SonicWALL NSA 2600 User manual

SonicWall™NSA2600/3600/4600/5600/6600
GettingStartedGuide
RegulatoryModelNumbers:
1RK29‐0A9–NSA2600
1RK26‐0A2–NSA3600
1RK26‐0A3–NSA4600
1RK26‐0A4–NSA5600
1RK27‐0A5–NSA6600

Copyright©2017SonicWallInc.Allrightsreserved.
SonicWallisatrademarkorregisteredtrademarkofSonicWallInc.and/oritsaffiliatesintheU.S.A.and/orothercountries.Allothertrademarksandregistered
trademarksarepropertyoftheirrespectiveowners
TheinformationinthisdocumentisprovidedinconnectionwithSonicWallInc.and/oritsaffiliates’products.Nolicense,expressorimplied,byestoppelor
otherwise,toanyintellectualpropertyrightisgrantedbythisdocumentorinconnectionwiththesaleofSonicWallproducts.EXCEPTASSETFORTHINTHETERMS
ANDCONDITIONSASSPECIFIEDINTHELICENSEAGREEMENTFORTHISPRODUCT,SONICWALLAND/ORITSAFFILIATESASSUMENOLIABILITYWHATSOEVERAND
DISCLAIMSANYEXPRESS,IMPLIEDORSTATUTORYWARRANTYRELATINGTOITSPRODUCTSINCLUDING,BUTNOTLIMITEDTO,THEIMPLIEDWARRANT YOF
MERCHANTABILITY,FITNESSFORAPA RT I CU L A R PURPOSE,ORNON‐INFRINGEMENT.INNOEVENTSHALLSONICWALLAND/ORITSAFFILIATESBELIABLEFORANY
DIRECT,INDIRECT,CONSEQUENTIAL,PUNITIVE,SPECIALORINCIDENTALDAMAGES(INCLUDING,WITHOUTLIMITATION,DAMAGESFORLOSSOFPROFITS,
BUSINESSINTERRUPTIONORLOSSOFINFORMATION)ARISINGOUTOFTHEUSEORINABILITYTOUSETHISDOCUMENT,EVENIFSONICWALLAND/ORITS
AFFILIATESHAVEBEENADVISEDOFTHEPOSSIBILITYOFSUCHDAMAGES.SonicWalland/oritsaffiliatesmakenorepresentationsorwarrantieswithrespectto
theaccuracyorcompletenessofthecontentsofthisdocumentandreservestherighttomakechangestospecificationsandproductdescriptionsatanytime
withoutnotice.SonicWallInc.and/oritsaffiliatesdonotmakeanycommitmenttoupdatetheinformationcontainedinthisdocument.
Formoreinformation,visithttps://www.sonicwall.com/legal/.
NSA2600/3600/4600/5600/6600GettingStartedGuide
Updated‐March2017
232‐003419‐51RevA
Legend
WARNING:AWARNINGiconindicatesapotentialforpropertydamage,personalinjury,ordeath.
CAUTION:ACAUTIONiconindicatespotentialdamagetohardwareorlossofdataifinstructionsarenotfollowed.
IMPORTANT,NOTE,TIP,MOBILE,orVIDEO:Aninformationiconindicatessupportinginformation.

SonicWallNSA2600/3600/4600/5600/6600GettingStartedGuide 3
1
InthisGuide
ThisSonicWall™NSA2600/3600/4600/5600/6600GettingStartedGuideprovidesinstructionsforbasicinstallationand
configurationofSonicWallNSA2600,NSA3600,NSA4600,NSA5600,andNSA6600appliances.
•Contentsonpage4
•GettingStartedTaskOverviewonpage7
SonicWallNSAappliancesprovidethesekeyfeatures:
•TheNSA6600supportsupto12Gbpsofhigh‐performancefirewallthroughputandupto6000VPNclients.
•TheNSA5600deliversupto9Gbpsfirewallinspectionthroughput,NSA4600delivers6Gbps,NSA3600delivers3.4Gbps,
andNSA2600delivers1.9Gbps.
•Eachoftheseplatformsconsolidateintrusionprevention,gatewayanti‐virusandanti‐spyware,network‐basedmalware
protection,andapplicationintelligenceandcontrol.Allsupporthighavailabilitydeploymentswhenpairedwiththesame
model.
•Youcanaddbandwidthmanagement,applicationblocking,CaptureAdvancedThreatProtection,deeppacketinspection
withDPI‐SSLandDPI‐SSH,secureconnectivitywithSSLVPNandIPSecVPN,contentfiltering,clientanti‐virus,anti‐spam,
statefulhighavailability,and,ontheNSA6600,highavailabilityclustering.
Formoreproductinformation,visithttps://www.sonicwall.com.

