NSA E5500 GSG - Andover Consulting Group

NSA E5500 GSG.book Page 12 Thursday, June 18, 2009 3:26 AMf.Front Bezel Configuration ExamplePress Right.LAN IP ConfigurationThe SonicWALL NSA E5500 is assigned the default LAN IP of192.168.168.168. Complete the following steps to change it to192.168.168.10.1.2.Press Right to exit screen-saver mode if not at the rootmenu.Press Down to select the Configuration entry.3.4.Press Right to enter Configuration Mode.Input PIN (76642 by default; SONIC on a phone keypad.)a.b.c.d.e.Press Up or Down until the cursor displays 7,press Right.Press Up or Down until the cursor displays 6,press Right.Press Up or Down until the cursor displays 6,press Right.Press Up or Down until the cursor displays 4,press Right.Press Up or Down until the cursor displays 2,press Right.Page 12 Front Bezel Configuration Example5.Press Down until X1 IP is selected (four times).6.Press Right to configure X1 IP.7.Edit X1 IP:a. Press Right ten times to select the tenth digit.b.c.d.e.f.Press UP or Down until the cursor displays 0.Press Right once to select the next digit.Press UP or Down until the cursor displays 1.Press Right once to select the next digit.Press Up or Down until the cursor displays 0.g.h.Press Right to finish editing the X1 IP.Press Right again to confirm changes.

NSA E5500 GSG.book Page 13 Thursday, June 18, 2009 3:26 AMRegistering Your Appliance on mysonicwall.com2In this Section:This section provides instructions for registering your SonicWALL NSA E5500. Before You Register - page 14Creating a mysonicwall.com Account - page 15Registering and Licensing Your Appliance on mysonicwall.com - page 15 Licensing Security Services and Software - page 16 Registering a Second Appliance as a Backup - page 18Note: Registration is an important part of the setup process and is necessary in order to receive the benefits of SonicWALL securityservices, firmware updates, and technical support.SonicWALL NSA E5500 Getting Started Guide Page 13

NSA E5500 GSG.book Page 14 Thursday, June 18, 2009 3:26 AMBefore You RegisterYou need a mysonicwall.com account to register theSonicWALL NSA E5500. You can create a newmysonicwall.com account on www.mysonicwall.com or directlyfrom the SonicWALL management interface. This sectiondescribes how to create an account by using the Web site.You can use mysonicwall.com to register your SonicWALLappliance and activate or purchase licenses for SecurityServices, ViewPoint Reporting and other services, support, orsoftware before you even connect your device. This allows youto prepare for your deployment before making any changes toyour existing network.For a High Availability configuration, you must usemysonicwall.com to associate a backup unit that can share theSecurity Services licenses with your primary SonicWALL.Note: Your SonicWALL NSA E5500 does not need to bepowered on during account creation or during themysonicwall.com registration and licensing process.Page 14 Before You RegisterNote: After registering a new SonicWALL appliance onmysonicwall.com, you must also register the appliancefrom the SonicOS management interface. This allowsthe unit to synchronize with the SonicWALL LicenseServer and to share licenses with the associatedappliance, if any. See Accessing the ManagementInterface - page 26.If you already have a mysonicwall.com account, go toRegistering and Licensing Your Appliance onmysonicwall.com - page 15 to register your appliance onmysonicwall.com.

NSA E5500 GSG.book Page 15 Thursday, June 18, 2009 3:26 AMCreating a mysonicwall.com AccountTo create a mysonicwall.com account, perform the followingsteps:1.2.In your browser, navigate to www.mysonicwall.com.In the login screen, click If you are not a registered user,Click here.Registering and Licensing Your Applianceon mysonicwall.comThis section contains the following subsections: Product Registration - page 15Licensing Security Services and Software - page 16Registering a Second Appliance as a Backup page 18Registration Next Steps - page 18Product RegistrationYou must register your SonicWALL security appliance onmysonicwall.com to enable full functionality.1.2.3.3.4.5.Complete the Registration form and then click Register.Verify that the information is correct and then click Submit.In the screen confirming that your account was created,click Continue.4.Login to your mysonicwall.com account.On the main page, in the Register A Product field, typethe appliance serial number and then click Next.On the My Products page, under Add New Product, typethe friendly name for the appliance, select the ProductGroup if any, type the authentication code into theappropriate text boxes, and then click Register.On the Product Survey page, fill in the requestedinformation and then click Continue.SonicWALL NSA E5500 Getting Started Guide Page 15

