Dell SonicWALL Secure Mobile Access 8.5. Geo IP & Botnet Filters Feature Guide

Transcription

1 Dell SonicWALL Secure Mobile Access 8.5

2 2016 Dell Inc. ALL RIGHTS RESERVED. This product is protected by U.S. and international copyright and intellectual property laws. Dell, the Dell logo, and SonicWALL are trademarks of Dell Inc. in the United States and/or other jurisdictions. All other marks and names mentioned herein may be trademarks of their respective companies. For more information, go to Legend CAUTION: A CAUTION icon indicates potential damage to hardware or loss of data if instructions are not followed. WARNING: A WARNING icon indicates a potential for property damage, personal injury, or death. IMPORTANT NOTE, NOTE, TIP, MOBILE, or VIDEO: An information icon indicates supporting information. Dell SonicWALL Secure Mobile Access Updated - June 2016 Version Rev A

3 Contents Document Scope Overview What is Geo IP? What are Botnet Filters? Licensing Configuring Geo IP & Botnet Filters Enable Geo IP & Botnet Filters Remediation Settings Configure Access Policies Viewing Geo IP & Botnet Filter Activity General Status Botnet Status Using the Log Searching the Log Controlling the Log Pagination Exporting and ing Log Files Clearing the Log Troubleshooting Using Log Messages Using the Diagnostic Tool Location Columns About Dell Contacting Dell Technical support resources

4 1 Document Scope This document describes how to configure and use Geo IP locations and Botnet filters, introduced in Dell SonicWALL Secure Mobile Access 8.5. This document contains the following sections: Overview on page 5 Licensing on page 6 Configuring Geo IP & Botnet Filters on page 7 Viewing Geo IP & Botnet Filter Activity on page 13 Using the Log on page 15 Troubleshooting on page 18 Location Columns on page 20 4

5 2 Overview This section, which provides an introduction to using Geo IP and Botnet filters with the Dell SonicWALL Secure Mobile Access/SRA appliances, contains the following subsections: What is Geo IP? on page 5 What are Botnet Filters? on page 5 What is Geo IP? The Geo IP feature enables administrators to monitor and enforce policies effectively, based on the geographical locations of remote users. In addition, users Geo IP locations are displayed on several AMC pages. Geo IP is disabled by default in SMA/SRA appliances. What are Botnet Filters? A Botnet, which is a task-oriented robot network of internet-connected programs, poses huge security risks such as DoS and Data Leakage. Botnets are hard to identify and control due to the transient nature of their origins. Botnet Filters enforce a strong and anti-evasive defense against rogue activity from Botnets using a dynamically updated database maintained by Dell SonicWALL to: Block connections to/from known botnet control servers. Your SonicWALL appliance watches for and stops attempts to connect with a botnet server. Furthermore, built-in reporting tells you exactly which PC on the network has the bot installed so it can be removed. Block connections to/from countries - With this feature you can prevent connections to and from servers outside of your local country. This helps control which servers your network users can connect to and helps block botnet servers that have not yet been discovered. Botnet Filter lookup is done asynchronously. Therefore, it allows the first few packets from an IP address to go through while it is looking up the Botnet policy for the IP address. After the policy is cached, the policy is enforced for subsequent packets from that IP address. Botnet filters are disabled by default in SMA/SRA appliances. 5

6 3 Licensing Geo IP & Botnet Filter is a subscription service, which includes a free trial that expires one year after the Dell SonicWALL Secure Mobile Access/SRA 8.5 release date. The licensing status of the Geo IP & Botnet Filter subscription service is shown on the Geo IP & Botnet Filter > Licensing page. The Licensing page also includes a brief description of the feature and a link to the System > Licenses page where you can activate, upgrade, and renew licenses. Dell SonicWALL Secure Mobile Access 8.5 6

7 Configuring Geo IP & Botnet Filters 4 To configure Geo IP and Botnet Filters for a Dell SonicWALL Secure Mobile Access/SRA appliance, review the following sections: Enable Geo IP & Botnet Filters on page 8 Configure Access Policies on page 11 NOTE: If a firewall is installed before the SMA/SRA appliance, the firewall should allow: 1 HTTP request/response to and from address set to geoipdata.global.sonicwall.com 2 Suffix of DNS packets (at least DNS queries) is smagbdata.global.sonicwall.com Verify their locations by checking the Tool Tip for Protection Status. 7

