SonicWALL Internet Security Appliances SonicWALL TZ 180 Recommends Guide

Registering and Enabling SupportStep 13 Navigate to System Diagnostics. Check all four boxes and generate the Tech Support Report. Save thefile, which contains the serial number, auth code, registration code, and all other administrator settings, toyour computer.Step 14 Make a note of the serial number of the appliance, the authorization code, the registration code, the nameand password of the MySonicWALL account the appliance is registered under, and the date when thesoftware support contract expires for the appliance.Save all files on a secure network resource that is backed up on a regular basis. Refer to “SonicWALL Backupand Recovery Solutions” section on page 28 for information about how a SonicWALL CDP appliance toperform this task.If any problems occur, restore using the backup snapshot. If this fails, reload the firmware and preferencesmanually using SafeMode.Step 15 If you found and downloaded a more recent firmware version, navigate to the System Settings page onthe management interface and click on the Upload New Firmware button. Click Browse and find thefirmware file you downloaded.Step 16 After approximately two days, if the new firmware has had no issues, copy the new files. Refer to the backupsection above and save a copy of the new firmware and the new settings, making sure to differentiate themfrom the older versions. It is recommended that you keep multiple sets of ‘known-good’ firmware.SonicWALL TZ 180 Recommends Guide7

Registering and Enabling SupportYour TZ 180 security appliance has a protected boot loader that allows you to reset the security appliance,even if the firmware has become inoperable or corrupted. To access SafeMode, connect a computer to oneof the LAN interfaces on the TZ 180 security appliance using a standard crossover Ethernet cable and assignthis computer a static IP address of 192.168.168.200 with a netmask of 255.255.255.0. If the SafeModeinterface does not display, wait 10-15 seconds and try again. When the link is active, unplug the power cableto the TZ 180 and insert a straightened-out paperclip into the small opening next to the power port untilyou feel a small switch depress. Keep this small switch depressed and plug the power cable back in. Holdthe small switch in for about 20 seconds until the “wrench light” on the front of the TZ 180 flashes, thenrelease it. The security appliance is now in SafeMode.For more information on SafeMode, refer to the “Resetting the SonicWALL Security Appliance UsingSafeMode” chapter in the SonicOS Standard 3.8 Administrator’s Guide.Open a Web browser and navigate to the default SafeMode address at http://192.168.168.168. Figure 5provides an example of SafeMode view.Figure 5SafeModeIn SafeMode, you can boot the security appliance with the current firmware with default settings, or you canclick on the Upload New Firmware button and load a newer or previously known-good version. Once thesecurity appliance has successfully booted, you can then restore the settings file from the managementinterface.No matter what happens to the TZ 180’s firmware or settings, you can return to this SafeMode menu andget the appliance running again. It is recommended that you save your known-good settings and firmwarefor this purpose.8SonicWALL TZ 180 Recommends Guide

