SonicWALL CSa 1000 User manual

Capture Security Appliance
Getting Started Guide

Contents
Introduction 3
Technical Overview 4
Deployment Examples 6
Prerequisites for CSa Deployment 8
High-Level Task List 9
Hardware Overview 10
Connect and Power On 13
Change the Administrator Password 14
Initial Setup Using Web Management 15
Register and License 19
Upgrade the Firmware 22
Configure Allowed Devices 24
Related Documents for Additional Configuration 26
Creating a MySonicWall Account 27
SonicWall Support 29
About This Document 30
Capture Security Appliance 1000 Getting Started Guide
Contents
2

Introduction
Welcome to the SonicWall Capture Security Appliance Getting Started Guide. This guide provides the
information you need to deploy your Capture Security Appliance (CSa) in your network, configure the initial
settings, and prepare it to start analyzing suspicious files from your firewalls, Email Security systems and API
connectors.
This Getting Started Guide supports the following SonicWall Capture Security Appliance:
lCSa 1000
Capture Security Appliance 1000 Getting Started Guide
Introduction
1
3

Technical Overview
The Capture Security Appliance provides the same Real-Time Deep Memory Inspection (RTDMI™) technology
used by the SonicWallCapture Advanced Threat Protection (Capture ATP) cloud service to protect your network
from malware. RTDMI does the following:
lProactively detects and blocks unknown mass-market malware via deep memory inspection in real time
lDetects and blocks malware that does not exhibit any malicious behavior and hides its weaponry via
custom encryption
lForces malware to “reveal” its weaponry into memory
lIdentifies and mitigates sophisticated attacks where weaponry is exposed for less than 100 nanoseconds
One benefit of the Capture Security Appliance is that it brings the power of RTDMI into an appliance form factor to
serve customers who, due to geographical, regulatory or organizational requirements, cannot send files to the
cloud for ATP analysis.
Benefits of the Capture Security Appliance:
lMemory-based inspection with RTDMI
lMulti-stage analysis with reputation check, static analysis and dynamic analysis
lAPI access for threat analysis
lBroad file type support
lBlock until verdict support
lHigh-security effectiveness
lReporting
lRole-Based access
You can connect the Capture Security Appliance to a supported SonicWall firewall and/or SonicWall Email
Security appliance, or to an API Connector.
Because the Capture Security Appliance is IP addressable, it does not need to be connected directly to a firewall
or Email Security appliance in order to process files. You can connect an API Connector to the CSa and pass files
to it for analysis, run scripts that generate reports, and use other features via API. Refer to
https://github.com/sonicwall for resources describing how to use the Capture ATP API.
Capture Security Appliance 1000 Getting Started Guide
Technical Overview
2
4

To utilize the Capture Security Appliance with a connected firewall, the firewall must be able to ping and
communicate via UDP port 2259. Email Security and API scripts need to be able to ping and access the Capture
Security Appliance via HTTPS. As long as the firewalls ,Email Security or API Connector can ping the CSa, it is
operational.
The Capture Security Appliance operates in one-arm mode. Traffic does not pass through it and the CSa does
not sniff files from the network. Files must be sent to the CSa by the supported sources (firewall, Email Security or
API).
The current capabilities of the Capture Security Appliance include:
lAnalysis:
lGlobal Verdict Lookup – SHA256 reputation lookup is performed before proceeding to static and
dynamic analysis.
lRTDMI Static & Dynamic Analysis
lWhitelist / Blacklist
lUser Role Management – Ability to create various roles (such as security analyst, network engineer) and
control what the various roles can see, access and edit.
lScheduled Reporting & Alerts – Ability to create scheduled reports for groups of file sources on a
schedule.
lSecurity Dashboard – Provides a quick glance at file activity.
lConfiguration Backup & Management – Provides safe upgrade/downgrade operations.
lAPI Access – Provides access for file analysis.
Capture Security Appliance 1000 Getting Started Guide
Technical Overview
5

