SonicWall™ SonicOS 6.2.7

1 SonicWall SonicOS Notes1 SonicWall SonicOS NotesMarch 2017, updated May 2017 These release notes provide information about the SonicWall SonicOS : About SonicOS Supported Platforms New Features Enhancements Resolved Issues Known Issues System Compatibility Product Licensing Upgrading Information SonicWall SupportAbout SonicOS SonicOS provides important new features and fixes many known issues found in previous releases. For more information, see the New Features and Resolved Issues PlatformsSonicOS is supported on the following SonicWall appliances: SuperMassive 9600 NSA 6600 TZ600 SuperMassive 9400 NSA 5600 TZ500 / TZ500 Wireless SuperMassive 9200 NSA 4600 TZ400 / TZ400 Wireless NSA 3600 TZ300 / TZ300 Wireless NSA 2600 SOHO WirelessSonicWall SonicOS Notes2 New FeaturesThis section describes the new features introduced in SonicOS .

2 DNS Proxy VPN Auto Provisioning DPI SSH Open Authentication Social Login Biometric Authentication Flow Reporting using IPFIX Extension Version 2 Syslog Server Profiling System Logs on AppFlow Server via IPFIX FQDN Routing Custom Lists for Geo IP and Botnet High Availability with Dynamic WAN and DHCP PPPoE Unnumbered Interface Support 31 Bit Network SonicPoint Radius Accounting Updated SonicPoint Firmware Vendor OUI Detection and Logging Threat API Dell X Series Switch Integration Features Packet Monitor pcapNG Export TSR FTP for Periodic Backup SIP UDP Fragmentation Fixes DPI SSL Increased Connection Counts and Enhancements Maximum Routes Doubled Maximum Zone to Zone Access Rules Increased NAT64.

3 Stateful NAT from IPv6 Client to IPv4 Server Additional IPv6 SupportDNS ProxySonicOS supports DNS proxy to allow IPv4 clients to access DNS services in a network with mixed IPv4 and a normal deployment, an IPv4 interface can do name resolution on IPv4 internet, and an IPv6 interface can only do name resolution on IPv6 internet through DNS SonicOS Notes3A new page is added to the SonicOS web management interface, Network > DNS Proxy. Select the Enable DNS Proxy checkbox to globally enable the are two modes for DNS proxy: IPv4 to IPv4, and IPv4 to IPv6.

4 The default mode is IPv4 to IPv6, meaning that the firewall redirects queries from clients to upstream IPv6 DNS servers. For IPv4 to IPv4, the firewall redirects the queries to upstream IPv4 DNS option on DNS proxy protocol is UDP and TCP, which means when DNS query is sent over TCP, it will be proxied and retransmitted to outside DNS servers over checkbox Enforce DNS Proxy For All DNS Requests is an enhanced option for DNS proxy. When the option is selected, other types of DNS queries will be hooked by the DNS proxy module, including stack DNS packets sent by SonicOS , and forwarding DNS queries with destination address of outside DNS Configuration and Allow RulesSonicOS supports the DNS proxy feature on physical interface, VLAN interface, or VLAN trunk interface, and the zone for each interface can only be LAN, DMZ or the Advanced tab of the interface configuration page.

5 There is a checkbox named Enable DNS Proxy when the interface permits configuring DNS DNS proxy is enabled on an interface, one Allow Rule is auto added by SonicOS for UDP with the settings: From the interface to the interface, source with any and destination with the interface IP, service with DNS, and enable management. When DNS Proxy over TCP is enabled, another Allow Rule is auto DNS proxy is enabled on an interface, the device needs to push the interface IP as DNS server address to clients, so the SonicOS administrator needs to configure the DHCP server manually and use the interface address as the DNS Server 1 address in the DHCP server settings on the DNS/WINS tab.

6 The Interface Pre populate check box in the DHCP page makes this easy to configure; if the selected interface has enabled DNS proxy, the DNS server IP is auto added into the DNS/WINS SonicOS Notes4 DNS CacheIn the Network > DNS Proxy page, the DNS Cache function can be enabled by selecting the Enable DNS Cache checkbox; the default setting is enabling the function, SonicOS caches the answers from DNS responses during the DNS Proxy process, and will directly respond to clients if a subsequent DNS query matches the DNS are two kinds of DNS cache: static DNS cache and dynamic DNS cache.

7 Static DNS cache means that it can be manually created and edited by users, and never expires. Dynamic DNS cache is added automatically during the DNS proxy process, and it is displayed only in the whole DNS cache table. Its type is Dynamic, and has TTL value. Dynamic DNS cache can be flushed by the DNSS plit DNS is an enhancement for DNS proxy, which allows the administrator to configure a set of name servers and associate them to a given domain name (can be wildcard). When SonicOS receives a query that matches the domain name, it will be transmitted to the designated DNS Auto ProvisioningSonicOS introduces the VPN Auto Provisioning feature.

8 This feature provides automatic VPN provisioning for box to box hub and spoke configurations. The user experience is similar to that seen when using SonicWall Global VPN Client to connect from a client machine to a firewall, in which none of the complexity is visible to the , only two pieces of information are required to configure a spoke appliance when using VPN Auto Provisioning: The peer gateway address or domain name The machine authentication credentialsBy selecting the Default Provisioning Key option, machine authentication credentials can be based on a default value known to all the appliances.

9 To increase security, user level credentials may also be Auto Provisioning can be used when adding a VPN Policy in the VPN > Settings page. In the Add dialog under Security Policy, select either: SonicWall Auto Provisioning ClientSonicWall SonicOS Notes5 SonicWall Auto Provisioning ServerDPI SSHS onicOS introduces the DPI SSH feature. DPI SSH inspects the data traversing the firewall in an SSH tunnel. SSH, or Secure Shell, is a cryptographic network protocol for secure network communication and services between two networked computers. It connects, via a secure channel over an insecure network, a server and a client running SSH server and SSH client programs, respectively.

10 SSH is not only a shell, but acts as a secure channel. It can provide different services over this tunnel, including shell, file transfer or X11 supports SSH2. SSH1 sessions will not be intercepted and inspected. If the SSH1 banner message contains a non conforming SSH version number, it will be treated as a bad protocol and , or Deep Packet Inspection, examines the data part (and possibly also the header) of a packet as it passes the SonicWall firewall. It searches for protocol non compliance, viruses, spam, intrusions, or defined criteria to decide whether the packet may SSH decrypts incoming SSH packets and sends them to the DPI module for inspection.