U0_interface

U0_interface

Configuring the U0 External 3G/Modem Interface

The SonicWALL TZ 200 security appliances support an external 3G/mobile or analog modem interface. This interface is listed at the bottom of the Interface Settings table as the U0 interface. A number of the settings for the external interface can be configured from the Network > Interfaces page, but it can be more thoroughly configured using the pages on the 3G or Modem tab in the left-side navigation bar.

For complete information on configuring a 3G or analog modem external interface, see 3G/4G/Modem.

Specifying the WAN Connection Model

Note: The WAN Connection Model drop-down menu is only displayed when the U0 interface is configured for a 3G/mobile external interface. This menu item is not displayed when the U0 interface is configured for an analog modem.

To configure the WAN connection model, navigate to the Network > Interfaces page and select one of the following options in the WAN Connection Model drop-down menu:

For a detailed explanation of the behavior of the Ethernet with 3G Failover setting see Understanding 3G/4G Connection Types.

Configuring SonicWALL PortShield Interfaces (TZ series, NSA 240, and NSA 2400MX)

PortShield architecture enables you to configure some or all of the LAN ports into separate security contexts, providing protection not only from the WAN and DMZ, but between devices inside your network as well. In effect, each context has its own wire-speed PortShield that enjoys the protection of a dedicated, deep packet inspection firewall.

PortShield is supported on SonicWALL TZ Series, NSA 240, and NSA 2400MX appliances.

Tip: Zones can always be applied to multiple interfaces in the Network > Interfaces page, even without the use of PortShield groupings. However, these interfaces will not share the same network subnet unless they are grouped using PortShield.

You can assign any combination of ports into a PortShield interface. All ports you do not assign to a PortShield interface are assigned to the LAN interface.

To configure a PortShield interface, perform the following steps:

  1. Click on the Network > Interfaces page.
  2. Click the Configure button for the interface you want to configure. The Edit Interface window displays.
  3. In the Zone pulldown menu, select on a zone type option to which you want to map the interface.

    4. Note: You can add PortShield interfaces only to Trusted, Public, and Wireless zones.

  4. In the IP Assignment pulldown menu, select PortShield Switch Mode.
  5. In the PortShield to pulldown menu, select the interface you want to map this port to. Only ports that match the zone you have selected are displayed.

Configuring VLAN Subinterfaces (SonicWALL NSA series appliances)

VLAN subinterfaces are supported on SonicWALL NSA series appliances. When you add a VLAN subinterface, you need to assign it to a zone, assign it a VLAN Tag, and assign it to a physical interface. Based on your zone assignment, you configure the VLAN subinterface the same way you configure a physical interface for the same zone.

Adding a virtual interface

  1. In the left-navigation menu click on Network and then Interfaces to display the Network > Interfaces page.
  2. At the bottom of the Interface Settings table, click Add Interface. The Edit Interface window displays.
  3. Select a zone to assign to the interface. You can select LAN, WAN, DMZ, WLAN, or a custom zone. The zone assignment does not have to be the same as the parent (physical) interface. In fact, the parent interface can even remain Unassigned.

    4. Your configuration choices for the network settings of the subinterface depend on the zone you select.

  4. Assign a VLAN tag (ID) to the subinterface. Valid VLAN ID’s are 1 to 4095, although some switches reserve VLAN 1 for native VLAN designation. You will need to create a VLAN subinterface with a corresponding VLAN ID for each VLAN you wish to secure with your security appliance.
  5. Declare the parent (physical) interface to which this subinterface will belong. There is no per-interface limit to the number of subinterfaces you can assign – you may assign subinterfaces up to the system limit.
  6. Configure the subinterface network settings based on the zone you selected. See the interface configuration instructions earlier in this chapter:
  7. Select the management and user-login methods for the subinterface.
  8. Click OK.

Configuring Layer 2 Bridge Mode

See the following sections:

Configuration Task List for Layer 2 Bridge Mode

Configuring the Common Settings for L2 Bridge Mode Deployments

The following settings need to be configured on your SonicWALL UTM appliance prior to using it in most of the Layer 2 Bridge Mode topologies.

Licensing Services

When the appliance is successfully registered, go to the System > Licenses page and click Synchronize under Manage Security Services Online. This will contact the SonicWALL licensing server and ensure that the appliance is properly licensed.

To check licensing status, go to the System > Status page and view the license status of all the UTM services (Gateway Anti-Virus, Anti-Spyware, and Intrusion Prevention).

Disabling DHCP Server

When using a SonicWALL UTM appliance in Layer 2 Bridge Mode in a network configuration where another device is acting as the DHCP server, you must first disable its internal DHCP engine, which is configured and running by default. On the Network > DHCP Server page, clear the Enable DHCP Server check box, and then click on the Accept button at the top of the screen.

Configuring SNMP Settings

On the System > Administration page, make sure the checkbox next to Enable SNMP is checked, and then click on the Accept button at the top of the screen.

