SonicOS Release Notes

Transcription

1 SnicOS Cntents Platfrm Cmpatibility... 1 Brwser Supprt... 2 Supprted Features... 2 Key Features in SnicOS Knwn Issues Reslved Issues Upgrading SnicOS Image Prcedures Related Technical Dcumentatin Platfrm Cmpatibility The SnicOS release is supprted n the fllwing SnicWALL Deep Packet Inspectin (DPI) security appliances: SnicWALL NSA E8500 SnicWALL NSA E7500 SnicWALL NSA E6500 SnicWALL NSA E5500 SnicWALL NSA 5000 SnicWALL NSA 4500 SnicWALL NSA 3500 SnicWALL NSA 2400 SnicWALL NSA 240 SnicWALL TZ 210 / 210 Wireless SnicWALL TZ 200 / 200 Wireless SnicWALL TZ 100 / 100 Wireless The SnicWALL WXA series appliances (WXA 500 Live CD, WXA 5000 Virtual Appliance, WXA 2000/4000 Appliances) are als supprted fr use with SnicWALL NSA E-Class, NSA, and TZ prducts running The minimum recmmended firmware versin fr the WXA series appliances is

2 Brwser Supprt SnicOS with Visualizatin uses advanced brwser technlgies such as HTML5, which are supprted in mst recent brwsers. SnicWALL recmmends using the latest Chrme, Firefx, Internet Explrer, r Safari brwsers fr administratin f SnicOS. This release supprts the fllwing Web brwsers: Chrme 18.0 and higher (recmmended brwser fr dashbard real-time graphics display) Firefx 16.0 and higher Internet Explrer 8.0 and higher (d nt use cmpatibility mde) Safari 5.0 and higher Mbile device brwsers are nt recmmended fr SnicWALL appliance system administratin. Supprted Features This sectin details the supprted SnicOS features by appliance mdel and hw they are affected by the licensing status. Supprted Features by Appliance Mdel The fllwing table lists the key features in SnicOS and which appliance mdels supprt them. Feature / Enhancement Wireless Client Bridge Supprt NSA E-Class Series NSA Series TZ 210 Series TZ 200 Series TZ 100 Series Supprted Supprted Supprted App Flw Mnitr Supprted Supprted Supprted Real-Time Mnitr Supprted Supprted Supprted Packet Mnitr Enhancements Lg > Flw Reprting Enhancements Supprted Supprted Supprted Supprted Supprted Supprted Supprted Supprted App Cntrl Advanced Supprted Supprted Supprted Supprted Supprted App Rules Supprted Supprted Supprted DPI-SSL Supprted Supprted Clud GAV Supprted Supprted Supprted Supprted Supprted NTP Auth Type Supprted Supprted Supprted Supprted Supprted Link Aggregatin Prt Redundancy Supprted Supprted CFS Enhancements Supprted Supprted Supprted Supprted Supprted IPFIX & NetFlw Reprting Supprted Supprted Supprted 2

3 Feature / Enhancement NSA E-Class Series NSA Series TZ 210 Series TZ 200 Series TZ 100 Series VLAN Subinterfaces Supprted Supprted Supprted Supprted Supprted SnicPint VAPs Supprted Supprted Supprted Supprted Supprted CASS 2.0 Supprted Supprted Supprted Supprted Supprted Enhanced Cnnectin Limit Supprted Supprted Supprted Supprted Supprted Dynamic WAN Scheduling Supprted Supprted Supprted Supprted Supprted Brwser NTLM Auth Supprted Supprted Supprted Supprted Supprted User Imprt frm LDAP Supprted Supprted Supprted Supprted Supprted SSL VPN NetExtender Client Update DHCP Scalability Enhancements SIP Applicatin Layer Enhancements Supprted Supprted Supprted Supprted Supprted Supprted Supprted Supprted Supprted Supprted Supprted Supprted Supprted Supprted Supprted SnicPint-N DR Supprted Supprted Supprted Supprted Supprted Accept Multiple VPN Client Prpsals. Supprted Supprted Supprted Supprted Supprted WAN Acceleratin Supprt Supprted Supprted Supprted Supprted Supprted App Cntrl Plicy Cnfiguratin via App Flw Mnitr Glbal BWM Ease f Use Enhancements Applicatin Usage and Risk Reprt Ge-IP Filtering and Btnet Cmmand & Cntrl Filtering Wire and Tap Mde Supprted Supprted Supprted Supprted Supprted Supprted Supprted Supprted Supprted Supprted Supprted Supprted Supprted Supprted Supprted Supprted Supprted NSA 3500 and abve Custmizable Lgin Page Supprted Supprted Supprted Supprted Supprted Preservatin f Anti-Virus Exclusins After Upgrade Management Traffic Only Optin fr Netwrk Interfaces Current Users and Detail f Users Optins fr TSR Supprted Supprted Supprted Supprted Supprted Supprted Supprted Supprted Supprted Supprted Supprted Supprted Supprted Supprted Supprted User Mnitr Tl Supprted Supprted Supprted Aut-Cnfiguratin f URLs t Bypass User Authenticatin Supprted Supprted Supprted Supprted Supprted 3

4 Supprted Features and Licensing Sme pages in the SnicOS management interface d nt display if the license is nt activated fr the feature n that page. Here is an example f the Dashbard > Real-Time Mnitr page with App Visualizatin nt licensed: The fllwing table lists the key features in SnicOS that depend n licenses and ther settings fr the related management interface pages t display and functin prperly: SnicOS Feature N license (SGSS) With license Disabled in flw reprting With license and enabled in flw reprting Dashbard > Real-Time Mnitr Blcks the page with a license ppup windw. All charts are independently enabled r disabled frm the Lg > Flw Reprting page. It is nt dependent n Visualizatin being enabled. All charts are enabled. The App charts cntent depends n whether Visualizatin r App Cntrl Advanced is enabled with zne settings. Dashbard > AppFlw Mnitr Blcks the page with a license ppup windw. The AppFlw Mnitr Page displays the message flw reprting and visualizatin is disabled. All tabs are visible and fully peratinal. Cntent is nt shwn. Dashbard > BWM Mnitr Blcks the page with a license ppup windw. Always n if Glbal BWM and Interface are enabled. Always n if Glbal BWM and Interface are enabled. Lg > Flw Reprting Blcks the page with a license ppup windw. Available Available Security Services > GeIP Filter Blcks the page with a license ppup windw. Nt available Available Security Services > Btnet Filter Blcks the page with a license ppup windw. * This is a separate license and is nt part f the SGSS. Available Available 4

