SonicWALL CSa 1000 User manual

Capture Security Appliance
Getting Started Guide

Contents
Introduction 3
Technical Overview 4
Deployment Examples 6
Prerequisites for CSa Deployment 8
High-Level Task List 9
Hardware Overview 10
Connect and Power On 13
Change the Administrator Password 14
Initial Setup Using Web Management 15
Register and License 19
Upgrade the Firmware 22
Configure Allowed Devices 24
Related Documents for Additional Configuration 26
Creating a MySonicWall Account 27
SonicWall Support 29
About This Document 30
Capture Security Appliance 1000 Getting Started Guide
Contents
2

Introduction
Welcome to the SonicWall Capture Security Appliance Getting Started Guide. This guide provides the
information you need to deploy your Capture Security Appliance (CSa) in your network, configure the initial
settings, and prepare it to start analyzing suspicious files from your firewalls, Email Security systems and API
connectors.
This Getting Started Guide supports the following SonicWall Capture Security Appliance:
lCSa 1000
Capture Security Appliance 1000 Getting Started Guide
Introduction
1
3

Technical Overview
The Capture Security Appliance provides the same Real-Time Deep Memory Inspection (RTDMI™) technology
used by the SonicWallCapture Advanced Threat Protection (Capture ATP) cloud service to protect your network
from malware. RTDMI does the following:
lProactively detects and blocks unknown mass-market malware via deep memory inspection in real time
lDetects and blocks malware that does not exhibit any malicious behavior and hides its weaponry via
custom encryption
lForces malware to “reveal” its weaponry into memory
lIdentifies and mitigates sophisticated attacks where weaponry is exposed for less than 100 nanoseconds
One benefit of the Capture Security Appliance is that it brings the power of RTDMI into an appliance form factor to
serve customers who, due to geographical, regulatory or organizational requirements, cannot send files to the
cloud for ATP analysis.
Benefits of the Capture Security Appliance:
lMemory-based inspection with RTDMI
lMulti-stage analysis with reputation check, static analysis and dynamic analysis
lAPI access for threat analysis
lBroad file type support
lBlock until verdict support
lHigh-security effectiveness
lReporting
lRole-Based access
You can connect the Capture Security Appliance to a supported SonicWall firewall and/or SonicWall Email
Security appliance, or to an API Connector.
Because the Capture Security Appliance is IP addressable, it does not need to be connected directly to a firewall
or Email Security appliance in order to process files. You can connect an API Connector to the CSa and pass files
to it for analysis, run scripts that generate reports, and use other features via API. Refer to
https://github.com/sonicwall for resources describing how to use the Capture ATP API.
Capture Security Appliance 1000 Getting Started Guide
Technical Overview
2
4

To utilize the Capture Security Appliance with a connected firewall, the firewall must be able to ping and
communicate via UDP port 2259. Email Security and API scripts need to be able to ping and access the Capture
Security Appliance via HTTPS. As long as the firewalls ,Email Security or API Connector can ping the CSa, it is
operational.
The Capture Security Appliance operates in one-arm mode. Traffic does not pass through it and the CSa does
not sniff files from the network. Files must be sent to the CSa by the supported sources (firewall, Email Security or
API).
The current capabilities of the Capture Security Appliance include:
lAnalysis:
lGlobal Verdict Lookup – SHA256 reputation lookup is performed before proceeding to static and
dynamic analysis.
lRTDMI Static & Dynamic Analysis
lWhitelist / Blacklist
lUser Role Management – Ability to create various roles (such as security analyst, network engineer) and
control what the various roles can see, access and edit.
lScheduled Reporting & Alerts – Ability to create scheduled reports for groups of file sources on a
schedule.
lSecurity Dashboard – Provides a quick glance at file activity.
lConfiguration Backup & Management – Provides safe upgrade/downgrade operations.
lAPI Access – Provides access for file analysis.
Capture Security Appliance 1000 Getting Started Guide
Technical Overview
5

Deployment Examples
There are three primary deployments for the Capture Security Appliance:
lSingle Office/Single Location
The CSa can be deployed anywhere on the network. It must be reachable via an IP address, and
SonicWall firewalls connected to it must be able to access it via UDP on port 2259.
Firewalls and Email Security systems can send suspicious files to the CSa for analysis within the local
network, rather than using the SonicWall Capture ATP cloud service.
lDistributed Enterprise / Multiple Locations
Multiple offices or branches can share access to a single CSa device, deployed either in the headquarters
data center or in a remote data center accessible by all devices.
Files can be sent to the CSa directly over the internet or over VPN.
You can use either SonicWall GMS or the cloud-based NSM centralized management solutions for rapid
configuration of multiple SonicWall systems to point to the CSa.
Capture Security Appliance 1000 Getting Started Guide
Deployment Examples
3
6

lREST API Gateway
The Capture Security Appliance has a REST API interface that can be used to submit files for analysis and
query results by threat intelligence teams via their own scripts, web-portal integrations and other security
products.
Instructions on how to get started with API scripting for the CSa along with code samples are available at
https://github.com/sonicwall.
Capture Security Appliance 1000 Getting Started Guide
Deployment Examples
7

Prerequisites for CSa Deployment
The following SonicWall appliances and versions are supported in a Capture Security Appliance deployment:
lCapture Security Appliance running 1.2.0 or newer
lFirewalls running SonicOS/X 7.0.0 or newer
lFirewalls running SonicOS 6.5.4.6 or newer
lEmail Security running 10.0.6 or newer
Additional prerequisites include:
lMySonicWall account
lIntelligence Updates license for the CSa
lREST API license for the CSa, if using REST APIfrom an APIConnector
lCapture ATP license on firewalls and Email Security
Capture Security Appliance 1000 Getting Started Guide
Prerequisites for CSa Deployment
4
8

High-Level Task List
The following are the steps for a successful deployment of your Capture Security Appliance:
1. Physically connect the CSa to your network device and management computer
2. Log into the CSa
3. Change the admin account password (highly recommended)
4. Set up networking (critical, will not operate otherwise)
After this step, you can manage your CSa from either the X0 or the WAN interface. Using X0 allows
management traffic to be on a separate subnet, while using the WAN interface allows you to manage the
CSa from a remote location via the internet.
5. Register and license your CSa (critical, will not operate otherwise)
6. Update firmware on your CSa (highly recommended)
7. Add allowed devices and other sources that can send files for analysis to the CSa (critical, will not operate
otherwise)
These tasks are described in this Getting Started Guide.
For information about additional configuration of your Capture Security Appliance and configuring your firewalls,
Email Security system or API Connectors to use your CSa, refer to the Related Documents for Additional Configuration
section.
Capture Security Appliance 1000 Getting Started Guide
High-Level Task List
5
9

Hardware Overview
This section describes the hardware components of the CSa 1000 appliance.
FRONT PANEL ILLUSTRATION
Item Description
ALCD controls
BDisplay port - Disabled
CConsole port for serial connection
Settings are: Speed=115200, Data bits=8, Stop bits=1, Parity=None, Flow control=None
DUSB ports
FRONT PANEL COMPONENT DESCRIPTIONS
Capture Security Appliance 1000 Getting Started Guide
Hardware Overview
6
10