NSA E5500 GSG.book Page 16 Thursday, June 18, 2009 3:26 AMLicensing Security Services and Software The Service Management - Associated Products page inmysonicwall.com lists security services, support options, andsoftware such as ViewPoint that you can purchase or try with afree trial. For details, click the Info button. Your current licensesare indicated in the Status column with either a license key oran expiration date. You can purchase additional services now orat a later time. The following products and services are available for theSonicWALL NSA E5500: Service Bundles: Client/Server Anti-Virus Suite Comprehensive Gateway Security Suite Gateway Services: Gateway AV, Anti-Spyware, Application Firewall,Intrusion Prevention Service Content Filtering: Premium Edition Stateful High Availability (HA) UpgradePage 16 Registering and Licensing Your Appliance on mysonicwall.com Desktop and Server Software: Enforced Client Anti-Virus and Anti-Spyware Global VPN Client Global VPN Client Enterprise VPN Policy Upgrade (for site-to-site VPN) ViewPoint Global Management SystemSupport Services: Dynamic Support 24x7 Software and Firmware UpdatesConsulting Services: Implementation Service GMS Preventive Maintenance Service

NSA E5500 GSG.book Page 17 Thursday, June 18, 2009 3:26 AMTo manage your licenses, perform the following tasks:1.2.3.In the mysonicwall.com Service Management - AssociatedProducts page, check the Applicable Services table forservices that your SonicWALL appliance is alreadylicensed for. Your initial purchase may have includedsecurity services or other software bundled with theappliance. These licenses are enabled onmysonicwall.com when the SonicWALL appliance isdelivered to you.If you purchased a service subscription or upgrade from asales representative separately, you will have anActivation Key for the product. This key is emailed to youafter online purchases, or is on the front of the certificatethat was included with your purchase. Locate the producton the Services Management page and click Enter Key inthat row.In the Activate Service page, type or paste your key into theActivation Key field and then click Submit. Depending onthe product, you will see an Expire date or a license keystring in the Status column when you return to the ServiceManagement page.4.5.6.To license a product of service, do one of the following: To try a Free Trial of a service, click Try in the ServiceManagement page. A 30-day free trial is immediatelyactivated. The Status page displays relevantinformation including the activation status, expirationdate, number of licenses, and links to installationinstructions or other documentation. The ServiceManagement page is also updated to show the statusof the free trial. To purchase a product or service, click Buy Now.In the Buy Service page, type the number of licenses youwant in the Quantity column for either the 1 year, 2 year, or3 year license row and then click Add to Cart.In the Checkout page, follow the instructions to completeyour purchase.The mysonicwall.com server will generate a license key for theproduct. The key is added to the license keyset. You can usethe license keyset to manually apply all active licenses to yourSonicWALL appliance.SonicWALL NSA E5500 Getting Started Guide Page 17

NSA E5500 GSG.book Page 18 Thursday, June 18, 2009 3:26 AMRegistering a Second Appliance as a BackupTo ensure that your network stays protected if your SonicWALLappliance has an unexpected failure, you can associate asecond SonicWALL with the first in a high availability (HA) pair.You can associate the two appliances as part of the registrationprocess on mysonicwall.com. The second SonicWALL willautomatically share the Security Services licenses of theprimary appliance.6.7.To register a second appliance and associate it with theprimary, perform the following steps:1.2.3.4.5.Login to your mysonicwall.com account.On the main page, in the Register A Product field, type theappliance serial number and then click Next.On the My Products page, under Add New Product, typethe friendly name for the appliance, select the ProductGroup if any, type the authentication code into theappropriate text boxes, and then click Register.On the Product Survey page, fill in the requestedinformation and then click Continue. The CreateAssociation Page is displayed.On the Create Association Page, click the radio button toselect the primary unit for this association, and then clickContinue. The screen only displays units that are notalready associated with other appliances.Page 18 Registering and Licensing Your Appliance on mysonicwall.comOn the Service Management - Associated Products page,scroll down to the Associated Products section to verifythat your product registered successfully. You should seethe HA Primary unit listed in the Parent Product section, aswell as a Status value of 0 in the Associated Products /Child Product Type section.Although the Stateful High Availability Upgrade and all theSecurity Services licenses can be shared with the HAPrimary unit, you must purchase a separate ViewPointlicense for the backup unit. This will ensure that you do notmiss any reporting data in the event of a failover. You mustalso purchase a seperate support license for the backupunit. Under DESKTOP & SERVER SOFTWARE, click BuyNow for ViewPoint. Follow the instructions to complete thepurchase.To return to the Service Management - Associated Productspage, click the serial number link for this appliance.Registration Next StepsYour SonicWALL NSA E5500 or E5500 HA Pair is nowregistered and licensed on mysonicwall.com. To complete theregistration process in SonicOS and for more information, see: Accessing the Management Interface - page 26Activating Licenses in SonicOS - page 28Enabling Security Services in SonicOS - page 50Applying Security Services to Zones - page 50