Security Best Practices for TZ 180 Running SonicOS StandardSecurity Best Practices for TZ 180 Running SonicOSStandardBy default the TZ 180s security appliance is available with a number of security settings enabled and disabledto provide a moderate level of initial security to protect your network environment and the appliance, whilesimultaneously allowing basic and commonly used outbound network communications. Some of the securitysettings can have a potentially disruptive effect if configured incorrectly. Always activate, deactivate, andchange settings with consideration and care. Table 1 provides an overview of the settings available on theTZ 180 security appliance.Table 1Security Settings Best PracticesSolutionDescriptionRelated InformationSecure managementaccess to the appliancefrom any interface,including across thepublic InternetNavigate to the Firewall Access Rulespage and modify the default rule forHTTPS management. Click the Configureicon, change the Source drop-down fromLAN to *, and click OK to save andactivate the change.For more information on securemanagement access, refer to the“Configuring Network AccessRules” chapter in the SonicOSStandard 3.8 Administrator’sGuide.Create a secure defaultadministrator nameNavigate to the System Administrationpage and change the AdministratorName. Make a note of your newadministrator name. Change the passwordto something complex (for example, acombination of letters, numbers and/orsymbols at least six characters in length).For more information onchanging default Administratornames, refer to the “UsingSystem Administrator” chapterin the SonicOS Standard 3.8Administrator’s Guide.Verify time settingsNavigate to the System Time page andverify that the time zone settings are correctbased on the location of the appliance. Theuse of NTP for accuracy is recommended.Accurate time settings are crucial for thelogging and reporting functions of theappliance.For more information onverifying time settings, refer tothe “Setting System Time”chapter in the SonicOS Standard3.8 Administrator’s Guide.Configure DNS settings Navigate to the Network Settings pageand verify that the appliance has valid DNSserver(s) configured (if running Enhanced,the DNS server(s) can be found on theconfiguration page of the WAN interface).This is crucial for the logging, lookup,DHCP, and reporting functions of theappliance. If you do not know your ISPDNS servers, you can temporarily use4.2.2.1 and 4.2.2.2, but discontinue useonce your ISP has provided you with thecorrect DNS server address.For more information onconfiguring DNS settings, referto the “Configuring NetworkSettings” chapter in the SonicOSStandard 3.8 Administrator’sGuide.SonicWALL TZ 180 Recommends Guide9

Security Best Practices for TZ 180 Running SonicOS Standard10SolutionDescriptionRelated InformationUse Dynamic DNS(DDNS) to make yourWAN IP address easilyresolvableNavigate to the Network DynamicDNS page and configure the securityappliance for DDNS. You can find atechnote on how to do this on theSonicWALL support site. This featuremakes remote management and VPNconnectivity significantly easier, especiallyif your TZ 180 has a dynamically-obtained(DHCP, PPPoE, L2TP) WAN IP address.For more information on usingDynamic DNS, refer to the“Configuring Dynamic DNS”chapter in the SonicOS Standard3.8 Administrator’s Guide.Audit your firewallaccess rules monthlyNavigate to the Firewall Access rulespage, and perform an audit of rules on amonthly basis. It is strongly recommendedto re-evaluate your settings and policies atregular intervals for optimum functionality.For more information onauditing your firewall accessrules, refer to the “ConfiguringNetwork Access Rules” chapterin the SonicOS Standard 3.8Administrator’s Guide.Enable better supportfor Microsoft networksNavigate to the Firewall Advancedpage. If you have a Microsoft networkingenvironment that spans across the LANand OPT/DMZ interfaces of the TZ 180,and security has been set to allow this,check the boxes to allow NetBIOSbroadcast for LAN to DMZ and DMZ toLAN. Microsoft networking relies onNetBIOS broadcasts to identify andregister network resources such as serversand printers, so enabling these checkboxescan resolve network connectivity issues.For more information onenabling support for MicrosoftNetworks, refer to the“Configuring Advanced Rule”chapter in the SonicOS Standard3.8 Administrator’s Guide.Properly configureadvanced firewallfeaturesNavigate to the Firewall Advancedpage. Some security features can causeissues if arbitrarily enabled. For example,enabling Stealth Mode causes the applianceto silently drop any unauthorizedconnection to the WAN interface, insteadof sending a deny back to the source (thattells the source that there is a securityappliance at that address). Enabling theRandomize IP ID scrambles the packetidentification sequence and prevents“fingerprint” detection toolkits fromdetermining the appliance’s make andmodel. Enabling both is recommended.Checksum enforcement options shouldonly be enabled if the network securitypolicy of your organization requires it,because it can lead to significantconnectivity issues with certain applicationsthat do not conform to TCP/IP standards.For more information onconfiguring advanced firewalls,refer to the “ConfiguringAdvanced Rule Options”chapter in the SonicOS Standard3.8 Administrator’s Guide.SonicWALL TZ 180 Recommends Guide

