SonicWALL TZ 180 User manual

COMPREHENSIVE INTERNET SECURITY
SonicWALL TZ 180
Recommends Guide
SonicWALL Internet Security Appliances

SonicWALL Recommends Guide
Recommended Solutions for the SonicWALL TZ 180
SonicOS 3.8 Standard and Enhanced

i
Table of Contents
Document Scope ..................................................................................................................................................2
SonicWALL TZ 180 Network Topology .........................................................................................................3
Registering and Enabling Support .....................................................................................................................4
Security Best Practices for TZ 180 Running SonicOS Standard ...................................................................9
Troubleshooting TZ 180 Configuration and Settings Issues .................................................................... 13
DMZ/OPT Port Troubleshooting ......................................................................................................... 14
Global VPN Client Troubleshooting ..................................................................................................... 16
Registration Troubleshooting .................................................................................................................. 18
VPN Troubleshooting .............................................................................................................................. 19
Internet Connectivity Troubleshooting ................................................................................................. 25
Firmware Update Troubleshooting ........................................................................................................ 26
SonicWALL Solutions Integration .................................................................................................................. 27
SonicWALL Security Services ................................................................................................................. 27
SonicWALL Backup and Recovery Solutions ...................................................................................... 28
SonicWALL Secure Remote Access Solutions ..................................................................................... 30
SonicWALL Email Security Solution ..................................................................................................... 31
SonicWALL SonicPoint Wireless Access Points .................................................................................. 32
SonicWALL Global Management System (GMS) ............................................................................... 33
Related Documentation .................................................................................................................................... 34
Obtaining Technical Support ........................................................................................................................... 35
More Information on SonicWALL Products ....................................................................................... 36
Copyright and Trademarks ...................................................................................................................... 37

ii
SonicWALL TZ 180 Recommends Guide

1
SonicWALL TZ 180 Recommends Guide
Recommends Guide Overview
Welcome to the ‘SonicWALL Recommends’ Guide for the SonicWALL TZ 180 security appliance. This
guide is designed to help you configure the TZ 180 security appliance to provide reliable, secure, and
trouble-free connectivity. This guide is not intended as a replacement for the Getting Started Guide or the
Administrator’s Guide, but rather as an addendum to both guides. The SonicWALL Recommends Guide for
the SonicWALL TZ 180 security appliance can significantly simplify and enhance the installation and
operation of the TZ 180 security appliance.
This SonicWALL Recommends Guide contains the following sections:
• “Registering and Enabling Support” section on page 4 – This section provides instructions for verifying
that the TZ 180 security appliance is properly registered, keeping proper backups of critical files, and
retrieving updated firmware files.
• “Security Best Practices for TZ 180 Running SonicOS Standard” section on page 9 – This section
provides instructions for configuring security settings for the TZ 180 security appliance and its
nterfaces.
• “Troubleshooting TZ 180 Configuration and Settings Issues ” section on page 13 – This section
provides troubleshooting for the most common configuration issues, as reported by SonicWALL’s
Technical Support department.
• “SonicWALL Solutions Integration” section on page 27 – This section provides information about
SonicWALL’s suite of products that are complementary to the TZ 180 security appliance and describes
how they can be easily integrated into your network environment.
• “Obtaining Technical Support” section on page 35 – This section provides contact information for
SonicWALL Technical Support.
The guide provides instructions and information to quickly configure and use a SonicWALL TZ 180 security
appliance. For details about the features introduced in this guide, refer to the SonicOS Enhanced or
SonicOS Standard Administrator’s Guide and SonicWALL’s online library of technical notes, available on
SonicWALL’s Web site at http://www.sonicwall.com/us/support.