Then, click the Configure button. On the SNMP Settings page, enter all the relevant information for your UTM appliance: the GET and TRAP SNMP community names that the SNMP server expects, and the IP address of the SNMP server. Click OK to save and activate the changes.

Enabling SNMP and HTTPS on the Interfaces

On the Network > Interfaces page, enable SNMP and HTTP/HTTPS on the interface through which you will be managing the appliance.

Enabling Syslog

On the Log > Syslog page, click on the Add button and create an entry for the syslog server. Click OK to save and activate the change.

Activating UTM Services on Each Zone

On the Network > Zones page, for each zone you will be using, make sure that the UTM services are activated.

Then, on the Security Services page for each UTM service, activate and configure the settings that are most appropriate for your environment.

An example of the Gateway Anti-Virus settings is shown below:

An example of the Intrusion Prevention settings is shown below:

An example of the Anti-Spyware settings is shown below:

Creating Firewall Access Rules

If you plan to manage the appliance from a different zone, or if you will be using a server such as the HP PCM+/NIM server for management, SNMP, or syslog services, create access rules for traffic between the zones. On the Firewall > Access Rules page, click on the icon for the intersection of the zone of the server and the zone that has users and servers (your environment may have more than one of these intersections). Create a new rule to allow the server to communicate with all devices in that zone.

Configuring Log Settings

On the Log > Categories page, set the Logging Level to Informational and the Alert Level to Critical. Click Accept to save and activate the change.

Then, go to the Log > Name Resolution page and set the Name Resolution Method to DNS then NetBios. Click Accept to save and activate the change.

Configuring Wireless Zone Settings

In the case where you are using a HP PCM+/NIM system, if it will be managing a HP ProCurve switch on an interface assigned to a WLAN/Wireless zone, you will need to deactivate two features, otherwise you will not be able to manage the switch. Go to the Network > Zones page and select your Wireless zone. On the Wireless tab, clear the checkboxes next to Only allow traffic generated by a SonicPoint and WiFiSec Enforcement. Click OK to save and activate the change.

Configuring Layer 2 Bridge Mode Procedure

Refer to the L2 Bridge Interface Zone Selection for choosing a topology that best suits your network. In this example, we will be using a topology that most closely resembles the Simple L2 Bridge Topology.

Choose an interface to act as the Primary Bridge Interface. Refer to the L2 Bridge Interface Zone Selection for information in making this selection. In this example, we will use X1 (automatically assigned to the Primary WAN):

Configuring the Primary Bridge Interface

  1. Select the Network tab, Interfaces folder from the navigation panel.
  2. Click the Configure icon in the right column of the X1 (WAN) interface.
  3. Configure the interface with a Static IP address (e.g. 192.168.0.12).

    4. Note: The Primary Bridge Interface must have a Static IP assignment.

  4. Configure the default gateway. This is required for the security appliance itself to reach the Internet. (This applies only to WAN interfaces.)
  5. Configure the DNS server. (This applies only to WAN interfaces.)
  6. Configure management (HTTP, HTTPS, Ping, SNMP, SSH, User Logins, HTTP Redirects).
  7. Click OK.

Choose an interface to act as the Secondary Bridge Interface. Refer to the L2 Bridge Interface Zone Selection for information in making this selection. In this example, we will use X0 (automatically assigned to the LAN):

Configuring the Secondary Bridge Interface

  1. On the Network > Interfaces page, click the Configure icon in the right column of the X0 (LAN) interface.
  2. In the IP Assignment drop-down list, select Layer 2 Bridged Mode.
  3. In the Bridged to drop-down list, select the X1 interface.
  4. Configure management (HTTP, HTTPS, Ping, SNMP, SSH, User Logins, HTTP Redirects).
  5. You may optionally enable the Block all non-IPv4 traffic setting to prevent the L2 bridge from passing non-IPv4 traffic.

    6. VLAN Filtering (SonicWALL NSA series appliances)

  6. Click OK.

The Network > Interfaces page displays the updated configuration:

You may now apply security services to the appropriate zones, as desired. In this example, they should be applied to the LAN, WAN, or both zones.

VLAN Integration with Layer 2 Bridge Mode (SonicWALL NSA series appliances)

VLANs are supported on SonicWALL NSA series appliances. When a packet with a VLAN tag arrives on a physical interface, the VLAN ID is evaluated to determine if it is supported. The VLAN tag is stripped, and packet processing continues as it would for any other traffic. A simplified view of the inbound and outbound packet path includes the following potentially reiterative steps:

At this point, if the packet has been validated as acceptable traffic, it is forwarded to its destination. The packet egress path includes:

On egress, if the route policy lookup determines that the gateway interface is a VLAN subinterface, the packet is tagged (encapsulated) with the appropriate VLAN ID header. The creation of VLAN subinterfaces automatically updates the SonicWALL’s routing policy table:

The auto-creation of NAT policies, Access Rules with regard to VLAN subinterfaces behave exactly the same as with physical interfaces. Customization of the rules and policies that govern the traffic between VLANs can be performed with customary SonicOS ease and efficiency.

