SonicWALL NSA 250M series User manual

SonicOS 7
Getting Started Guide
for the NSsp 13700 and NSa Series

Contents
Introduction 4
NSa Series Overview 5
Deployment Options 5
Internet Edge Deployment 6
Medium and Distributed Enterprises 7
NSa Hardware Features 7
NSa System Requirements 9
NSsp 13700 Overview 11
Features 11
Connectivity, Port Density and Performance 11
Firmware Features 12
Hardware Features 13
Front Panel 13
Rear Panel 17
System Specifications 17
Determining the WAN Type 19
System Setup 21
Default Settings 21
System Startup 22
Basic Configuration 23
Registration and Licensing 23
Creating a MySonicWall Account 24
Setup Options 25
Zero Touch 25
Setting Up with NSM 25
Setting Up with SonicExpress 28
Setting Up with CLI 29
Running the Setup Wizard 30
Testing and Troubleshooting Connectivity 32
Testing Your Internet Connection 32
Troubleshooting your Internet Connection 32
SonicOS 7 Getting Started Guide for the NSsp 13700 and NSa Series
Contents
2

Troubleshooting Your MGMT Connection 33
Troubleshooting Your LAN Connection 33
Using SafeMode 33
Migration Tool 34
About Migration 34
Using the Migration Tool 35
SonicWall Support 38
About This Document 39
SonicOS 7 Getting Started Guide for the NSsp 13700 and NSa Series
Contents
3

Introduction
Today’s distributed IT—where end points are on premises, in the cloud, in the data center, at a branch office or in
a home office—is creating an unprecedented explosion of exposure across organizations. As the exposure
points to multiply, business risks continue to escalate, and each one needs to be protected from today’s
sophisticated threats. SonicWall offers several firewall models to suit your business.
The NSa Series offers a mid-range solution. They are designed for businesses having 250 users and up. With
cloud-based and on-box capabilities like TLS/SSL decryption and inspection, application intelligence and control,
secure SD-WAN, real-time visualization, and WLAN management, the NSa Series provides flexible, fast and
cost-effective security to keep the threats out.
To resolve similar challenges for enterprise-level customers, the SonicWall Network Security services platform
(NSsp) is a high-end firewall series delivering advanced threat protection and fast speeds demanded by large
enterprises, data centers and service providers. The NSsp 13700 is the enterprise firewall to replace existing NSa
9650 firewalls.
This document describes how to get started on one of the firewalls from the NSa Series or on the NSsp 13700.
These systems run classic SonicOS 7. It also includes information on how to migrate the configuration settings
from older firewalls to firewalls covered by this document.
NOTE: This document does not include information pertaining to the NSsp 15700. For more information
about that firewall, refer to SonicOSX7 NSsp 15700 Getting Started Guide.
Topics in this document include:
lNSa Series Overview
lNSsp 13700 Overview
lDetermining the WAN Type
lSystem Setup
lSetup Options
lRunning the Setup Wizard
lTesting and Troubleshooting Connectivity
lMigration Tool
SonicOS 7 Getting Started Guide for the NSsp 13700 and NSa Series
Introduction
1
4

NSa Series Overview
The NSa Series offers a mid-range solution. They are designed for businesses having 250 users and up. With
cloud-based and on-box capabilities like TLS/SSL decryption and inspection, application intelligence and control,
secure SD-WAN, real-time visualization, and WLAN management, the NSa Series provides flexible, fast and
cost-effective security to keep the threats out.
The updated NSa Series has been built from the ground up with the latest hardware components, all designed to
deliver multi-gigabit threat prevention throughput — even for encrypted traffic. The firewalls support high port
density, including multiple 40 GbE and 10 GbE ports, hardware redundancy with high availability, and dual power
supplies, depending on the model.
This section describes how to get started on one of the firewalls from the NSa Series:
lDeployment Options
lNSa Hardware Features
lNSa System Requirements
Deployment Options
The NSa Series has two main deployment options for medium and distributed enterprises:
lInternet Edge Deployment
lMedium and Distributed Enterprises
SonicOS 7 Getting Started Guide for the NSsp 13700 and NSa Series
NSa Series Overview
2
5