Document Scope
2
SonicWALL TZ 180 Recommends Guide
Document Scope
This ‘SonicWALL Recommends’ Guide describes how to how to plan, design, implement, and manage the
TZ 180 security appliance on your network.
This document contains the following sections:
• “SonicWALL TZ 180 Network Topology” section on page 3
• “Registering and Enabling Support” section on page 4
• “Security Best Practices for TZ 180 Running SonicOS Standard” section on page 9
• “Troubleshooting TZ 180 Configuration and Settings Issues ” section on page 13
– “Symptom: I Am Having Problems Installing a Public Server on the DMZ/OPT Port” section on
page 14
– “Symptom: I Cannot Get the Global VPN Client Working” section on page 17
– “Symptom: I Am Having Registration Problems with the TZ 180” section on page 18
– “Symptom: I Cannot Get Site-to-Site VPN to Work” section on page 19
– “Symptom: I Do Not Have Internet Access from Behind the TZ 180” section on page 25
– “Symptom: I Want to Update the Firmware on the TZ 180” section on page 26
• “SonicWALL Solutions Integration” section on page 27
– “SonicWALL Security Services” section on page 27
– “SonicWALL Backup and Recovery Solutions” section on page 28
– “SonicWALL Secure Remote Access Solutions” section on page 30
– “SonicWALL Email Security Solution” section on page 31
– “SonicWALL SonicPoint Wireless Access Points” section on page 32
– “SonicWALL Global Management System (GMS)” section on page 33
– “More Information on SonicWALL Products” section on page 36
• “Related Documentation” section on page 34
• “Obtaining Technical Support” section on page 35

SonicWALL TZ 180 Network Topology
3
SonicWALL TZ 180 Recommends Guide
SonicWALL TZ 180 Network Topology
Figure 1 SonicWALL TZ 180 Sample Network Topology
SSL-VPN 200
link/act
10/100
Local Area Network
Wireless Local Area Network
SonicWALL
Security Services
SonicWALL TZ 180
Remote Client
SonicPointSonicPoint
SonicWALL CDP 2440i
SonicWALL
Email Security 300
GMS 4.0
SonicWALL SSL-VPN 200

Registering and Enabling Support
4
SonicWALL TZ 180 Recommends Guide
Registering and Enabling Support
Your TZ 180 network security appliance provides 90 days of free software updates and technical support.
To activate your free software updates and technical support, you must register your security appliance at
mysonicwall.com before you install the appliance on your network. This process takes no more than a few
minutes and significantly reduces future runtime and support issues with the appliance. Registering at
mysonicwall.com also provides you access to new firmware patches and new firmware versions with added
features.
It is critical to register the TZ 180 security appliance. If the TZ 180 security appliance is not registered, you
cannot install new firmware or access new firmware updates on the MySonicWALL portal. As with other
networking devices, the TZ 180 is shipped with the most current software possible; however, it is difficult
to predict how much time may have elapsed since shipping. During this time it’s possible that SonicWALL
has updated the firmware. It is recommended that you visit mysonicwall.com to check for a more current
version.
Once registered, SonicWALL products provide dynamic support by periodically checking with
SonicWALL’s security portal for firmware updates, and security services signature updates on appropriately
licensed appliances. This ensures that your network, users, and data are protected from emerging threats.
The communications channel between the SonicWALL security appliance and the security portal is SSL
encrypted for confidentiality, and no sensitive or private data is exchanged.
Note Turn off pop-up blockers on your Web browser when accessing MySonicWALL Web site or
the management interface of your TZ 180 security appliance.
Note Your SonicWALL TZ 180 security appliance should be operational and have Internet
connectivity prior to enabling support. Refer to the SonicWALL TZ 180 Getting Started Guide
to set up your SonicWALL TZ 180 security appliance for the first time. For additional setup
information, refer to the “Basic SonicWALL Security Appliance Setup” section in the
SonicOS Standard 3.8 Administrator’s Guide.
To enable support on a SonicWALL TZ 180 network security appliance, perform the following steps:
Step 1 Navigate to https://www.mysonicwall.com or navigate to Wizards > License and Registration Wizard
in the SonicWALL TZ 180 management interface.
Step 2 Click the Click here link in If you are not a registered user, Click Here.
Step 3 Fill out the registration fields, including a working email address.
Note Your email address is used to send you important update information related to your TZ 180
and is not used for spam. Provide a working email address.
Step 4 To be a beta tester and be provided access to pre-release firmware updates for your TZ 180 security
appliance, check the box next to Yes, I would like to be a Beta Tester.
Step 5 Locate the serial number and authentication code of the appliance, located on the bottom of the appliance
and on the System > Status page of the management interface of the security appliance.
Note The management interface can be accessed by default at http://192.168.168.168, using the
LAN interface of the TZ 180 security appliance. Login using the default username admin
and default password password.