When creating a zone (either as part of general administration, or as a step in creating a subinterface), a checkbox will be presented on the zone creation page to control the auto-creation of a GroupVPN for that zone. By default, only newly created Wireless type zones will have ‘Create GroupVPN for this zone’ enabled, although the option can be enabled for other zone types by selecting the checkbox during creation.

Management of security services between VLAN subinterfaces is accomplished at the zone level. All security services are configurable and applicable to zones comprising physical interfaces, VLAN subinterfaces, or combinations of physical and VLAN subinterfaces.

Gateway Anti-Virus and Intrusion Prevention Services between the different workgroups can easily be employed with the use of VLAN segmentation, obviating the need for dedicated physical interfaces for each protected segment.

VLAN support enables organizations to offer meaningful internal security (as opposed to simple packet filtering) between various workgroups, and between workgroups and server farms without having to use dedicated physical interfaces on the SonicWALL.

Here the ability to assign VLAN subinterfaces to the WAN zone, and to use the WAN client mode (only Static addressing is supported on VLAN subinterfaces assigned to the WAN zone) is illustrated, along with the ability to support WAN Load Balancing and failover. Also demonstrated is the distribution of SonicPoints throughout the network by means of connecting them to access mode VLAN ports on workgroup switches. These switches are then backhauled to the core switch, which then connects all the VLANs to the appliance via a trunk link.

VPN Integration with Layer 2 Bridge Mode

When configuring a VPN on an interface that is also configured for Layer 2 Bridge mode, you must configure an additional route to ensure that incoming VPN traffic properly traverses the SonicWALL security appliance. Navigate to the Network > Routing page, scroll to the bottom of the page, and click on the Add button. In the Add Route Policy window, configure the route as follows:

Configuring IPS Sniffer Mode (SonicWALL NSA series appliances)

To configure the SonicWALL NSA appliance for IPS Sniffer Mode, you will use two interfaces in the same zone for the L2 Bridge-Pair. You can use any interfaces except the WAN interface. For this example, we will use X2 and X3 for the Bridge-Pair, and configure them to be in the LAN zone. The WAN interface (X1) is used by the SonicWALL appliance for access to the SonicWALL Data Center as needed. The mirrored port on the switch will connect to one of the interfaces in the Bridge-Pair.

This section contains the following topics:

Configuration Task List for IPS Sniffer Mode

Configuring the Primary Bridge Interface

  1. Select the Network tab, Interfaces folder from the navigation panel.
  2. Click the Configure icon in the right column of interface X2.
  3. In the Edit Interface dialog box on the General tab, select LAN from the Zone drop-down list.

    4. Note that you do not need to configure settings on the Advanced or VLAN Filtering tabs.

  4. For IP Assignment, select Static from the drop-down list.
  5. Configure the interface with a static IP Address (e.g. 10.1.2.3). The IP address you choose should not collide with any of the networks that are seen by the switch.

    6. Note: The Primary Bridge Interface must have a static IP assignment.

  6. Configure the Subnet Mask.
  7. Type in a descriptive comment.
  8. Select management options for the interface (HTTP, HTTPS, Ping, SNMP, SSH, User Logins, HTTP Redirects).
  9. Click OK.

Configuring the Secondary Bridge Interface

Our example continues with X3 as the secondary bridge interface.

  1. Select the Network tab, Interfaces folder from the navigation panel.
  2. Click the Configure icon in the right column of the X3 interface.
  3. In the Edit Interface dialog box on the General tab, select LAN from the Zone drop-down list.

    4. Note that you do not need to configure settings on the Advanced or VLAN Filtering tabs.

  4. In the IP Assignment drop-down list, select Layer 2 Bridged Mode.
  5. In the Bridged to drop-down list, select the X2 interface.
  6. Do not enable the Block all non-IPv4 traffic setting if you want to monitor non-IPv4 traffic.
  7. Select Never route traffic on this bridge-pair to ensure that the traffic from the mirrored switch port is not sent back out onto the network. (The Never route traffic on this bridge-pair setting is known as Captive-Bridge Mode.)
  8. Select Only sniff traffic on this bridge-pair to enable sniffing or monitoring of packets that arrive on the L2 Bridge from the mirrored switch port.
  9. Select Disable stateful-inspection on this bridge-pair to exempt these interfaces from stateful high availability inspection. If Deep Packet Inspection services are enabled for these interfaces, the DPI services will continue to be applied.
  10. Configure management (HTTP, HTTPS, Ping, SNMP, SSH, User Logins, HTTP Redirects).
  11. Click OK.

Enabling and Configuring SNMP

When SNMP is enabled, SNMP traps are automatically triggered for many events that are generated by SonicWALL Security Services such as Intrusion Prevention and Gateway Anti-Virus.