Internet Edge Deployment
In this standard deployment option, the NSa Series—a next generation firewall (NGFW)—protects private
networks from malicious traffic coming from the internet.
It allows you to:
lDeploy a proven NSa Series solution with highest performance and port density (including 40 GbE and 10
GbE connectivity) in its class
lGain visibility and inspect encrypted traffic, including TLS 1.3, to block evasive threats coming from the
Internet — all without compromising performance
lProtect your enterprise with integrated security, including malware analysis, cloud app security, URL
filtering and reputation services
lSave space and money with an integrated solution that includes advanced security and networking
capabilities
lReduce complexity and maximize efficiency using a central management system delivered through an
intuitive single-pane of-glass user interface
SonicOS 7 Getting Started Guide for the NSsp 13700 and NSa Series
NSa Series Overview
6

Medium and Distributed Enterprises
The SonicWall NSa Series supports SD-WAN and can be centrally managed, making it an ideal fit for medium
and distributed enterprises.
This deployment allows organizations to:
lFuture-proof against an ever-changing threat landscape by investing in a firewall with multi-gigabit threat
analysis performance
lProvide direct and secure internet access to distributed branch offices instead of back-hauling through
corporate headquarters
lAllow distributed branch offices to securely access internal resources in corporate headquarters or in a
public cloud, significantly improving application latency
lAutomatically block threats that use encrypted protocols such as TLS 1.3, securing networks from the
most advanced attacks
lReduce complexity and maximize efficiency using a central management system delivered through an
intuitive single pane of glass user interface
lLeverage high port density that includes 40 GbE and 10 GbE connectivity to support a distributed
enterprise and wide area networks
NSa Hardware Features
The following images show the front and back panel of each of the NSa Series firewalls. The ports and key
features are also identified.
SonicOS 7 Getting Started Guide for the NSsp 13700 and NSa Series
NSa Series Overview
7

NSa 2700:
NSa 3700:
NSa 4700:
SonicOS 7 Getting Started Guide for the NSsp 13700 and NSa Series
NSa Series Overview
8

NSa 6700:
NSa System Requirements
The NSa Series firewalls meet the following system requirements:
Model NSa 2700 NSa 3700 NSa 4700 NSa 6700
Storage 64GB (M.2) 128GB (M.2) 128 GB 256GM (M.2)
System Memory Storage expansion
slot, up to 256GB
Storage expansion
slot, up to 256GB
Storage expansion
slot, up to 1TB
Storage expansion
slot, up to 1TB
VLAN interfaces 256 256 512 512
Maximum access
point supported
32 32 512 512
Interfaces l16 x 1GbE
l3 x 10G SFP+
l2 USB 3.0
l1 Console
l1 Mgmt port
l24 x 1GbE,
l6 x 10G SFP+
l4 x 5G SFP+
l2 USB 3.0
l1 Console
l1 Mgmt port
l6 x
10G/5G/2.5G/1G
SFP+
l24 x 1GbE,
l2 USB 3.0
l1 Console
l1 Mgmt port
l2 x 40G
l8 x 25G
l4 x
10G/5G/2.5G/1G
SFP+
l4 x
10G/5G/2.5G/1G
Cu
l16 x 1GbE,
l2 USB 3.0
l1 Console
l1 Mgmt port
SonicOS 7 Getting Started Guide for the NSsp 13700 and NSa Series
NSa Series Overview
9

Model NSa 2700 NSa 3700 NSa 4700 NSa 6700
Fans 1 2 2 (removable) 2 (removable)
Power supply 60W 90W 1x350W 1x350W
Chassis
Dimension (1U)
16.9 x 12.8 x. 1.8 in
43 x 32.5 x 4.5 cm
16.9 x 12.8 x. 1.8 in
43 x 32.5 x 4.5 cm
16.9 x 18.1 x. 1.8 in
43 x 46.5 x 4.5 cm
16.9 x 18.1 x. 1.8 in
43 x 46.5 x 4.5 cm
SonicOS 7 Getting Started Guide for the NSsp 13700 and NSa Series
NSa Series Overview
10