4SonicWallNSA2600/3600/4600/5600/6600GettingStartedGuide
Contents
Chapter1Sectionsincluded:
InthisGuideonpage3•Contentsonpage4
•GettingStartedTaskOverviewonpage7
Chapter2Sectionsincluded:
HardwareOverviewonpage9•SonicWallNSAPackageContentsonpage10
•NSA2600FrontPanelonpage12
•NSA2600BackPanelonpage13
•NSA3600/4600/5600FrontPanelonpage14
•NSA3600/4600/5600BackPanelonpage15
•NSA6600FrontPanelonpage16
•NSA6600BackPanelonpage17

SonicWallNSA2600/3600/4600/5600/6600GettingStartedGuide 5
Chapter3Sectionsincluded:
InitialSetuponpage19 •DeterminingtheWANTypeonpage20
•SystemRequirementsonpage21
•RecordingConfigurationInformationonpage21
•InitialConfigurationonpage23
•ConnectingtotheInternetonpage26
•TroubleshootingConnectionsonpage30
Chapter4Sectionsincluded:
Registering,Licensing,andUpgradingon
page31
•UsingMySonicWallonpage32
•CreatingaMySonicWallAccountonpage32
•RegistrationOverviewonpage33
•RegisteringinSonicOSonpage33
•AlternativeRegistrationOptionsonpage33
•LicensingSecurityServicesonpage35
•ActivatingLicensesUsingaKeyonpage37
•UpgradingFirmwareonpage37

6SonicWallNSA2600/3600/4600/5600/6600GettingStartedGuide
Forgeneralsupportinformation,seeSonicWallSupportonpage61.
Chapter5Sectionsincluded:
SupportandTrainingOptionsonpage41 •CustomerSupportonpage42
•KnowledgeBaseonpage42
•UserForumsonpage42
•Trainingonpage42
•RelatedDocumentationonpage43
•AdditionallySupportedLanguagesonpage43
Chapter6Sectionincluded:
RailAssemblyandRackMounting
Instructionsonpage45
•RailAssemblyandRackMountingonpage46
Chapter7Sectionsincluded:
ProductSafetyandRegulatory
Informationonpage51
•SafetyInstructionsonpage52
•Sicherheitsanweisungenonpage54
•安全說明onpage56
•DeclarationofConformityonpage58
•WarrantyInformationonpage58
•(台灣 RoHS)/ 限用物質含有情況標示資訊onpage59

SonicWallNSA2600/3600/4600/5600/6600GettingStartedGuide 7
GettingStartedTaskOverview
ThefollowingflowchartillustratesthenecessarystepsintheprocessofgettingstartedwithyournewSonicWallNSAappliance.
Verify
Pre-Configuration
Requirements
Start Up
Management
Computer
Perform Initial
Setup
Register
Appliance in
SonicOS
Complete
Deployment
Configuration
Create a
MySonicWall
Account
Configuration Process
Registration, Licensing, and Deployment Process

8SonicWallNSA2600/3600/4600/5600/6600GettingStartedGuide

SonicWallNSA2600/3600/4600/5600/6600GettingStartedGuide 9
2
HardwareOverview
ThissectiondescribestheitemsshippedwiththeSonicWallNSAapplianceandprovidesfrontandrearillustrationsofthe
appliances.
•SonicWallNSAPackageContentsonpage10
•NSA2600FrontPanelonpage12
•NSA2600BackPanelonpage13
•NSA3600/4600/5600FrontPanelonpage14
•NSA3600/4600/5600BackPanelonpage15
•NSA6600FrontPanelonpage16
•NSA6600BackPanelonpage17