Registering and Enabling Support
5
SonicWALL TZ 180 Recommends Guide
Step 6 You can register appliance from the System > Status page, using the Registration & License Wizard, or
directly from mysonicwall.com. To register your TZ 180, log into MySonicWALL, enter your username and
password, and enter the serial number of the TZ 180 in the Quick Registration field in the lower-left side
of the page. Fill out the fields when prompted. A registration code is generated.
Step 7 Navigate to the System > Status page on the appliance management interface. Under Security Services,
your registration code in the field below the message You will be given a registration code, which you
should enter below:, illustrated in Figure 2, and click Update.
Figure 2 Unregistered TZ 180 Security Appliance
When the registration process is complete, the Security Services section displays the status of current
licenses. Figure 3 provides a view of a registered TZ 180 appliance.
Figure 3 Registered TZ 180 Security Appliance

Registering and Enabling Support
6
SonicWALL TZ 180 Recommends Guide
Step 8 Determine what firmware version is on the TZ 180 security appliance by navigating to the System > Status
page of the management interface. Figure 4 provides a view of the System Information tab.
Figure 4 Determining the TZ 180 Current Firmware
Step 9 Log into mysonicwall.com and select the TZ 180 security appliance you just registered. Download the most
recent version of firmware, if applicable.
Note When your support contract expires, you will only be able to download the last current
version available upon expiration and will not have access to subsequent versions until a
software support contract has been renewed. To renew, contact the reseller you purchased
the TZ 180 from, or contact SonicWALL.
Note Before updating the firmware on the TZ 180 security appliance, always perform these steps:
Create a backup, store the current settings, store a copy of the current firmware, and record
the details of the appliance along with the details of the MySonicWALL account the
appliance has been registered under. This ensures that you can return the security
appliance to a known-good state if any errors occur during the installation of new firmware.
Step 10 Navigate to System > Settings in the management interface and click the Create Backup Settings...
button to create a restorable backup of the current appliance settings.
Note The TZ 180 security appliance can store one backup.
Step 11 Manually download the preferences file of the TZ 180 to a safe location by clicking Export Settings.
Provide the preferences file a name that you can recognize, for example, tz180settings18jan2006-440pm.exp.
Step 12 Click the Download icon next to Current Firmware to manually download a copy of the current firmware.

Registering and Enabling Support
7
SonicWALL TZ 180 Recommends Guide
Step 13 Navigate to System > Diagnostics. Check all four boxes and generate the Tech Support Report. Save the
file, which contains the serial number, auth code, registration code, and all other administrator settings, to
your computer.
Step 14 Make a note of the serial number of the appliance, the authorization code, the registration code, the name
and password of the MySonicWALL account the appliance is registered under, and the date when the
software support contract expires for the appliance.
Save all files on a secure network resource that is backed up on a regular basis. Refer to “SonicWALL Backup
and Recovery Solutions” section on page 28 for information about how a SonicWALL CDP appliance to
perform this task.
If any problems occur, restore using the backup snapshot. If this fails, reload the firmware and preferences
manually using SafeMode.
Step 15 If you found and downloaded a more recent firmware version, navigate to the System > Settings page on
the management interface and click on the Upload New Firmware… button. Click Browse and find the
firmware file you downloaded.
Step 16 After approximately two days, if the new firmware has had no issues, copy the new files. Refer to the backup
section above and save a copy of the new firmware and the new settings, making sure to differentiate them
from the older versions. It is recommended that you keep multiple sets of ‘known-good’ firmware.

