Instruction/ maintenance manual of the product UTM Appliance SonicWALL
Go to page of 57
LDAP Leveraging LDAP Groups/ Use rs with SonicWALL UTM Appliance Contents Contents ....................................................................................................................... ....................................... 1 Integrating LDAP/Active Dire ctory with S onicwall UTM .
2 Blocking IM Traffi c Categorically .............................................................................................. ................. 51 Applying Granular IM Policies ....................................................................
3 Integrating LDAP/Active Directo ry with Sonicwall UTM SonicOS supports a range of different LDAP se rvers, the most popular being Active Directory (AD). AD i s also an LDAP implementation. Please refer to the followin g pape r as a supplement on how to configure L DAP settings.
4 Exporting the CA Certificate fr om the Active Directory Server To export the CA certificate from the AD server: Step 1: Launch the Certification Authority application: Start > Ru n > cer tsrv.msc . Step 2: Right click on the CA you creat ed and select Properties.
5 Step 5: On the Settings tab of the LDAP Configuration win do w , configure the following fields: • Name or IP Address – The FQDN or the IP address of the LDA P serve r against which you wish to authenticate. If using a name, be certain that it c an be resolved by your DNS server.
6 • Send LDAP ‘Start TLS’ Request – Some LDAP server implementations suppo rt the Start TLS directive rather than using native LDAP over TLS. This allows the L DAP se rver to listen on o ne port (normally 389) for LDAP connections, and to switch to TLS as direct ed by the client.
7 Selecting any of the predefined schemas will automat ically populate the fields used by that schema with their correct values. Selecting ‘User Defined’ will allow you to specif y your own values – use thi s only if you have a specific or proprietary LDAP schem a co nfiguration.
8 • Primary Domain – The user domain used by your LDAP implementation. For AD, this will be the Active Directory domain n ame, e.g. yourADd omain . c om. Chan ges to this field will, optionally, automatically update the tree information in the rest of the page.
9 trees are best ordered with those on the primary server first, and the rest in the same order that they will be referred. NOTE : When working with AD, to determine the location of a user in the dire.
10 Step 10: On the LDAP Users tab, configure the following fields: • Allow only users listed locally – Requires that LDAP users al so be present in the SonicWALL local user database for logins to be allowed.
11 In the LDAP Import User Groups dialog box, sele ct t he checkbox for ea ch group that you want to import into the SonicWALL, and then click Save. Having user groups on the SonicWALL with the sa me name a s existing LDAP/AD use r grou ps allo ws SonicWALL group membership s an d privileges to be granted upon succe ssful LDAP authentication.
12 Step 11: On the LDAP Relay tab, configure the following fields: The RADIUS to LDAP Relay feature is d esig ned for use in a topology where there is a central site with an LDAP/AD server and a central SonicWALL wi th remote satellite sites connected into it via older low-end SonicWALL security appli ances that may not support LDAP.
13 configurable. Step 12: Select the Test tab to test the configured LDAP settings: The Test LDAP Settings page allows for the configured LDAP sett ings to be te sted by attempting authentication with specified user an d p assword credentials.
14 Logon to Appliance – Configuring User Level Authentic ation Settings This is the other method of authenticating users, and requi res the user to login to the appliance. Please refer to the following paper for more details on ULA: http://www.sonicwall.
15 Step 5: Click Add , then create the following two rules as de picted below. The order is importan t. The new first rule allows any DNS queries out. The new second rule forces all users (Everyone) to be challenged before accessing the Intern et for HTTP only.
16 NOTE : The difference between “All” and “Everyone ” in a polic y rule. Selecting “All” will allow all matching traffic, regardless from an authenticated user or n ot. Se lecting the “Everyone” user group will allow traffic from any logged in user, but not from a user who ha s not lo gged in.
17 If everything is working correctly, you should then see users authenticated on the Log>Vie w page. SonicOS Options That Lev erage Groups/Users Now that we have a means of authent i c ating users.
18 • Rule processing stop s a s soon as there is a match (with some cave ats – see below) • Rule logic first looks at Source, then Destination, Service, and Action. If there is a match the re, rule processing st ops a nd then further subset rule processi ng can happen (rul es set for schedules, users/ groups, or BWM) for that specific rule .
19 allowed access throug h it. Matching traffic from the user or me mbers of the user grou p will be given access, and matching traffic from anyone else will be denied access.
20 Firewall Rules with Bandwidth Mana gement & Logging It is possible to leverage FW rules simpl y for logging and/or bandwidth manag ement (BWM). To enable BWM, it is first necessary to go to Network > Interfac es and configure the WAN interface.
21 After BWM is enabled on the WAN interface, a new ta b is displayed within FW rule creation: the Ethernet BWM tab. You can now enable BWM on a rule by rule basis setting a g uaranteed bandwidth rate (Kbps) or %, a maximum rate or %, priori ty, and tracking of bandwidth usage.