More than 50 IPS and GAV events currently trigger SNMP traps. The SonicOS Log Event Reference Guide contains a list of events that are logged by SonicOS, and includes the SNMP trap number where applicable. The guide is available online at http://www.sonicwall.com/us/Support.html by typing Log Event into the Search field at the top of the page.

To determine the traps that are possible when using IPS Sniffer Mode with Intrusion Prevention enabled, search for Intrusion in the table found in the Index of Log Event Messages section in the SonicOS Log Event Reference Guide. The SNMP trap number, if available for that event, is printed in the SNMP Trap Type column of the table.

To determine the possible traps with Gateway Anti-Virus enabled, search the table for Security Services, and view the SNMP trap number in the SNMP Trap Type column.

To enable and configure SNMP:

  1. Select the System tab, Administration folder from the navigation panel.
  2. Scroll down to the Advanced Management section.
  3. Select the Enable SNMP checkbox. The Configure button becomes active.
  4. Click Configure. The SNMP Settings dialog box is displayed.
  5. In the SNMP Settings dialog box, for System Name, type the name of the SNMP manager system that will receive the traps sent from the SonicWALL.
  6. Enter the name or email address of the contact person for the SNMP Contact
  7. Enter a description of the system location, such as “3rd floor lab”.
  8. Enter the system’s asset number.
  9. For Get Community Name, type the community name that has permissions to retrieve SNMP information from the SonicWALL, e.g. public.
  10. For Trap Community Name, type the community name that will be used to send SNMP traps from the SonicWALL to the SNMP manager, e.g. public.
  11. For the Host fields, type in the IP address(es) of the SNMP manager system(s) that will receive the traps.
  12. Click OK.

Configuring Security Services (Unified Threat Management)

The settings that you enable in this section will control what type of malicious traffic you detect in IPS Sniffer Mode. Typically you will want to enable Intrusion Prevention, but you may also want to enable other Security Services such as Gateway Anti-Virus or Anti-Spyware.

To enable Security Services, your SonicWALL must be licensed for them and the signatures must be downloaded from the SonicWALL Data Center. For complete instructions on enabling and configuring IPS, GAV, and Anti-Spyware, see the Security Services section in this guide.

Configuring Logging

You can configure logging to record entries for attacks that are detected by the SonicWALL.

To enable logging, perform the following steps:

  1. Select the Log tab, Categories folder from the navigation panel.
  2. Under Log Categories, select All Categories in the View Style drop-down list.
  3. In the Attacks category, enable the checkboxes for Log, Alerts, and Syslog.
  4. Click Apply.

Connecting the Mirrored Switch Port to a IPS Sniffer Mode Interface

Use a standard Cat-5 Ethernet cable to connect the mirrored switch port to either interface in the Bridge-Pair. Network traffic will automatically be sent from the switch to the SonicWALL where it can be inspected.

Consult the switch documentation for instructions on setting up the mirrored port.

Connecting and Configuring the WAN Interface to the Data Center

Connect the WAN port on the SonicWALL, typically port X1, to your gateway or to a device with access to the gateway. The SonicWALL communicates with the SonicWALL Data Center automatically. For detailed instructions on configuring the WAN interface, see Configuring a WAN Interface.

Configuring Wire Mode (SonicWALL NSA series appliances)

Adding to the broad collection of traditional modes of SonicOS interface operation, including all LAN modes (Static, NAT, Transparent Mode, L2 Bridge Mode, Portshield Switch Mode), and all WAN modes (Static, DHCP, PPPoE, PPTP, and L2TP), SonicOS 5.8 introduces Wire-Mode, which provides four new methods non-disruptive, incremental insertion into networks.

Table 1: Wire Mode Settings

Wire Mode Setting

Description

Bypass Mode

Bypass Mode allows for the quick and relatively non-interruptive introduction of Wire Mode into a network. Upon selecting a point of insertion into a network (e.g. between a core switch and a perimeter firewall, in front of a VM server farm, at a transition point between data classification domains) the SonicWALL security appliance is inserted into the physical data path, requiring a very short maintenance window. One or more pairs of switch ports on the appliance are used to forward all packets across segments at full line rates. While Bypass Mode does not offer any inspection or firewalling, this mode allows the administrator to physically introduce the SonicWALL security appliance into the network with a minimum of downtime and risk, and to obtain a level of comfort with the newly inserted component of the networking and security infrastructure. The administrator can then transition from Bypass Mode to Inspect or Secure Mode instantaneously through a simple user-interface driven reconfiguration.

Inspect Mode

Inspect Mode extends Bypass Mode without functionally altering the low-risk, zero-latency packet path. Packets continue to pass through the SonicWALL security appliance, but they are also mirrored to the multi-core RF-DPI engine for the purposes of passive inspection, classification, and flow reporting. This reveals the appliance’s Application Intelligence and threat detection capabilities without any actual intermediate processing.