NSsp 13700 Overview
The SonicWall Network Security services platform (NSsp) firewall series delivers the advanced threat protection,
fast speeds and budget friendly price that large enterprises, data centers, and service providers require.
Designed for large distributed enterprises, data centers, government agencies and service providers, the NSsp
13700 pairs advanced technologies like Real-Time Deep Memory Inspection (RTDMI™) with high-speed
performance.
The NSsp is a high-end firewall delivering advanced threat protection and the fast speeds demanded by large
enterprises, data centers and service providers. The NSsp 13700 is the enterprise firewall to replace existing NSa
9650 firewalls.
This chapter covers the following topics:
lFeatures
lSystem Specifications
Features
The SonicWall NSsp 13700 is a next-generation firewall (NGFW) with multiple interfaces (100/40/25/10/5/2.5/1.0
GbE), capable of processing millions of connections. Its high-speed connectivity and large port density—coupled
with superior IPS and TLS1.3 inspection support—make the NSsp 13700 an ideal threat protection platform for
enterprise internet edge and data center deployments. SonicWall NSsp 13700 combines validated security
effectiveness and best-in-class price performance in a high-end, single-rack-mountable NGFW appliance.
Topics:
lConnectivity, Port Density and Performance
lFirmware Features
Connectivity, Port Density and Performance
The NSsp 13700 is an energy-efficient, reliable appliance in a compact form factor. It can process millions of
encrypted and unencrypted connections to deliver the security required for large organizations. The high-port-
density NSsp 13700 includes the following interfaces:
SonicOS 7 Getting Started Guide for the NSsp 13700 and NSa Series
NSsp 13700 Overview
3
11

l2 100GbE interfaces
l8 5GbE interfaces
l8 10/5/2.5/1GbE interfaces
l16 1GbE interfaces
It also features a dedicated management port, 512GB of built-in storage, and redundant power supplies and fans.
Performance specifications are targeted at:
l45 Gbps of threat prevention throughput
l57 Gbps of application inspection throughput
l48 Gbps of IPS throughput
l5 Gbps of TLS inspection throughput
l14 million stateful connections
l12 million DPI connections
Firmware Features
The SonicWall NSsp 13700 runs on SonicOS 7.0.1, a new operating system built to deliver a modern user
interface, intuitive workflows and user-first design principles. SonicOS 7 provides multiple features that facilitate
enterprise-level workflows, easy configuration and simplified management—all of which allow enterprises to
improve both their security and their operational efficiency. SonicOS 7 features:
lSandboxing using Reassembly-Free Deep Packet Inspection® (RFDPI) and Real-Time Deep Memory
Inspection™ (RTDMI) technology
lSecure SD-WAN
lHigh Availability
lTLS 1.3 support
lDNS Security
lGateway Anti-Virus, Intrusion Prevention, and Application Control
lCapture ATP Multi-Engine Sandboxing
lURL Filtering
lError-free change management with Network Security Manager (NSM)
lNew intuitive dashboards with single-pane-of-glass management
lNew application framework
lEnhanced APIs
lConfiguration audit
lNotification center providing actionable alerts
lUsage statistics for rules, objects and services
SonicOS 7 Getting Started Guide for the NSsp 13700 and NSa Series
NSsp 13700 Overview
12

Hardware Features
Review the following for more details about the NSsp 13700 hardware features.
Topics:
lFront Panel
lRear Panel
lSystem Specifications
Front Panel
Refer to the following front panel and the associated table to understand the ports and LED lighting on the ports.
MGMT MGMT Port - RJ45: The MGMT port is a
dedicated 1GE interface for appliance
management and SafeMode access.
lSolid green = link at 1G or lower
lBlinking green = activity.
console Console Port - RJ45: Serial Console for
CLI access.
SonicOS 7 Getting Started Guide for the NSsp 13700 and NSa Series
NSsp 13700 Overview
13