22 NOTE : You can create a firewall rule for any given user /group and rest rict that group’s overall bandwidth for any network service/protocol. Con sider also us ing Application Firewall which allows mo re granular control of bandwidth policies.
23 Step 2: Create an AO for yahoo.com. Step 3: Now, create an AO Group and add the ap propriate AOs to this group..
24 Step 4: Next, create an FW rule that will deny traffic to the Blocke d Sites AO Group. Allowing Specific Domains and Blocking All Others with Firewall Rules With firewall rules you can block HTTP/HTTPS traffic for all traffic except for the defined list you’ve created.
25 Step 2: Create an AO for Mysonicwall.com. Whil e u sing a FQDN is often more “friendly”, in this example we’ve chosen the IP address. Step 2: Create an AO Group for the Allowed site s.
26 Step 4: Create a rule to allow HTTP traffic for your all owed lists..
27 Step 5: Do the same for HTTPS..
28 Step 6: Create the deny rules for HTTP and HT TPS..
29 The firewall rules should now loo k like the belo w pi cture: NOTE: that the downside to using F W rules to block/allow we bsites is that if a user is a member of differe nt groups in LDAP, and if different rules are created for different grou ps, it can cause undesirable behavio r for a given user.
30 Blocking HTTPS (SSL) Domains with SSL Control With Secure Socket Layer (SSL) Control it is possi bl e to whitelist an d blacklist HTTPS domains, as well as other SSL services, based on key words i n their certificate. SSL control ca nnot be enforced at the group/user level, only at the ZONE level.
31 ever decreasing cost and complexity of SSL, however , has also spurred the growth of more dubiou s applications of SSL, designed prim arily for the pu rposes of obfuscation or concealment rather than security .
32 Step 1: To configure the Whitelist and Blacklist naviga te to Firewall > SSL control > click the Configure button to bring up the following window: Entries can be added, edited and delete d with the but tons beneath each list wind ow.
33 Applying Differen t CFS Policies to Gr oups It is important to understand what CFS is capabl e of (as of SonicOS 5.2). CFS is a subscri ption based service that allows administrators to block domai ns b as ed on category ratings. The Premium CFS features over 50 different categories to choose from.
34 CFS has the ability to allow or block domains by thei r fully qualified domain n ame (FQDN) or by keywords in their FQDN. This functionality does not require a sub scription to CFS. This list is a single master list that can be enforced on any given CFS policy.
35 NOTE: If you wish to forbid or allow HTTPS domains, us e of their IP address must be used in CFS. FQDN does not work for HTTPS sites in the CFS Custo m List.
36 Step 1: Under the C FS tab, enable the IP based HTTPS content filtering. This enables CFS f or HTTPS domains. This is important if you wish to block sites such a s HTTPS://www.fac ebook.com or proxy sites such as HTTPS://megaproxy.com. Step 2: Navigate to the Policy tab and add a ne w CFS policy.
37 Step 3: Create a friendly name for the new poli cy. Step 4: Navigate to the URL List tab and sel ect the categories you want to block or allo w for this policy. Step 5: Navigate to the Settings Tab a nd sel ect if you want to enforce allowed domains, forb idden domains, or keywords in domains.
38 default of “moderate” to “strict” filtering on Google however. Step 6: Select if you want the CFS Policy to only run at certain times of the day. For example, you might allow access to social networki ng sites betwe en 12-1 for lun ch brea k, but rest rict access the remainder of the time.
39 Step 7: Next nav igate to Users > Local Groups and configure the Group you want the new CFS policy to apply to. Step 8: Select the CFS policy you created under the CFS Policy tab. Repeat this same p ro ce ss fo r every group that requires custom CFS settings.
40 Step 1: Navigate to Network > Network Interfac es. Configure the respective interfaces you wish to support local authenticatio n on by enabl ing HTTPS user login. Step 2: Navigate to Security Services > Content Filter. At the bottom of the page is the html code that can be customized.
41 Basic Sample Code for SonicOS 5.2 ----*snipped*---- (with virtual sci ssors ☺ ) <tr><td align=center nowrap><font size="2" col or="#000000"><br> If you believe the below web site is rated incorrec tly click <a href="HTTP://cfssupport.
42 NOTE : Use caution the website you are r edi re cting isn’t on the CFS list or blocked domains. It would create a looping situation. <html> <head> <meta HTTP-equiv="Content-Ty.
43 </div> </div> <div id="popup_box_text"> <table align=center cell padding=5 widt h=8 0%> <tr><td align=center><font size="2" colo r=" #000000"> <br> <script> <!-- var blockedURL = new String(docume nt.