5 Key Features in SnicOS 5.8 The fllwing are the key features in SnicOS 5.8: YuTube fr Schl Cntent Filtering Supprt YuTube fr Schls is a service that allws fr custmized YuTube access fr students, teachers, and administratrs. YuTube Educatin (YuTube EDU) prvides schls access t hundreds f thusands f free educatinal vides. These vides cme frm a number f respected rganizatins. Yu can custmize the cntent available in yur schl. All schls get access t all f the YuTube EDU cntent, but teachers and administratrs can als create playlists f vides that are viewable nly within their schl's netwrk. Befre cnfiguring yur SnicWALL security appliance fr YuTube fr Schls, yu must first sign up: The cnfiguratin f YuTube fr Schls depends n the methd f Cntent Filtering yu are using, which is cnfigured n the Security Services > Cntent Filter page. Membership in Multiple Grups If a user is a member f multiple grups where ne plicy allws access t any part f YuTube and the ther plicy has a YuTube fr Schls restrictin, the user will be filtered by the YuTube fr Schls plicy and nt be allwed unrestricted access t YuTube. A user cannt be a member f multiple grups that have different YuTube fr Schl IDs. While the firewall will accept the cnfiguratin, this is nt supprted. Nte: Fr mre infrmatin n the general cnfiguratin f CFS, refer t the Security Services > Cntent Filter sectin in the SnicOS Administratr s Guide. When the CFS Plicy Assignment pulldwn menu is set t Via Applicatin Cntrl, YuTube fr Schls is cnfigured as an App Cntrl Plicy. 1. Navigate t Firewall > Match Objects and click Add New Match Object. 2. Type in a descriptive name, and then select CFS Allw/Frbidden List as the Match Object Type. 3. Select Partial Match fr the Match Type. 4. In the Cntent field, type in yutube.cm and then click Add. 5. Type in ytimg.cm and then click Add. 6. Click OK t create the Match Object. 5

6 7. Navigate t the Firewall > App Rules page and click Add New Plicy. 8. Type in a descriptive Plicy Name. 9. Fr the Plicy Type, select CFS. 10. Select the apprpriate settings fr Match Object and Actin Object, based n yur envirnment. 11. Fr CFS Allw/Excluded List, select the Match Object yu just created (ur example uses CFS Allw YT4S ). 12. Select the Enable YuTube fr Schls checkbx. 13. Paste in yur Schl ID, which is btained frm Click OK t create the plicy. NOTE: Once the plicy has been applied, any existing brwser cnnectins will be unaffected until the brwser has been clsed and repened. Als, if yu have a brwser pen as administratr n the firewall, yu will be excluded frm CFS plicy enfrcement unless yu cnfigure the firewall specifically nt t exclude yu (select the D nt bypass CFS blcking fr the Administratr checkbx n the Security Services > Cntent Filter page). 6

7 When the CFS Plicy Assignment pulldwn menu is set t Via User and Zne Screens, YuTube fr Schls is cnfigured as part f the Cntent Filter plicy. 1. On the Security Services > Cntent Filter page, select Cntent Filter Service fr the Cntent Filter Type pulldwn menu. 2. Click the Cnfigure buttn. 3. On the Plicy tab, click the Cnfigure icn fr the CFS plicy n which yu want t enable YuTube fr Schls. 4. Click n the Settings tab, and select the Enable YuTube fr Schls checkbx. 5. Paste in yur Schl ID, which is btained frm 6. Click OK. 7. On the Custm List tab, click the Add buttn fr Allwed Dmains. 8. In the dialg bx, type yutube.cm int the Dmain Name field and click OK. 9. Click Add again. 7

8 10. Type ytimg.cm int the Dmain Name field and click OK. 11. Click OK. These settings will verride any CFS categry that blcks YuTube. NOTE: Once the plicy has been applied, any existing brwser cnnectins will be unaffected until the brwser has been clsed and repened. Als, if yu have a brwser pen as administratr n the firewall, yu will be excluded frm CFS plicy enfrcement unless yu cnfigure the firewall specifically nt t exclude yu (select the D nt bypass CFS blcking fr the Administratr checkbx n the Security Services > Cntent Filter page). 8

9 SnicOS Web-based Management Interface HTTP access t the SnicOS web-based management interface is disabled by default. When running SnicOS with factry defaults, the administratr can lg int the management interface using HTTPS at HTTP management is still allwed when upgrading frm prir firmware versins, when already enabled in the previus cnfiguratin settings. Nte: HTTP management must be enabled when the firewall is being managed by SnicWALL GMS via a VPN tunnel. This applies when using either a GMS Management Tunnel r an existing VPN tunnel. The System > Administratin page has a new Allw management via HTTP checkbx t allw the administratr t enable/disable HTTP management glbally. 9

10 Real-Time Mnitr The real-time visualizatin dashbard mnitring feature allws administratrs t respnd quickly t netwrk security vulnerabilities and netwrk bandwidth issues. Administratrs can see what websites their users are accessing, what applicatins and services are being used in their netwrks and t what extent, in rder t plice cntent transmitted in and ut f their rganizatins. New appliances running SnicOS receive an autmatic 30-day free trial fr App Visualizatin upn registratin. SnicWALL appliances upgrading frm a pre-snicos 5.8 release and already licensed fr GAV/IPS/AS, Ttal Secure, r Cmprehensive Gateway Security Suite (CGSS) autmatically receive a cmplimentary App Visualizatin license fr the Real-Time Visualizatin Dashbard. 10