10 SonicWallNSA2600/3600/4600/5600/6600GettingStartedGuide
SonicWallNSAPackageContents
Beforeyoubeginthesetupprocess,verifythatyourpackagecontainsthefollowingitems:
1OneSonicWallNSA2600,NSA3600,NSA4600,NSA5600,orNSA6600appliance
2Onerackmountingrailkit(withNSA3600/4600/5600/6600)ortworackmountingearkits(withNSA2600)
3OneserialCLIcable
4OneEthernetcable
5Onepowercord*
6OneSafety,Environmental,andRegulatoryInformationdocument
7OneSonicWallNSA2600/3600/4600/5600/6600GettingStartedGuide
*Theincludedpowercordisapprovedforuseonlyinspecificcountriesorregions.Beforeusingapowercord,verifythatitisrated
andapprovedforuseinyourlocation.ThepowercordisforACmainsinstallationonly.SeeInstallationRequirementsonpage52
formoreinformation.

SonicWallNSA2600/3600/4600/5600/6600GettingStartedGuide 11
SonicWallNSAPackageContents
MissingItems?Ifanyitemsaremissingfromyourpackage,contactSonicWallSupportat:
https://support.sonicwall.com/contact‐support
1
45
7
3
2
SonicWall NSA 5600 CONSOLE
SDHC
MGMT X17
X16 X14 X12 X10 X8 X6 X4
1GE
10GE X2 X0
X1X3X5X7
X9X11X13X15
M0
ALARM
TEST
PWR
6
SonicWall™ Products
Safety, Environmental, and Regulatory
InformaƟŽŶ
January 2017
Thefollowing informaƟon comprises the safety, environmental, and regulatory message
applicableto SonicWall products. These messages ensure proper handling and disposal of
theequipment.
Thevarious messages are grouped by language. In general, the languages of the European
Unionappear Įrst and are grouped alphabeƟcally. Non European Union languages are
groupedtogether towards the back, aŌer the double line.
sonicwall.com | support.sonicwall.com
232 001007 50 Rev A
Copyright© 2017 SonicWall Inc. All rights reserved.
SonicWallis a trademark or registered trademark of SonicWall Inc. and/or its Ăĸliates in the U.S.A.
and/orother countries. All other trademarks are property of th eir respecƟve owners.
TheinformaƟon in this document is provided in connecƟon with SonicWall Inc. and/or its aĸliates'
products.No license, express or implied, by estoppel or otherwise, to any intellectual property right is
grantedby this document. SonicWall In c. and/or its aĸliates do not make any commitment to update
theinformaƟon contained in this document. For more informaƟon, visit hƩps://www.sonicwall.com/
legal/.
SonicWall™ NSA 2600/3600/4600/5600/6600
Geƫng Started Guide
Regulatory Model Numbers:
1RK29-0A9 – NSA 2600
1RK26-0A2 – NSA 3600
1RK26-0A3 – NSA 4600
1RK26-0A4 – NSA 5600
1RK27-0A5 – NSA 6600

12 SonicWallNSA2600/3600/4600/5600/6600GettingStartedGuide
NSA2600FrontPanel
SonicWall NSA 2600 CONSOLE
SDHC
MGMT
X6 X4 1GE X2 X0 M0
X1X3X5X7
ALARM
M0
TEST
PWR
Expansion Module
Console Port
USB Ports (2)
SafeMode Button
LED Indicators
MGMT Port (1 GE)
X0-X7 (1 GE)
Access the SonicOS Command Line
Interface (CLI) via the enclosed serial
CLI cable
For 3G/4G/Analog modem adaptor support
Press and hold until Test LED starts blinking
to set the appliance into SafeMode.
High-speed copper Gigabit Ethernet ports
Expansion Module Bay
For SonicWall-approved
expansion modules
Power: Blue: Indicates power supply is operating correctly
Yellow: Indicates power supply is disconnected
Test: Quick Blinking Yellow: Initializing
Slow Blinking Yellow: Safe Mode
Solid Yellow: Test mode
Alarm: Indicates alarm activity in Red LED
M0: Indicates Expansion Module 0 activity in Red LED
1 Gigabit Ethernet Management Interface
SDHC Port
Secure Digital High-Capacity (SDHC)
port for future use

