• Network Security Manager 2.5.0
• Network Security Manager Overview
  • About Network Security Manager
  • Related Documents
  • API Support
  • Legal Information
  • Conventions
    • Guide Conventions
    • UI Conventions
• Dashboard
  • Summary
  • Network
  • Threat
• Firewalls
  • Device Inventory
    • Device Status
      • Management Status
      • System Details
      • License Details
      • Zero Touch Status
      • Template and Firmware Versions
    • Managing Devices
      • Editing Device Settings
      • Multi-device Firmware Upgrade
      • Upgrading Firmware
      • Synchronizing Firewall Configuration with NSM
      • Creating Backup of Device Configuration
      • Manual Firewall Acquisition
    • Firewall View
  • Device Groups
    • Working with Device Groups
      • Creating Device Groups
      • Editing Device Groups
      • Creating Backup of Device-Group Configuration
      • Deleting Device Groups
  • Device Backups
    • Scheduling Backups
    • Archiving TSR
    • Archiving EXP
• Templates and Variables
  • Templates
    • Templates Inventory
    • Creating Templates
    • Editing Templates
    • Viewing Template Configuration
    • Creating Duplicate Template
    • Modifying Template Attributes
    • Applying Templates
    • View Template Status
    • Deleting Templates
    • Storage
  • Golden Template
  • Variable Data
    • Template Variables Overview
    • Add Variable
    • Edit Variable
    • Resolve Variable
    • Delete Variable
    • Using Template Variables
    • Creating Variables within Templates
• SonicWall Switch Configuration in Template
  • Add Switch
  • Edit Port
  • Switches
    • Network
    • Users
    • Static routes
    • 802.1x
    • Radius server
    • ARP
• Certificates
  • Navigating Certificates
  • New Signing Request
  • Commit and Deploy Certificate(s)
  • Configuring SCEP
  • Importing Certificates
  • Deleting Certificates
• Configuration Management
  • Approval Groups
    • Approval Workflow Settings
  • Approval Group Management
    • Searching the Approval Groups
    • Adding a New Approval Group
    • Editing an Approval Group
    • Deleting an Approval Group
    • Setting the Default Approval Group
  • Configuration Management Workflow
    • Committing and Deploying the Updates
      • Committing and Deploying Updates in the Firewall View
      • Committing and Deploying Updates to Device(s) in the Manager View
    • Viewing Pending Configuration Updates
    • Discarding Pending Configurations
    • Monitoring Commits
    • Managing Commits
      • Editing Commits
      • Redeploying Commits
      • Rescheduling Commits
      • Deleting Commits
    • Auditing Configuration Changes
• Tenants
• VPN Topology
  • IPsec VPN Topology
    • Topologies
      • Hub and Spoke Topology
      • Full Mesh Topology
      • Point to Point Topology
    • Security Associations
  • IPsec Monitor
  • Global Settings
• SD-WAN Topology
  • Configuring SD-WAN
  • Basic Information
  • Rules and Devices
    • Service Rule
    • Application Rule
    • Device Selection
• CSC Users
  • CSC User Status
  • Users
    • Sorting and Filtering
    • Editing CSC Users
  • Support Portal Users
  • Roles and Permissions
  • Authentication Servers
• Scheduled Reports
  • Managing the Schedules
    • Creating Scheduled Reports
    • Editing Schedule
    • Running Reports Manually
    • Setting the Report Date Range
  • Archived Reports
    • Downloading Archived Reports
• System Events
  • Configuring Log Settings
  • Alerts and Notifications
  • Configuring Twilio Setting for SMS
  • Viewing System Events
• SonicWall Support
  • About This Document

Global Settings

This screen displays all the settings that can be changed or modified to the VPN Topology. The screen is categorized based on different options available for each section.

• GLOBAL SETTINGS
  • Enable VPN - Toggle the button to enable or disable VPN.
  • Enable Fragmented Packet Handling - Toggle the button to enable or disable the breaking of packets into fragments.
  • Ignore df don't fragment bit - Toggle the button to enable or disable the packets don't need to be fragmented
• DEAD PEER DETECTION
  • Enable VPN - Toggle the button to enable or disable VPN.
  • Dead peer Detection Interval - Enter the timeout interval (in seconds) to detect a dead Internet Key Exchange (IKE) peer. The number of seconds between “heartbeats.” The minimum is 3 seconds, the maximum is 120 seconds, and the default value is 60 seconds.
  • Failure trigger level (Missed heartbeats) - Enter the number of missed heartbeats. The minimum is 3 heartbeats, the maximum is 10, and the default value is 3. If the trigger level is reached, the VPN connection is dropped by the security appliance.
  • Enable IKE dead peer detection on idle VPN settings - Select this setting if you want idle VPN connections to be dropped by the security appliance after the time value defined in the Dead Peer Detection Interval for Idle VPN Sessions (seconds) field. The minimum time is 60 seconds, the maximum is 3600 seconds, and the default value is 600 seconds (10 minutes).
• IKEV2 SETTINGS

  • Send IKEv2 cookie notify - Sends cookies to IKEv2 peers as an authentication tool.

  • Send IKEv2 SPF notify - Sends an invalid Security Parameter Index (SPI) notification to IKEv2 peers when an active IKE security association (SA) exists.

    • IKEv2 dynamic client proposal - SonicOS provides IKEv2 Dynamic Client Support, which provides a way to configure the Internet Key Exchange (IKE) attributes rather than using the default settings.

      Clicking the Configure button launches the Configure IKEv2 Dynamic Client Proposal dialog.

      • DH Group: Group 1, Group 2,...

        256-bit Random ECP Group

        384-bit Random ECP Group

        521-bit Random ECP Group

        192-bit Random ECP Group

        224-bit Random ECP Group

      • Encryption: DES, 3DES (default), AES-128, AES-192, AES-256.

      • Authentication : MD5, SHA1 (default), SHA256, SHA384, or SHA512.
• OTHER SETTINGS

  • Clean up Active Tunnels when Peer Gateway DNS name resolves to a different IP address : Breaks down SAs associated with old IP addresses and reconnects to the peer gateway.

  • Send tunnel traps only when IPV4 changes : Reduces the number of VPN tunnel traps that are sent by only sending traps when the tunnel status changes.

  • Use Radius in : When using RADIUS to authenticate VPN client users, RADIUS will be used in its MSCHAP (or MSCHAPv2) mode. The primary reason for choosing to do this would be so that VPN client users can make use of the MSCHAP feature to allow them to change expired passwords at login time.

  • MSCHAP and MSCHAPv2 : Click the radio button to select the mode. Click Configure to view additional settings

    • DNS Servers - Selecting this option automatically populates the DNS and WINS settings. This option is selected by default.
    • Specify Manually- If you do not want to use the SonicWall security appliance network settings, select Specify Manually, and type the IP address of your DNS Server in the DNS Server 1 field. You can specify two additional DNS servers.

    • WINS Server - Configure a WINS server in the WINS Server 1 field. You can configure a second WINS server, also.