Manual d'usuari de l'alta disponibilitat de Sonicwall NSA 2700

1. Acabatview

The SonicWall Network Security appliance (NSa) 2700 High Availability unit is designed to provide robust, next-generation security for businesses with 250 users and up. This device is specifically configured for High Availability (HA) setups, meaning it functions as a secondary unit in a pair to ensure continuous network connectivity and security in the event of a primary unit failure. It offers advanced threat protection, including defense against ransomware and attacks on non-standard ports, while maintaining high performance.

Key capabilities include TLS/SSL decryption and inspection, application intelligence and control, secure SD-WAN, real-time visualization, and WLAN management. The NSa 2700 operates on SonicOS 7.0, providing a flexible, fast, and cost-effective security solution.

Figura 1: Frontal view of the Sonicwall NSA 2700 High Availability unit, showcasing its compact rack-mountable design and various network ports.

2. Setup and High Availability Configuration

The SonicWall NSA 2700 High Availability unit is designed to work in conjunction with an identical primary unit to form a High Availability pair. This configuration ensures network reliability by allowing the backup unit to seamlessly take over all network responsibilities if the primary unit fails. It is crucial to understand that this unit cannot function as a standalone primary device.

2.1 Physical Connections and Ports

Before configuring the High Availability setup, ensure all necessary physical connections are made. The NSA 2700 features a variety of ports for network connectivity and management.

Figura 2: posterior view of the Sonicwall NSA 2700, highlighting key ports including the Console port, 1 GbE Management port, Dual USB Ports, 3 x 10-GbE SFP+ Ports, and 16 x 1-GbE Ports.

• Port de la consola: Used for direct console access for initial configuration and troubleshooting.
• 1 GbE Mgmt Port: Dedicated management interface.
• Ports USB dobles: For connecting external devices or storage.
• 3 x 10-GbE SFP+ Ports: High-speed fiber optic ports for uplink or critical network segments.
• 16 x 1-GbE Ports: Standard Gigabit Ethernet ports for various network connections.

For High Availability, ensure that the primary and secondary units are connected via dedicated HA links as per SonicWall's HA deployment guide, typically involving specific Ethernet ports for heartbeat and state synchronization.

3. Deployment Scenarios

The SonicWall NSA 2700 is versatile and can be deployed in various network architectures to provide comprehensive security. Its capabilities are particularly suited for medium and distributed enterprises.

3.1 Internet Edge Deployment

In an Internet Edge deployment, the NSA 2700 protects private networks from malicious traffic originating from the internet. This setup allows for high-performance threat prevention and deep packet inspection, including TLS 1.3, to block evasive threats without compromising network speed.

Figure 3: Diagram illustrating the SonicWall NSA 2700 in an Internet Edge deployment, positioned between the ISP router and the internal network, protecting both the campus/private edge network and a DMZ network.

3.2 Medium and Distributed Enterprises Deployment

For distributed environments, the NSA 2700 supports SD-WAN capabilities and can be centrally managed. This makes it an ideal solution for securing branch offices and providing secure access to internal resources, while reducing complexity and maximizing efficiency.

Figure 4: Diagram showing the SonicWall NSA 2700 deployed in a distributed enterprise, connecting branch offices to enterprise headquarters via SD-WAN for secure internal resource access and direct internet access.

4. Advanced Security Features

The NSA 2700 incorporates advanced security technologies to protect against sophisticated cyber threats.

4.1 Reassembly-Free Deep Packet Inspection (RFDPI)

RFDPI is a single-pass, low-latency inspection system that performs stream-based, bi-directional traffic analysis. It uncovers intrusion attempts and malware downloads regardless of port and protocol, relying on streaming traffic payload inspection to detect threats at Layers 3-7. This proprietary engine uses memory representation of signature databases to identify intrusions, malware, and applications.

Figure 5: Diagram illustrating a competitive proxy-based architecture, showing potential bottlenecks and limitations in inspection time and capacity due to packet assembly and proxy buffering.