When Inspect Mode is selected, the Restrict analysis at resource limit option specifies whether all traffic is inspected. When this option is enabled (which is the default), the appliance scans the maximum number of packets it can process. The remaining packets are allowed to pass without inspection. If this option is disabled, traffic will be throttled in the flow of traffic exceeds the firewalls inspection ability.

Note: Disabling the Restrict analysis at resource limit option will reduce throughput if the rate of traffic exceeds the appliance’s ability to scan all traffic.

Secure Mode

Secure Mode is the progression of Inspect Mode, actively interposing the SonicWALL security appliance’s multi-core processors into the packet processing path. This unleashes the inspection and policy engines’ full-set of capabilities, including Application Intelligence and Control, Intrusion Prevention Services, Gateway and Cloud-based Anti-Virus, Anti-Spyware, and Content Filtering. Secure Mode affords the same level of visibility and enforcement as conventional NAT or L2 Bridge mode deployments, but without any L3/L4 transformations, and with no alterations of ARP or routing behavior. Secure Mode thus provides an incrementally attainable NGFW deployment requiring no logical and only minimal physical changes to existing network designs.

Tap Mode

Tap Mode provides the same visibility as Inspect Mode, but differs from the latter in that it ingests a mirrored packet stream via a single switch port on the SonicWALL security appliance, eliminating the need for physically intermediated insertion. Tap Mode is designed for use in environments employing network taps, smart taps, port mirrors, or SPAN ports to deliver packets to external devices for inspection or collection. Like all other forms of Wire Mode, Tap Mode can operate on multiple concurrent port instances, supporting discrete streams from multiple taps.

Restrict analysis at resource limit

To summarize the key functional differences between modes of interface configuration:

Table 2: Functionality of the Different Wire Mode Settings

Bypass Mode

Inspect Mode

Secure Mode

Tap Mode

L2 Bridge, Transparent, NAT, Route Modes

Active/Active Clustering 1

No

No

No

No

Yes

Application Control

No

No

Yes

No

Yes

Application Visibility

No

Yes

Yes

Yes

Yes

ARP/Routing/NAT 1

No

No

No

No

Yes

Comprehensive Anti-Spam Service 1

No

No

No

No

Yes

Content Filtering

No

No

Yes

No

Yes

DHCP Server 1

No

No

No

No

Yes 2

DPI Detection

No

Yes

Yes

Yes

Yes

DPI Prevention

No

No

Yes

No

Yes

DPI-SSL1

No

No

No

No

Yes

High-Availability 1 3

No

No

No

No

Yes

Link-State Propagation 4

Yes

Yes

Yes

No

No

SPI

No

Yes

Yes

Yes

Yes

TCP Handshake Enforcement 5

No

No

No

No

Yes

Virtual Groups 1

No

No

No

No

Yes

1 These functions or services are unavailable on interfaces configured in Wire Mode, but remain available on a system-wide level for any interfaces configured in other compatible modes of operation.

2 Not available in L2 Bridge Mode.

3 Not available on the E10100. Active/Passive HA can be achieved using Active/Active Clustering in singleton mode.

4Link State Propagation is a feature whereby interfaces in a Wire-Mode pair will mirror the link-state triggered by transitions of their partners. This is essential to proper operations in redundant path networks, in particular.

5 Disabled by design in Wire Mode to allow for failover events occurring elsewhere on the network to be supported when multiple Wire-Mode paths, or when multiple SonicWALL security appliance units are in use along redundant or asymmetric paths.

Note: When operating in Wire-Mode, the SonicWALL security appliance’s dedicated “Management” interface will be used for local management. To enable remote management and dynamic security services and application intelligence updates, a WAN interface (separate from the Wire-Mode interfaces) must be configured for Internet connectivity. This is easily done given that SonicOS supports interfaces in mixed-modes of almost any combination.

To configure an interface for Wire Mode, perform the following steps:

  1. On the Network > Interfaces page, click the Configure button for the interface you want to configure for Wire Mode.
  2. In the Zone pulldown menu, select LAN.
  3. To configure the Interface for Tap Mode, in the Mode / IP Assignment pulldown menu, select Tap Mode (1-Port Tap) and click OK.
  4. To configure the Interface for Wire Mode, in the Mode / IP Assignment pulldown menu, select Wire Mode (2-Port Wire).
  5. In the Wire Mode Type pulldown menu, select the appropriate mode:
  6. When Inspect Mode is selected, the Restrict analysis at resource limit option is displayed. It is enabled by default. When this option is enabled, the appliance scans the maximum number of packets it can process. The remaining packets are allowed to pass without inspection. If this option is disabled, traffic will be throttled in the flow of traffic exceeds the firewalls inspection ability.

    7. Note: Disabling the Restrict analysis at resource limit option will reduce throughput if the rate of traffic exceeds the appliance’s ability to scan all traffic.

