Integrating SonicWALL PRO-Series/E-Class UTM Appliances with HP ProCurve Manager Plus/Network Immunity Manager

Size: px

Start display at page:

Download "Integrating SonicWALL PRO-Series/E-Class UTM Appliances with HP ProCurve Manager Plus/Network Immunity Manager"

Blake Preston
6 years ago
Views:

1 SonicOS/ E-Class Integrating SonicWALL PRO-Series/E-Class UTM Appliances with HP ProCurve Manager Plus/Network Immunity Manager Overview This technote covers the proper registration and installation of a SonicWALL PRO-series or E- Class-series UTM appliance into a HP ProCurve switching environment. SonicWALL is a member of HP s ProCurve Alliance more details can be found at the following location: HP s ProCurve Manager Plus (PCM+) and HP Network Immunity Manager (NIM) server software packages can be used to manage the switches as well as some aspects the SonicWALL UTM appliance. While there are multiple methods of deploying the combined solution, we will outline the four most common deployments: 1. Gateway Mode 2. In-Line Layer 2 Bridge Mode 3. One-Port Sniffer Mode 4. PortShield Multizone Mode Gateway Mode is a basic deployment method wherein the SonicWALL UTM appliance is used as the primary gateway between internal network resources and the public internet. Layer 2 Bridge (L2B) mode allows the SonicWALL UTM appliance to be quickly and easily dropped into any Ethernet-based networking environment, without requiring any changes to existing network equipment. In this scenario the SonicWALL UTM appliance is not used for security enforcement, but instead for bidirectional scanning, blocking viruses and spyware, and stopping intrusion attempts. If you need to revert to your previous configuration, the SonicWALL UTM appliance is easily removed. One-Port Sniffer mode allows the SonicWALL UTM appliance to be quickly and easily dropped into any Ethernet-based networking environment and only requires minimal configuration to the switch. In this scenario the SonicWALL UTM appliance is not used for security enforcement, but instead for out-of-band scanning, blocking viruses and spyware, and stopping intrusion attempts. If you need to revert to your previous configuration, the SonicWALL UTM appliance is easily removed. PortShield Multizone mode allows the SonicWALL to interact with the VLAN configuration of a HP ProCurve switch to create fully protected and isolated network segments. Users and network resources can be grouped into specific zones. All traffic between these zones as well as the public internet can be protected from threats, whether those threats are incoming or outgoing. Prerequisites Please note the following information before continuing: SonicWALL PRO-series UTM appliances must have SonicOS Enhanced or newer installed in order be interoperate with PCM+/NIM.

2 SonicWALL E-Class series UTM appliances must have SonicOS Enhanced or newer installed in order be interoperate with PCM+/NIM. You must have a current service contract for the Gateway Anti-Virus, Gateway Anti- Spyware, and Gateway Intrusion Protection features on the SonicWALL UTM appliance in order to use the stream-based scanning and protection features. Failure to keep the services renewed may seriously impact the security level and protection capabilities of your network architecture. Interop between HP PCM+/NIM and SonicWALL TZ-series appliances is not supported. Interop between HP PCM+/NIM and SonicWALL SonicOS Standard is not supported. HP ProCurve Manager Plus must be updated to version 2.3 or newer, with all current patches. HP Network Immunity manager must be updated to version or newer, with all current patches. This technote does *NOT* cover installation, setup, and configuration of PCM+ or NIM. You can find a comprehensive PCM+/NIM guide at the following location: ImmunityImplementation.pdf. Your networking environment must be modified to allow the SonicWALL appliance to contact the SonicWALL backend servers via its X1 (the WAN, or public) interface using DNS and HTTPS for registration and signature updates. The default X0 (the LAN, or private) interface IP address for a the SonicWALL appliance is /24. The default administrator username is admin with a password of password. For the first several steps you will need a laptop or desktop set to /24 and cross-connected to the X0 interface of the SonicWALL appliance. Customers with current service/software support contracts can obtain updated versions of SonicWALL firmware from the MySonicWALL customer portal at Updated firmware is also freely available to customers who have registered the SonicWALL device on MySonicWALL for the first 90 days. This technote does not cover configuration of the SonicWALL UTM appliance only the administrative steps required to allow it to interoperate with PCM+/NIM. Please refer to the SonicOS Enhanced 4.x or 5.x Administrator s guide. Due to the potential for complexity when operating these products together, it is strongly advised that you obtain HP ProCurve training on PCM+ and NIM, as well as SonicWALL training for SonicOS Enhanced. HP s training classes can be found at the following location: SonicWALL UTM appliances that interoperate with PCM+/NIM PRO 2040 PRO 3060 PRO 4060 PRO 4100 NSA 3500, 4500, and 5000 NSA E5500, E6500, and E7500 2