11 T ppulate the Real-Time Mnitr with data, navigate t the Lg > Flw Reprting page, then click the Enable Real-Time Data Cllectin and Enable AppFlw T Lcal Cllectr checkbxes. In the Cllect Real-Time Data Fr drp-dwn list, click the checkbxes fr the types f data yu wish t cllect. Yu can then view real-time applicatin traffic n the Dashbard > Real-Time Mnitr page. Nte: Clicking the Enable AppFlw t Lcal Cllectr checkbx may require rebting the device. All Real-Time Mnitr applicatin legends are hidden by default frm the Applicatin and Bandwidth charts. T view the legends, click the icn. T relcate the legends int the Applicatin r Bandwidth charts, click the checkbx(s). icn, then select the desired 11

12 T view individual applicatin infrmatin, hver the muse ver the real-time visualizatin graph t display a tltip. By default, the Multi-Cre Mnitr displays as a stack chart, rather than as a bar graph, t easily shw its relatin t the ther charts n this screen. Nte: The Multi-Cre Mnitr nly shws the prcessr lad fr the cres f the managing firewall. If perating in Active-Active DPI mde, the cre lad fr the standby firewall des nt display. App Flw Mnitr The tlbar categries display Ttal Packets, Ttal Bytes, and Average Rate, prviding the user with a specific view f data being transferred. In the Flw Table, clicking n the number specified under the Sessins categry f any Applicatin, a Flw Table displays with Applicatin-specific data, including the Rate in KBps. 12

13 Lg > Flw Reprting Page The Lg > Flw Reprting page displays detailed external and internal flw reprting statistics. The Settings area prvides ptins t enable AppFlw t Lcal Cllectr and Real-Time Data Cllectin, as well as t allw the selectin f data type fr real-time cllectin. Reprt Settings are split int tw sectins, ne fr Cnnectin Reprt Settings with ptins fr reprts abut cnnectins, and the ther fr Other Reprt Settings with additinal ptins, including a way t specify URL types t include and an ptin t cntrl the gruping f flws by dmain r cuntry. 13

14 Pp-Up Visualizatin Dashbard Displays Several f the SnicWALL Visualizatin Dashbard pages cntain a blue pp-up buttn that will display the dashbard in a standalne brwser windw that allws fr a wider display. Click n the blue pp-up icn t the right f the page name in the left-hand navigating bar t display a dashbard page as a standalne page. The pp-up buttn is als available at the tp right f the individual dashbard pages, as shwn belw: Wire Mde / Inspect Mde When Inspect Mde (Passive DPI) is selected as the Wire Mde Setting, a Restrict analysis at resurce limit checkbx appears. This checkbx is selected by default. The behavir f this ptin is as fllws: Enabled Scan nly the amunt f packets that the device can handle. Disabled Thrttle the traffic t be able t scan all packets. 14

15 Applicatin Intelligence + Cntrl This feature has tw cmpnents fr mre netwrk security: (a) Identificatin: Identify applicatins and track user netwrk behavirs in real-time. (b) Cntrl: Allw/deny applicatin and user traffic based n bandwidth limiting plicies. Administratrs can easily create netwrk plicy bject-based cntrl rules t filter netwrk traffic flws based n: Blcking signature-matching Applicatins, which are ntriusly dangerus and difficult t enfrce Viewing the real-time netwrk activity f trusted Users and User Grups and guest services Matching Cntent-rated categries Netwrk security administratrs nw have applicatin-level, user-level, and cntent-level real-time visibility int the traffic flwing thrugh their netwrks. Administratrs can take immediate actin t re-traffic engineer their netwrks, quickly identify Web usage abuse, and prtect their rganizatins frm infiltratin by malware. Administratrs can limit access t bandwidth-hgging websites and applicatins, reserve higher pririty t critical applicatins and services, and prevent sensitive data frm escaping the SnicWALL secured netwrks. New appliances running SnicOS receive an autmatic 30-day free trial fr App Cntrl upn registratin. SnicWALL appliances upgrading frm a pre-snicos 5.8 release and already licensed fr GAV/IPS/AS, Ttal Secure, r Cmprehensive Gateway Security Suite (CGSS) autmatically receive a cmplimentary App Cntrl license, required fr creating Applicatin Cntrl plicies. Select the Enable App Cntrl ptin n the Firewall > App Cntrl Advanced page t begin using the App Cntrl feature. T create plicies using App Rules (included with the App Cntrl license), select Enable App Rules n the Firewall > App Rules page. 15

16 Glbal Bandwidth Management Glbal Bandwidth Management imprves ease f use fr bandwidth management (BWM) cnfiguratin, and increases thrughput perfrmance f managed packets fr ingress and egress traffic n all interfaces, nt just WAN. The new Firewall Settings > BWM page allws netwrk administratrs t specify guaranteed minimum bandwidth, maximum bandwidth, and cntrl the number f different pririty levels fr traffic. These glbal settings are used in firewall access rules and applicatin cntrl plicies. Glbal BWM prvides: Simple bandwidth management n all interfaces. Bandwidth management f bth ingress and egress traffic. Supprt fr specifying bandwidth management pririty per firewall rules and applicatin cntrl rules. Default bandwidth management queue fr all traffic. Supprt fr applying bandwidth management directly frm the Dashbard > App Flw Mnitr page. Glbal bandwidth management prvides 8 pririty queues, which can be applied t each physical interface. The new Firewall Settings > BWM page is shwn belw: Yu can select either WAN r Glbal as the Bandwidth Management Type. Nte: When switching between bandwidth management mdes, all bandwidth management settings in firewall access rules are set back t defaults and any custm settings must be recnfigured. Default BWM actins in Applicatin Cntrl plicies are autmatically cnverted t WAN BWM r Glbal BWM, using default pririty levels. In the glbal pririty queue table, yu can cnfigure the Guaranteed and Maximum\Burst rates fr each Pririty queue. The rates are specified as a percentage. The actual rate is determined dynamically while applying BWM n an interface. The cnfigured bandwidth n an interface is used in calculating the abslute value. The sum f all guaranteed bandwidth must nt exceed 100%, and guaranteed bandwidth must nt be greater than maximum bandwidth per queue. 16

