Dell SonicWALL Security User Guide

Transcription

1 Dell SonicWALL Security 8.1.1

2 2015 Dell Inc. ALL RIGHTS RESERVED. This guide contains proprietary information protected by copyright. The software described in this guide is furnished under a software license or nondisclosure agreement. This software may be used or copied only in accordance with the terms of the applicable agreement. No part of this guide may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying and recording for any purpose other than the purchaser s personal use without the written permission of Dell Inc. The information in this document is provided in connection with Dell products. No license, express or implied, by estoppel or otherwise, to any intellectual property right is granted by this document or in connection with the sale of Dell products. EXCEPT AS SET FORTH IN THE TERMS AND CONDITIONS AS SPECIFIED IN THE LICENSE AGREEMENT FOR THIS PRODUCT, DELL ASSUMES NO LIABILITY WHATSOEVER AND DISCLAIMS ANY EXPRESS, IMPLIED OR STATUTORY WARRANTY RELATING TO ITS PRODUCTS INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. IN NO EVENT SHALL DELL BE LIABLE FOR ANY DIRECT, INDIRECT, CONSEQUENTIAL, PUNITIVE, SPECIAL OR INCIDENTAL DAMAGES (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, BUSINESS INTERRUPTION OR LOSS OF INFORMATION) ARISING OUT OF THE USE OR INABILITY TO USE THIS DOCUMENT, EVEN IF DELL HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Dell makes no representations or warranties with respect to the accuracy or completeness of the contents of this document and reserves the right to make changes to specifications and product descriptions at any time without notice. Dell does not make any commitment to update the information contained in this document. If you have any questions regarding your potential use of this material, contact: Dell Inc. Attn: LEGAL Dept 5 Polaris Way Aliso Viejo, CA Refer to our website (software.dell.com) for regional and international office information. Trademarks Dell, the Dell logo, SonicWALL, SonicWALL ViewPoint. Reassembly-Free Deep Packet Inspection, Dynamic Security for the Global Network, SonicWALL Clean VPN, SonicWALL Clean Wireless, SonicWALL Global Response Intelligent Defense (GRID) Network, SonicWALL Mobile Connect, and all other SonicWALL product and service names and slogans are trademarks of Dell Inc. Microsoft Windows 7, Windows Server 2010, Internet Explorer, and Active Directory are trademarks or registered trademarks of Microsoft Corporation. Adobe, Acrobat, and Acrobat Reader are either registered trademarks or trademarks of Adobe Systems Incorporated in the U.S. and/or other countries. Other trademarks and trade names may be used in this document to refer to either the entities claiming the marks and names or their products. Dell disclaims any proprietary interest in the marks and names of others. Legend CAUTION: A CAUTION icon indicates potential damage to hardware or loss of data if instructions are not followed. WARNING: A WARNING icon indicates a potential for property damage, personal injury, or death. IMPORTANT NOTE, NOTE, TIP, MOBILE, or VIDEO: An information icon indicates supporting information. Security Updated - June 2015 Version Rev A

3 1 Using This Guide About this Guide Welcome to the. This document provides instructions for basic configuration for all facets of the product, including Security appliances, the Security Virtual Appliance, and Security Software. Navigate to for the latest version of this guide as well as other Dell SonicWALL products and services documentation. Guide Conventions The following conventions used in this guide are as follows: Table 1. Guide conventions Convention Bold Italic Use Highlights dialog box, window, and screen names. Also highlights buttons. Also used for file names and text or values you are being instructed to type into the interface. Indicates the name of a technical manual. Also indicates emphasis on certain words in a sentence. Sometimes indicates the first instance of a significant term or concept. 3

4 2 Managing the Junk Box This chapter provides information about the following topics: Logging In to Your Junk Box on page 4 Junk Box Management > Junk Box on page 5 Junk Box Management > Junk Box Summary on page 6 Logging In to Your Junk Box When Security determines a message is junk, the message is stored in a Junk Box on the Security server and alerts you by . You can log in to your Junk Box to view messages that were junked by Security. To log in to your Junk Box, click the Visit Junk Box link in the Junk Box Summary . NOTE: Many of windows are pop-up windows; configure your Web browser to allow pop-ups from the server. 4