3 Procedure Examples Common Setup for all Deployment Methods The following items will need to be configured on your SonicWALL UTM appliance before interoperating with PCM+/NIM, regardless of deployment method. Please note that for most of these examples, the PCM+/NIM server has been placed on a separate interface of the SonicWALL UTM appliance in order to provide an additional layer of security. However you may place this server anywhere on your network, provided it has connectivity to/from the HP ProCurve switch and the SonicWALL UTM appliance. As noted previously the design and placement of the components is entirely dependent upon your network s needs, and these examples are here only to show potential deployment methods -- they by no means should be considered required. Please note that the following examples were created on a SonicWALL NSA E6500, which has a different look and feel than previous versions of SonicWALL s management GUI. If you are using a PRO-series UTM appliance your screens may look slightly different, button placement may be changed, but the general layout remains the same between the two versions. 1. Services Licensing In the SonicwALL s management GUI, go to System > Status page and make sure all the UTM services (Gateway Anti-Virus, Anti-Spyware, and Intrusion Prevention) are properly licensed for the device. See the example below. 3

4 2. SNMP Go to the System > Administration page and make sure the checkbox next to Enable SNMP is checked, and then click on the Accept button in the top-left-hand side of the screen. See the example below. Then, click on the Configure button. On the page that appears, enter in all the relevant info for your UTM appliance, the GET and TRAP SNMP community names the PCM+/NIM server expects, and then the IP address of the PCM+/NIM server. When done, click on the OK button to save and activate the changes. 4

UTM services Go to the Network > Zones page, and for each zone you will be using, make sure the UTM services are acativated.

5 3. Syslog Go to the Log > Syslog page, click on the Add button and create an entry for the PCM+/NIM server. When done click on the OK button to save and activate the change. See the example below. 4. UTM services Go to the Network > Zones page, and for each zone you will be using, make sure the UTM services are acativated. See the example below. Then, Go to the Security Services section, and for each UTM service activate and configure the settings that will be most appropriate for your environment. See the examples below. 5

6 6

7 5. Interface Go to the Network > Interfaces page and make sure that SNMP and HTTP/S are enabled on the interface that the PCM+/NIM server is on. See the example below. 7

8 6. Firewall rules Go to the Firewall > Access Rules page and click on the icon for the intersection of the zone that the PCM+/NIM server is on and the zone that has users and servers (note: your environment may have more than one of these intersections). Create a new rule to allow the 8

See the example below. Then, go to the Log > Name Resolution page and set the Name Resolution Method to DNS then NetBios. When done click on the Accept button to save and activate the change.

9 PCM+/NIM server to communicate with all devices in that zone. See the example below. 7. Logging Go to the Log > Categories page and set the Logging Level to Informational and the Alert Level to Critical. When done click on the Accept button to save and activate the change. See the example below. Then, go to the Log > Name Resolution page and set the Name Resolution Method to DNS then NetBios. When done click on the Accept button to save and activate the change. See the example below. 8. Wireless Interfaces/Zone If your PCM+/NIM system will be managing a HP ProCurve switch on an interface assigned to a WLAN/Wireless zone, you will need to deactivate two features, otherwise you will not be able to manage the switch. Go to the Network > Zones page and select your Wireless zone. On the page 9