8 Enable Geo IP & Botnet Filters Use the General Settings section of the Geo IP & Botnet Filter > Settings page to globally enable or disable the Geo IP & Botnet Filter, which is disabled by default. This section is also used to enable or disable Geo IP & Botnet Filter logging, which is described in Using the Log on page 15. NOTE: An IP address can be manually identified as a Botnet IP address by using the Botnet Test diagnostic tool accessed from the System > Diagnostics page, as explained in Using the Diagnostic Tool on page 18. To enable the Geo IP & Botnet Filter: 1 From the Geo IP & Botnet Filter > Settings page, check Enable Geo IP & Botnet Filter to enable this feature. When enabled, a Location column is added to the Users > Status, NetExtender > Status, and Geo IP & Botnet Filter Status Botnet Status pages that identifies the location of users source IP addresses. Mousing over an icon in the Location column displays the Region and Country of the source IP. 2 Click Accept. When these features are enabled, the General Settings section displays four sub-features that can be individually enabled or disabled: Enforce Geo IP Policy Select this option to enforce Geo IP polices. 8

9 Enforce Botnet Filter Policy Select this option to enforce Botnet Filter policies. If this is disabled, Botnet IPs is not blocked, however, they are still detected and included in the Botnet Filter Statistics. Find Geo IP Location for Logs When this option is enabled, a column indication the location of the source IP is added to the following screens: End Point Control > Log, Web Application Firewall > Log, Geo IP & Botnet Filter > Log, and Log > Views. Enable Packet Log (Debug mode) Select this option to generate logs for allowed or denied packets. This option is for debug purposes only. Enabling the Packet Log makes logs increase rapidly if the log level is set to Debug. Remediation Settings Access to an SMA/SRA appliance from aggressive IP addresses are denied directly when Geo IP & Botnet Filter is enabled. Remediation provides valid users an opportunity to process the access from the aggressive IP addresses. For web access, user are redirected to the CAPTCHA page, as shown in the following figure. A countdown timer tells the time that remained for the user to complete remediation. The user must finish remediation within limited time, otherwise user IP address is added to the block list and all access from the aggressive IP address is blocked for a period of time. If remediation is successful within the Verification Time, the user is directed to corresponding page that was requested. A CAPTCHA session is then created to record the remediation status. During the Valid Duration, all access from the IP address is allowed. After the Valid Duration, the CAPTCHA session goes to expired status. If the user is still in login status, access is not interrupted, but after the user login session is expired the CAPTCHA session is deleted and remediation is required again. 9

10 To enable Remediation and configure the settings: 1 Click Remediation Settings. 2 Click Enable Remediation. Remediation can be enforced separately for the IPs defined by Geo IP Policy, Botnet Filter Policy, and Botnet Database. NOTE: Denied users might not be able to access the appliance without CAPTCHA-based remediation. Enforce remediation for IPs defined by: Geo IP Policy Botnet Filter Policy IPs in the backend Botnet Database 3 In the Max allowed time for CAPTCHA entries (s) field, select the maximum amount of time (in seconds) that the user has to complete Remediation. The minimum/maximum range is seconds, with default value for this field being 60 seconds. 4 In the Allowed/Blocked duration after CAPTCHA validation (m) field, select the duration of time (in minutes) that the user is allowed/blocked after completing the CAPTCHA validation. The minimum value is 5 minutes and the maximum is 30, with the default value being 15 minutes. 10

11 Configure Access Policies Use the Geo IP & Botnet Filter > Policies page to view, add, edit, and delete Geo IP and Botnet Filter access policies. Up to 64 Geo IP and Botnet Filter access policies can be created. Consider the following when configuring access policies: Each policy is automatically assigned a different priority with 1 being the highest priority. A policy s priority determines the order of enforcement, which is identified by the order they are listed on the Settings page. Botnet Filter policies have a higher priority than Geo IP policies. Geo IP policies are prioritized by the time they were created with those created first having the higher priority. Botnet Filter policies defined for a single IP address have a higher priority than Botnet Filter policies defined for a subnet, and each type is then prioritized based on the time they were created with those created first having the higher priority. Custom created polices are enforced first, which means if an IP address is listed in the SonicWALL Botnet Filter database, but admin defines an allow policy for this IP, then access from this IP will be allowed. A policy can be modified by clicking the button, but a policy name cannot be modified. A policy can be deleted by clicking the button. To add a Geo IP policy: 1 Go to the Geo IP & Botnet Filter > Policies page. 2 Click Add Policy, which displays the Add Policy page. 3 Select the GeoIP tab. 4 In the Policy Name field, type the name you want to use to identify the policy. 5 Select the Country pull-down to allow or deny traffic from specified country groupings or select the box next to a specific country. The country changes to a color on the map image. 6 Select the Action pull-down to Allow or Deny deny traffic. 11