  7. In the Paired Interface pulldown menu, select the interface that will connect to the upstream firewall. The paired interfaces must be of the same type (two 1 GB interfaces or two 10 GB interfaces).

    8. Note: Only unassigned interfaces are available in the Paired Interface pulldown menu. To make an interface unassigned, click on the Configure button for it, and in the Zone pulldown menu, select Unassigned.

  8. Click OK.

Configuring Interfaces for IPv6

For complete information on SonicWALL’s implementation of IPv6, see the Appendix C: IPv6 Appendix.

IPv6 interfaces are configured on the Network > Interfaces page by clicking the IPv6 option for the View IP Version radio button at the top right corner of the page.

By default, all IPv6 interfaces appear as routed with no IP address. Multiple IPv6 addresses can be added on the same interface. Auto IP assignment can only be configured on WAN interfaces.

Each interface can be configured to receive router advertisement or not. IPv6 can be enabled or disabled on each interface.

Note: The zone assignment for an interface must be configured through the IPv4 interface page before switching to IPv6 mode.

The following sections describe IPv6 interface configuration:

IPv6 Interface Configuration Constraints

Configuring an Interface for IPv6 Static Mode

Static mode provides user a way to assign static IPv6 address as opposed to an auto-assigned address. Using static mode, the IPv6 interface can still listen for Router Advertisements and learn an autonomous address from the appropriate prefix option. Static Mode does not disturb the running of Stateless Address Autoconfiguration on IPv6 interface unless the user manually disables it.

The following diagram shows a sample topology with IPv6 configured in static mode.

3 types of IPv6 address are possible to assign under this mode:

To configure an interface for a static IPv6 address, perform the following steps:

  1. Navigate to the Network > Interfaces page.
  2. Click on the IPv6 button at the top right corner of the page. IPv6 addresses for the appliance are displayed.
  3. Click on the Configure icon for the interface you want to configure an IPv6 address for. The Edit Interface window displays.

    4. Note: The zone assignment for interfaces must be configured on the IPv4 addressing page. To modify the zone assignment for an IPv6 interface, click the IPv4 button at the top right of the page, modify the zone for the interface, and then return to the IPv6 interface page.

  4. In the IP Assignment pulldown menu, select Static.
  5. Enter the IPv6 Address for the interface.
  6. Enter the Prefix Length for the address.
  7. If this is the primary WAN interface, enter the IPv6 address of the Default Gateway. If this is not the primary WAN interface, any Default Gateway entry will be ignored, so you can leave this as ::. (The double colon is the abbreviation for an empty address, or 0:0:0:0:0:0:0:0.)
  8. If this is the primary WAN interface, enter up to three DNS Server IPv6 addresses. Again, if this is not the primary WAN interface, any DNS Server entries will be ignored.
  9. Select Enable Router Advertisement to make this an advertising interface that distributes network and prefix information.
  10. Select Advertise Subnet Prefix of IPv6 Primary Static Address to add a default prefix into the interface advertising prefix list. This prefix is the subnet prefix of interface IPv6 primary static address. This option will help all hosts on the link stay in the same subnet.

Configuring Advanced IPv6 Interface Options and Multiple IPv6 Addresses

Perform the following steps to modify Advanced IPv6 interface options or to configure multiple static IPv6 addresses.

  1. In the Edit Interface window, click on the Advanced tab.
  2. Click the Add Address button to configure multiple static IPv6 addresses for the interface.

    3. Note: Multiple IPv6 addresses can only be added for an interface that is configured for Static IPv6 address mode. Multiple IPv6 addresses cannot be configured for Auto or DHCPv6 modes.

  3. Enter the IPv6 Address for the additional address for the interface.
  4. Enter the Prefix Length for the address.
  5. Select Advertise Subnet Prefix of IPv6 Primary Static Address to add a default prefix into the interface advertising prefix list. This prefix is the subnet prefix of interface IPv6 primary static address. This option will help all hosts on the link stay in the same subnet.
  6. Click OK.
  7. The following additional options can be configured on the Advanced tab under the Advanced Settings heading:

Similar with IPv4 gratuitous ARP, IPv6 node uses Neighbor Solicitation message to detect duplicate IPv6 address on the same link. DAD must be performed on any Unicast address (except Anycast address) before assigning a tentative to an IPv6 interface.

Configuring Router Advertisement Settings

Router Advertisement allows IPv6 routers to advertise DNS recursive server addresses to IPv6 hosts. Router Advertisement-based DNS configuration is a useful, optional alternative in networks where an IPv6 host's address is autoconfigured through IPv6 stateless address autoconfiguration, and where the delays in acquiring server addresses and communicating with the servers are critical. Router Advertisement allows the host to acquire the nearest server addresses on every link. Furthermore, it learns these addresses from the same RA message that provides configuration information for the link, thereby avoiding an additional protocol run. This can be beneficial in some mobile environments, such as with Mobile IPv6. SonicWALL’s implementation of IPv6 is full conformable with RFC 4861 in Router and Prefix Discovery.