17 Bandwidth Management Mnitr Page The new BWM Mnitr page displays per-interface bandwidth management fr ingress and egress netwrk traffic. The BWM mnitr graphs are available fr real-time, highest, high, medium high, medium, medium lw, lw and lwest plicy settings. The view range is cnfigurable in 60 secnds, 2 minutes, 5 minutes, and 10 minutes (default). The refresh interval rate is cnfigurable frm 3 t 30 secnds. The bandwidth management pririty is depicted by guaranteed, maximum, and drpped. 17

18 Ge-IP Filter The Ge-IP Filter includes several ptins, including the Blck Cnnectins t/frm Fllwing Cuntries checkbx and a checkbx fr Enable Lgging. The Blck Cnnectins t/frm Fllwing Cuntries checkbx prvides ptins t blck All r blck Firewall Rule-Based. 18

19 WAN Acceleratin SnicOS and higher prvides supprt fr the SnicWALL WXA series appliances which are deplyed in ne-arm mde with SnicWALL firewalls. WAN Acceleratin appliances emply techniques such as TCP acceleratin and Windws File Sharing (WFS) acceleratin t ptimize WAN traffic between multiple lcatins cnnected by VPN r dedicated links. In this deplyment, the SnicWALL appliance prvides netwrking and security services, such as applicatin cntrl, intrusin preventin, anti-malware prtectin, VPN, ruting, anti-spam, and cntent filtering while the WAN acceleratin appliance eliminates redundant traffic and eliminates prtcl latency. The fllwing diagram illustrates the basic netwrk tplgy fr the SnicWALL WXA series appliances and the SnicWALL netwrk security appliances. WAN acceleratin using a SnicWALL WXA series appliance can prvide an increase in applicatin perfrmance respnse time withut purchasing a higher quality service r larger prvisin f bandwidth. This is especially nticeable n WAN cnnectins such with high latency, which causes sme applicatins t perfrm prly. SnicPint-N Dual Radi Supprt The SnicWALL SnicPint-N Dual Radi appliance (SnicPint-N DR) is supprted by all SnicWALL NSA and TZ platfrms when running SnicOS r higher. With supprt fr tw wireless radis at the same time, yu can use SnicPint-N DR Clean Wireless access pints t create an enterprise-class secure wireless netwrk. The SnicPint-N DR uses six antennas t cmmunicate with wireless clients n tw frequency ranges: 2.4 GHz and 5 GHz. Yu can install and cnfigure a SnicPint-N DR access pint in abut an hur. Nte: The SnicPint-N DR cannt bradcast the same Service Set Identifiers (SSID) when using Virtual Access Pints (VAP) n 2.4 and 5 Ghz frequency ranges. Fr mre infrmatin, see the SnicWALL SnicPint-N DR Getting Started Guide, at: 19

20 Accept Multiple Prpsals fr Clients Optin The Accept Multiple Prpsals fr Clients checkbx allws multiple VPN r L2TP clients using different security plicies t cnnect t a firewall running SnicOS r higher. The ptin is n the Advanced tab when cnfiguring a GrupVPN plicy frm the VPN > Settings page in SnicOS. The client plicy is still strictly checked against the cnfigured prpsal in the Prpsals tab, as with clients cnnecting with SnicWALL GVC. This ptin has n effect n GVC. If the Accept Multiple Prpsals fr Clients ptin is selected, SnicOS will allw cnnectins frm ther L2TP clients, such as Apple OS, Windws, r Andrid clients whse ffered prpsal is different frm what is cnfigured n the Prpsals tab. The prpsal is accepted if it meets the fllwing cnditins: If the ffered algrithm matches ne f the pssible algrithms available in SnicOS. If the ffered algrithm is strnger and mre secure than the cnfigured algrithm in the SnicOS prpsal. If this ptin is nt selected, SnicOS will require the client t strictly match the cnfigured plicy. This ptin allws SnicWALL t supprt hetergeneus envirnments fr Apple, Windws, and Andrid clients. Using this ptin, SnicOS can wrk with these clients if their prpsal includes a cmbinatin f algrithms which are supprted in SnicOS, but are nt cnfigured in the plicy t prevent ther clients like GVC frm failing. Deep Packet Inspectin f SSL encrypted data (DPI-SSL) Prvides the ability t transparently decrypt HTTPS and ther SSL-based traffic, scan it fr threats using SnicWALL s Deep Packet Inspectin technlgy, then re-encrypt (r ptinally SSL-fflad) the traffic and send it t its destinatin if n threats r vulnerabilities are fund. This feature wrks fr bth client and server deplyments. It prvides additinal security, applicatin cntrl, and data leakage preventin functinality fr analyzing encrypted HTTPS and ther SSL-based traffic. The fllwing security services and features are capable f utilizing DPI-SSL: Gateway Anti-Virus, Gateway Anti-Spyware, Intrusin Preventin, Cntent Filtering, Applicatin Cntrl, Packet Mnitr and Packet Mirrr. DPI-SSL is supprted n SnicWALL NSA mdels 240 and higher. Gateway Anti-Virus Enhancements (Clud GAV) The Clud Gateway Anti-Virus feature intrduces an advanced malware scanning slutin that cmpliments and extends the existing Gateway AV scanning mechanisms present n SnicWALL firewalls t cunter the cntinued grwth in the number f malware samples in the wild. Clud Gateway Anti-Virus expands the Reassembly Free Deep Packet Inspectin engine capabilities by cnsulting with the data center based malware analysis servers. This apprach keeps the fundatin f RFDPI-based malware detectin by prviding a lw-latency, real-time slutin that is capable f scanning unlimited numbers f files f unlimited size n all prtcls that are presently supprted withut adding any significant incremental prcessing verhead t the appliances themselves. With this additinal layer f security, SnicWALL s Next Generatin Firewalls are able t extend their current prtectin t cver multiple millins f pieces f malware. 20