44 Sample JavaScript Code for SonicOS 5.2 In this example, “blockedURL” is the variable that refe rences the URL the client wa s trying to browse to. In this example, we are looking for facebo ok, and the n ta king a unique action for that URL. You could use this to redirect users or take custom actions again st a defined list of URLs.
45 Applying Application Firewa ll Polices to Groups/Users Application Firewall is a very flexible tool to manage application specific traffic. The goal of this guide is to demonstrate how Application Firewall can be applied to different groups/ users.
46 When lookin g for a HTTP Hos t, you can get sp ecific wi th a FQDN or leave it more general with a partial match. With the below example, websites with monster in the URL will be blocked.
47 Step 3: Navigate to Policies and add a new policy. Give the policy a friendly name. Select the Application Object that was just created “Blocked Domains”. The action we will take in this example is “drop/reset”. You can then select the grou ps you wish to include or exclude from the policy.
48 When a user attempts to navigate to monster.com, they will be presente d with a page cannot be displayed message. Alternatively, you can have the blocked domains redi rect to another web page or displ ay a custom block page. Step 5: Navigate to Actions under Application Fire wall and create a new Action to redirect users.
49 Step 6: Navigate to Application Fire wall > Policies and chang e the action from reset/drop to the new custom action. If you wish to display a block page instead, creat e a new ac tion with HTTP Block Page. You can either insert text in the content or html markup to customize it further .
50 Tightening Control over the Bro wsing Behavior of Users Now that we’ve looked at the different ways to restrict browsin g and web behavior thro ugh dif ferent mechanisms, I’m sure ide a s are spinning in your head on ho w you can apply these policies i n your environment.
51 • Turn on Gateway AV and Antispyware – turn all settings o n. If you really want to block everything, the most drastic step you can take is to unplug the firewall from the wa ll. Applying Intrusion Prevention Serv ice Signatures to Group s/Users There are 2 different methods of leveraging IPS signat ures .
52 NOTE : You can change the Prevention and Detectio n from t he glo bal settings and adjust other setting s such as the schedule when the sign ature i s enabled. For exam ple, some organizati ons want to allow IM traffic for everyone during lunch hours but deny it outside of those ho urs.
53 Applying VPN Access Policies to Groups/Users SonicOS 5.2 supports 2 VPN client s; Gl obal VPN Cli ent (GVC), an IPSec client and NetExtender, a SSL-VPN client. Both clients can utilize LDAP groups/users fo r authentication and access, but each does it in a slightly different manner.
54 NOTE : Depending on how you setup yo ur group member ship, being a member of this group does not automatically grant those users VPN access. Step 2: Navigate to Users > Local Grou ps an d configure the group(s) that require VPN access. Under the VPN Access tab select the ne twork(s) or address obje cts that group wi ll have VPN access to.
55 SSL-VPN (NetExtender) SonicOS 5.2 introduces SSL VPN functionality via NetExtender. NetExtender is a light weight client that can run on Windows, Linux, Mac, and Wi ndo ws Mobile devices. It can easily be installed by directing the client to the URL of the WAN interface.
56 Guest Services (Wireless Guest Serv ices) SonicOS supports Guest Services. Gues t services are typically used in wireless hotspot deployments, but they can also be used in scenario s such as guest clients needing to plug into the wired LAN i nfrast ructure.
57 It’s not that hard of a stretch to see that if you are using LDAP integrati on, you could essentially build guest accounts and profiles in LDAP and then leverag e that gue st group in the same ways we’ve shown above. However, that may be more time consuming then ne cessary for administrators, espe cially when guests come and go frequently.
An important point after buying a device SonicWALL SonicWALL UTM Appliance (or even before the purchase) is to read its user manual. We should do this for several simple reasons:
If you have not bought SonicWALL SonicWALL UTM Appliance yet, this is a good time to familiarize yourself with the basic data on the product. First of all view first pages of the manual, you can find above. You should find there the most important technical data SonicWALL SonicWALL UTM Appliance - thus you can check whether the hardware meets your expectations. When delving into next pages of the user manual, SonicWALL SonicWALL UTM Appliance you will learn all the available features of the product, as well as information on its operation. The information that you get SonicWALL SonicWALL UTM Appliance will certainly help you make a decision on the purchase.
If you already are a holder of SonicWALL SonicWALL UTM Appliance, but have not read the manual yet, you should do it for the reasons described above. You will learn then if you properly used the available features, and whether you have not made any mistakes, which can shorten the lifetime SonicWALL SonicWALL UTM Appliance.
However, one of the most important roles played by the user manual is to help in solving problems with SonicWALL SonicWALL UTM Appliance. Almost always you will find there Troubleshooting, which are the most frequently occurring failures and malfunctions of the device SonicWALL SonicWALL UTM Appliance along with tips on how to solve them. Even if you fail to solve the problem, the manual will show you a further procedure – contact to the customer service center or the nearest service center