5 Junk Box Management > Junk Box After clicking the Visit Junk Box link in the Junk Box Summary , you are automatically directed to the Junk Box Management > Junk Box page. Messages in junk box can be quickly sorted and viewed by threat types. Messages that contain definite spam, phishing, and viruses have red asterisks (*) adjacent to them. Messages that contain likely spam, phishing, and viruses do not have any marks. Type of Message Spam (definite) Likely Spam Phishing (definite) Likely Phishing Virus (definite) Likely Virus Display *Spam Spam *Phishing Phishing *Virus Virus Using the Junk Box Simple View The Junk Box Management > Junk Box window displays all the messages that have been categorized as the selected threats. This page also allows you to: Search for messages containing specific strings in the following fields: Subject, From, To, or Unique Message ID. Search is not case sensitive. Select a specific date to search on any particular date. Using the Junk Box Advanced View Additional search capabilities give administrators the ability to support users more effectively, audit more selectively, and dispose of unwanted messages with more granularity. To use Advanced Search: 1 On the Junkbox Management > Junk Box page, click the Advanced View button. 5

6 2 To search for specific threat types, select the check boxes in the Threats section. 3 Click Search. Messages matching your search criteria are displayed. Junk Box Management > Junk Box Summary From the Junk Box Management > Junk Box Summary page, users can determine the language, frequency, content, and format of the Junk Box Summary messages. By default, the Adhere to System Defaults check box is selected. To configure your own settings, deselect this check box. 6

7 Configure the following settings: Specify the Frequency of summaries to be sent. Select from the drop down list the frequency of Junk Box Summaries to be sent to you. Specify the Time of day to send summary. Select Any time of day or specify an hour to send the summaries. Specify the Day of the week to send summary. Select any time of day or specify day to send the summaries. Select the Time Zone from the drop down list. Select Summaries include to include All Junk Messages or Only Likely Junk (hide definite junk) in Junk Box Summaries. Select the Language of summary from the drop down list. Select the Send plain summary check box to send junk box summaries without graphics.the following image shows a Plain Summary: 7

8 The following image shows a Graphic Summary: Select the Send Junk Box Summary to Delegates check box to have summary s sent directly to a user s delegates. With this option enabled, users with delegates no longer receive summary s. 8

9 3 Managing Anti-Spam This chapter provides information about the following topics: Anti-Spam > Spam Management on page 9 Anti-Spam > Anti-Spam Aggressiveness on page 10 Anti-Spam > Languages on page 11 Anti-Spam > Anti-Spam Aggressiveness on page 10 Anti-Spam > Spam Management By default, the Adhere to System Defaults check box is selected. To configure your own settings, deselect this check box. To manage messages marked as definite spam or likely spam: 1 Navigate to the Anti-Spam > Spam Management page. 2 Choose one of the following responses for messages marked as Definite Spam and Likely Spam: Response No Action Store in Junk Box (default setting) Tag With Effect No action is taken for messages. The message is stored in the Junk Box. It can be unjunked by users and administrators with appropriate permissions. This option is the recommended setting. The is tagged with a term in the subject line, for example [SPAM]. Selecting this option allows the user to have control of the and can junk it if it is unwanted. 9