Note: Router Advertisement can only be enabled when interface is under Static mode.

To configure Router Advertisement for an IPv6 interface, perform the following steps.

  1. In the Edit Interface window, click on the Router Advertisement tab.
  2. Select the Enable Router Advertisement checkbox to have make this an advertising interface that will distribute network and prefix information.
  3. Optionally, you can modify the following Router Advertisement settings:
  4. Select the Managed checkbox to set the managed address configuration flag in the Router Advertisement message. If set, it indicates that IPv6 addresses are available via Dynamic Host Configuration Protocol.
  5. Select the Other Configuration checkbox to set the Other configuration flag in Router Advertisement message. If set, it indicates that other configuration information is available via Dynamic Host Configuration Protocol.

Configuring Router Advertisement Prefix Settings

  1. Click the Add Prefix button to configure an advertising prefix. Advertising prefixes are used for providing hosts with prefixes for on-link determination and Address Autoconfiguration.
  2. Enter the Prefix that is to be advertised with the Router Advertisement message.
  3. Enter the Valid Lifetime to set the length of time (in minutes) that the prefix is valid for the purpose of on-link determination. A value of “71582789” means the lifetime is infinite.
  4. Enter the Preferred Lifetime to set the length of time that addresses generated from the prefix via stateless address autoconfiguration remain preferred. A value of “71582789” means the lifetime is infinite.
  5. Optionally click the On-link checkbox to enable the on-link flag in Prefix Information option, which indicates that this prefix can be used for on-link determination.
  6. Optionally click the Autonomous checkbox to enable the autonomous address-configuration flag in Prefix Information option, which indicates that this prefix can be used for stateless address configuration.
  7. Click OK.

Configuring an Interface for DHCPv6 Mode

DHCPv6 (DHCP for IPv6) is a client/server protocol that provides stateful address configuration or stateless configuration setting for IPv6 hosts. DHCPv6 client is enabled to learn IPv6 address and network parameters when interface is configured to DHCPv6 mode.

DHCPv6 defines two different configuration modes:

The following diagram shows a sample DHCPv6 topology.

There are three types of IPv6 addresses that can be assign under DHCPv6:

To configure an interface for a DHCPv6 address, perform the following steps:

  1. Navigate to the Network > Interfaces page.
  2. Click on the IPv6 button at the top right corner of the page. IPv6 addresses for the appliance are displayed.
  3. Click on the Configure icon for the interface you want to configure an IPv6 address for. The Edit Interface window displays.
  4. In the IP Assignment pulldown menu, select DHCPv6.
  5. The following options can be configured for IPv6 interfaces configured for DHCPv6 mode:
  6. Set the DHCPv6 Mode for the interface. As required by RFC, DHCPv6 client depends on Router Advertisement message to decide which mode (stateful or stateless) it should choose. This definition will limit user's choice if they want to determine DHCPv6 mode by itself. SonicWALL’s implementation of DHCPv6 defines two different modes to balance the conformance and flexibility:
  7. Optionally, select the Only Request Stateless Information checkbox to have DHCPv6 clients only requests network parameter setting from the DHCPv6 server. The IPv6 address is assigned through stateless auto-configuration.
  8. Click OK to complete the configuration, or click the Advanced tab to configure Advanced options or click the Protocol tab to view DHCPv6 stateful and stateless configuration information.

Configuring Advanced Settings for an IPv6 Interface

The following options can be configured on the Advanced tab of the IPv6 Edit Interface window:

Similar with IPv4 gratuitous ARP, IPv6 node uses Neighbor Solicitation message to detect duplicate IPv6 address on the same link. DAD must be performed on any Unicast address (except Anycast address) before assigning a tentative to an IPv6 interface.

DHCPv6 Protocol Tab

When configuring an IPv6 interface in DHCpv6 mode, the Protocol tab displays additional DHCPv6 information.

The following information is displayed on the Protocol tab:

Configuring an Interface for Auto Mode

Auto mode utilities IPv6’s Stateless Address Autoconfiguration to assign IPv6 address. This mode does not require any manual address configuration by the network administrator. The firewall listens to the network and receives prefix information from neighboring routers. The IPv6 Stateless Address Autoconfiguration feature performs all configuration details, such as IPv6 address assignment, address deleting for address conflicting or lifetime expiration, and default gateway selection based on the information collected from on-link router.

Note: Auto mode can only be configured for the WAN zone. For security consideration, Auto mode is not available on LAN zone interface.

The following diagram shows a sample topology for IPv6 configured in Auto mode.

