SonicWALL CSa 1000 User manual

Capture Security Appliance

Getting Started Guide

Contents

Introduction 3

Technical Overview 4

Deployment Examples 6

Prerequisites for CSa Deployment 8

High-Level Task List 9

Hardware Overview 10

Connect and Power On 13

Change the Administrator Password 14

Initial Setup Using Web Management 15

Upgrade the Firmware 22

Configure Allowed Devices 24

Related Documents for Additional Configuration 26

Creating a MySonicWall Account 27

SonicWall Support 29

About This Document 30

Capture Security Appliance 1000 Getting Started Guide

Contents

Introduction

Welcome to the SonicWall Capture Security Appliance Getting Started Guide. This guide provides the

information you need to deploy your Capture Security Appliance (CSa) in your network, configure the initial

settings, and prepare it to start analyzing suspicious files from your firewalls, Email Security systems and API

connectors.

This Getting Started Guide supports the following SonicWall Capture Security Appliance:

lCSa 1000

Capture Security Appliance 1000 Getting Started Guide

Introduction

Technical Overview

The Capture Security Appliance provides the same Real-Time Deep Memory Inspection (RTDMI™) technology

used by the SonicWallCapture Advanced Threat Protection (Capture ATP) cloud service to protect your network

from malware. RTDMI does the following:

lProactively detects and blocks unknown mass-market malware via deep memory inspection in real time

lDetects and blocks malware that does not exhibit any malicious behavior and hides its weaponry via

custom encryption

lForces malware to “reveal” its weaponry into memory

lIdentifies and mitigates sophisticated attacks where weaponry is exposed for less than 100 nanoseconds

One benefit of the Capture Security Appliance is that it brings the power of RTDMI into an appliance form factor to

serve customers who, due to geographical, regulatory or organizational requirements, cannot send files to the

cloud for ATP analysis.

Benefits of the Capture Security Appliance:

lMemory-based inspection with RTDMI

lMulti-stage analysis with reputation check, static analysis and dynamic analysis

lAPI access for threat analysis

lBroad file type support

lBlock until verdict support

lHigh-security effectiveness

lReporting

lRole-Based access

You can connect the Capture Security Appliance to a supported SonicWall firewall and/or SonicWall Email

Security appliance, or to an API Connector.

Because the Capture Security Appliance is IP addressable, it does not need to be connected directly to a firewall

or Email Security appliance in order to process files. You can connect an API Connector to the CSa and pass files

to it for analysis, run scripts that generate reports, and use other features via API. Refer to

https://github.com/sonicwall for resources describing how to use the Capture ATP API.

Capture Security Appliance 1000 Getting Started Guide

Technical Overview

To utilize the Capture Security Appliance with a connected firewall, the firewall must be able to ping and

communicate via UDP port 2259. Email Security and API scripts need to be able to ping and access the Capture

Security Appliance via HTTPS. As long as the firewalls ,Email Security or API Connector can ping the CSa, it is

operational.

The Capture Security Appliance operates in one-arm mode. Traffic does not pass through it and the CSa does

not sniff files from the network. Files must be sent to the CSa by the supported sources (firewall, Email Security or

API).

The current capabilities of the Capture Security Appliance include:

lAnalysis:

lGlobal Verdict Lookup – SHA256 reputation lookup is performed before proceeding to static and

dynamic analysis.

lRTDMI Static & Dynamic Analysis

lWhitelist / Blacklist

lUser Role Management – Ability to create various roles (such as security analyst, network engineer) and

control what the various roles can see, access and edit.

lScheduled Reporting & Alerts – Ability to create scheduled reports for groups of file sources on a

schedule.

lSecurity Dashboard – Provides a quick glance at file activity.

lConfiguration Backup & Management – Provides safe upgrade/downgrade operations.

lAPI Access – Provides access for file analysis.

Capture Security Appliance 1000 Getting Started Guide

Technical Overview

Deployment Examples

There are three primary deployments for the Capture Security Appliance:

lSingle Office/Single Location

The CSa can be deployed anywhere on the network. It must be reachable via an IP address, and

SonicWall firewalls connected to it must be able to access it via UDP on port 2259.

Firewalls and Email Security systems can send suspicious files to the CSa for analysis within the local

network, rather than using the SonicWall Capture ATP cloud service.

lDistributed Enterprise / Multiple Locations

Multiple offices or branches can share access to a single CSa device, deployed either in the headquarters

data center or in a remote data center accessible by all devices.

Files can be sent to the CSa directly over the internet or over VPN.

You can use either SonicWall GMS or the cloud-based NSM centralized management solutions for rapid

configuration of multiple SonicWall systems to point to the CSa.

Capture Security Appliance 1000 Getting Started Guide

Deployment Examples

lREST API Gateway

The Capture Security Appliance has a REST API interface that can be used to submit files for analysis and

query results by threat intelligence teams via their own scripts, web-portal integrations and other security

products.