Registering and Enabling Support
8
SonicWALL TZ 180 Recommends Guide
Your TZ 180 security appliance has a protected boot loader that allows you to reset the security appliance,
even if the firmware has become inoperable or corrupted. To access SafeMode, connect a computer to one
of the LAN interfaces on the TZ 180 security appliance using a standard crossover Ethernet cable and assign
this computer a static IP address of 192.168.168.200 with a netmask of 255.255.255.0. If the SafeMode
interface does not display, wait 10-15 seconds and try again. When the link is active, unplug the power cable
to the TZ 180 and insert a straightened-out paperclip into the small opening next to the power port until
you feel a small switch depress. Keep this small switch depressed and plug the power cable back in. Hold
the small switch in for about 20 seconds until the “wrench light” on the front of the TZ 180 flashes, then
release it. The security appliance is now in SafeMode.
For more information on SafeMode, refer to the “Resetting the SonicWALL Security Appliance Using
SafeMode” chapter in the SonicOS Standard 3.8 Administrator’s Guide.
Open a Web browser and navigate to the default SafeMode address at http://192.168.168.168. Figure 5
provides an example of SafeMode view.
Figure 5 SafeMode
In SafeMode, you can boot the security appliance with the current firmware with default settings, or you can
click on the Upload New Firmware button and load a newer or previously known-good version. Once the
security appliance has successfully booted, you can then restore the settings file from the management
interface.
No matter what happens to the TZ 180’s firmware or settings, you can return to this SafeMode menu and
get the appliance running again. It is recommended that you save your known-good settings and firmware
for this purpose.

Security Best Practices for TZ 180 Running SonicOS Standard
9
SonicWALL TZ 180 Recommends Guide
Security Best Practices for TZ 180 Running SonicOS
Standard
By default the TZ 180s security appliance is available with a number of security settings enabled and disabled
to provide a moderate level of initial security to protect your network environment and the appliance, while
simultaneously allowing basic and commonly used outbound network communications. Some of the security
settings can have a potentially disruptive effect if configured incorrectly. Always activate, deactivate, and
change settings with consideration and care. Table 1 provides an overview of the settings available on the
TZ 180 security appliance.
Table 1 Security Settings Best Practices
Solution Description Related Information
Secure management
access to the appliance
from any interface,
including across the
public Internet
Navigate to the Firewall > Access Rules
page and modify the default rule for
HTTPS management. Click the Configure
icon, change the Source drop-down from
LAN to *, and click OK to save and
activate the change.
For more information on secure
management access, refer to the
“Configuring Network Access
Rules” chapter in the SonicOS
Standard 3.8 Administrator’s
Guide.
Create a secure default
administrator name
Navigate to the System > Administration
page and change the Administrator
Name. Make a note of your new
administrator name. Change the password
to something complex (for example, a
combination of letters, numbers and/or
symbols at least six characters in length).
For more information on
changing default Administrator
names, refer to the “Using
System Administrator” chapter
in the SonicOS Standard 3.8
Administrator’s Guide.
Verify time settings Navigate to the System > Time page and
verify that the time zone settings are correct
based on the location of the appliance. The
use of NTP for accuracy is recommended.
Accurate time settings are crucial for the
logging and reporting functions of the
appliance.
For more information on
verifying time settings, refer to
the “Setting System Time”
chapter in the SonicOS Standard
3.8 Administrator’s Guide.
Configure DNS settings Navigate to the Network > Settings page
and verify that the appliance has valid DNS
server(s) configured (if running Enhanced,
the DNS server(s) can be found on the
configuration page of the WAN interface).
This is crucial for the logging, lookup,
DHCP, and reporting functions of the
appliance. If you do not know your ISP
DNS servers, you can temporarily use
4.2.2.1 and 4.2.2.2, but discontinue use
once your ISP has provided you with the
correct DNS server address.
For more information on
configuring DNS settings, refer
to the “Configuring Network
Settings” chapter in the SonicOS
Standard 3.8 Administrator’s
Guide.

