Web Management Settings

Topics:

Managing via HTTP

The SonicWALL security appliance can be managed using HTTP or HTTPS and a Web browser. HTTP web-based management is disabled by default. Use HTTPS to log into the SonicOS management interface with factory default settings.

To use HTTP management, select the Allow management via HTTP checkbox to enable HTTP management globally. Deselect the checkbox to disable HTTP management. This option is not selected by default.

The default port for HTTP is port 80, but you can configure access through another port. Type the number of the desired port in the HTTP Port field, and click Accept. If you configure another port for HTTP management, however, you must include the port number when you use the IP address to log into the SonicWALL security appliance. For example, if you configure the port to be 76, then you must type <LAN IP Address>:76 into the Web browser; for example, http://192.168.168.1:76.

The default port for HTTPS management is 443. You can add another layer of security for logging into the SonicWALL security appliance by changing the default port. To configure another port for HTTPS management, type the preferred port number into the HTTPS Port field. If you configure another port for HTTPS management, however, you must include the port number when you use the IP address to log into the SonicWALL security appliance. For example, if you configure the HTTPS Management Port to be 700, then you must log into the SonicWALL using the port number as well as the IP address by typing <LAN IP Address>:700, for example, https://192.168.168.1:700.

Deleting Cookies

The Delete Cookies button removes all browser cookies saved by the SonicWALL appliance, which clears any choices remembered by the browser. Deleting cookies causes you to lose any unsaved changes made in the Management interface. If you click Delete Cookies, a warning message displays:

Toggling Configuration Mode

You can toggle between configuration mode and non-config mode by:

Selecting Certificates

The Certificate Selection drop-down menu allows you to select:

Client Certificate Check with Common Access Card

You can enable a Client Certificate Check for use with or without a Common Access Card (CAC). A Common Access Card (CAC) is a United States Department of Defense (DoD) smart card used by military personnel and other government and non-government personnel who require highly secure access over the internet. A CAC uses PKI authentication and encryption.

NOTE: Using a CAC requires an external card reader that is connected on a USB port.

The Client Certificate Check was developed for use with a CAC; however, it is useful in any scenario that requires a client certificate on an HTTPS/SSL connection. CAC support is available for client certification only on HTTPS connections.

NOTE: CACs may not work with browsers other than Microsoft Internet Explorer.

The Enable Client Certificate Check checkbox allows you to enable or disable client certificate checking and CAC support on the SonicWALL security appliance.

The Client Certificate Issuer drop-down menu lists the Certification Authority (CA) certificate issuers that are available to sign the client certificate. If the appropriate CA is not listed, you need to import that CA into the SonicWALL security appliance.

The Enable OCSP Checking checkbox allows you to enable or disable the Online Certificate Status Protocol (OCSP) check for the client certificate to verify that the certificate is still valid and has not been revoked.

Topics:

Using CAC

If you use the client certificate check without a CAC, you must manually import the client certificate into the browser.

If you use the Client Certificate Check with a CAC, the client certificate is installed automatically on the browser by middleware. When you begin a management session through HTTPS, the certificate selection window is displayed asking you to confirm the certificate.

After you select the client certificate from the drop-down menu, the HTTPS/SSL connection is resumed, and the SonicWALL security appliance checks the Client Certificate Issuer to verify that the client certificate is signed by the CA. If a match is found, the administrator login page is displayed. If no match is found, the browser displays a standard browser connection fail message, such as:

.....cannot display web page!

If OCSP is enabled, before the administrator login page is displayed, the browser performs an OCSP check and displays the following message while it is checking.

Client Certificate OCSP Checking.....

If a match is found, the administrator login page is displayed, and you can use your administrator credentials to continue managing the SonicWALL security appliance.

If no match is found, the browser displays the following message:

OCSP Checking fail! Please contact system administrator!

Troubleshooting User Lock Out

When using the client certificate feature, these situations can lock the user out of the SonicWALL security appliance:

To restore access to a user that is locked out, the following CLI commands are provided:

Managing Interface Tables

You can change the default size for management interface tables and their refresh rate.

Topics:

Changing the Default Size for Management Interface Tables

The Dell SonicWALL Management Interface allows you to control the display of large tables of information across all tables in the management Interface. You can change the default table page size in all tables displayed in the Management Interface from the default 50 items per page to any size ranging from 1 to 5,000 items. Some tables, including Active Connections Monitor, VPN Settings, and Log View, have individual settings for items per page that are initialized at login to the value configured here. After these pages are viewed, their individual settings are maintained. Subsequent changes made here affect these pages only following a new login.

To change the default table size:

Changing the Auto-Refresh Rate

You can set the interval for background auto-refresh of across all tables in the management Interface, such as Process Monitor, Active Connections Monitor, and Interface Traffic Statistics. You can change the default auto-refresh rate in all tables from the default 10 seconds to any rate ranging from 1 to 300 seconds.

To change the auto-refresh rate:

Displaying Threat Reports

To see the Dashboard > Threat Reports page first when you login, select the Use System Dashboard View as starting page checkbox. This is not selected by default.

Managing Tooltips

SonicOS introduced embedded tool tips for many elements in the SonicOS UI. These Tooltips are small pop-up dialogs that are displayed when you hover your mouse over a UI element. They provide brief information describing the element. Tooltips are displayed for many forms, buttons, table headings and entries.

NOTE: Not all UI elements have Tooltips. If a Tooltip does not display after hovering your mouse over an element for a couple of seconds, you can safely conclude that it does not have an associated Tooltip.

When applicable, Tooltips display the minimum, maximum, and default values for form entries. These entries are generated directly from the SonicOS firmware, so the values are correct for the firmware you are using.

Tooltips are enabled by default. To disable Tooltips, deselect the Enable Tooltip checkbox, which is selected by default. You can configure the duration before Tooltips display for forms, buttons, and text.