Instructions on how to get started with API scripting for the CSa along with code samples are available at

https://github.com/sonicwall.

Capture Security Appliance 1000 Getting Started Guide

Deployment Examples

Prerequisites for CSa Deployment

The following SonicWall appliances and versions are supported in a Capture Security Appliance deployment:

lCapture Security Appliance running 1.2.0 or newer

lFirewalls running SonicOS/X 7.0.0 or newer

lFirewalls running SonicOS 6.5.4.6 or newer

lEmail Security running 10.0.6 or newer

Additional prerequisites include:

lMySonicWall account

lIntelligence Updates license for the CSa

lREST API license for the CSa, if using REST APIfrom an APIConnector

lCapture ATP license on firewalls and Email Security

Capture Security Appliance 1000 Getting Started Guide

Prerequisites for CSa Deployment

High-Level Task List

The following are the steps for a successful deployment of your Capture Security Appliance:

1. Physically connect the CSa to your network device and management computer

2. Log into the CSa

3. Change the admin account password (highly recommended)

4. Set up networking (critical, will not operate otherwise)

After this step, you can manage your CSa from either the X0 or the WAN interface. Using X0 allows

management traffic to be on a separate subnet, while using the WAN interface allows you to manage the

CSa from a remote location via the internet.

5. Register and license your CSa (critical, will not operate otherwise)

6. Update firmware on your CSa (highly recommended)

7. Add allowed devices and other sources that can send files for analysis to the CSa (critical, will not operate

otherwise)

These tasks are described in this Getting Started Guide.

For information about additional configuration of your Capture Security Appliance and configuring your firewalls,

Email Security system or API Connectors to use your CSa, refer to the Related Documents for Additional Configuration

section.

Capture Security Appliance 1000 Getting Started Guide

High-Level Task List

Hardware Overview

This section describes the hardware components of the CSa 1000 appliance.

FRONT PANEL ILLUSTRATION

Item Description

ALCD controls

BDisplay port - Disabled

CConsole port for serial connection

Settings are: Speed=115200, Data bits=8, Stop bits=1, Parity=None, Flow control=None

DUSB ports

FRONT PANEL COMPONENT DESCRIPTIONS

Capture Security Appliance 1000 Getting Started Guide

Hardware Overview

Other manuals for CSa 1000

Table of contents

Other SonicWALL Firewall manuals

SonicWALL

SonicWALL ESA 4300 User manual

SonicWALL

SonicWALL NSa 4650 User manual

SonicWALL

SonicWALL CSa 1000 Use and care manual

SonicWALL

SonicWALL TZ 170 SP User manual

SonicWALL

SonicWALL SuperMassive 9800 User manual

SonicWALL

SonicWALL NSA 250M series User manual

SonicWALL

SonicWALL TZ600 User manual

SonicWALL

SonicWALL TZ570 User manual

SonicWALL

SonicWALL Internet Security User manual

SonicWALL

SonicWALL Secure Mobile Access 6210 User manual

SonicWALL

SonicWALL SMA 210 Quick reference guide

SonicWALL

SonicWALL Email Security 800 User manual

SonicWALL

SonicWALL SuperMassive 9800 AC User manual

SonicWALL

SonicWALL TZ 170 SP User manual

SonicWALL

SonicWALL NSa 6700 User manual

SonicWALL

SonicWALL TZ 200 Series User manual

SonicWALL

SonicWALL SonicOS Enhanced 2.2 Service manual

SonicWALL

SonicWALL ESA 5000 User manual

SonicWALL

SonicWALL TZ 150 Wireless User manual

SonicWALL

SonicWALL Email Security 6000 User manual

SonicWALL

SonicWALL SMA 400 Instruction Manual

SonicWALL

SonicWALL TZ500 User manual

SonicWALL

SonicWALL NSA E6500 User manual

SonicWALL

SonicWALL SuperMassive 9200 User manual

Popular Firewall manuals by other brands

Cisco

Cisco S190 quick start guide

Fortinet

Fortinet FortiGate Voice Series install guide

ADTRAN

ADTRAN NetVanta 2300 Specifications

SecureLogix

SecureLogix ETM System installation guide

NETGEAR

NETGEAR ProSafe FVX538 Reference manual

Lanner

Lanner FW-8877 user manual

Huawei

Huawei USG6000 Series Upgrade guide

H3C

H3C SecPath F5000-AI-15 installation guide

Nexcom

Nexcom DNA 1150 user manual

Fortinet

Fortinet FortiGate-60 series install guide

Cisco

Cisco 3110 Hardware installation guide

Draytek

Draytek Vigor2860 Series user guide

Lanner electronics

Lanner electronics FW-7650 Series user manual

Swisscom

Swisscom Internet Backup manual

DPtech

DPtech FW1000 SERIES Maintenance manual

FEITIAN

FEITIAN MultiPass FIDO product manual

EBLOCKER

EBLOCKER PRO user manual

GTA

GTA GB-200 Product guide