User manual SONICWALL SONICOS ENHANCED 5.6 ADMINISTRATORS

[. . . ] SonicOS Enhanced 5. 6 Administrator's Guide PROTECTION AT THE SPEED OF BUSINESSTM Table of Contents Table of Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iii Part 1: Introduction Chapter 1: Preface . . 26 More Information on SonicWALL Products . . 29 Key Features in SonicOS Enhanced 5. 6 . . 29 Key Features in SonicOS Enhanced 5. 5 . [. . . ] 802. 1p can be enabled on any Ethernet interface on any SonicWALL appliance. 560 SonicOS Enhanced 5. 6 Administrator Guide Firewall > QoS Mapping (Not Supported on TZ platforms nor the NSA 240) The behavior of the 802. 1p field within these tags can be controlled by Access Rules. The default 802. 1p Access Rule action of None will reset existing 802. 1p tags to 0, unless otherwise configured (see "Managing QoS Marking" section on page 566 for details). Enabling 802. 1p marking will allow the target interface to recognize incoming 802. 1p tags generated by 802. 1p capable network devices, and will also allow the target interface to generate 802. 1p tags, as controlled by Access Rules. Frames that have 802. 1p tags inserted by SonicOS will bear VLAN ID 0. 802. 1p tags will only be inserted according to Access Rules, so enabling 802. 1p marking on an interface will not, at its default setting, disrupt communications with 802. 1p-incapable devices. 802. 1p requires the specific support by the networking devices with which you wish to use this method of prioritization. Many voice and video over IP devices provide support for 802. 1p, but the feature must be enabled. Check your equipment's documentation for information on 802. 1p support if you are unsure. Similarly, many server and host network cards (NICs) have the ability to support 802. 1p, but the feature is usually disabled by default. On Win32 operating systems, you can check for and configure 802. 1p settings on the Advanced tab of the Properties page of your network card. If your card supports 802. 1p, it will list it as 802. 1p QoS, 802. 1p Support, QoS Packet Tagging or something similar: To process 802. 1p tags, the feature must be present and enabled on the network interface. The network interface will then be able to generate packets with 802. 1p tags, as governed by QoS capable applications. By default, general network communications will not have tags inserted so as to maintain compatibility with 802. 1p-incapable devices. Note If your network interface does not support 802. 1p, it will not be able to process 802. 1p tagged traffic, and will ignore it. Make certain when defining Access Rules to enable 802. 1p marking that the target devices are 802. 1p capable. It should also be noted that when performing a packet capture (for example, with the diagnostic tool Ethereal) on 802. 1p capable devices, some 802. 1p capable devices will not show the 802. 1q header in the packet capture. Conversely, a packet capture performed on an 802. 1p-incapable device will almost invariably show the header, but the host will be unable to process the packet. Before moving on to "Managing QoS Marking" section on page 566, it is important to introduce `DSCP Marking' because of the potential interdependency between the two marking methods, as well as to explain why the interdependency exists. SonicOS Enhanced 5. 6 Administrator Guide 561 Firewall > QoS Mapping (Not Supported on TZ platforms nor the NSA 240) Example Scenario In the scenario above, we have Remote Site 1 connected to `Main Site' by an IPsec VPN. The company uses an internal 802. 1p/DSCP capable VoIP phone system, with a private VoIP signaling server hosted at the Main Site. The Main Site has a mixed gigabit and Fast-Ethernet infrastructure, while Remote Site 1 is all Fast Ethernet. Both sites employ 802. 1p capable switches for prioritization of internal traffic. 1. PC-1 at Remote Site 1 is transferring a 23 terabyte PowerPointTM presentation to File Server 1, and the 100mbit link between the workgroup switch and the upstream switch is completely saturated. At the Main Site, a caller on the 802. 1p/DSCP capable VoIP Phone 10. 50. 165. 200 initiates a call to the person at VoIP phone 192. 168. 168. 200. The calling VoIP phone 802. 1p tags the traffic with priority tag 6 (voice), and DSCP tags the traffic with a tag of 48. a. [. . . ] · · · · · 3. Use a DB9 to RJ45 connector to connect the serial port of your PC to the console port of your TZ 170. Using a terminal emulator program, such as TerraTerm, use the following parameters: 115, 200 baud (9600 for TZ 170) 8 bits No parity 1 stop bit No flow control You may need to hit return two to three times to get to a command prompt, which will look similar to the following: TZ170> If you have used any other CLI, such as Unix shell or Cisco IOS, this process should be relatively easy and similar. It has auto-complete so you do not have to type in the entire command. 4. When a you need to make a configuration change, you should be in configure mode. To enter configure mode, type configure. [. . . ]