SonicWallNSA2600/3600/4600/5600/6600GettingStartedGuide 13
NSA2600BackPanel
I
o
Fans (2)
Power Supply
Dual auto-throttling fans for system
temperature control
Provides power to the SonicWall appliance
by plugging in the AC cord and switching
the appliance on

14 SonicWallNSA2600/3600/4600/5600/6600GettingStartedGuide
NSA3600/4600/5600FrontPanel
SonicWall NSA 5600 CONSOLE
SDHC
MGMT X17
X16 X14 X12 X10 X8 X6 X4
1GE
10GE X2 X0
X1X3X5X7
X9X11X13X15
ALARM
M0
TEST
PWR
Console Port
USB Ports (2)
SafeMode Button
LED Indicators
Management Port (1 GE)
X0-X11 (1 GE)
Access the SonicOS Command Line
Interface (CLI) via the enclosed serial
CLI cable
For 3G/4G/Analog modem adaptor support
Press and hold until Test LED starts blinking
to set the appliance into SafeMode. High-speed copper
Gigabit Ethernet ports
Power: Blue: Indicates power supply is operating correctly
Yellow: Indicates power supply is disconnected
Test: Quick Blinking Yellow: Initializing
Slow Blinking Yellow: SafeMode
Solid Yellow: Test mode
Alarm: Indicates alarm activity in Red LED
M0: Indicates Expansion Module 0 activity in Red LED
1 Gigabit Ethernet Management Interface
SDHC Port
Secure Digital High-Capacity (SDHC)
port for future use
X12-X15 (1 GE SFP)
X16-X17 (10 GE SFP+)
1 Gigabit Ethernet hot-pluggable SFP
interfaces for high-speed ber or
copper Ethernet communication
10 Gigabit Ethernet hot-pluggable ports

SonicWallNSA2600/3600/4600/5600/6600GettingStartedGuide 15
NSA3600/4600/5600BackPanel
I
o
Expansion Bay
Fans (2)
Power Supply
For SonicWall-approved
expansion modules
Dual auto-throttling fans for system
temperature control
Provides power to the SonicWall appliance by
plugging in the AC adaptor and switching the
appliance on

16 SonicWallNSA2600/3600/4600/5600/6600GettingStartedGuide
NSA6600FrontPanel
SonicWall NSA 6600 CONSOLE
SDHC
MGMT X19 X17
X16 X14 X12 X10 X8 X6 X4 1GE1GE
10GE
BYPASS
STATUS
X2 X0
X1X3X5X7
X9X11X13X15
X18
M0
ALARM
TEST
PWR
Console Port
USB Ports (2)
SafeMode Button
LED Indicators
X0-X7 (1 GE)
Bypass Status
Access the SonicOS Command Line Interface
(CLI) via the enclosed serial CLI cable
For 3G/4G/Analog modem adaptor support
Press and hold until Test LED starts blinking to
set the appliance into SafeMode.
High-speed copper
Gigabit Ethernet ports
Turns on when
fail-to-wire bypass
mode is active
Power: Blue: Indicates power supplies are operating correctly
Yellow: Indicates a disconnected power supply
Test: Quick Blinking Yellow: Initializing
Slow Blinking Yellow: SafeMode
Solid Yellow: Test mode
Alarm: Indicates alarm activity in Red LED
M0: Indicates Expansion Module 0 activity in Red LED
1 Gigabit Ethernet
Management Interface
SDHC Port
Secure Digital High-Capacity (SDHC) port
for future use
X8-X15 (1 GE SFP)
X16-X19 (10 GE SFP+)
1 Gigabit Ethernet hot-pluggable SFP
interfaces for high-speed ber or
copper Ethernet communication
10 Gigabit Ethernet hot-pluggable ports
*X16, X18, and X19 are designated with a‘dot’ to
signify ports with a direct uplink to the appliance
CPU for maximum throughput ; X17 shares the
CPU uplink with X0-X15.
MGMT Port (1 GE)