X32 - X33 100/40GE QSFP28 Ports and LEDs:
lSolid amber = link at 100G or 40G
lBlinking amber = activity
lSolid green = link at 1G or lower
lBlinking green = activity
lOff = no link.
NOTE: Breakout cables are not supported
on these ports.
X24 - X31 25/10/5/2.5GE SFP28 Ports and LEDs:
lSolid amber = link at 25G, 10G, 5G or
2.5G
lBlinking amber = activity at 25G, 10G,
5G or 2.5G,
lSolid green = link at 1G or lower
lBlinking green = activity
lOff = no link
X20 - X23 10/5/2.5GE SFP+ Ports and LEDs:
lSolid amber = link at 10G, 5G or 2.5G
lBlinking amber = activity
lSolid green = link at 1G or lower
lBlinking green = activity
lOff = no link
SonicOS 7 Getting Started Guide for the NSsp 13700 and NSa Series
NSsp 13700 Overview
14

X16 - X19 10/5/2.5/1GE Copper RJ45 Ports and
LEDs:
lSolid green = link at speeds 1G or lower
lBlinking green = activity at 1G or lower
lAmber = unused
lOff = no link
X0 - X15 1GE Copper RJ45 Ports and LEDs:
lSolid green = link at speeds 1G or lower
lBlinking green = activity at 1G or lower
lAmber = unused
lOff = no link
SafeMode Button: A recessed button
used to enter SafeMode:
lIf [[[Undefined variable
Products/SonicOS.Product_Series_
NSsp]]] is up, press button with a
narrow, straight object.
lIf [[[Undefined variable
Products/SonicOS.Product_Series_
NSsp]]] is down, press while connecting
[[[Undefined variable
Products/SonicOS.Product_Series_
NSsp]]] to power and hold until Test
LED blinks yellow 3 times.
Power Button:
lShort press powers ON if button was
used to power system off.
lShort press powers OFF with graceful
shutdown. Test and Alarm LEDs turn
red. Standby power to some circuitry
stays on.
lLong press (5+ sec) = forced shutdown.
Standby power to some circuitry stays
on.
SonicOS 7 Getting Started Guide for the NSsp 13700 and NSa Series
NSsp 13700 Overview
15

LAN Bypass LED: When [[[Undefined
variable Products/SonicOS.Product_
Series_NSsp]]] is without power and LED
is off, LAN Bypass state is difficult to
distinguish. It can be either:
lBypass disabled (default), traffic cannot
pass
lBypass enabled, power is lost, traffic
can pass
Yellow = bypass active and traffic is
passing while [[[Undefined variable
Products/SonicOS.Product_Series_
NSsp]]] is powered but not available, such
as during reboot.
Green = bypass enabled and traffic can
pass if firewall goes down.
SS
USB SS 3.0 Ports: For configuration,
recovery, re-imaging the [[[Undefined
variable Products/SonicOS.Product_
Series_NSsp]]], and USB WWAN device
support.
Storage LED: Status on internal and
external storage.
lBlinking green = activity
lYellow = storage warning
lOff = no activity
Alarm LED:
lRed = high Level alarm (such as fan
failure) or power down requested
lYellow = lower level alarm
Test LED:
lRed = power down requested
lYellow = initializing
lBlinking yellow = SafeMode/FIPS test
in progress
lOff = normal
SonicOS 7 Getting Started Guide for the NSsp 13700 and NSa Series
NSsp 13700 Overview
16