12 7 Click Accept to create the policy. 8 Select the Botnet Policy tab to allow or deny access from a specified IPv4 IP address or IP address range. 9 If you selected Botnet Policy as the Policy Type, in the Apply Policy To section either: a b c d 10 Click Accept. Use the Apply Policy To drop-down list to select whether the policy will be enforced on a single IP Address or an IP Network. If you chose to enforce the policy on a single IP address, type the IP address in the IP Address field. If you chose to enforce the policy on a range of IP addresses, type the beginning IP address in the IP Network Address field and the subnet mask in the Subnet Mask field. In the Action drop-down list, select Allow to allow traffic from all IP addresses identified in the policy access to the network or select Deny to prohibit traffic from all IP addresses identified in the policy. 12

13 Viewing Geo IP & Botnet Filter Activity 5 Use the Geo IP & Botnet Filter > Status page to check information detailing Geo IP and Botnet activities. The Status page contains two tabs of information: General Status Botnet Status General Status The General Status tab displays general filter status and is used to synchronize the Geo IP and Botnet caches manually: When the Geo IP & Botnet Filter is enabled, the General Status tab provides the following information: Database Protection Status shows whether the backend server is connected. Offline status may indicate the network settings may need to be changed. Cache Size shows the total size of the Geo IP and Botnet cache. Last checked displays the most recent timestamp of the cache. 13

14 Service Expiration Date shows the license expiration date of the Geo IP & Botnet Filter service. License Status identifies whether the Geo IP & Botnet Filter service is licensed. The Geo IP & Botnet Filter is a subscription service, which includes a free trial that expires one year after the Dell SonicWALL Secure Mobile Access 8.5 release date. When the Geo IP & Botnet Filter is licensed but disabled, the Status page displays a warning that contains a link to the Settings page where the feature can be enabled: Botnet Status The Botnet Status tab shows traffic statistics for Botnet IP addresses for the current reporting period. Statistics are shown for the top 10 IP addresses detected by the Botnet Filter during the selected period. Note that if the location of an IP address changes, each location is shown as a different IP address and statistics are divided. Use the Monitoring Period drop-down list to select the reporting period: Last 12 Hours, Last 14 Days, Last 21 Days, Last 6 Months, and All recorded traffic data. 14

15 6 Using the Log The Geo IP & Botnet Filter > Log page lists information detected by the Geo IP & Botnet Filter: Location information that identifies the geographical location of the source IP for each event log message generated by Geo IP. Location information is also displayed on applicable SMA log and status pages. If Geo IP Logging is disabled, this column contains a Not Logged icon. If a location or country flag is not available, this column contains an Unknown icon. Mousing over an icon in the Location field displays the Region and Country of the source IP. Traffic detected by the Botnet Filter. Traffic from each IP is logged only once for each second, no matter if it s denied or allowed. Several functions can be perform on this page, including a flexible search mechanism and the ability to export the log to a file or it. Following are instruction for using these functions. Clicking on a log entry displays more information about the event, if available. Click any of the headings to sort the log messages alphabetically by heading. For more information on using the log, see the following: Searching the Log on page 16 Controlling the Log Pagination on page 16 Exporting and ing Log Files on page 16 Clearing the Log on page 17 15