21 NTP Authenticatin Type When adding a Netwrk Time Prtcl server, the Add NTP Server dialg bx prvides a field t specify the NTP authenticatin type, such as MD5. Fields are als available t specify the trust key ID, the key number and the passwrd. Link Aggregatin Link Aggregatin prvides the ability t grup multiple Ethernet interfaces t frm a trunk which lks and acts like a single physical interface. This feature is useful fr high end deplyments requiring mre than 1 Gbps thrughput fr traffic flwing between tw interfaces. This functinality is available n all NSA E-Class platfrms. Static Link Aggregatin with the ability t aggregate up t 4 prts int a single link is supprted in SnicOS 5.8. A rund-rbin algrithm is used fr lad balancing traffic acrss the interfaces in an aggregated link. Prt Redundancy Prt Redundancy prvides the ability t cnfigure a redundant physical interface fr any Ethernet interface in rder t prvide a failver path in case a link ges dwn. Prt Redundancy is available n all NSA E-Class platfrms. When the primary interface is active, it handles all traffic frm/t the interface. When the primary interface ges dwn, the backup interface takes ver and handles all utging/incming traffic. When the primary interface cmes up again, it takes ver all the traffic handling duties frm the backup interface. When Prt Redundancy, High Availability and WAN Lad Balancing are used tgether, Prt Redundancy takes precedence fllwed by High Availability, then fllwed by WAN Lad Balancing. Cntent Filtering Enhancements The CFS enhancements prvide plicy management f netwrk traffic based n Applicatin usage, User activity, and Cntent type. Administratrs can create multiple CFS plicies per user grup and set restrictive Bandwidth Management Plicies based n CFS categries. IPFIX and NetFlw Reprting This feature enables administratrs t gain visibility int traffic flws and vlume thrugh their netwrks, helping them with tracking, auditing and billing peratins. This feature prvides standards-based supprt fr NetFlw Reprting, IPFIX, and IPFIX with extensins. The data exprted thrugh IPFIX with extensins cntains infrmatin abut netwrk flws such as applicatins, users, and URLs extracted thrugh Applicatin Intelligence, alng with standard attributes such as surce/destinatin IP address (includes supprt fr IPv6 netwrks), surce/destinatin prt, IP prtcl, ingress/egress interface, sequence number, timestamp, number f bytes/packets, and mre. VLAN Supprt fr TZ Series SnicOS prvides VLAN supprt fr SnicWALL TZ 210/200/100 Series appliances, including wireless mdels. The TZ 210 and 200 Series supprt up t 10 VLANs, the TZ 100 Series supprts up t 5 VLANs. SnicPint Virtual Access Pint Supprt fr TZ Series Virtual Access Pints (VAPs) are supprted when ne r mre SnicWALL SnicPints are cnnected t a SnicWALL TZ 210/200/100 Series appliance. The TZ 210 and 200 Series supprt up t 8 VAPs, the TZ 100 Series supprts up t 5 VAPs. LDAP Primary Grup Attribute T allw Dmain Users t be used when cnfiguring plicies, membership f the Dmain Users grup can be lked up via an LDAP "Primary grup" attribute. Beginning in , SnicOS prvides an attribute setting in the LDAP schema cnfiguratin fr using this feature. Preservatin f Anti-Virus Exclusins After Upgrade Beginning in , SnicOS includes the ability t detect if the starting IP address in an existing range cnfigured fr exclusin frm anti-virus enfrcement belngs t either LAN, WAN, DMZ r WLAN znes. After upgrading t a newer firmware versin, SnicOS applies the IP range t a newly created address bject. Detecting addresses fr ther znes nt listed abve, including custm znes, is nt supprted. Anti-virus exclusins which existed befre the upgrade and which apply t hsts residing in custm znes will nt be detected. IP address ranges nt falling int the supprted znes will default t the LAN zne. Cnversin t the LAN zne ccurs during the restart prcess. There is n message in the SnicOS management interface at lgin time regarding the cnversin. 21

22 Cmprehensive Anti-Spam Service (CASS) 2.0 The Cmprehensive Anti-Spam Service (CASS) feature prvides a quick, efficient, and effective way t add anti-spam, anti-phishing, and anti-virus capabilities t yur SnicWALL security appliance. This feature increases the efficiency f yur SnicWALL security appliance by prviding yu the ability t cnfigure user view settings and filter junk messages befre users see it in their inbxes. The fllwing capabilities are available with CASS 2.0: The Security Junk Stre applicatin can reside utside the Exchange Server system, such as n a remte server. Dynamic discvery f Junk Stre user interface pages feature allws the Junk Stre t infrm SnicOS f a list f pages t display under Anti-Spam in the SnicOS left hand navigatin pane. Fr example, the pane might shw Junk Bx View, Junk Bx Settings, Junk Summary, User View Setup, and/r Address Bks. User-defined Allw and Deny Lists can be cnfigured with FQDN and Range address bjects in additin t Hst bjects. A GRID IP Check tl is available in the Anti-Spam > Status page. The SnicWALL administratr can specify (n-demand) an IP address t check against the SnicWALL GRID IP server. The result will either be LISTED r UNLISTED. Cnnectins frm a LISTED hst will be blcked by the SnicWALL security appliance running CASS (unless verridden in the Allw List). A parameter t specify the Prbe Respnse Timeut is available in the Anti-Spam > Settings page Advanced Optins sectin. This ptin supprts deplyment scenaris where a lnger timeut is needed t prevent a target frm frequently being marked as Unavailable. The default value is 30 secnds. Enhanced Cnnectin Limiting Cnnectin Limiting enhancements expand the riginal Cnnectin Limiting feature which prvided glbal cntrl f the number f cnnectins fr each IP address. This enhancement is designed t increase the granularity f this kind f cntrl s that the SnicWALL administratr can cnfigure cnnectin limitatin mre flexibly. Cnnectin Limiting uses Firewall Access Rules and Plicies t allw the administratr t chse which IP address, which service, and which traffic directin when cnfiguring cnnectin limiting. Dynamic WAN Scheduling SnicOS 5.8 supprts scheduling t cntrl when Dynamic WAN clients can cnnect. A Dynamic WAN client cnnects t the WAN interface and btains an IP address with the PPPE, L2TP, r PPTP. This enhancement allws the administratr t bind a schedule bject t Dynamic WAN clients s that they can cnnect when the schedule allws it and they are discnnected at the end f the cnfigured schedule. In the SnicOS management interface, a Schedule ptin is available n the WAN interface cnfiguratin screen when ne f the abve prtcls is selected fr IP Assignment. Once a schedule is applied, a lg event is recrded upn start and stp f the schedule. NTLM Authenticatin with Mzilla Brwsers As an enhancement t Single Sign-On, SnicOS can nw use NTLM authenticatin t identify users wh are brwsing using Mzilla-based brwsers (including Internet Explrer, Firefx, Chrme and Safari). NTLM is part f a brwser authenticatin suite knwn as Integrated Windws Security and shuld be supprted by all Mzilla-based brwsers. It allws a direct authenticatin request frm the SnicWALL appliance t the brwser with n SSO agent invlvement. NTLM authenticatin wrks with brwsers n Windws, Linux and Mac PCs, and prvides a mechanism t achieve Single Sign-On with Linux and Mac PCs that are nt able t interperate with the SSO agent. Single Sign-On Imprt Users frm LDAP Optin An Imprt frm LDAP buttn n the Users > Lcal Users page allws yu t cnfigure lcal users n the SnicWALL by retrieving the user names frm yur LDAP server. This allws SnicWALL user privileges t be granted upn successful LDAP authenticatin. Fr ease f use, ptins are prvided t reduce the list t a manageable size and then select the users t imprt. SSL VPN NetExtender Update This enhancement supprts passwrd change capability fr SSL VPN users, alng with varius fixes. When the passwrd expires, the user is prmpted t change it when lgging in via the NetExtender client r SSL VPN prtal. It is supprted fr bth lcal users and remte users (RADIUS and LDAP). 22