Security Best Practices for TZ 180 Running SonicOS Standard
10
SonicWALL TZ 180 Recommends Guide
Use Dynamic DNS
(DDNS) to make your
WAN IP address easily
resolvable
Navigate to the Network > Dynamic
DNS page and configure the security
appliance for DDNS. You can find a
technote on how to do this on the
SonicWALL support site. This feature
makes remote management and VPN
connectivity significantly easier, especially
if your TZ 180 has a dynamically-obtained
(DHCP, PPPoE, L2TP) WAN IP address.
For more information on using
Dynamic DNS, refer to the
“Configuring Dynamic DNS”
chapter in the SonicOS Standard
3.8 Administrator’s Guide.
Audit your firewall
access rules monthly
Navigate to the Firewall > Access rules
page, and perform an audit of rules on a
monthly basis. It is strongly recommended
to re-evaluate your settings and policies at
regular intervals for optimum functionality.
For more information on
auditing your firewall access
rules, refer to the “Configuring
Network Access Rules” chapter
in the SonicOS Standard 3.8
Administrator’s Guide.
Enable better support
for Microsoft networks
Navigate to the Firewall > Advanced
page. If you have a Microsoft networking
environment that spans across the LAN
and OPT/DMZ interfaces of the TZ 180,
and security has been set to allow this,
check the boxes to allow NetBIOS
broadcast for LAN to DMZ and DMZ to
LAN. Microsoft networking relies on
NetBIOS broadcasts to identify and
register network resources such as servers
and printers, so enabling these checkboxes
can resolve network connectivity issues.
For more information on
enabling support for Microsoft
Networks, refer to the
“Configuring Advanced Rule”
chapter in the SonicOS Standard
3.8 Administrator’s Guide.
Properly configure
advanced firewall
features
Navigate to the Firewall > Advanced
page. Some security features can cause
issues if arbitrarily enabled. For example,
enabling Stealth Mode causes the appliance
to silently drop any unauthorized
connection to the WAN interface, instead
of sending a deny back to the source (that
tells the source that there is a security
appliance at that address). Enabling the
Randomize IP ID scrambles the packet
identification sequence and prevents
“fingerprint” detection toolkits from
determining the appliance’s make and
model. Enabling both is recommended.
Checksum enforcement options should
only be enabled if the network security
policy of your organization requires it,
because it can lead to significant
connectivity issues with certain applications
that do not conform to TCP/IP standards.
For more information on
configuring advanced firewalls,
refer to the “Configuring
Advanced Rule Options”
chapter in the SonicOS Standard
3.8 Administrator’s Guide.
Solution Description Related Information

Security Best Practices for TZ 180 Running SonicOS Standard
11
SonicWALL TZ 180 Recommends Guide
Optimize your firewall
access rules
On any firewall rule, enable fragmented
packet handling, and verify that the
connection timeout for the rule is
appropriate to the referenced service. For
example, telnet connections tend to be
long-lasting, so TCP timeout should be set
accordingly. Similarly, timeout can be set
lower for short-lived services, thus keeping
the connection cache clean.
For more information on
firewall access, refer to the
“Configuring Network Access
Rules” chapter in the SonicOS
Standard 3.8 Administrator’s
Guide.
Optimize your VPN
settings
Navigate to the VPN > Advanced page
and verify that fragmented packet
handling/NAT traversal/IKE DPD is
enabled, and if you use Microsoft
networking across VPN tunnels, uncheck
the box next to Disable all VPN Windows
Networking (NetBIOS) Broadcasts.
When creating VPN policies, be sure to
check the box next to Enable Windows
Networking (NetBIOS) Broadcasts on
the Advanced tab of the VPN policy.
For more information on VPN
settings, refer to the
“Configuring Advanced VPN
Settings” chapter in the SonicOS
Standard 3.8 Administrator’s
Guide.
Audit your User
accounts
Navigate to the Users > Local Users page
and audit user entries at least once a month
to verify there are not inappropriate
accounts. Also enforce the use of complex
passwords, and require users to change
passwords on a regular basis. Three months
is the recommended interval. Do not allow
the use of common accounts, in which the
username and password are known to a
wide audience.
For more information on user
accounts, refer to the
“Configuring Local Users”
chapter in the SonicOS Standard
3.8 Administrator’s Guide.
Establish, a logging
baseline
On the Log > View page, it is
recommended to enable all categories and
alerts for at least the first few days of a new
installation, allowing a better understand
the various functions. This generates a lot
of log messages, so after a few days,
configure logs a level appropriate for your
environment.
For more information on
logging baselines, refer to the
“Viewing Log Events” chapter
in the SonicOS Standard 3.8
Administrator’s Guide.
Deliver logs and alerts
by email
On the Log > Automation page, enter in
the fully-qualified domain name (FQDN)
or IP address of a mail server that you relay
SMTP mail through, and a working email
address that the appliance uses to notify in
case of alerts, and to email the logs to on a
periodic basis. This is strongly
recommended.
For more information on logs
and alerts, refer to the
“Configuring Log Automation”
chapter in the SonicOS Standard
3.8 Administrator’s Guide.
Solution Description Related Information

