Sonicwall Configuration Guide v1.0 Sonicwall NSA240 / TZ210 Configuration Guide (Firmware: SonicOS Enhanced 5.8.1.1-35o & up) 169 Saxony Road, Suite 212 Encinitas, CA 92024 Phone & Fax: (800) 477-1477 1
Introduction Thank you for choosing FreedomIQ by FreedomVoice for your industry-leading cloud based phone system. We are glad to have you on board as part of our team and this document should help answer most questions you may have on setting up the Sonicwall router to best optimize voice quality with FreedomIQ. There are multiple sections in this document from Internet access and various basic settings to the QoS configuration monitoring. This guide will walk you through the following configurations: 1. Change the default password 2. Configuration of the Public Interface (Internet access) 3. Enable Remote Access 4. Set Measured WAN Speed 5. Configure Basic QoS 6. Configure Advanced QoS 7. Enable Netflow Monitoring Sonicwall NSA240/TZ210 Product Information: Sonicwall NSA240 The Sonicwall NSA240 series is a Fixed-port Access Router that is ideal for medium to large business Internet access and/or IP Telephony using broadband access such as DSL, cable or T1 Ethernet handoff. The NSA240 includes six 10/100 ports and three 10/100/1000 ports, a built-in firewall for network security, QoS & BWM to prioritize delay sensitive traffic like VoIP, and a host of other features such as DHCP, Network Address Translation (NAT), and IPSec VPN. Features: Fixed-port Access Router for broadband access such as DSL, cable or T1 Ethernet handoff Six 10/100 ports and three 10/100/1000 ports High performance dual-core processor Powerful threat management firewall Quality of Service (QoS) & bandwidth management (BWM) for delay-sensitive traffic like Voice over IP (VoIP) IPSec & SSL VPN 600 Mbps Stateful Throughput Product Information: Sonicwall TZ210 The Sonicwall TZ210 series is a Fixed-port Access Router that is ideal for small to medium sized business Internet access and/or IP Telephony broadband access. The TZ210 includes one ADSL WAN port, integrated four port switch, built in firewall, QoS, DHCP, NAT, and an IPSec VPN. Features: Fixed-port Access Router for broadband access such as DSL, cable or T1 Ethernet handoff Five 10/100 ports and Two 10/100/1000 ports Powerful threat management firewall Quality of Service (QoS) & bandwidth management (BWM) for delay-sensitive traffic like Voice over IP (VoIP) IPSec VPN 200 Mbps Stateful Throughput 2
Change Default Username/Password It is important that you change the default username and password to something secure. This new login information ensures that no one within the LAN can make unauthorized changes, but can also be used as the default remote login information for remote access to the router in the event changes need to be made remotely by a dealer or a FreedomIQ representative. Default login information: Gateway: 192.168.168.168 Username: admin Password: password Follow these steps to update the admin login information: 1. From the System section in the left column, select Administration. 2. Find the section labeled Administrator Name & Password. 3. Enter the original or old password. Enter the new password twice. 4. Click the Accept button toward the bottom of the page. - Changing username/password is now complete. Set Up Internet Access Follow these steps closely to set up the Sonicwall NSA240/TZ210 via the built in GUI. Your ISP should have provided you with general instructions related to your internet connection. If you are unsure what these settings are, contact your ISP with regard to the settings you will need for your router. In most cases your service provider will either have you to set your router to DHCP mode or they will provide you with IP address, Gateway, Subnet and DNS server settings. You will need this information to continue the set up. Follow these steps to configure internet access: 1. From the Network section in the left column, select Interfaces. 2. Under Interface Settings find the Zone column labeled WAN and click on the pencil icon under the Configure column. 3. Make sure the Zone: drop down says WAN. 4. Your ISP will have given you instructions to choose either DHCP or Static for an IP address type within your router. Choose this from the IP Assignment: drop down. 5. Enter your IP Address, Subnet Mask, Default Gateway, DNS Server 1 and DNS Server 2 information. 6. Click the OK button at the bottom of the window. 7. Click the Accept button at the top of the page. See screenshots below 3