23 DHCP Scalability Enhancements The DHCP server in SnicWALL appliances has been enhanced t prvide between 2 t 4 times the number f leases previusly supprted. T enhance the security f the DHCP infrastructure, the SnicOS DHCP server nw prvides server side cnflict detectin t ensure that n ther device n the netwrk is using the assigned IP address. Cnflict detectin is perfrmed asynchrnusly t avid delays when btaining an address. SIP Applicatin Layer Gateway Enhancements SIP peratinal and scalability enhancements are prvided in SnicOS 5.8. The SIP feature-set remains equivalent t previus SnicOS releases, but prvides drastically imprved reliability and perfrmance. The SIP Settings sectin under the VIP > Settings page is unchanged. SIP ALG supprt has existed within SnicOS firmware since very early versins n legacy platfrms. Changes t SIP ALG have been added ver time t supprt ptimized media between phnes, SIP Back-t-Back User Agent (B2BUA), additinal equipment vendrs, and peratin n a multi-cre system. The SIP prtcl is nw in a psitin f business critical imprtance prtecting the vice infrastructure, including VIP. T accmmdate the demands f this mdern vice infrastructure, SIP ALG enhancements include the fllwing: SIP Endpint Infrmatin Database The algrithm fr maintaining the state infrmatin fr knwn endpints is redesigned t use a database fr imprved perfrmance and scalability. Endpint infrmatin is n lnger tied t the user ID, allwing multiple user IDs t be assciated with a single endpint. Endpint database access is flexible and efficient, with indexing by NAT plicy as well as by endpint IP address and prt. Autmatically Added SIP Endpints User-cnfigured endpints are autmatically added t the database based n user-cnfigured NAT plicies, prviding imprved perfrmance and ensuring crrect mappings, as these endpints are pre-ppulated rather than learnt. SIP Call Database A call database fr maintaining infrmatin abut calls in prgress is implemented, prviding imprved perfrmance and scalability t allw SnicOS t handle a much greater number f simultaneus calls. Call database entries can be assciated with multiple calls. B2BUA Supprt Enhancements SIP Back-t-Back User Agent supprt is mre efficient with varius algrithm imprvements. Cnnectin Cache Imprvements Much f the data previusly held in the cnnectin cache is ffladed t either the endpint database r the call database, resulting in mre efficient data access and crllary perfrmance increase. Graceful Shutdwn Allws SIP Transfrmatins t be disabled withut requiring the firewall t be restarted r waiting fr existing SIP endpint and call state infrmatin t time ut. Management Traffic Only Optin fr Netwrk Interfaces Beginning in , SnicOS prvides a Management Traffic Only ptin n the Advanced tab f the interface cnfiguratin windw, when cnfiguring an interface frm the Netwrk > Interfaces page. When selected, this ptin priritizes all traffic arriving n that interface. The administratr shuld enable this ptin ONLY n interfaces intended t be used exclusively fr management purpses. If this ptin is enabled n a regular interface, it will still priritize the traffic, but that may nt be the desired result. It is up t the administratr t limit the traffic t just management; the firmware des nt have the ability t prevent pass- thrugh traffic. The purpse f this ptin is t prvide the ability t access the SnicOS management interface even when the appliance is running at 100% utilizatin. Aut-Cnfiguratin f URLs t Bypass User Authenticatin Beginning in , SnicOS includes an aut-cnfiguratin utility t temprarily allw traffic frm a single, specified IP address t bypass authenticatin. The destinatins that traffic accesses are then recrded and used t allw that traffic t bypass user authenticatin. Typically this is used t allw traffic such as anti-virus updates and Windws updates. T use this feature, navigate t Users > Settings and click the Aut-cnfigure buttn in the Other Glbal User Settings sectin. 23