Security Best Practices for TZ 180 Running SonicOS Standard
12
SonicWALL TZ 180 Recommends Guide
Map logged IP address
to machine name for
identification
On the Log > Name Resolution page, set
it to DNS then NetBIOS and click the
Apply button in the upper-right-hand part
of the screen to save and activate the
change. This lets the appliance apply more
a “friendly” name to the IP address in the
log, including the NetBIOS names of
systems on the LAN, which is easier than
using a non-fixed IP address. Do not use
this setting if you are using DNS servers
supplied by your ISP.
For more information on
mapping a logged IP address,
refer to the “Configuring Name
Resolution” chapter in the
SonicOS Standard 3.8
Administrator’s Guide.
Keep backups Store known-good preferences and
firmware in a safe place that is accessible in
the event of problems with the appliance,
and verify the appliance is always under a
valid service and software support contract.
Disaster recovery can be fairly painless if
you follow these policies.
For more information on
keeping backups, refer to the
“Configuring System Settings”
chapter in the SonicOS Standard
3.8 Administrator’s Guide.
Control physical access Other measures are irrelevant if you do not
limit physical access to the security
appliance itself, as it can be easily reset and
illegally accessed if an intruder can get to
the security appliance.
For more information on
controlling physical access,
refer to the “Mounting
Instructions” chapter in the
SonicWALL TZ 180 Series
Getting Started Guide.
Solution Description Related Information

Troubleshooting TZ 180 Configuration and Settings Issues
13
SonicWALL TZ 180 Recommends Guide
Troubleshooting TZ 180 Configuration and Settings
Issues
This section provides troubleshooting information for the six most common issues reported by SonicWALL
technical support for the TZ 180 security appliance running SonicOS Standard firmware. If you need to
troubleshoot an issue that is not listed below, or if the suggestions below do not resolve your issue, visit
SonicWALL’s support Web site at www.sonicwall.com to review the SonicOS Administrator’s Guides and
technotes. Another resource is SonicWALL’s interactive online Knowledge Portal.
Note The six issues listed below have detailed technotes available on www.sonicwall.com.
This section provides troubleshooting for the SonicWALL TZ 180 security appliance. This section contains
the following subsections:
• DMZ/OPT Port Troubleshooting, page 14
– Symptom: I Am Having Problems Installing a Public Server on the DMZ/OPT Port, page 14
– Symptom: I Have One Public WAN IP Address, the TZ 180 Is Already Using the HTTP and
HTTPS Ports for Management, and the Ports Are Needed for an Internal Server, page 15
– Symptom: I Want to Assign a Unique Public IP Address to the Resource on the OPT Interface,
page 16
– Symptom: Internal Users Are Having Problems Accessing the Server on the OPT Port, page 16
– Symptom: Users Across a Site-to-Site VPN Tunnel Unable to Access a Server on the OPT
Interface, page 16
• Global VPN Client Troubleshooting, page 16
– Symptom: GlobalVPN Clients Are Unable to Access the Server on the OPT Interface, page 16
– Symptom: I Cannot Get the Global VPN Client Working, page 17
– Symptom: The GlobalVPN Client Asks for a Key on First Connection, page 18
– Symptom: The GlobalVPN Client Displays a Tmeout with a DHCP Error, page 18
– Symptom: The GlobalVPN Client Has Connectivity Issues or Reports Unusual Messages upon
Failure, page 18
– Symptom: GlobalVPN Users Have Problems Accessing Microsoft Networking Resources over the
Connection, page 18
• Registration Troubleshooting, page 18
– Symptom: I Am Having Registration Problems with the TZ 180, page 18
– Symptom: The Appliance Is Reporting that the Security Appliance Is Already Registered, page 19
– Symptom: The Appliance Reports that the Connection Timed Out, page 19
• VPN Troubleshooting, page 19
– Symptom: I Cannot Get Site-to-Site VPN to Work, page 19
– Symptom: Phase 1 Settings Are Identical on Both Sides, but the Log Displays a Failure in Phase 2,
page 22
– Symptom: General, Phase 1, and Phase 2 Settings All Seem Correct on Both Sides but It Still Does
Not Negotiate, page 23