Deployment Examples
There are three primary deployments for the Capture Security Appliance:
lSingle Office/Single Location
The CSa can be deployed anywhere on the network. It must be reachable via an IP address, and
SonicWall firewalls connected to it must be able to access it via UDP on port 2259.
Firewalls and Email Security systems can send suspicious files to the CSa for analysis within the local
network, rather than using the SonicWall Capture ATP cloud service.
lDistributed Enterprise / Multiple Locations
Multiple offices or branches can share access to a single CSa device, deployed either in the headquarters
data center or in a remote data center accessible by all devices.
Files can be sent to the CSa directly over the internet or over VPN.
You can use either SonicWall GMS or the cloud-based NSM centralized management solutions for rapid
configuration of multiple SonicWall systems to point to the CSa.
Capture Security Appliance 1000 Getting Started Guide
Deployment Examples
3
6

lREST API Gateway
The Capture Security Appliance has a REST API interface that can be used to submit files for analysis and
query results by threat intelligence teams via their own scripts, web-portal integrations and other security
products.
Instructions on how to get started with API scripting for the CSa along with code samples are available at
https://github.com/sonicwall.
Capture Security Appliance 1000 Getting Started Guide
Deployment Examples
7

Prerequisites for CSa Deployment
The following SonicWall appliances and versions are supported in a Capture Security Appliance deployment:
lCapture Security Appliance running 1.2.0 or newer
lFirewalls running SonicOS/X 7.0.0 or newer
lFirewalls running SonicOS 6.5.4.6 or newer
lEmail Security running 10.0.6 or newer
Additional prerequisites include:
lMySonicWall account
lIntelligence Updates license for the CSa
lREST API license for the CSa, if using REST APIfrom an APIConnector
lCapture ATP license on firewalls and Email Security
Capture Security Appliance 1000 Getting Started Guide
Prerequisites for CSa Deployment
4
8

High-Level Task List
The following are the steps for a successful deployment of your Capture Security Appliance:
1. Physically connect the CSa to your network device and management computer
2. Log into the CSa
3. Change the admin account password (highly recommended)
4. Set up networking (critical, will not operate otherwise)
After this step, you can manage your CSa from either the X0 or the WAN interface. Using X0 allows
management traffic to be on a separate subnet, while using the WAN interface allows you to manage the
CSa from a remote location via the internet.
5. Register and license your CSa (critical, will not operate otherwise)
6. Update firmware on your CSa (highly recommended)
7. Add allowed devices and other sources that can send files for analysis to the CSa (critical, will not operate
otherwise)
These tasks are described in this Getting Started Guide.
For information about additional configuration of your Capture Security Appliance and configuring your firewalls,
Email Security system or API Connectors to use your CSa, refer to the Related Documents for Additional Configuration
section.
Capture Security Appliance 1000 Getting Started Guide
High-Level Task List
5
9

Hardware Overview
This section describes the hardware components of the CSa 1000 appliance.
FRONT PANEL ILLUSTRATION
Item Description
ALCD controls
BDisplay port - Disabled
CConsole port for serial connection
Settings are: Speed=115200, Data bits=8, Stop bits=1, Parity=None, Flow control=None
DUSB ports
FRONT PANEL COMPONENT DESCRIPTIONS
Capture Security Appliance 1000 Getting Started Guide
Hardware Overview
6
10