24 Knwn Issues This sectin cntains a list f knwn issues in the SnicOS release. Applicatin Firewall Symptm Cnditin / Wrkarund Issue An App Firewall rule matching a surce zne/netwrk address bject des nt functin prperly. Occurs when cnfiguring an App Firewall rule t match a surce zne/netwrk address bject Cntent Filtering System Symptm Cnditin / Wrkarund Issue The YuTube fr Schls feature is bypassed with ios r Andrid wireless devices using the YuTube applicatin. Occurs when cnnecting an ios r Andrid device t a wireless netwrk that has YuTube fr Schls filtering enabled. Use the YuTube applicatin and see that all cntent is available fr access Security Services Symptm Cnditin / Wrkarund Issue Signature dwnlads fail fr all three services (Gateway Anti-Virus, Intrusin Preventin, and Anti-Spyware), and the Signature Database status cntinually displays the message dwnlad in prgress. Occurs when dwnlading signatures thrugh a prxy server Thrughput Symptm Cnditin / Wrkarund Issue HTTP thrughput perfrmance may be Occurs when the AppFlw Mnitr is enabled reduced due t Deep Packet Inspectin. Wireless Symptm Cnditin / Wrkarund Issue The same SSID cannt be used n internal radi and VAP SnicPints. Occurs when setting the SSID n the internal radi, and then trying t create a VAP n the SnicPint. A VAP is created when the SSID is set n the internal radi, therefr a VAP cannt be created n the SnicPint with the same SSID because the SSID is used as the bject name

25 Reslved Issues The fllwing issue is reslved in the SnicOS release: Vulnerability Symptm Cnditin / Wrkarund Issue A vulnerability can allw a specifically cnstructed POST request t execute malicius script cde in the cntext f an administrative sessin in the web brwser. Occurs when the administratr is lgged int the firewall and the attacker issues a POST request t a specific page n the firewall frm the administratr s PC. Successful explitatin f the vulnerability can result in sessin hijacking and unexpected behavir This is limited t the 5.8.x versins f SnicOS. This vulnerability was identified and submitted thrugh the Vulnerability Labratry Research Team prgram - Benjamin Kunz Mejri. 25

26 Upgrading SnicOS Image Prcedures The fllwing prcedures are fr upgrading an existing SnicOS image t a newer versin: Obtaining the Latest SnicOS Image Versin Saving a Backup Cpy f Yur Cnfiguratin Preferences Upgrading a SnicOS Image with Current Preferences Imprting Preferences t SnicOS Imprting Preferences frm SnicOS Standard t SnicOS Enhanced Supprt Matrix fr Imprting Preferences Upgrading a SnicOS Image with Factry Defaults Using SafeMde t Upgrade Firmware Obtaining the Latest SnicOS Image Versin T btain a new SnicOS firmware image file fr yur SnicWALL security appliance: 1. Cnnect t yur mysnicwall.cm accunt at 2. Cpy the new SnicOS image file t a directry n yur management statin. Yu can update the SnicOS image n a SnicWALL security appliance remtely if the LAN interface r the WAN interface is cnfigured fr management access. Saving a Backup Cpy f Yur Cnfiguratin Preferences Befre beginning the update prcess, make a system backup f yur SnicWALL security appliance cnfiguratin settings. The backup feature saves a cpy f yur current cnfiguratin settings n yur SnicWALL security appliance, prtecting all yur existing settings in the event that it becmes necessary t return t a previus cnfiguratin state. In additin t using the backup feature t save yur current cnfiguratin settings t the SnicWALL security appliance, yu can exprt the cnfiguratin preferences file t a directry n yur lcal management statin. This file serves as an external backup f the cnfiguratin preferences, and can be imprted back int the SnicWALL security appliance. Perfrm the fllwing steps t save a backup f yur cnfiguratin settings and exprt them t a file n yur lcal management statin: 1. On the System > Settings page, click Create Backup. Yur cnfiguratin preferences are saved. The System Backup entry is displayed in the Firmware Management table. 2. T exprt yur settings t a lcal file, click Exprt Settings. A ppup windw displays the name f the saved file. 3. On the System > Diagnstics page, under Tech Supprt Reprt, select the fllwing checkbxes and then click the Dwnlad Reprt buttn: VPN Keys ARP Cache DHCP Bindings IKE Inf SnicPintN Diagnstics Current users Detail f users The infrmatin is saved t a techsupprt_ file n yur management cmputer. 26

27 Upgrading a SnicOS Image with Current Preferences Perfrm the fllwing steps t uplad new firmware t yur SnicWALL appliance and use yur current cnfiguratin settings upn startup: 1. Dwnlad the SnicOS firmware image file frm mysnicwall.cm and save it t a lcatin n yur lcal cmputer. 2. On the System > Settings page, click Uplad New Firmware. 3. Brwse t the lcatin where yu saved the SnicOS firmware image file, select the file, and click Uplad. 4. On the System > Settings page, click the Bt icn in the rw fr Upladed Firmware. 5. In the cnfirmatin dialg bx, click OK. The SnicWALL restarts and then displays the lgin page. 6. Enter yur user name and passwrd. Yur new SnicOS image versin infrmatin is listed n the System > Settings page. Imprting Preferences t SnicOS Preferences imprting t the SnicWALL netwrk security appliances is generally supprted frm the fllwing SnicWALL appliances running SnicOS: NSA Series NSA E-Class Series TZ 210/200/100/190/180/170 Series PRO Series There are certain exceptins t preferences imprting n these appliances running the SnicOS release. Preferences cannt be imprted in the fllwing cases: Settings files cntaining Prtshield interfaces created prir t SnicOS 5.x Settings files cntaining VLAN interfaces are nt accepted by the TZ 100/200 Series firewalls Settings files frm a PRO 5060 with ptical fiber interfaces where VLAN interfaces have been created Full supprt fr preferences imprting frm these appliances is targeted fr a future release. At that time, yu will need t upgrade yur firmware t the latest SnicOS maintenance release available n MySnicWALL. 27

