Configuration Task List

This section provides a list of the following configuration tasks:

Displaying Access Rules with View Styles

Access rules can be displayed in multiple views using SonicOS. You can select the type of view from the selections in the View Style section. The following View Styles are available:

TIP: You can also view access rules by zones. Use the Option checkboxes in the From Zone and To Zone column. Select LAN, WAN, VPN, ALL from the From Zone column. And then select LAN, WAN, VPN, ALL from the To Zone column. Click OK to display the access rules.

Each view displays a table of defined network access rules. For example, selecting All Rules displays all the network access rules for all zones.

Configuring Access Rules for a Zone

To display the Access Rules for a specific zone select a zone from the Matrix, Drop-down Boxes, or All Rules view.

The access rules are sorted from the most specific at the top, to less specific at the bottom of the table. At the bottom of the table is the Any rule. The default access rule is all IP services except those listed in the Access Rules page. Access rules can be created to override the behavior of the Any rule; for example, the Any rule allows users on the LAN to access all Internet services, including NNTP News.

You can change the priority ranking of an access rule by clicking the Arrows icon in the Priority column. The Change Priority dialog is displayed. Enter the new priority number (1-10) in the Priority field, and click OK.

TIP: If the Delete or Edit icons are dimmed (unavailable), the access rule cannot be changed or deleted from the list.

Adding Access Rules

TIP: Although custom access rules can be created that allow ingress IP traffic, the Dell SonicWALL security appliance does not disable protection from DoS attacks, such as the SYN Flood and Ping of Death attacks.

To add access rules to the Dell SonicWALL security appliance, perform the following steps:

Topics:

Displaying the Add Rule dialog

If the service is not listed, you must define the service in the Add Service dialog by selecting either:

If the service is not listed, you must define the service in the Add Service dialog by selecting either:

Selecting Create new network displays the Add Address Object dialog. If you want to define the source IP addresses that are affected by the access rule, such as restricting certain users from accessing the Internet:

TIP: To include all IP addresses, type an asterisk (*) in the Address Range Begin field.

Selecting Create New Network displays the Add Address Object dialog.

NOTE: Large IP packets are often divided into fragments before they are routed over the Internet and then reassembled at a destination host. One reason to disable this setting is because it is possible to exploit IP fragmentation in Denial of Service (DoS) attacks.

Advanced tab

QoS tab

Select a numeric value between 0 and 7:

BWM tab

To create a new bandwidth object, select Create new Bandwidth Object. For more information about creating bandwidth objects, see Configuring a Bandwidth Object .

To create a new bandwidth object, select Create new Bandwidth Object. For more information about creating bandwidth objects, see Configuring a Bandwidth Object .

Adding the rule

Editing an Access Rule

To display the Edit Rule dialog (includes the same settings as the Add Rule dialog), click the Edit icon.

Deleting an Access Rule

To delete the individual access rule, click on the Delete icon. To delete all the checkbox-selected access rules, click the Delete button.

Enabling and Disabling an Access Rule

To enable or disable an access rule, click the Enable checkbox.

Restoring Access Rules to Default Zone Settings

To remove all end-user configured access rules for a zone, click the Default button. This restores the access rules for the selected zone to the default access rules initially setup on the Dell SonicWALL network security appliance.

Displaying Access Rule Traffic Statistics

Move your mouse pointer over the Graph icon to display the following access rule receive (Rx) and transmit (Tx) traffic statistics:

Connection Limiting Overview

The Connection Limiting feature is intended to offer an additional layer of security and control when coupled with such SonicOS features as SYN Cookies and Intrusion Prevention Services (IPS). Connection limiting provides a means of throttling connections through the firewall using Access Rules as a classifier, and declaring the maximum percentage of the total available connection cache that can be allocated to that class of traffic.