NSA E5500 GSG.book Page 19 Thursday, June 18, 2009 3:26 AMDeployment Scenarios3In this Section:This section provides detailed overviews of advanced deployment scenarios as well as configuration instructions for connecting yourSonicWALL NSA E5500. Selecting a Deployment Scenario - page 20 Scenario A: NAT/Route Mode Gateway - page 21 Scenario B: State Sync Pair in NAT/Route Mode - page 22 Scenario C: L2 Bridge Mode - page 23Initial Setup - page 24Configuring a State Sync Pair in NAT/Route Mode - page 32Configuring L2 Bridge Mode - page 40Tip: Before completing this section, fill out the information in Obtain Configuration Information - page 5, and Obtain InternetService Provider (ISP) Information - page 5. You will need to enter this information during the Setup Wizard.SonicWALL NSA E5500 Getting Started Guide Page 19

NSA E5500 GSG.book Page 20 Thursday, June 18, 2009 3:26 AMSelecting a Deployment ScenarioBefore continuing, select a deployment scenario that best fits your network scheme. Reference the table below and the diagrams on thefollowing pages for help in choosing a scenario.Current Gateway ConfigurationNo gateway applianceExisting Internet gateway applianceExisting SonicWALL gateway applianceNew Gateway ConfigurationUse ScenarioSingle SonicWALL NSA as a primary gateway.A - NAT/Route Mode GatewayPair of SonicWALL NSA appliances for highavailability.B - NAT with State Sync PairSonicWALL NSA as replacement for an existinggateway appliance.A - NAT/Route Mode GatewaySonicWALL NSA in addition to an existinggateway appliance.C - L2 Bridge ModeSonicWALL NSA in addition to an existingSonicWALL gateway appliance.B - NAT with State Sync PairBACE5500SonicPointNetwork Security ApplianceSonicPointScenario A: NAT/Route Mode Gateway - page 21Scenario C: L2 Bridge Mode - page 23Page 20 Selecting a Deployment ScenarioScenario B: State Sync Pair in NAT/Route Mode - page 22

NSA E5500 GSG.book Page 21 Thursday, June 18, 2009 3:26 AMScenario A: NAT/Route Mode GatewayFor new network installations or installations where theSonicWALL NSA E5500 is replacing the existing networkgateway.ASonicWALL NSA E-ClassISP 1In this scenario, the SonicWALL NSA E5500 is configured inNAT/Route mode to operate as a single network gateway. TwoInternet sources may be routed through the SonicWALLappliance for load balancing and failover purposes. Becauseonly a single SonicWALL appliance is deployed, the addedbenefits of high availability with a stateful synchronized pair arenot available.InternetSonicPointDMZ ZoneWLAN ZoneLAN ZoneTo set up this scenario, follow the steps covered in the InitialSetup section. If you have completed setup procedures in thatsection, continue to the Additional Deployment Configurationsection, on page 43 to complete configuration.SonicWALL NSA E5500 Getting Started Guide Page 21

NSA E5500 GSG.book Page 22 Thursday, June 18, 2009 3:26 AMScenario B: State Sync Pair in NAT/Route ModeFor network installations with two SonicWALL NSA E-Seriesappliances configured as a stateful synchronized pair forredundant high-availability networking.In this scenario, one SonicWALL NSA E5500 operates as theprimary gateway device and the other SonicWALL NSA E5500is in passive mode. All network connection information issynchronized between the two devices so that the backupappliance can seamlessly switch to active mode withoutdropping any connections if the primary device losesconnectivity.To set up this scenario, follow the steps covered in the InitialSetup and the Configuring a State Sync Pair in NAT/RouteMode - page 32 sections. If you have completed setupprocedures in those sections, continue to the AdditionalDeployment Configuration section, on page 43 to completeconfiguration.Page 22 Selecting a Deployment ScenarioBSonicWALLHA / Failover PairSonicWALL NSA E-Class 2E5500HA LinkSonicNetwork Security ApplianceInternetLocal Network

