Solved

How to whitelist a block of ip's in SonicWall NSA 2400

Posted on 2013-01-04
7
4,855 Views
Last Modified: 2013-01-07
We have a new SonicWall NSA 2400, and have an upcoming penetration test. They have requested we whitelist a block if their IP's in the SonicWall to allow tests to run.

I have navigated to Security Services --> Intrusion Prevention --> Configure IPS Settings

added the scope requested and turned on the exclusion ability.

If anyone is familiar with needing to do this, have I done enough, or do I need to make some additional changes? How do I make those additional changes if necessary?

Thanks.
0
Comment
Question by:tjwo94
  • 4
  • 3
7 Comments
 
LVL 76

Expert Comment

by:arnold
ID: 38746155
Are you sure the request is not a social engineering test of the penetration test?
I.e. you hire a firm to test the security of your home.  A week before the test is run you receive a letter from the firm asking you for the key to your home so they can perform the complete test.  Would you send the key or advise them where it can be located?
0
 

Author Comment

by:tjwo94
ID: 38750998
I appreciate your questions, but your questions, nor my response to them are answers to the question at hand. What is being performed, both how and why is necessary.
0
 
LVL 76

Accepted Solution

by:
arnold earned 500 total points
ID: 38751019
You would define the block as untrusted and exempt it from the filtration/restrictions. Do not add it as trusted.
http://help.mysonicwall.com/sw/eng/general/ui1/6600/Access/Add_Rule.htm
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 

Author Closing Comment

by:tjwo94
ID: 38751048
Thank you.
0
 
LVL 76

Expert Comment

by:arnold
ID: 38751109
IMHO, a penetration test means they have to co tend with your existing configuration to make sure it is not open. Whitelisting their block means their attack vector is simplified.
0
 

Author Comment

by:tjwo94
ID: 38751125
The block being whitelisted isn't the block being used for the attack, there are other things being performed that require the requested block to be available.
0
 
LVL 76

Expert Comment

by:arnold
ID: 38751145
If they are performing an internal security analysis, you may want to setup a VPN connection. I.e. the second phase often deals with whether internal systems are susceptible to web based, attachment, virus style attack vectors.
0

Featured Post

Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

Join & Write a Comment

Network traffic routing plays key role in your network, if you have single site with heavy browsing or multiple sites, replicating important application data from your Primary Default Gateway ,you have to route your other network traffic from your p…
Imagine you have a shopping list of items you need to get at the grocery store. You have two options: A. Take one trip to the grocery store and get everything you need for the week, or B. Take multiple trips, buying an item at a time, to achieve t…
Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…
You have products, that come in variants and want to set different prices for them? Watch this micro tutorial that describes how to configure prices for Magento super attributes. Assigning simple products to configurable: We assigned simple products…

759 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

24 Experts available now in Live!

Get 1:1 Help Now