28 Imprting Preferences frm SnicOS Standard t SnicOS Enhanced The SnicOS Standard t Enhanced Settings Cnverter is designed t cnvert a surce Standard Netwrk Settings file t be cmpatible with a target SnicOS Enhanced appliance. Due t the mre advanced nature f SnicOS Enhanced, its Netwrk Settings file is mre cmplex than the ne SnicOS Standard uses. They are nt cmpatible. The Settings Cnverter creates an entirely new target Enhanced Netwrk Settings file based n the netwrk settings fund in the surce Standard file. This allws fr a rapid upgrade frm a Standard deplyment t an Enhanced ne with n time wasted in re-creating netwrk plicies. Nte: SnicWALL recmmends deplying the cnverted target Netwrk Settings file in a testing envirnment first and always keeping a backup cpy f the riginal surce Netwrk Settings file. The SnicOS Standard t Enhanced Settings Cnverter is available at: If the preferences cnversin fails, yur SnicOS Standard cnfiguratin file t settings_cnverter@snicwall.cm with a shrt descriptin f the prblem. In this case, yu may als cnsider manually cnfiguring yur SnicWALL appliance. T cnvert a Standard Netwrk Settings file t an Enhanced ne: 1. Lg in t the management interface f yur SnicOS Standard appliance, navigate t System > Settings, and save yur netwrk settings t a file n yur management cmputer. 2. On the management cmputer, pint yur brwser t 3. Click the Settings Cnverter buttn. 4. Lg in using yur MySnicWALL credentials and agree t the security statement. The surce Standard Netwrk Setting file must be upladed t MySnicWALL as part f the cnversin prcess. The Setting Cnversin tl uses MySnicWALL authenticatin t secure private netwrk settings. Users shuld be aware that SnicWALL will retain a cpy f their netwrk settings after the cnversin prcess is cmplete. 5. Uplad the surce Standard Netwrk Settings file: Click Brwse. Navigate t and select the surce SnicOS Standard Settings file. Click Uplad. Click the right arrw t prceed. 6. Review the surce SnicOS Standard Settings Summary page. This page displays useful netwrk settings infrmatin cntained in the upladed surce Netwrk Settings file. Fr testing purpses, the LAN IP and subnet mask f the appliance can be changed n this page in rder t deply it in a testing envirnment. (Optinal) Change the LAN IP address and subnet mask f the surce appliance t that f the target appliance. Click the right arrw t prceed. 7. Select the target SnicWALL appliance fr the Enhanced deplyment frm the available list. SnicOS Enhanced is cnfigured differently n varius SnicWALL appliances, mstly t supprt different interface numbers. As such, the cnverted Enhanced Netwrk Settings file must be custmized t the appliance targeted fr deplyment. 8. Cmplete the cnversin by clicking the right arrw t prceed. 9. Optinally click the Warnings link t view any differences in the settings created fr the target appliance. 10. Click the Dwnlad buttn, select Save t Disk, and click OK t save the new target SnicOS Enhanced Netwrk Settings file t yur management cmputer. 11. Lg in t the management interface fr yur SnicWALL appliance. 12. Navigate t System > Settings, and click the Imprt Settings buttn t imprt the cnverted settings t yur appliance. 28

29 Supprt Matrix fr Imprting Preferences 29

30 Upgrading a SnicOS Image with Factry Defaults Perfrm the fllwing steps t uplad new firmware t yur SnicWALL appliance and start it up using the default cnfiguratin: 1. Dwnlad the SnicOS firmware image file frm mysnicwall.cm and save it t a lcatin n yur lcal cmputer. 2. On the System > Settings page, click Create Backup. 3. Click Uplad New Firmware. 4. Brwse t the lcatin where yu saved the SnicOS firmware image file, select the file, and click Uplad. 5. On the System > Settings page, click the Bt icn in the rw fr Upladed Firmware with Factry Default Settings. 6. In the cnfirmatin dialg bx, click OK. The SnicWALL restarts and then displays the Setup Wizard, with a link t the lgin page. 7. Enter the default user name and passwrd (admin / passwrd) t access the SnicWALL management interface. Using SafeMde t Upgrade Firmware The SafeMde prcedure uses a reset buttn in a small pinhle, whse lcatin varies: n the NSA mdels, the buttn is near the USB prts n the frnt; n the TZ mdels, the buttn is next t the pwer crd n the back. If yu are unable t cnnect t the SnicWALL security appliance s management interface, yu can restart the SnicWALL security appliance in SafeMde. The SafeMde feature allws yu t quickly recver frm uncertain cnfiguratin states with a simplified management interface that includes the same settings available n the System > Settings page. T use SafeMde t upgrade firmware n the SnicWALL security appliance, perfrm the fllwing steps: 1. Cnnect yur cmputer t the X0 prt n the SnicWALL appliance and cnfigure yur IP address with an address n the /24 subnet, such as D ne f the fllwing t restart the appliance in SafeMde: Use a narrw, straight bject, like a straightened paper clip r a tthpick, t press and hld the reset buttn n the frnt f the security appliance fr mre than 20 secnds. Use the LCD cntrl buttns n the frnt bezel t set the appliance t Safe Mde. Once selected, the LCD displays a cnfirmatin prmpt. Select Y and press the Right buttn t cnfirm. The SnicWALL security appliance changes t SafeMde. The Test light starts blinking when the SnicWALL security appliance has rebted int SafeMde. Nte: Hlding the reset buttn fr tw secnds will send a diagnstic snapsht t the cnsle. Hlding the reset buttn fr six t eight secnds will rebt the appliance in regular mde. 3. Pint the Web brwser n yur cmputer t The SafeMde management interface displays. 4. If yu have made any cnfiguratin changes t the security appliance, select the Create Backup On Next Bt checkbx t make a backup cpy f yur current settings. Yur settings will be saved when the appliance restarts. 5. Click Uplad New Firmware, and then brwse t the lcatin where yu saved the SnicOS firmware image, select the file, and click Uplad. 6. Select the bt icn in the rw fr ne f the fllwing: Upladed Firmware New! Use this ptin t restart the appliance with yur current cnfiguratin settings. Upladed Firmware with Factry Defaults New! Use this ptin t restart the appliance with default cnfiguratin settings. 7. In the cnfirmatin dialg bx, click OK t prceed. 8. After successfully bting the firmware, the lgin screen is displayed. If yu bted with factry default settings, enter the default user name and passwrd (admin / passwrd) t access the SnicWALL management interface. 30

31 Related Technical Dcumentatin SnicWALL user guides and reference dcumentatin is available at the SnicWALL Technical Dcumentatin Online Library: Fr basic and advanced deplyment examples, refer t SnicOS Guides and SnicOS TechNtes available n the Website. Last updated: 12/3/