16 Searching the Log Search for a value contained in a specific column of the log table or search for log entries that do not contain the specified value. To view and search the log: 1 On the Geo IP & Botnet Filter > Log page, type the value to search for into the Search field. The search values are case sensitive. 2 Select the column in which to search from the drop-down list to the right of the Search field. 3 Do one of the following: To start searching for log entries containing the search value, click Search. To start searching for log entries that do not contain the search value, click Exclude. To clear the Search field and display the first page of log entries, click Reset. Controlling the Log Pagination To adjust the number of entries on the log page and display a different range of entries: 1 On the Geo IP & Botnet Filter > Log page, enter the number of log entries that you want on each page into the Items per Page field. The Log page changes to show the new number of entries. 2 To view the log entries beginning at a certain number, type the starting number into the Item field and press Enter on your keyboard. 3 To view the first page of log entries, click the left-most button in the arrow control pad. 4 To view the previous page of log entries, click the left arrow in the arrow control pad. 5 To view the next page of log entries, click the right arrow in the arrow control pad. 6 To view the last page of log entries, click the right-most button in the arrow control pad. Exporting and ing Log Files You can export the current contents of the log to a file, or the log contents by using the buttons in the top right corner of the Geo IP & Botnet Filter > Log page. Exported files are saved with a.wri file name extension, and open with WordPad, by default. ed files are automatically sent to the address configured on the Log > Settings page of the SMA management interface. If no address is configured, the Status line at the bottom of the browser will display an error message when you click the Log button. 16

17 To export or the log: 1 To export the log contents, click Export Log in the top right corner of the Geo IP & Botnet Filter > Log page. The File Download dialog box is displayed. 2 In the File Download dialog box, do one of the following: To open the file, click Open. To save the file, click Save, then browse to the folder where you want to save the file and click Save. 3 To the log contents, click the Log button in the top right corner of the Geo IP & Botnet Filter > Log page. The log contents are ed to the address specified in the Log > Settings page. Clearing the Log You can remove all entries from the log on the Geo IP & Botnet Filter > Log page. The entries on the page are removed, and any attempt to export or the log file while it is still empty will cause a confirmation dialog box to display. To clear the log: 1 On the top right corner of the Geo IP & Botnet Filter > Log page, click Clear. 2 Click OK in the confirmation dialog box. 17

18 7 Troubleshooting Use the following Troubleshooting information to pinpoint questionable IP addresses and troubleshoot Botnet Filter problems. Using Log Messages The following log messages are useful to troubleshoot Botnet Filter problems: All packets from <IP address> will be allowed All packets from <IP address> will be denied These log messages indicate that a Geo IP & Botnet Filter policy has added the source IP address to the Allow/Deny list. During the cache lifetime, all packets from the identified source IP are allowed or denied, as indicated. If a user failed to connect to the appliance, check the log to find out if the user is denied by the Geo IP & Botnet Filter. Failed to reload Regions Database, no Regions information available Failed to reload Regions Database These log messages indicate that the system could not load any region data from the backend server. When the message includes no Regions information available, no region data was found in the local database. When the message does not include this text, a previous version of region data was found and used. Check the network settings to see if the backend server is accessible. Using the Diagnostic Tool To manually identify whether an IP address is a Botnet IP address, use the Botnet Test diagnostic tool. This tool is often used when you suspect an IP address is a Botnet and want to confirm it before creating an access policy that denies access. 18

19 1 Open the System > Diagnostics page. 2 In the Diagnostic Tool drop-down list, select Botnet Test. 3 In the IP Address field, type the IP address you want to check. 4 Click Enter. The diagnostic result is displayed. 19

20 8 Location Columns A Location column identifying where a user is located has been added to the tables of the following pages: Users > Status NetExtender > Status Geo IP & Botnet Filter Status Botnet Status For example: Tables can be sorted by the Location column. In addition, the Location column can be searched or excluded from searches. 20

21 About Dell Dell listens to customers and delivers worldwide innovative technology, business solutions and services they trust and value. For more information, visit Contacting Dell Technical support: Online support Product questions and sales: (800) Technical support resources Technical support is available to customers who have purchased Dell software with a valid maintenance contract and to customers who have trial versions. To access the Support Portal, go to The Support Portal provides self-help tools you can use to solve problems quickly and independently, 24 hours a day, 365 days a year. In addition, the portal provides direct access to product support engineers through an online Service Request system. The site enables you to: Create, update, and manage Service Requests (cases) View Knowledge Base articles Obtain product notifications Download software. For trial software, go to Trial Downloads. View how-to videos Engage in community discussions Chat with a support engineer 21