10 3 Select the Accept Automated Allowed List check box to allow automated lists that are created by User Profiles to prevent spam. With this feature enabled, User Profiles analyze the recipients of s from members of your organization and automatically added them to Allowed Lists. 4 Click Apply Changes to save and apply changes to this screen. Anti-Spam > Anti-Spam Aggressiveness The Anti-Spam > Anti-Spam Aggressiveness page allows you to tailor the Security product to your preference. NOTE: Configuring this page is optional. See the following topics: General Settings on page 10 Category Settings on page 10 General Settings The General Settings section allows you to configure GRID Network Aggressiveness and the Adversarial Bayesian Aggressiveness. The GRID Network Aggressiveness technique determines the degree to which you want to use the collaborative database. Security maintains a database of junk mail identified by the entire user community. You can customize the level of community input on your corporate spam blocking. Selecting a stronger setting makes Security more likely more responsive to other users who mark a message as spam. The Adversarial Bayesian technique refers to s statistical engine that analyzes messages for many of the spam characteristics. This is the high-level setting for the Rules portion of spam blocking and lets you choose where you want to be in the continuum of choice and volume of . This setting determines the threshold for how likely an message is to be identified as junk . Use the following settings to specify how stringently Security will evaluate messages: Setting Mildest Mild Medium Strong Strongest Description You will receive a large amount of questionable in your mailbox. This is the lightest level of aggressiveness. You are likely to receive more questionable in your mailbox and receive less in the Junk Box. This can cause you to spend more time weeding through unwanted from your personal mailbox. You accept Security s spam-blocking evaluation. Security rules out greater amounts of spam for you. This can create a slightly higher probability of good messages in your Junk Box. Security heavily filters out spam. This creates an even higher probability of good messages in your Junk Box. Category Settings The Category Settings allow you to select the level of aggressiveness for specific categories of spam, such as Sexual Content, Offensive Language, Get Rich Quick Schemes, Gambling, Advertisements, and Images. 10

11 Use the following settings to specify the level of aggressiveness: Setting Mildest Mild Medium Strong Strongest Description This setting allows you to view most of the messages that contain terms that relate to the category. This setting allows you to be able to view messages that contain terms that relate to the category. This setting forces Security to tag messages with this content as Likely Junk. This setting more likely tags messages with this content as Definite Junk. This setting tags all messages with this content as Definite Junk. NOTE: You can select the Strong setting for messages containing a specific category, such as Sexual Content, and a Mild setting for a category you may be less concerned about, like Advertisements. Anti-Spam > Languages The Anti-Spam > Languages page gives you the option to Allow All, Block All, or have No Opinion on messages in various languages. By default, the Adhere to System Defaults check box is selected. To configure your own settings, deselect this check box. Allow All Allows all messages in a language without any screening. Block All Blocks all messages in a language. No Opinion Allows messages in a language to be screened by all filters installed in Security. 11

12 Anti-Spam > Address Books The Anti-Spam > Address Books page enables you to allow or block people or companies from sending you . This page shows a compilation of allowed and blocked senders from your organization s lists, as well as lists provided by default. NOTE: Some of the entries were added by your organization, and appear on every user s list. These entries are indicated with a dimmed check box. You do not have access delete them from your list. See the following topics: Using the Search Field on page 12 Adding to the Address Book on page 12 Deleting from the Address Book on page 13 Using the Search Field To search for an address, select the Allowed or Blocked tab. Then, enter all or part of the address in the Search field. Narrow your search by selecting the People, Companies, Lists, Corporate, or Personal checkbox(es). Click Go to perform the search. Adding to the Address Book To add People, Companies, or Lists to the Address Book: 1 To add items to your Allowed list, click the Allowed tab. To add items to your Blocked list, click the Blocked tab. 2 Click the Add button. The Add Items window displays. 3 Select from the drop down list what type of item you are adding. The available selections are People, Companies, or Lists. 4 If you selected People, you will have to specify the address(es) to add in the space provided. If you selected Companies, you will have to specify the domains to add in the space provided. If you selected Lists, you will have to specify the mailing lists to add in the space provided. 5 Click Add to finish adding to your list. 12

13 Deleting from the Address Book To delete People, Companies, or Lists to the Address Book: 1 To delete items from your Allowed list, click the Allowed tab. To delete items from your Blocked list, click the Blocked tab. 2 Click the check box next to the item(s) you want to delete. Then, click the Delete button. 3 To delete all items from your list, click the Delete All button. You will have to select the items you want to delete. Then, click Delete All. 13

14 4 Configuring Settings The Settings page allows you to add delegates to your Junk Box. Delegates are people who have full access to your own individual Junk Box. Delegates have the availability to change your Junk Box settings, as well as manage the messages in you Junk Box. The most common use of delegates may be for an administrative assistant that acts as a delegate to the CEO of a company. The assistant may need to frequently access the CEO s messages, thus having access to the CEO s Junk Box and Junk Box Settings. This chapter includes the following topics: Adding a Delegate on page 14 Deleting a Delegate on page 15 Adding a Delegate To add a delegate to have access to your Junk Box: 1 Navigate to the Settings > Delegates page. 2 Click the Add button. The Add Delegates page displays. 3 Select the check box of the delegate(s) from the list of addresses you want to add, or you can conduct a Search to find specific addresses. 4 Click the Add Delegate button. The selected users will be added to your list of Delegates. 14

15 Deleting a Delegate To remove users that are considered delegates for your Junk Box: 1 Navigate to the Settings > Delegates page. 2 Select the check box next to the delegate(s) you wish to remove. 3 Click the Remove button. The selected user(s) will be removed from your list of Delegates. 15

16 5 Using Reports & Monitoring The Reports and Monitoring page of your Junk Box allows you to access several different reports on the Dashboard regarding incoming and outgoing mail messages. This page allows you to view statistics hourly, daily, or monthly. Dashboard The Reports > Dashboard page provides information about at a glance. These charts are updated hourly and display the statistics for the last 24 hours. On any report page, drag and drop the charts to customize the order of how each report appears on the page. The following settings are also available: Click the Stacked Chart tab to see the report visualized as a stacked chart view. Click the Line Chart tab to see the report visualized as a line chart. Click the Table tab to see the report in a table format. Click the Refresh Reports button to update the data in the reports with the most current data. Click the Zoom or Undo Zoom button to change the view of the report. Click the Save View button to save the current view of the report page, which saves any changes made to the view. Click Reset to Default View to return the page to default settings. Click the Download icon to download the report. You can download the report as a PDF or JPEG. 16

17 See the following topics for more information: Inbound Good vs Junk on page 17 Outbound Good vs Junk on page 17 Junk Breakdown on page 17 Inbound Good vs Junk Displays the number of Good messages in comparison to the Junk messages received. The Junk messages include spam, likely spam, phishing, likely phishing, viruses, likely viruses, Directory Harvest Attacks (DHA), and messages that trigger policy events. The information in this chart can also be found in the Reports & Monitoring > Overview Reports > Inbound Good vs. Junk report. Outbound Good vs Junk Displays the number of Good messages in comparison to the Junk messages received. The Junk messages include spam, likely spam, phishing, likely phishing, viruses, likely viruses, Directory Harvest Attacks (DHA), and messages that trigger policy events. The information in this chart can also be found in the Reports & Monitoring > Overview Reports >Outbound Good vs. Junk report. Junk Breakdown Displays the number of Junk messages, classified into the following categories: Spam (Definite Spam and Likely Spam) Phishing (Definite Phishing and Likely Phishing) Virus (Definite Virus and Likely Virus) Policy Directory Harvest Attack (DHA) Connection Management (CM) 17

18 6 Downloads The Downloads page on your Junk Box provides information about the tools available for you to download to enhance your spam-blocking experience. Select one of the following to download and install to your local system. Anti-Spam Desktop for Outlook The Anti-Spam Desktop for Outlook and Outlook Express link is a trial version of the Dell SonicWALL Anti-Spam Desktop feature. This download provides Junk and Unjunk buttons for you to help customize your own Security solution. Junk Button for Outlook The Junk Button for Outlook link provides a Junk button for you to install on your own Microsoft Outlook program, which helps to customize your own Security solution. Send Secure Button for Outlook The Send Secure Button for Outlook link provides a Send Secure button for you to install on your own Microsoft Outlook program, which allows you to send secure, encrypted messages prefaced with [SECURE] in the message heading using the Encryption Service. 18

19 About Dell Dell listens to customers and delivers worldwide innovative technology, business solutions and services they trust and value. For more information, visit Contacting Dell Technical support: Online support Product questions and sales: (800) Technical support resources Technical support is available to customers who have purchased Dell software with a valid maintenance contract and to customers who have trial versions. To access the Support Portal, go to The Support Portal provides self-help tools you can use to solve problems quickly and independently, 24 hours a day, 365 days a year. In addition, the portal provides direct access to product support engineers through an online Service Request system. The site enables you to: Create, update, and manage Service Requests (cases) View Knowledge Base articles Obtain product notifications Download software. For trial software, go to Trial Downloads. View how-to videos Engage in community discussions Chat with a support engineer 19