate to 2 In the navigation menu, click Downloads > Free Downloads. Dell SonicWALL GMS 8.1 SP1 23

24 3 Click the Software Type drop-down menu and then select GMS software for Windows or Virtual Appliance according to your installation. 4 In the Description column, click the name of the item you would like to download and download it. To apply the Service Pack: 1 Log in to the /appliance (System) interface of the GMS server. 2 Navigate to the System > Settings page. 3 Click Browse, navigate to the location where you saved the above file, and select it. 4 Click Apply to begin the firmware upgrade installation. 5 After the installer has completed, reboot the system to complete the installation. Upgrading the GMS Virtual Appliance The GMS Virtual Appliance can be upgraded from or to 8.1 SP1, but cannot be directly upgraded from GMS versions earlier than 8.1. To upgrade the GMS Virtual Appliance from a version earlier than 8.1, you need to upgrade to major versions of GMS until you reach 8.1, then you can upgrade to GMS 8.1 SP1. For Dell SonicWALL GMS Virtual Appliance deployments, upgrading from the GMS 8.1 release to the GMS 8.1 SP1 release can be performed on the System > Settings page. In a distributed environment, shut down all GMS servers except the one that is running the database. Then upgrade the Console/AIOP first and then the other servers. You must upgrade all GMS servers in your deployment to GMS 8.1 SP1. You cannot have some servers running version 8.1 and others running 8.1 SP1. For a fresh install of the GMS 8.1 SP1 64-bit Virtual Appliance, refer to the GMS Virtual Appliance Getting Started Guide. To upgrade the GMS Virtual Appliance, complete the following: 1 You must be currently running GMS 8.1. (See the GMS 8.1 for help installing GMS 8.1 if necessary.) Navigate to from your workstation. 2 In the navigation menu, click Downloads > Free Downloads. 3 Click the Software Type drop-down menu and then select GMS/Analyzer software for Windows or Virtual Appliance according to your installation. 4 In the Description column, select GMS 8.1 SP1 and download it. 5 Log in to the /Virtual Appliance (System) interface of the GMS server. 6 Navigate to the System > Settings page. 7 Click Browse, navigate to the location where you saved the above file, and select it. 8 Click Apply to begin the firmware upgrade installation. 9 Reboot the system. Dell SonicWALL GMS 8.1 SP1 24

25 Technical support resources Technical support is available to customers who have purchased Dell software with a valid maintenance contract and to customers who have trial versions. The Support Portal provides self-help tools you can use to solve problems quickly and independently, 24 hours a day, 365 days a year. In addition, the portal provides direct access to product support engineers through an online Service Request system. To access the Support Portal, go to The site enables you to: Create, update, and manage Service Requests (cases) View Knowledge Base articles Obtain product notifications Download software. For trial software, go to Trial Downloads. View how-to videos Engage in community discussions Chat with a support engineer Dell SonicWALL reference documentation is available on the Dell Software Support site: Datasheets, white papers, and other product information are available on the Dell Software Products website: Knowledge articles and links to related community forums and other resources are available at: Dell SonicWALL GMS 8.1 SP1 25

26 Online training materials Dell SonicWALL Technical Training Services offers GMS software for essential security administrator certification. This Certified Dell SonicWALL Security Administrator (CSSA) course provides fundamental instructions to help you understand the basic deployment best practices for Managed Security Service Providers. The following link provides the latest information regarding Dell SonicWALL GMS elearning courses: Click Find Your Course and search for Global Management System Certification Training. About Dell Dell listens to customers and delivers worldwide innovative technology, business solutions and services they trust and value. For more information, visit Contacting Dell For sales or other inquiries, visit or call Dell SonicWALL GMS 8.1 SP1 26

27 Copyright 2016 Dell Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. Dell, the Dell logo, and SonicWALL are trademarks of Dell Inc. in the United States and/or other jurisdictions. All other marks and names mentioned herein may be trademarks of their respective companies. Patents For more information, go to Legend CAUTION: A CAUTION icon indicates potential damage to hardware or loss of data if instructions are not followed. WARNING: A WARNING icon indicates a potential for property damage, personal injury, or death. IMPORTANT, NOTE, TIP, MOBILE, or VIDEO: An information icon indicates supporting information. Last updated: 5/2/ Rev A Dell SonicWALL GMS 8.1 SP1 27