SonicWallNSA2600/3600/4600/5600/6600GettingStartedGuide 17
NSA6600BackPanel
WARNING:PotentialHazardfromFan
Thismanualcontainsspecificwarningandcautionstatementswheretheyapply.PleasereadtheSafetyInstructions
beforeuse!SeeProductSafetyandRegulatoryInformationonpage61.
I
o
Expansion Bay
Fans (2)
Power Supply
For SonicWall-approved
expansion modules
Dual auto-throttling fans for system
temperature control
Provides power to the SonicWall appliance by
plugging in the AC adaptor and switching the
appliance on

18 SonicWallNSA2600/3600/4600/5600/6600GettingStartedGuide

SonicWallNSA2600/3600/4600/5600/6600GettingStartedGuide 19
3
InitialSetup
ThissectionprovidesanoverviewofavailableWANtypes,asectiontorecordconfigurationinformation,andinitialsetup
informationandprocedures.
•DeterminingtheWANTypeonpage20
•SystemRequirementsonpage21
•RecordingConfigurationInformationonpage21
•InitialConfigurationonpage23
•ConnectingtotheInternetonpage26
•TroubleshootingConnectionsonpage30

20 SonicWallNSA2600/3600/4600/5600/6600GettingStartedGuide
DeterminingtheWANType
BeforeconfiguringyourSonicWallNSAappliance,youneedto
determinethetypeofWANconnectionthatyoursetupwill
use.SonicWallsupportsthefollowingtypes:
•Static—Configurestheapplianceforanetworkthatuses
staticIPaddresses.
•DHCP—ConfigurestheappliancetorequestIPsettings
fromaDHCPserverontheInternet.
•PPPoE
—Point‐to‐PointProtocoloverEthernet(PPPoE)is
typicallyusedwithaDSLmodem.IfyourISPrequires
desktopsoftwarewithausernameandpassword,select
NATwithPPPoEmode.
•PPTP—Point‐to‐PointTunnelingProtocol(PPTP)isusedto
connecttoaremoteserver.PPTPtypicallysupportsolder
MicrosoftWindowsimplementationsthatrequire
tunnelingconnectivity.
•L2TP—Layer2TunnelingProtocol(L2TP)isusedtotransmit
Layer2dataoverIPorotherLayer3routednetworks.
InternetServiceProviders(ISPs)oftenuseittoenable
virtualprivatenetworks(VPNs)forcustomersoverthe
Internet.Itdoesnotencryptnetworktrafficitself.IfL2TPis
notavailableintheSetupWizard,youcanconfigureitlater
intheSonicOSmanagementinterface.
•WireMode(2‐PortWire)—Insertstheapplianceintothe
networkusingtwopairedinterfaces.AvailableWireMode
typesincludeBypass,Inspect,andSecure.Bypassmode
allowsforquickandnon‐disruptiveinsertionintothedata
path.InspectmodeextendsBypassmodewithtraffic
inspectionforclassificationandflowreporting.Secure
modeprovidesfullSonicWallReAssembly‐FreeDeep
PacketInspection™(RF‐DPI)andcontrolofnetworktraffic.
SecureModeaffordsthesamelevelofvisibilityand
enforcementasconventionalNATorL2BridgedMode
deployments,butwithoutanyL3/L4transformations,and
withnoalterationsofARPorroutingbehavior.IfWire
ModeisnotavailableintheSetupWizard,youcan
configureitlaterintheSonicOSmanagementinterface.
•TapMode(1‐PortTap)—Usingasingleinterface,the
firewallconnectstoandreceivesmirroredpacketsfroman
adjacentswitchSPANport.SimilartoInspectmodeinWire
Mode,butwithasingleportandnotinthephysicalpathof
traffic.
NOTE:WhenoperatinginWireMode,thefirewall’s
MGMTinterfaceisusedforlocalmanagement.To
enableremotemanagementanddynamicsecurity
servicesandapplicationintelligenceupdates,aWAN
interface(separatefromtheWireModeinterfaces)
mustbeconfiguredforInternetconnectivity.