Security Best Practices for TZ 180 Running SonicOS StandardSolutionDescriptionRelated InformationOptimize your firewallaccess rulesOn any firewall rule, enable fragmentedpacket handling, and verify that theconnection timeout for the rule isappropriate to the referenced service. Forexample, telnet connections tend to belong-lasting, so TCP timeout should be setaccordingly. Similarly, timeout can be setlower for short-lived services, thus keepingthe connection cache clean.For more information onfirewall access, refer to the“Configuring Network AccessRules” chapter in the SonicOSStandard 3.8 Administrator’sGuide.Optimize your VPNsettingsNavigate to the VPN Advanced pageand verify that fragmented packethandling/NAT traversal/IKE DPD isenabled, and if you use Microsoftnetworking across VPN tunnels, uncheckthe box next to Disable all VPN WindowsNetworking (NetBIOS) Broadcasts.When creating VPN policies, be sure tocheck the box next to Enable WindowsNetworking (NetBIOS) Broadcasts onthe Advanced tab of the VPN policy.For more information on VPNsettings, refer to the“Configuring Advanced VPNSettings” chapter in the SonicOSStandard 3.8 Administrator’sGuide.Audit your UseraccountsNavigate to the Users Local Users pageand audit user entries at least once a monthto verify there are not inappropriateaccounts. Also enforce the use of complexpasswords, and require users to changepasswords on a regular basis. Three monthsis the recommended interval. Do not allowthe use of common accounts, in which theusername and password are known to awide audience.For more information on useraccounts, refer to the“Configuring Local Users”chapter in the SonicOS Standard3.8 Administrator’s Guide.Establish, a loggingbaselineOn the Log View page, it isrecommended to enable all categories andalerts for at least the first few days of a newinstallation, allowing a better understandthe various functions. This generates a lotof log messages, so after a few days,configure logs a level appropriate for yourenvironment.For more information onlogging baselines, refer to the“Viewing Log Events” chapterin the SonicOS Standard 3.8Administrator’s Guide.Deliver logs and alertsby emailOn the Log Automation page, enter inthe fully-qualified domain name (FQDN)or IP address of a mail server that you relaySMTP mail through, and a working emailaddress that the appliance uses to notify incase of alerts, and to email the logs to on aperiodic basis. This is stronglyrecommended.For more information on logsand alerts, refer to the“Configuring Log Automation”chapter in the SonicOS Standard3.8 Administrator’s Guide.SonicWALL TZ 180 Recommends Guide11

Security Best Practices for TZ 180 Running SonicOS Standard12SolutionDescriptionRelated InformationMap logged IP addressto machine name foridentificationOn the Log Name Resolution page, setit to DNS then NetBIOS and click theApply button in the upper-right-hand partof the screen to save and activate thechange. This lets the appliance apply morea “friendly” name to the IP address in thelog, including the NetBIOS names ofsystems on the LAN, which is easier thanusing a non-fixed IP address. Do not usethis setting if you are using DNS serverssupplied by your ISP.For more information onmapping a logged IP address,refer to the “Configuring NameResolution” chapter in theSonicOS Standard 3.8Administrator’s Guide.Keep backupsStore known-good preferences andfirmware in a safe place that is accessible inthe event of problems with the appliance,and verify the appliance is always under avalid service and software support contract.Disaster recovery can be fairly painless ifyou follow these policies.For more information onkeeping backups, refer to the“Configuring System Settings”chapter in the SonicOS Standard3.8 Administrator’s Guide.Control physical accessOther measures are irrelevant if you do notlimit physical access to the securityappliance itself, as it can be easily reset andillegally accessed if an intruder can get tothe security appliance.For more information oncontrolling physical access,refer to the “MountingInstructions” chapter in theSonicWALL TZ 180 SeriesGetting Started Guide.SonicWALL TZ 180 Recommends Guide