Configuration Screen 1 of 2 Configuration Screen 2 of 2 - Internet configuration is now complete. 4
Enable Remote Access The Sonicwall NSA240/TZ210 allows you to configure remote access to the GUI or command line interface. Follow these steps to configure remote access: 1. From the Network section in the left column, select Interfaces. 2. Under Interface Settings find the Zone column labeled WAN and click on the pencil icon under the Configure column. 3. Make sure the Zone: drop down says WAN. 4. In the Management section check the boxes appropriate to the type of remote access you want to allow (HTTP or HTTPS is most common). 5. Click the OK button at the bottom of the window. 6. Click the Accept button at the top of the page. - Remote access is now complete. Set the measured WAN speed The Sonicwall NSA240/TZ210 works best when you specify the amount of internet bandwidth that is allocated to you from your ISP. This step is always important but it is absolutely critical to proper QoS functionality. Don t always take your ISP s word for the up and down speeds, the values entered here should be an average of three speed tests. A recommended place to run these tests is at www.speedtest.net. Follow these steps to set the WAN bandwidth: 1. From the Network section in the left column, select Interfaces. 2. Under Interface Settings find the Zone column labeled WAN and click on the pencil icon under the Configure column. 3. Make sure the Zone: drop down says WAN. 4. Click on the Advanced tab. 5. Check the box Enable flow reporting. 6. Under the heading Bandwidth Management, check Enable Egress Bandwidth Management. 7. In the field Available Interface Egress Bandwidth (Kbps): enter your measured internet speed. If you have a single T-1 this might be 1500.00. If you have a cable modem that measures 10Mbps down, you would enter 10000.00. 8. Under the heading Bandwidth Management, check Enable Ingress Bandwidth Mangement. 9. In the field Available Interface Ingress Bandwidth (Kbps): enter your measured internet speed. If you have a single T-1 this might be 1500.00. If you have a cable modem that measures 2Mbps up, you would enter 2000.00. 10. Click the OK button at the bottom of the window. - WAN speed setup is now complete. 5
Configure basic QoS (Quality of Service) The Sonicwall NSA240/TZ210 comes preconfigured for basic QoS (UDP packet priority & bandwidth management) when ordered directly from FreedomVoice. You may need to modify the bandwidth allocations depending on the bandwidth available to the customer in each direction. Also, depending on the type of traffic on the network, you may want to modify the QoS so it is based on a specific VLAN or specific device(s) instead of giving priority to all UDP traffic. We cover these alternate QoS configurations under Advanced QoS later on in this document. Configure basic QoS within the GUI, Step 1: Select a type of Bandwidth Management Start by setting BWM to WAN: 1. Login to the Sonicwall router GUI (default is 192.168.168.168). 2. Click on the Firewall Settings section in the left column, select BWM. 3. Next to Bandwidth Management Type: make sure WAN is selected. 4. Next to 0 Realtime check the Enable box. 5. Next to 2 High uncheck the Enable box. 6. Next to 4 Medium set Guaranteed to 0 %. 7. Next to 6 Low set Guaranteed to 0 %. 8. Click the Accept button. Configure basic QoS within the GUI, Step 2: Create Service Objects Now, create a UDP 5060 signal service object: 9. Login to the Sonicwall router GUI (default is 192.168.168.168). 10. Click on the Firewall section in the left column, select Service Objects. 11. Under Services click Add. 12. Enter a descriptive name such as SignalUDP. 13. Select the protocol UDP. 14. Enter the port range of 5060 5060. 15. Click Add. Next, create a TCP 5061 signal service object: 1. Click on the Firewall section in the left column, select Service Objects. 2. Under Services click Add. 3. Enter a descriptive name such as SignalTCP. 4. Select the protocol TCP. 5. Enter the port range of 5061 5061. 6. Click Add. Next, create a UDP audio service object: 1. Click on the Firewall section in the left column, select Service Objects. 2. Under Services click Add. 3. Enter a descriptive name such as AudioUDP. 4. Select the protocol UDP. 5. Enter the port range of 6000 55000. 6. Click Add. Next, create a group that contains all three service objects: 1. Click on the Firewall section in the left column, select Service Objects. 2. Under Service Groups click Add Group. 3. Enter a descriptive name such as FreedomIQ. 4. Find the three service objects you created earlier. 6