Coupled with IPS, this can be used to mitigate the spread of a certain class of malware as exemplified by Sasser, Blaster, and Nimda. These worms propagate by initiating connections to random addresses at atypically high rates. For example, each host infected with Nimda attempted 300 to 400 connections per second, Blaster sent 850 packets per second, and Sasser was capable of 5,120 attempts per second. Typical, non-malicious network traffic generally does not establish anywhere near these numbers, particularly when it is Trusted ->Untrusted traffic (that is, LAN->WAN). Malicious activity of this sort can consume all available connection-cache resources in a matter of seconds, particularly on smaller appliances.

In addition to mitigating the propagation of worms and viruses, Connection limiting can be used to alleviate other types of connection-cache resource consumption issues, such as those posed by uncompromised internal hosts running peer-to-peer software (assuming IPS is configured to allow these services), or internal or external hosts using packet generators or scanning tools.

Finally, connection limiting can be used to protect publicly available servers (such as, Web servers) by limiting the number of legitimate inbound connections permitted to the server (that is, to protect the server against the Slashdot-effect). This is different from SYN flood protection which attempts to detect and prevent partially-open or spoofed TCP connection. This is most applicable for Untrusted traffic, but it can be applied to any zone traffic as needed.

Connection limiting is applied by defining a percentage of the total maximum allowable connections that may be allocated to a particular type of traffic. The above figures show the default LAN ->WAN setting, where all available resources may be allocated to LAN->WAN (any source, any destination, any service) traffic.

More specific rules can be constructed; for example, to limit the percentage of connections that can be consumed by a certain type of traffic (for example, FTP traffic to any destination on the WAN), or to prioritize important traffic (for example, HTTPS traffic to a critical server) by allowing 100% to that class of traffic, and limiting general traffic to a smaller percentage (minimum allowable value is 1%).

NOTE: It is not possible to use IPS signatures as a connection limiting classifier; only Access Rules (for example, Address Objects and Service Objects) are permissible.

Access Rule Configuration Examples

This section provides configuration examples on adding network access rules:

Enabling Ping

This section provides a configuration example for an access rule to allow devices on the DMZ to send ping requests and receive ping responses from devices on the LAN. By default your Dell SonicWALL network security appliance does not allow traffic initiated from the DMZ to reach the LAN.

To configure an access rule that allow devices in the DMZ to send ping requests and receive ping responses from devices in the LAN:

Blocking LAN Access for Specific Services

This section provides a configuration example for an access rule blocking LAN access to NNTP servers on the Internet during business hours.

To configure an access rule blocking LAN access to NNTP servers based on a schedule:

Allowing WAN Primary IP Access from the LAN Zone

By creating an access rule, it is possible to allow access to a management IP address in one zone from a different zone on the same firewall. For example, you can allow HTTP/HTTPS management or ping to the WAN IP address from the LAN side. To do this, you must create an access rule to allow the relevant service between the zones, giving one or more explicit management IP addresses as the destination. Alternatively, you can provide an address group that includes single or multiple management addresses (such as WAN Primary IP, All WAN IP, All X1 Management IP) as the destination. This type of rule allows the HTTP Management, HTTPS Management, SSH Management, Ping, and SNMP services between zones.

NOTE: Access rules can only be set for inter-zone management. Intra-zone management is controlled per-interface by settings in the interface configuration

To create a rule that allows access to the WAN Primary IP from the LAN zone:

NOTE: Do not select an address group or object representing a subnet, such as WAN Primary Subnet. This would allow access to devices on the WAN subnet (already allowed by default), but not to the WAN management IP address.

Enabling Bandwidth Management on an Access Rule

Bandwidth management can be applied on both ingress and egress traffic using access rules. Access rules displaying the Funnel icon are configured for bandwidth management.

TIP: Do not configure bandwidth management on multiple interfaces on a zone, where the configured guaranteed bandwidth for the zone is greater than the available bandwidth for the bound interface.

For information on configuring Bandwidth Management see Firewall Settings > BWM .