Troubleshooting TZ 180 Configuration and Settings Issues
14
SonicWALL TZ 180 Recommends Guide
– Symptom: The VPN tunnel Negotiated and Both Sides Show the Tunnel as Up, but I Cannot Reach
Anything on Either Side of the Tunnel from the Other Side, Respectively, page 23
– Symptom: The VPN Tunnel Works but Needs to be Faster, page 24
• Internet Connectivity Troubleshooting, page 25
– Symptom: I Do Not Have Internet Access from Behind the TZ 180, page 25
– Symptom: Users on the WAN Cannot Get to Servers on the OPT or LAN Interfaces, but the
NAT/Firewall Rules Look Fine, page 25
• Firmware Update Troubleshooting, page 26
– Symptom: I Want to Update the Firmware on the TZ 180, page 26
DMZ/OPT Port Troubleshooting
Symptom: I Am Having Problems Installing a Public Server on the DMZ/OPT Port
There are two options for the DMZ/OPT port: Transparent Mode, which allows you to configure the server
with a public IP address (useful for machines where it’s difficult or unfeasible to change the IP address), and
NAT Mode, which is the default setting. In Transparent Mode, verify the public IP address or the firewall
will not provide it access. Figure 6 provides an example of a deployment of a Web server with a public IP
address of 204.180.153.201 attached to the OPT interface.
Figure 6 OPT Port in Transparent Mode

Troubleshooting TZ 180 Configuration and Settings Issues
15
SonicWALL TZ 180 Recommends Guide
In NAT mode, use an address from the private ranges (10.0.0.0/8, 172.16.0.0/16, 192.168.0.0/24) and
assign the OPT interface a private address from this range. This is the address you’ll use as the gateway for
devices attached to the OPT interface. By default, the firewall allows LAN resources to access the OPT
resources, but not the other way around. If the appliances on the OPT interface need to access LAN
appliances, a firewall policy to allow it must be created. Likewise, if resources on the OPT interface need to
be accessed from the WAN, a firewall rule will have to be created. It is recommended that you use the Public
Server Wizard to do this, because it creates the necessary rules for NAT, firewall, and loopback (the special
rule that allows internal resources to contact the server on the OPT interface using its WAN IP address).
Verify that the OPT Interface Is Connected
Navigate to the Network > Settings page and verify that the Status displays as connected. For example,
Figure 7 provides a view the OPT interface as no link, indicating a connectivity problem. Check the cabling
and any other network equipment that joins the two together.
Figure 7 OPT Interface Is Down
Symptom: I Have One Public WAN IP Address, the TZ 180 Is Already Using the HTTP
and HTTPS Ports for Management, and the Ports Are Needed for an Internal Server
Navigate to the System > Administration page and set the HTTP and HTTPS Web management ports to
something non -standard, for example, 8080 and 40443. When accessing the appliance using the
management interface, append these ports onto the end of the management interface address.