Troubleshooting TZ 180 Configuration and Settings IssuesTroubleshooting TZ 180 Configuration and SettingsIssuesThis section provides troubleshooting information for the six most common issues reported by SonicWALLtechnical support for the TZ 180 security appliance running SonicOS Standard firmware. If you need totroubleshoot an issue that is not listed below, or if the suggestions below do not resolve your issue, visitSonicWALL’s support Web site at www.sonicwall.com to review the SonicOS Administrator’s Guides andtechnotes. Another resource is SonicWALL’s interactive online Knowledge Portal.NoteThe six issues listed below have detailed technotes available on www.sonicwall.com.This section provides troubleshooting for the SonicWALL TZ 180 security appliance. This section containsthe following subsections: DMZ/OPT Port Troubleshooting, page 14– Symptom: I Am Having Problems Installing a Public Server on the DMZ/OPT Port, page 14– Symptom: I Have One Public WAN IP Address, the TZ 180 Is Already Using the HTTP andHTTPS Ports for Management, and the Ports Are Needed for an Internal Server, page 15– Symptom: I Want to Assign a Unique Public IP Address to the Resource on the OPT Interface,page 16– Symptom: Internal Users Are Having Problems Accessing the Server on the OPT Port, page 16– Symptom: Users Across a Site-to-Site VPN Tunnel Unable to Access a Server on the OPTInterface, page 16 Global VPN Client Troubleshooting, page 16– Symptom: GlobalVPN Clients Are Unable to Access the Server on the OPT Interface, page 16– Symptom: I Cannot Get the Global VPN Client Working, page 17– Symptom: The GlobalVPN Client Asks for a Key on First Connection, page 18– Symptom: The GlobalVPN Client Displays a Tmeout with a DHCP Error, page 18– Symptom: The GlobalVPN Client Has Connectivity Issues or Reports Unusual Messages uponFailure, page 18– Symptom: GlobalVPN Users Have Problems Accessing Microsoft Networking Resources over theConnection, page 18 Registration Troubleshooting, page 18– Symptom: I Am Having Registration Problems with the TZ 180, page 18– Symptom: The Appliance Is Reporting that the Security Appliance Is Already Registered, page 19– Symptom: The Appliance Reports that the Connection Timed Out, page 19 VPN Troubleshooting, page 19– Symptom: I Cannot Get Site-to-Site VPN to Work, page 19– Symptom: Phase 1 Settings Are Identical on Both Sides, but the Log Displays a Failure in Phase 2,page 22– Symptom: General, Phase 1, and Phase 2 Settings All Seem Correct on Both Sides but It Still DoesNot Negotiate, page 23SonicWALL TZ 180 Recommends Guide13

Troubleshooting TZ 180 Configuration and Settings Issues– Symptom: The VPN tunnel Negotiated and Both Sides Show the Tunnel as Up, but I Cannot ReachAnything on Either Side of the Tunnel from the Other Side, Respectively, page 23– Symptom: The VPN Tunnel Works but Needs to be Faster, page 24 Internet Connectivity Troubleshooting, page 25– Symptom: I Do Not Have Internet Access from Behind the TZ 180, page 25– Symptom: Users on the WAN Cannot Get to Servers on the OPT or LAN Interfaces, but theNAT/Firewall Rules Look Fine, page 25 Firmware Update Troubleshooting, page 26– Symptom: I Want to Update the Firmware on the TZ 180, page 26DMZ/OPT Port TroubleshootingSymptom: I Am Having Problems Installing a Public Server on the DMZ/OPT PortThere are two options for the DMZ/OPT port: Transparent Mode, which allows you to configure the serverwith a public IP address (useful for machines where it’s difficult or unfeasible to change the IP address), andNAT Mode, which is the default setting. In Transparent Mode, verify the publi

SonicWALL SSL-VPN 200. Registering and Enabling Support . to set up your SonicWALL TZ 180 security appliance for the first time. For additional setup information, refer to the "Basic SonicWALL Security Appliance Setup" section in the . Save all files on a secure network resource that is backed up on a regular basis. Refer to .