Chat now with support
Chat with Support

Security Analytics Engine 1.1 - SonicWALL Configuration Guide

Optional SonicWALL Configuration

•
Introduction
•
User identification (recommended)
•
Client computer name identification
•
SSL-Encrypted detection

Introduction

Utilizing the required installation will allow the SonicWALL Processor service to process SonicWALL AppFlow data and generate user and IP address activity detection records for IP addresses and user names (if known to the firewall). However, not all data elements or detection modes will be possible without additional configurations. These capabilities include:
•
Identifying the user (see User identification (recommended))
•
Identifying the client computer name (see Client computer name identification)
•
Analyzing SSL-encrypted web site activity (see SSL-Encrypted detection)
If any of these optional firewall capabilities are desired, follow the instructions in the sections below.

User identification (recommended)

Although not required, it is strongly recommended that you take advantage of the user authentication options available with SonicWALL in order to best protect your applications from being accessed by a user ID associated with undesirable activity. SonicWALL user identification is a complex subject, with each option having both benefits and risks. For that reason, all options should be reviewed prior to configuration. In addition, refer to the SonicOS Administrator’s Guide for more information about configuring user authentication.

Client computer name identification

In order for the SonicWALL firewall to provide computer name information in the AppFlow packets, and subsequently in the Security Analytics Engine user and IP address activity record details, enable MAC-IP Anti-spoofing in the firewall administration, as follows:
1
Expand Network in the left-hand pane and select MAC-IP Anti-spoof.
2
Using the Settings for <nn> interface(s) drop-down, select the desired firewall interface (for example, XO is typically the LAN interface).
3
Click the button in the Configure column to open the Edit MAC-IP Anti-Spoof Settings dialog.
4
Select the check boxes for the following items:
•
Enable - Enable MAC-IP based anti-spoofing
•
Spoof Detection - Create MAC-IP spoof detection list for packets failing to match anti-spoof cache
•
Allow Management - All traffic destined to the box will be allowed without a valid MAC-IP Anti-spoof cache
5
Click the OK button. Over time, the cache of detected computer names can be viewed in the Spoof Detected List.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating