User manual SONICWALL SWITCHING NSA 2400MX IN SONICOS ENHANCED 5.7 FEATURE MODULE

[. . . ] Switching on the SonicWALL NSA 2400MX in SonicOS Enhanced 5. 7 Document Scope This solutions document describes how to configure and manage the Switching feature on a SonicWALL NSA 2400MX running SonicOS Enhanced 5. 7. This document contains the following sections: · · · "Feature Overview" section on page 1 "Configuring Switching" section on page 4 "Glossary" section on page 30 Feature Overview This section provides an introduction to the Switching feature. This section contains the following subsections: · · · · "What is Switching on the SonicWALL NSA 2400MX?" section on page 1 "Benefits of Switching" section on page 2 "How Does Switching Work on the SonicWALL NSA 2400MX?" section on page 3 "Supported Platforms" section on page 3 What is Switching on the SonicWALL NSA 2400MX? SonicOS Enhanced 5. 7 introduces Layer 2 (data link layer) switching functionality on the SonicWALL NSA 2400MX appliance. The SonicWALL NSA 2400MX appliance is a Unified Threat Management (UTM) security appliance that integrates the WAN flexibility of a router with 24 built-in Ethernet switch ports. [. . . ] This configuration allows port redundancy, but does not support load balancing in the NSA 2400MX-to-Server direction due to a hardware limitation on the NSA 2400MX. Switching in SonicOS Enhanced 5. 7 15 Configuring Switching · NSA 2400MX to Switch ­ This is allowed by enabling Link Aggregation on VLAN trunk ports. The NSA 2400MX supports one load balancing algorithm based on source and destination MAC address pairs. Server Logical Link (LAG) Redundant - Not Load Balanced Network Security Appliance 2400MX Logical Link (LAG) Internet Redundant and Load Balanced Switch Eng VLAN QA VLAN Similarly to PortShield configuration, you select an interface that represents the aggregated group. By default, the aggregator port key is the same as its interface number. Non-aggregator ports can be optionally configured with a key, which can help prevent an erroneous LAG if the switch connections are wired incorrectly. Ports bond together if connected to the same link partner and their keys match. If there is no key configured for a port (if the port is in auto mode), it will bond with an aggregator that is connected to the same link partner. Like a PortShield host, the aggregator port cannot be removed from the LAG since it represents the LAG in the system. Note Once link aggregation has been enabled on VLAN trunk ports, additional VLANs cannot be added or deleted on the LAG. Note If you need to enable RSTP on the LAG, first enable RSTP on the individual members and then enable link aggregation. 16 Switching in SonicOS Enhanced 5. 7 Configuring Switching Creating a Logical Link (LAG) To create a Logical Link (LAG), perform the following steps: Step 1 Step 2 On the Switching > Link Aggregation page, click the Add button. In the Add LAG Port window, select the interface from the Port drop-down list. Step 3 Step 4 Step 5 Step 6 Step 7 To specify a key, clear the Auto-Detect checkbox and type the desired key into the Key field. If this interface will be the aggregator for the LAG, select the Aggregator checkbox. On the Switching > Link Aggregation page, click the Add button again. Switching in SonicOS Enhanced 5. 7 17 Configuring Switching Step 8 In the Add LAG Port window, select the interface for the link partner from the Port drop-down list. Step 9 If you specified a key for the first interface (the aggregator), clear the Auto-Detect checkbox and type the same key into the Key field. If Auto-Detect was left enabled for the first interface, leave it enabled for this one as well. Step 10 Clear the Aggregator checkbox. Step 12 Click OK. The Switching > Link Aggregation page displays the LAG. The Partner column will display the MAC addresses of the link partners after they are physically connected. 18 Switching in SonicOS Enhanced 5. 7 Configuring Switching Configuring Port Mirroring You can configure Port Mirroring on the SonicWALL NSA 2400MX to send a copy of network packets seen on one or more switch ports (or on a VLAN) to another switch port called the mirror port. By connecting to the mirror port, you can monitor the traffic passing through the mirrored port(s). A VLAN trunk port can be mirrored, but cannot act as a mirror port itself. The Switching > Port Mirroring page allows the administrator to assign mirror ports to mirror ingress, egress or bidirectional packets coming from a group of ports. See the following procedures: · · "Configuring a Port Mirroring Group" on page 19 "Deleting a Port Mirroring Group" on page 20 Configuring a Port Mirroring Group To create a new port mirroring group, perform the following steps: Step 1 Step 2 On the Switching > Port Mirroring page, click the New Group button. In the Edit Mirror Group window, type a descriptive name for the group into the Interface Group Name field. Switching in SonicOS Enhanced 5. 7 19 Configuring Switching Step 3 For the Direction, select one of the following: · · · ingress ­ Select ingress to monitor traffic arriving on the mirrored port(s). egress ­ Select egress to monitor traffic being sent out on the mirrored port(s). both ­ Select both to monitor traffic in both directions on the mirrored port(s). Step 4 Step 5 In the All Interfaces list, select the port to mirror the traffic to and click the top right-arrow button to move it to the Mirror Port field. In the All Interfaces list, select one or more ports to be monitored, and click the lower right-arrow button to move it/them to the Mirrored Ports field. You will be able to monitor traffic on the mirrored port(s) by connecting to the mirror port. [. . . ] To create an address object, select Create new address object from the drop-down list. TheAdd Address Object window opens. Note Turn off the pop-up blocker in your browser before selecting Create new address object. Step 4 Step 5 Step 6 Step 7 Step 8 Step 9 Type a descriptive name for the address object into the Name field. If the device with this MAC address can have multiple IP addresses, select the Multi-homed host checkbox. The new address object appears in the MAC Address field of the Add Static MAC Address window. [. . . ]