Item Description
EReset button
FPower button
GX0/X1 - 1 Gigabit interfaces
X0 is a Dedicated Management interface
X1 can be configured as a WAN interface and used for WAN management
HX2/X3 - 1 Gigabit interfaces
Can be configured as a WAN interface / WAN management
IX4/X5 - 1 Gigabit interfaces
Can be configured as a WAN interface / WAN management
JX6/X7 - 10G interface
Can be configured as a WAN interface / WAN management
SFP+ ports - Disabled
KDiagnostics port - For future use
LLED indicators – Top to bottom:
lHard disk drive activity
lAlarm condition:
lSolid Color 1 (Amber)- FIPS errors
lBlinking Color 2 (Red)- Approaching non operational state or in non operational state
lSlow Blink:
DISK > 75%
Licenses will expire in 60 days
lMedium Blink:
Disk > 85%
Licenses will expire in 30 days
lFast Blink:
Disk >95%
Licenses will expire in 15 days
lSolid Color - Non operational or degraded operation - Requires immediate attention
Disk full, overwriting old files
Licenses expired (Most Important)
lTest:
Off - All fine
Blinking - Non-operational state
On - In a mode where the user can interact
lPower 1 & 2:
Blue = Operating correctly
Yellow = Unconnected power supply or failure
Capture Security Appliance 1000 Getting Started Guide
Hardware Overview
11

BACK PANEL ILLUSTRATION
Item Descriptions
AHard drives (2 x 960GB storage modules, RAID)
BPrimary power supply
CFans (3)
DRedundant power supply
BACK PANEL COMPONENT DESCRIPTIONS
In addition to the two RAID disks that contain the appliance data, the CSa1000 also has internal storage used for
the operating system and maintenance which is not accessible or serviceable by users.
Capture Security Appliance 1000 Getting Started Guide
Hardware Overview
12

Connect and Power On
This section describes the initial physical setup of your Capture Security Appliance .
To connect and power on your Capture Security Appliance:
1. Install the appliance into a rack with your other networking equipment. The Capture Security Appliance is
designed to be mounted in a standard 19-inch rack mount cabinet. Follow the instructions provided in the
rack mounting kit shipped with the appliance.
2. Using a standard Ethernet cable, connect the CSa WAN (typically X1) interface to a switch that provides
access to the internet.
This is how the CSa will access licensing services, update servers and access reputation checks. The
WAN interface is also used for data transfer from your firewalls, Email Security system and API
Connectors. After completing the initial setup, you can use this interface to manage the device.
3. Using the provided Ethernet cable, connect X0 to your management computer. You can use this interface
for initial setup and device management by using your browser to access the web management interface.
NOTE: To access the CSa at its default IP address of 192.168.168.168, your computer must be
configured with an address on the 192.168.168.x/24 subnet, such as 192.168.168.100.
4. Optionally connect the RJ45 connector of the provided serial console cable to the Console port on the
CSa. Connect the DB-9 connector to a serial port on your network device.
This step is optional because CSa management is not supported from the command line interface (CLI)
via the console. The console is only used if the CSa cannot boot up normally or must be put into
maintenance mode (SafeMode) for system recovery.
5. Using the provided power cords, connect both the primary and redundant power supplies to an
appropriate AC power source (120V). The Power LEDs turn blue and the Test LED blinks until the CSa
comes up.
NOTE: To disconnect AC power, both power cords must be removed.
You are now ready to log into your Capture Security Appliance, change the admin password and perform the
initial setup. Continue to:
lChange the Administrator Password
lInitial Setup Using Web Management
Capture Security Appliance 1000 Getting Started Guide
Connect and Power On
7
13

Change the Administrator Password
For security, SonicWall recommends that you change the password for the administrator account as the first step
of the initial setup of your Capture Security Appliance.
To change the administrator password:
1. Log into the CSa web management interface as the administrator using the default credentials, admin /
password.
2. Navigate to the Configuration > User Management page.
3. Select the three-dotted menu (...) on the right of the user list to open the Edit User dialog.
4. Type the new password into both the New Password and Confirm Password fields.
5. Click Save.
Continue to Initial Setup Using Web Management.
Capture Security Appliance 1000 Getting Started Guide
Change the Administrator Password
8
14