5. Highlight each of them and click the arrow to add them to the group. 6. Click OK. Configure basic QoS within the GUI, Step 3: Apply Service Objects to the firewall Lastly, create a new firewall rule: 1. Click on the Firewall section in the left hand column, select Access Rules. 2. Under Access Rules (ALL>ALL) click Add. 3. Next to From Zone: select LAN. 4. Next to To Zone: select WAN. 5. Next to Service: select the group ( FreedomIQ ) that was set up in the last step. 6. Next to Source: select Any. 7. Next to Destination: select Any. 8. Check Enable flow reporting. 9. Check Enable packet monitor. 10. Click on the Ethernet BWM tab. For the next steps you ll need to determine how much bandwidth you want to guarantee for this particular service group (the phones). This can be done by percentage of total bandwidth or by a set Kbps (Kilobits Per Second). When using the G.711 codec, each phone needs 88Kbps in both directions (Outbound, Inbound) to properly function. Many administrators like to allocate 90-100Kbps per phone to keep a slight cushion of bandwidth. Example: 1.44Mbps T-1 with 4 phones (using 90Kbps per phone) would require either 25% of available bandwidth or 360Kbps. 11. Check Enable Outbound Bandwidth Management. 12. In the field Guaranteed Bandwidth: enter your number and select the proper corresponding allocation type (% or Kbps). 13. In the field Maximum Bandwidth: enter 100 and select % from the drop down. 14. Check Enable Inbound Bandwidth Management. 15. In the field Guaranteed Bandwidth: enter the same number and corresponding allocation type (% or Kbps) you choose in the above (Outbound) section. 16. In the field Maximum Bandwidth: enter 100 and select % from the drop down. 17. Make sure the Bandwidth Priority: drop down is set to 0 Realtime for both Outbound and Inbound. 18. Check Enable Tracking Bandwidth Usage. 19. Click Add. - Basic QoS is now complete. 7
Configure Advanced QoS (Prioritize by Network, IP or Device) The Sonicwall NSA240/TZ210 comes preconfigured for basic QoS (UDP packet priority & bandwidth management) when ordered directly from FreedomVoice. If your network is running applications that run over UDP such as torrents, gaming or video conferencing, you shouldn t use generic UDP prioritization. In these cases prioritizing an entire Subnet, MAC addresses, or statically assigned IP addresses will be best practice. We only need to create one rule for QoS by network, IP or MAC since we re going to be prioritizing ALL traffic from those addresses rather than specific types of traffic. This is safe as long as the addresses are only those of phones and no other types of devices. Configure Advanced QoS within the GUI, Step 1: Select a type of Bandwidth Management Start by setting BWM to WAN: 1. Login to the Sonicwall router GUI (default is 192.168.168.168). 2. Click on the Firewall Settings section in the left column, select BWM. 3. Next to Bandwidth Management Type: make sure WAN is selected. 4. Next to 0 Realtime check the Enable box. 5. Next to 2 High uncheck the Enable box. 6. Next to 4 Medium set Guaranteed to 0 %. 7. Next to 6 Low set Guaranteed to 0 %. 8. Click the Accept button. Configure Advanced QoS within the GUI, Step 2: Create an Address Object Now, create an address object for the network, IP s or devices you wish to give priority. 1. Login to the Sonicwall router GUI (default is 192.168.168.168). 2. Click on the Firewall section in the left column, select Address Objects. 3. Under Address Objects click Add. 4. Enter a descriptive name such as Phone Network or Ext 800 depending on the type of address you re choosing. 5. Zone Assignment: should be Range (LAN IP s), Network (Voice Subnet), or MAC (a specific phone). 6. Enter the applicable information (IP range, Network or MAC) into the next field. 7. Click Add. NOTE: If you chose type MAC you ll need to repeat this process for each phone. Once all phones have been added to the Address Objects section, you ll want to go to Address Groups and create a single group for all of the MAC entries. Configure Advanced QoS within the GUI, Step 3: Apply Address Objects to the firewall Lastly, create a new firewall rule: 1. Click on the Firewall section in the left hand column, select Access Rules. 2. Under Access Rules (ALL>ALL) click Add. 3. Next to From Zone: select LAN. 4. Next to To Zone: select WAN. 5. Next to Service: select the address object (or address group) that was set up in the last step. 6. Next to Source: select Any. 7. Next to Destination: select Any. 8. Check Enable flow reporting. 9. Check Enable packet monitor. 10. Click on the Ethernet BWM tab. Continue on next page 8