Power LED: 1 = Primary, 2 = Redundant
lBlue = powered on
lYellow = defective redundant power
supply
Rear Panel
Refer to the following rear panel illustration and the associated table to understand the slots and parts.
M1 slot for SSD: Extended storage drive
M0 slot for M.2 module: Boot drive
System fans (3)
Redundant power input
Primary power input
System Specifications
The NSsp 13700 was built with an Intel-basedCPU. It ships with a storage module and 350W redundant power
supplies. It has compact footprint, requiring only one slot in the chassis. The hardware specifications for the NSsp
13700 are listed below:
Model NSsp 13700
CPU model Xeon D-2187NT
# Cores per CPU 16C (32T)
CPU frequency (Base/Max. Turbo) 2.0/3.0 GHz
SonicOS 7 Getting Started Guide for the NSsp 13700 and NSa Series
NSsp 13700 Overview
17

Model NSsp 13700
Hardware security support Intel QAT: 100 Gbps
System Memory, DDR4 2400 ECC, RDIMM 64 GB
Interfaces l2 x 100G QSFP28
l2 x 40G QSFP28
l8 x 25G QSFP28
l4 x 10G/5G/2.5G/1G SFP+
l4 x 10G/5G/2.5G/1G Cu
l16 x GbE Cu
l1 GbE MGMT
l1 Console (RJ45)
l2 USB 3.0
Expansion (M1) 1TBSSD
Expansion (M0) M.2 512 GB
Fan 3 (removable)
Power supply 2x 350W (removable)
Chassis Dimension (1U) 43cm x 46cm x 4.5cm
SonicOS 7 Getting Started Guide for the NSsp 13700 and NSa Series
NSsp 13700 Overview
18

Determining the WAN Type
Before configuring your SonicWall appliance, you need to determine the type of WAN connection for your setup .
SonicWall supports the following types:
lStatic—Configures the appliance for a network that uses static IP addresses.
lDHCP—Configures the appliance to request IP settings from a DHCP server on the Internet.
lPPPoE—Point-to-Point Protocol over Ethernet (PPPoE) is typically used with a DSL modem. If your ISP
requires desktop software with a username and password, select NAT with PPPoE mode.
lPPTP—Point-to-Point Tunneling Protocol (PPTP) is used to connect to a remote server. PPTP typically
supports older Microsoft Windows implementations that require tunneling connectivity.
lL2TP—Layer 2 Tunneling Protocol (L2TP) is used to transmit Layer 2 data over IP or other Layer 3 routed
networks. Internet Service Providers (ISPs) often use it to enable virtual private networks (VPNs) for
customers over the Internet. It does not encrypt network traffic itself.
NOTE: If L2TP is not available in the Setup Wizard, you can configure it later in the SonicOS
management interface.
lWire Mode (2-Port Wire)—Inserts the appliance into the network using two paired interfaces. Available
Wire Mode types include Bypass, Inspect, and Secure. Bypass mode allows for quick and non-disruptive
insertion into the data path. Inspect mode extends Bypass mode with traffic inspection for classification
and flow reporting. Secure mode provides full SonicWall ReAssembly-Free Deep Packet Inspection™
(RF-DPI) and control of network traffic.
Secure Mode also affords the same level of visibility and enforcement as conventional NAT or L2 Bridged
Mode deployments, but without any L3/L4 transformations, and with no alterations of ARP or routing
behavior. If Wire Mode is not available in the Setup Wizard, you can configure it later in the SonicOS
management interface.
NOTE: When operating in Wire Mode, the MGMT interface is used for local management. To enable
remote management, dynamic security services, and application intelligence updates, a WAN
interface (separate from the Wire Mode interfaces) must be configured for internet connectivity.
lTap Mode (1-Port Tap)—Using a single interface, the firewall connects to and receives mirrored packets
from an adjacent switch SPAN port. Similar to Inspect mode in Wire Mode, but with a single port and not in
the physical path of traffic.
If Tap Mode is not available in the Setup Wizard, you can configure it later in the SonicOS management
interface.
SonicOS 7 Getting Started Guide for the NSsp 13700 and NSa Series
Determining the WAN Type
4
19

For more information about WAN types including Wire Mode, Tap Mode, L2TP, and others, refer to the SonicOS
7 Network Firewall Administration Guide at the Technical Documentation portal.
SonicOS 7 Getting Started Guide for the NSsp 13700 and NSa Series
Determining the WAN Type
20