Figure 6: Diagram illustrating SonicWall's stream-based architecture with Reassembly-Free Deep Packet Inspection (RFDPI), demonstrating how it eliminates proxy and content size limitations for efficient threat inspection.

4.2 Secure, High-speed Wireless

When combined with a SonicWall SonicWave wireless access point, the NSA 2700 can create a high-speed wireless network security solution. Both the NSA series firewalls and SonicWave access points feature 2.5 GbE ports, enabling multi-gigabit wireless throughput offered in Wave 2 wireless technology. The firewall scans all wireless traffic for malware and intrusions, even over encrypted connections, providing additional layers of protection through content filtering, application control, and Capture Advanced Threat Protection.

Figure 7: Diagram showing the NSA 2700 integrated with a SonicWall SonicWave 432i access point, illustrating bi-directional scanning of wireless traffic to secure connected devices.

5. Operating System and Management

The SonicWall NSA 2700 operates on SonicOS 7.0, the latest generation operating system designed for enhanced security and simplified management. This OS provides a comprehensive suite of features for network control, threat prevention, and policy enforcement.

Centralized management is a key aspect of the NSA 2700, especially in distributed environments. The intuitive single-pane-of-glass user interface allows for efficient configuration, monitoring, and reporting across multiple devices, reducing operational complexity.

6. Pautes de manteniment

Proper maintenance ensures the longevity and optimal performance of your SonicWall NSA 2700 High Availability unit.

• Actualitzacions de firmware: Regularly check for and apply the latest SonicOS firmware updates. These updates often include security patches, bug fixes, and new features.
• Còpies de seguretat de configuració: Periodically back up your device configuration. This is critical for quick recovery in case of unexpected issues or hardware failure.
• Control ambiental: Ensure the device is operated within recommended temperature and humidity ranges. Provide adequate ventilation to prevent overheating.
• Inspecció física: Routinely inspect the device for any physical damage, loose cables, or dust accumulation. Keep the vents clear.
• Seguiment: Utilize the device's logging and reporting features to monitor network activity, security events, and system health.

7. Resolució de problemes comuns

This section provides guidance for common issues you might encounter with your NSA 2700 High Availability unit.

• HA Failover Not Occurring:
  • Verify the dedicated HA link cables are securely connected between both units.
  • Check the HA configuration settings on both the primary and secondary units to ensure they are correctly paired and synchronized.
  • Review system logs for any HA-related errors or warnings.
• Problemes de connectivitat de xarxa:
  • Confirm all network cables are properly connected to the correct ports.
  • Check the status LEDs on the ports for link activity.
  • Verify IP address configurations, subnet masks, and gateway settings.
  • Temporarily disable any recently applied security policies to rule them out as the cause.
• Rendiment de xarxa lent:
  • Monitor CPU and memory utilization on the device. High usage can indicate a bottleneck.
  • Review security services (e.g., DPI-SSL, IPS) and their impact on throughput. Adjust policies if necessary.
  • Check for excessive network traffic or potential denial-of-service attacks.
• Login Issues to Management Interface:
  • Ensure you are using the correct IP address for the management interface.
  • Esborra la memòria cau del navegador o prova un altre navegador.
  • If credentials are forgotten, follow the password recovery procedure outlined in the comprehensive SonicWall documentation.

For more detailed troubleshooting, refer to the official SonicWall support documentation or contact SonicWall technical support.

8. Especificacions tècniques

Below are the key technical specifications for the SonicWall NSA 2700 High Availability unit.

9. Garantia i Suport

For detailed information regarding the warranty coverage for your SonicWall NSA 2700 High Availability unit, please refer to the official warranty documentation provided with your purchase or visit the SonicWall official website. Warranty terms and conditions may vary based on region and purchase agreement.

For technical assistance, product support, or to report issues, please contact SonicWall's customer support. Support resources, including knowledge bases, forums, and contact information, are typically available on the official SonicWall support portal.

Figure 8: Image of the SonicWall High Availability License box, representing the licensing required for HA functionality.