Re: Sonicwall Cssa Exam Questions.zip
Irmgard Verzi
Please assist or point me in the right direction, having trouble understanding how to migrate my current NAT rules to junos, my lack of fully understanding all the NAT types isn't helping. Learning as I go
Following is my config off the sonicwall (single website example), I'm not sure how to translate that into source/dest/static NAT on juniper. I have all the address objects, security zones and interfaces created
In the sonicwall config, "WAN Primary IP" was an auto created address object that linked to the single firewall's external IP address. Now we are going to have multi-homed BGP with a block of IPs from ARIN. I assume the IP I map these NAT rules to needs to be a part of the IP block that fails over between ISPs? (active/passive BGP and SRX cluster setup)
On the SRX nat does work essentially in the same way that it does on Sonicwall. You will be configuring a nat policy in the nat hierarchy and your securty policy to permit the traffic under security policies. The main difference with SRX from Sonicwall is we label the source and destination by zone istead of interface.
In the sonicwall config, "WAN Primary IP" was an auto created address object that linked to the single firewall's external IP address. Now we are going to have multi-homed BGP with a block of IPs from ARIN. I assume the IP I map these NAT rules to needs to be a part of the IP block that fails over between ISPs? (active/passive BGP and SRX cluster setup).
I'm aware that they had an issue with a lot of their devices shutting down connectivity because of a licensing fault, and they have an overtly complex management GUI (on the older devices at least), but are there any other big "gotchas" that I need to be aware of before committing a not insubstantial amount of money towards these devices?
I've been very happy with HA on all the sonicwall models we've used. The closest match to your setup is a pair of NSA 4500s in our primary datacenter. Once setup, HA has been rock solid. The one item I'd note is be sure to setup individual management IPs in the HA setup. It allows you to log in to the standby firewall without affecting the primary (staging firmware updates, for example).
I don't know what you have planned for the SonicWalls, but our gateway router into our building is an NSA 3500. We're a company of about 85 users. We have licenses for the Content Filtering System, Intrusion Prevention, and the Application Flow Monitor, which are all superb. I can check how much of our bandwidth is going to Pandora or youtube, I can see what files are leaving the building. If I pull up the logs and I see that a user is using bittorrent, I can kill the session and block future bittorrent traffic in two clicks. For bandwidth management and security, it's great.
We also have SonicWalls in our remote shipping office and at our colocation where our production servers reside. We have VPN tunnels (site-to-site) between the three sites and it's ridiculously easy to configure. At our colocation is where we have two nsa 3500's in an HA pair. We did a few failover tests when we first set them up and we haven't had to worry about the pair since. We're also looking into licensing the HA pair with Intrusion Prevention, which will detect brute force attacks, sql injection attempts, etc., with what they call their "deep packet inspection" engine.
Some things to look out for, however, is the licensing. Sometimes it feels like they're taking every penny you have each time you add a feature. I believe the only licensing you have to worry about with HA is if you want it to be a stateful failover. If this is licensed, any connections to your primary sonicwall will be there and ready on the backup in the event of a failover and any existing connections won't be interrupted. I think that's it though.
A major gotcha with SonicWalls is currently IPv6 support. There is exactly one semi-supported release of SonicOS (5.5.6) that has any IPv6 features available at all. All later releases (5.8.x is current) have no IPv6 support whatsoever. Downgrades are not supported without rebuilding all of your confiugration. This is level of IPv6 support rediculous at this late date, and you shouldn't buy anything new from Sonicwall until they have IPv6 support in general supported release with reasonable feature parity.
We're pretty happy with our NSA4500 and NSA2400 pairs otherwise, HA works as advertised, as does the load balancing from multiple ISPs. The CLI functioanlity stinks, but the SonicOS Enhanced web GUI is better than just about any other firewall I've encountered. Configuration files are binary blobs, so you cannot edit them with anything besides the GUI. Just use good version control, and export your configuration blobs to SVN, Git, or whatever after every change.
I've had VoIP issues with a NSA 4500 - lots of out-of-sequence packets. Their version of QoS (called Bandwidth Management) was implemented for the SIP traffic but even a support call got nowhere. I finally just put our SIP vendor's box outside of the 4500 and the problem vanished. A quick google search will show that it's a pretty common problem. If you're going to run VoIP through it, you may want to look for a different solution.
SonicWall Certifications - Table of Content
- Sonicwall Certifications
- Types of sonicwall certifications
- How to take the Sonicwall network security administrator certification exam?
- Conclusion
SonicWall offers a variety of training options for security professionals seeking certification or simply looking to improve their knowledge and maximize their investment in SonicWall Network Security Products. SonicWall University, a rigorous online tutorial, as well as live classroom led by Authorized Training Partners, provide web-based, live, and on-demand sessions.
SonicWall Network Security Administrator (SNSA) training is intended to teach students about SonicWall network security technology.The course will teach students how to successfully install and configure SonicWall firewall appliances and security services. SonicWall recommends this course for networking professionals who are in charge of one or more security appliances on a daily basis.
The SonicWall Network Security Professional (SNSP) training and certification program designs on the enterprise information security workability in the SonicWall Network Security Administrator (SNSA) course.
The Secure Mobile Access Administrator (SMAA) eLearning training curriculum is intended to teach students how to use the SonicWall SMA 1000 series appliance to provide secure, anywhere access to applications and resources for employees, business partners, and other users.
You are eligible to take the Secure Mobile Access Administrator exam once you have completed the Secure Mobile Access Administrator eLearning course. To access different certifications under this sonicwall , just login into your sonicwall university account.
In the above blog post we had discussed about the sonicwall certifications in depth. Please go through them if you are interested. Had any doubts drop them in the comments section to get them clarified.
On Our Website all Courses, Technologies, logos, and certification titles we use are their respective owners' property, Trademarks & their intellectual Property belong to respective owners. All the firm, service, or product names on our website are solely for identification purposes. We do not own, endorse or have the copyright or officially partnered of any brand/logo/name in any manner. Few graphics on our website are freely available on public domains. we use all these just for the purpose of training only.
7fc3f7cf58