For the next steps you ll need to determine how much bandwidth you want to guarantee for this particular service group (the phones). This can be done by percentage of total bandwidth or by a set Kbps (Kilobits Per Second). When using the G.711 codec, each phone needs 88Kbps in both directions (Outbound, Inbound) to properly function. Many administrators like to allocate 90-100Kbps per phone to keep a slight cushion of bandwidth. Example: 1.44Mbps T-1 with 4 phones (using 90Kbps per phone) would require either 25% of available bandwidth or 360Kbps. 11. Check Enable Outbound Bandwidth Management. 12. In the field Guaranteed Bandwidth: enter your number and select the proper corresponding allocation type (% or Kbps). 13. In the field Maximum Bandwidth: enter 100 and select % from the drop down. 14. Check Enable Inbound Bandwidth Management. 15. In the field Guaranteed Bandwidth: enter the same number and corresponding allocation type (% or Kbps) you choose in the above (Outbound) section. 16. In the field Maximum Bandwidth: enter 100 and select % from the drop down. 17. Make sure the Bandwidth Priority: drop down is set to 0 Realtime for both Outbound and Inbound. 18. Check Enable Tracking Bandwidth Usage. 19. Click Add. - Advanced QoS is now complete. Configure Sonicwall to export Netflow data The Sonicwall TZ210/NSA240 comes with the ability to export valuable data to an external program that provides technical visuals on a variety of network specs. At FreedomVoice we use software called Netflow Analyzer. This allows us to see devices within the remote network that may be contributing to call quality issues by flooding the router or available bandwidth with heavy usage. Netflow setup 1. Click on the Network section in the left hand column, select Interfaces. 2. Under the Configure column, click the pencil icon for the WAN interface. 3. Under the General tab in the Management field, check the Ping & SNMP boxes. 4. Click on the Advanced tab. Make sure Enable flow reporting is checked. 5. At the bottom of the page click OK. 6. On the Interfaces page click Accept. Continue on next page 9
Netflow continued 7. Click on the Log section in the left hand column, select Flow Reporting. 8. Check the box Report to EXTERNAL flow collector. 9. In External collector s IP address enter 69.43.168.87. 10. Under External collector s UDP port number enter 3000. 11. Every other setting on this page should be left at the default. 12. At the top of the page click Accept. Netflow continued 13. Click on System in the left hand column and select Administration. 14. Scroll down to Advanced Management and check Enable SNMP. 15. Next to the SNMP checkbox, click the Configure button. 16. In the Get Community Name: field type ops$3cur3!. 17. At the bottom of the page click OK. 18. Scroll to the top of the page and click Accept. 19. Click on System in the left hand column and select Restart. 20. Click on the Restart button. 10
- Netflow setup is now complete. 11
Technical Support Technical support for FreedomIQ is available from 3:00 AM PST to 6:00 PM PST, Monday through Friday, Saturday from 6:30am PST to 3:30pm PST and can be reached either by phone or by email. Emergency support is available 24/7. Phone: 888-955-3520 ext. 2 Use this number to reach a trained FreedomIQ technical support representative during normal support hours. If calling outside of normal hours, you will be provided the option to either leave a voicemail message or connect to the emergency support service (see below). Numerous documents and support materials are available through the FreedomIQ Weblink. Please log into Weblink and select the support tab and review the documentation that is available online there. Support Email: iqsupport@freedomvoice.com Emails are automatically forwarded to our ticketing system. An auto-reply will be sent within a few minutes indicating the case number generated. Emails are generally returned within two hours during normal support hours, but may take longer depending on the current volume of tickets received. All emails should, however, be returned same day. For an issue that requires a faster turn-around time, please use the phone numbers listed above. 12