In this mode, 2 types of IPv6 address are possible to assign:

To configure an IPv6 interface for Auto mode, perform the following tasks:

  1. Navigate to the Network > Interfaces page.
  2. Click on the IPv6 button at the top right corner of the page. IPv6 addresses for the appliance are displayed.
  3. Click on the Configure icon for the interface you want to configure an IPv6 address for. The Edit Interface window displays.
  4. In the IP Assignment pulldown menu, select Auto.
  5. Optionally, you can select enter a numeric value for Duplicate Address Detection Transmits on the Advanced tab to specify the number of consecutive Neighbor Solicitation messages sent while performing Duplicate Address Detection (DAD) before assigning a tentative address to interface. A value of 0 indicates that DAD is not performed on the interface.
  6. Click OK.

Configuring IPv6 Tunnel Interfaces

For complete information on SonicWALL’s implementation of IPv6, see the Appendix C: IPv6 Appendix.

This section describes how to tunnel IPv4 packets through IPv6 networks and IPv6 packets through IPv4 networks. For instance, in order to pass IPv6 packets through the IPv4 network, the IPv6 packet will be encapsulated into an IPv4 packet at the ingress side of a tunnel. When the encapsulated packet arrives at the egress of the tunnel, the IPv4 packet will be de-capsulated.

Tunnels can be either automatic or manually configured. A configured tunnel determines the endpoint addresses by configuration information on the encapsulating node. An automatic tunnel determines the IPv4 endpoints from the address of the embedded IPv6 datagram. IPv4 multicast tunneling determines the endpoints through Neighbor Discovery.

The following diagram depicts an IPv6 to IPv4 tunnel.

The following sections describe IPv6 Tunnel Interface configuration:

Configuring the 6to4 Auto Tunnel

The 6to4 Auto Tunnel is an automatic tunnel: tunnel endpoints are extracted from the encapsulated IPv6 datagram. No manual configuration is necessary.

6to4 tunnels use a prefix of the form “2002:tunnel-IPv4-address::/48” to tunnel IPv6 traffic over IPv4. (for example, if the tunnel’s IPv4 endpoint has the address a01:203, the 6to4 tunnel prefix is “2002:a01:203::1.”) Routers advertise a prefix of the form “2002:[IPv4]:xxxx/64” to IPv6 clients. For complete information, see RFC 3056.

The following diagram shows a sample 6to4 auto tunnel topology.

In the example, customers do not need to specify the tunnel endpoint, but only need to enable the 6to4 auto tunnel. All packets with a 2002 prefix will be routed to the tunnel, and the tunnel's IPv4 destination will be extract from the destination IPv6 address.

6to4 tunnels are easy to configure and use. Users must have a global IPv4 address and IPv6 address, which must also have a 2002 prefix. Therefore, in general, user can only access network resource with a 2002 prefix.

Note: Only one 6to4 auto tunnel can be configured on the firewall.

To configure the 6to4 tunnel on the firewall, perform the following steps:

  1. Navigate to the Network > Interfaces page.
  2. Click the Add Interface button.
  3. Select the Zone for the 6to4 tunnel interface. This is typically the WAN interface.
  4. In the Tunnel Type pulldown menu, select 6to4 Auto Tunnel Interface.
  5. By default, the interface Name is set to 6to4AutoTun.
  6. Select the Enable IPv6 6to4 Tunnel checkbox.
  7. Optionally, you can configure Management login or User Login over the 6to4 tunnel.
  8. Click OK.

Configuring 6to4 Relay for Non-2002 Prefix Access

By default, 6to4 auto tunnel can only access the destination with a 2002 prefix. The 6to4 relay feature can be used to access non-2002 prefix destinations. To enable 6to4 relay, simply create a Route Policy to route all traffic destined for 2003 prefixes over the 6to4 auto tunnel interface, as shown in the following example.

This static route can be added on the 6to4 auto tunnel interface to enable the relay feature, which makes it possible to access the IPv6 destination with non-2002: prefix through 6to4 tunnel. Note that, the gateway must be the IPv6 address with the 2002: prefix.

Configuring a Manual Ipv6 Tunnel

To configure the 6to4 tunnel on the firewall, perform the following steps:

  1. Navigate to the Network > Interfaces page.
  2. Click the Add Interface button.
  3. Select the Zone for the tunnel interface.
  4. In the Tunnel Type pulldown menu, select IPv6 Manual Tunnel Interface.
  5. Enter a Name for the tunnel interface.
  6. Enter the Remote IPv4 address for the tunnel endpoint.
  7. For the Remote IPv6 network select an IPv6 Address object, which can be a group, range, network, or Host.
  8. Optionally, you can configure Management login or User Login over the 6to4 tunnel.
  9. Click OK.

Configuring a GRE IPv6 Tunnel

GRE can be used to tunnel IPv4 and IPv6 traffic over IPv4 or IPv6. GRE tunnels are static tunnels where both endpoints are specified manually. The following diagram shows a sample GRE IPv6 tunnel.

The configuration of a GRE tunnel is similar to a manual tunnel, except GRE Tunnel Interface is selected for the Tunnel Type.