10 that appears, uncheck the box next to Only allow traffic generated by a SonicPoint and WiFiSec Enforcement. When done click on the OK button to save and activate the change. See the example below. Deployment One This method requires no additional steps. 10

11 11

12 Deployment Two This method is useful in networks where there is an existing firewall that will remain in place, but you wish to utilize the SonicWALL s UTM services without making major changes to the network. By placing the SonicWALL in Layer 2 Bridge mode, the X0 and X1 interfaces become part of the same broadcast domain/network (i.e. that of the X1 WAN interface). Go to the Network > Interfaces page and click on the configure icon for the X0 LAN interface. On the page that appears, set the IP Assignment to Layer 2 Bridged Mode and set the Bridged To interface to X1. Also make sure that the interface is configured for HTTP and SNMP so it can be managed by PCM+/NIM. When done click on the OK button to save and activate the change. For an example see below. You will also need to make sure to modify the firewall rules to allow traffic from the LAN to WAN, and from the WAN to the LAN, otherwise traffic will not pass successfully. You may also need to modify routing information on your firewall if your PCM+/NIM server is placed on the DMZ. 12

13 13

14 Deployment Three This method is useful in networks where there is an existing firewall that will remain in place, but you wish to use the SonicWALL s UTM services as a sensor. This method relies on PCM+/NIM s ability to throttle and/or close ports that have threats emanating from them. Before you begin: This mode may be a little perplexing, as it is dramatically different than any SonicWALL deployment. The WAN interface and zone will actually be configured for the internal network s addressing scheme and attached to the internal network. The X2 port will be Layer 2 bridged to the LAN port but it won t be attached to anything. Finally, the LAN port will be configured to a second, specially programmed port on the HP ProCurve switch. This special port will be set for mirror mode it will forward all the internal user and server ports to the sniff port on the SonicWALL. This allows the SonicWALL to analyze the entire internal network s traffic, and if any traffic triggers the UTM signatures it will immediately trap out to the PCM+/NIM server, which then can take action on the specific port the threat is emanating from. Go to the Network > Interfaces page and click on the configure icon for the X2 interface. On the page that appears, set the IP Assignment to Layer 2 Bridged Mode and set the Bridged To interface to X0. Check the box next to Only sniff traffic on the bridge-pair. When done click on the OK button to save and activate the change. For an example see below. You will also need to make sure to modify the firewall rules to allow traffic from the LAN to WAN, and from the WAN to the LAN, otherwise traffic will not pass successfully. Please refer to the HP ProCurve Administrator s guide for details on how to set up a span/mirror port. 14

15 15

16 Deployment Four This method utilizes SonicWALL s PortShield capability and HP s VLAN capability to create a fully segmented network. This is particularly useful in high-risk environments where resources must be separated from one another. Full implementation details of PortShield and VLAN s, as well as step-by-step configuration examples can be found at the following location: 16

17 Contacting SonicWALL If you require technical assistance for your SonicWALL, check these online SonicWALL resources: The support site: The interactive online Knowledge Portal: If you cannot find the information you need, contact SonicWALL telephone support at one of these numbers: North America Telephone Support U.S./Canada or International Telephone Support Australia Austria + 43(0) EMEA + 31(0) France + 33(0) Germany + 49(0) Hong Kong India Italy Japan + 81(0) New Zealand Singapore Spain + 34(0) Switzerland UK + 44(0) Note: If you find that the number appropriate to your geographic region does not work, please visit for the latest technical support telephone numbers. 17

18 More Information on SonicWALL Products Contact SonicWALL, Inc. for information about SonicWALL products and services at: Web: Phone: (408) Fax: (408) Last updated: 4/15/2008 Author: Prepared by SonicWALL, Inc Version

SonicWALL Security Appliances. SonicWALL SSL-VPN 200 Getting Started Guide

SonicWALL Security Appliances. SonicWALL SSL-VPN 200 Getting Started Guide SonicWALL Security Appliances SonicWALL SSL-VPN 200 Getting Started Guide SonicWALL SSL-VPN 200 Appliance Getting Started Guide This Getting Started Guide contains installation procedures and configuration