Initial Setup Using Web Management
This section describes how to configure network settings on your Capture Security Appliance, including time zone
and mail server settings.
If you haven't already changed the password for the administrator account, SonicWall strongly recommends that
you do that right away. (Refer to Change the Administrator Password for instructions.)
To perform initial CSa setup using the web management interface:
1. Point your browser to https://192.168.168.168, the default LAN (X0) IP address.
2. Log into the CSa using the admin account credentials (default: admin/password).
3. Navigate to the Configuration > Network page.
4. Configure the following settings on the Network screen:
lIn the MANAGEMENT (X0) section, optionally change the IP address of the X0 interface. Set the
IPv4 field to an address on your local management subnet. The default is 192.168.168.168.
Change the Netmask field as needed for your subnet. The default is 255.255.255.0.
Capture Security Appliance 1000 Getting Started Guide
Initial Setup Using Web Management
9
15

lIn the WAN section, configure the following settings:
lIPv4 – This is the IPaddress of the WAN interface. Select DHCP addressing if your DHCP
server will provide an address, or enter a static IP address on your network. Any interface
except X0 can be selected as the WAN/Management interface, including the 10GbE X6/7
ports.
lNetmask – Enter the netmask for your network in a format such as 255.255.255.0 or
255.255.255.128.
lDefault Gateway – Enter the IP address of your gateway device, such as your perimeter
firewall.
lDNS 1 – Enter the IP address of your primary DNS server.
lDNS 2 (Optional) – Optionally enter the IP address of a secondary DNS server.
lIn the INTERNAL NETWORK section, optionally select a different subnet. The Internal Network is
used for internal communications among the components of the Capture Security Appliance. The
default is 172.24.0.0 – 172.31.255.255.
Capture Security Appliance 1000 Getting Started Guide
Initial Setup Using Web Management
16

If the default subnet overlaps with the CSa WAN or LAN (X0) subnets, you must select a different
subnet for the Internal Network from the Group list.
5. On the Time screen, select your timezone and optionally enter IP addresses for NTP Server 1,2and 3.
Capture Security Appliance 1000 Getting Started Guide
Initial Setup Using Web Management
17

6. On the Mail Server screen, optionally add your mail server settings. SonicWall recommends configuring a
mail server.
7. Click Save to save your changes.
8. Test connectivity from your management computer by pinging the appliance WAN IP that you just saved,
and by accessing it via HTTPS in your browser.
NOTE: The Management (X0) interface is only used for managing the Capture Security Appliance, while the
WAN interface is for data transfer. Therefore, all firewalls, Email Security systems and API Connectors
should connect to the CSa WAN interface.
You can manage the CSa on either the X0 or WAN interface.
You are now ready to register your Capture Security Appliance. Proceed to the Register and License section.
Capture Security Appliance 1000 Getting Started Guide
Initial Setup Using Web Management
18

Register and License
Registration and licensing is a critical step in the initial setup of your Capture Security Appliance. Without it, the
CSa will not perform file analysis, nor can you update its firmware.
If you do not yet have a MySonicWall account, you can easily create one as described in Creating a MySonicWall
Account.
To register and license your CSa:
1. Log into your MySonicWall account at https://www.mysonicwall.com.
2. On the My Workspace > Dashboard page, select the Tenant for your CSa.
3. Click the Register products button.
Capture Security Appliance 1000 Getting Started Guide
Register and License
10
19

4. On the Register Products page, enter the serial number, authentication code and friendly name of your
CSa into the indicated fields and then click Register.
MySonicWall indicates successful registration.
The Intelligence Updates license is activated.
5. Optionally activate a REST APIlicense for your Capture Security Appliance.
You need a separate license to use an APIConnector with the CSa, the REST API ACTIVATION FOR
SONICWALL CAPTURE APPLIANCE license. License SKUs are available starting at 1 year and up to 6
years in one-year increments.
6. Log into your CSa and navigate to the System > Registration/Licensing page.
Capture Security Appliance 1000 Getting Started Guide
Register and License
20