NSA E5500 GSG.book Page 23 Thursday, June 18, 2009 3:26 AMScenario C: L2 Bridge ModeFor network installations where the SonicWALL NSA E5500 isrunning in tandem with an existing network gateway.In this scenario, the original gateway is maintained. TheSonicWALL NSA E5500 is integrated seamlessly into theexisting network, providing the benefits of deep packetinspection and comprehensive security services on all networktraffic.CThird Party GatewayL2 Bridge LinkInternet orLAN Segment 2SonicWALL NSA E-ClassSonicPointL2 Bridge Mode employs a secure learning bridge architecture,enabling it to pass and inspect traffic types that cannot behandled by many other methods of transparent securityappliance integration. Using L2 Bridge Mode, a SonicWALLsecurity appliance can be non-disruptively added to anyEthernet network to provide in-line deep-packet inspection forall traversing IPv4 TCP and UDP traffic. L2 Bridge Mode canpass all traffic types, including IEEE 802.1q VLANs, SpanningTree Protocol, multicast, broadcast and IPv6.WLAN ZoneLAN ZoneTo set up this scenario, follow the steps covered in the InitialSetup and the Configuring L2 Bridge Mode sections. If youhave completed setup procedures in those sections, continue tothe Additional Deployment Configuration section, on page 43to complete configuration.SonicWALL NSA E5500 Getting Started Guide Page 23

NSA E5500 GSG.book Page 24 Thursday, June 18, 2009 3:26 AMInitial SetupThis section provides initial configuration instructions forconnecting your SonicWALL NSA E5500. Follow these steps ifyou are setting up scenario A, B, or C.This section contains the following sub-sections: System Requirements - page 24Connecting the WAN Port - page 24Connecting the LAN Port - page 25Applying Power - page 25Accessing the Management Interface - page 26Using the Setup Wizard - page 26Connecting to Your Network - page 27Testing Your Connection - page 27Activating Licenses in SonicOS - page 28Upgrading Firmware on Your SonicWALL - page 29System RequirementsBefore you begin the setup process, check to verify that youhave: An Internet connection A Web browser supporting Java Script and HTTP uploadsAcceptedBrowserBrowser VersionNumberInternet Explorer6.0 or higherFirefox2.0 or higherNetscape9.0 or higherOpera9.10 or higher forWindowsSafari2.0 or higher for MacOSConnecting the WAN Port1.2.Connect one end of an Ethernet cable to your Internetconnection.Connect the other end of the cable to the X1 (WAN) port onyour SonicWALL NSA E5500.6RQLF: // 16 ( .ETWORK 3ECURITY !PPLIANCE% ; 0DQDJHPHQW6WDWLRQPage 24 Initial Setup; ,QWHUQHW

NSA E5500 GSG.book Page 25 Thursday, June 18, 2009 3:26 AMConnecting the LAN PortThe Power LEDs1.plug in the SonicWALL NSA E5500. The Alarm2.Connect one end of the provided ethernet cable to thecomputer you are using to manage theSonicWALL NSA E5500.Connect the other end of the cable to the X0 port on yourSonicWALL NSA E5500.The Link LED above the X0 (LAN) port will light up in greenor amber depending on the link throughput speed,indicating an active connection:- Amber indicates 1 Gbps- Green indicates 100 Mbps- Unlit while the right (activity) LED is illuminatedindicates 10 Mbpson the front panel light up blue when youlight up and the TestLED mayLED will light up and may blink whilethe appliance performs a series of diagnostic tests.When the Power LEDs are lit and the Test LED is no longer lit,the SonicWALL NSA E5500 is ready for configuration. Thistypically occurs within a few minutes of applying power to theappliance.Alert: When disconnecting power, be sure to remove bothpower cords from the unit.Applying Power1.2.Plug the power cord into an appropriate power outlet.Turn on the power switch on the rear of the appliance nextto the power cords.Note: If the Test or Alarm LEDs remain lit after theSonicWALL NSA E5500 has booted, restart theappliance by cycling power.IoTo powersourceSonicWALL N

SonicWALL NSA E5500 Getting Started Guide Page 7 The Back Panel Icon Feature Description Expansion Bay Future extension. Fans (2) The SonicWALL NSA E5500 includes two fans for system temperature control. Power Supply The SonicWALL NSA E5500 power supply. I o PML A B C