SonicOSX 7 Rules and Policies
- SonicOSX 7 Rules and Policies
- Settings
- Security Policy
- NAT Policy
- About NAT in SonicOSX
- About NAT Load Balancing
- About NAT64
- About FQDN-based NAT
- About Source MAC Address Override
- Viewing NAT Policy Entries
- Adding or Editing NAT or NAT64 Policies
- Deleting NAT Policies
- Creating NAT Rule Policies: Examples
- Creating a One-to-One NAT Policy for Inbound Traffic
- Creating a One-to-One NAT Policy for Outbound Traffic
- Inbound Port Address Translation via One-to-One NAT Policy
- Inbound Port Address Translation via WAN IP Address
- Creating a Many-to-One NAT Policy
- Creating a Many-to-Many NAT Policy
- Creating a One-to-Many NAT Load Balancing Policy
- Creating a NAT Load Balancing Policy for Two Web Servers
- Creating a WAN-to-WAN Security Policy for a NAT64
- DNS Doctoring
- Routing Rules
- Decryption Policy
- DoS Policy
- Endpoint Policy
- Shadow
- SonicWall Support
Configuring Botnet Settings
To configure Botnet Policy-based Settings
- Navigate to POLICY | Rules and Policies > Settings > Botnet | Settings.
- To block all servers that are designated as Botnet command and control servers, select Block connections when Botnet signatures are unavailable and rules need botnet control. All connection attempts are blocked. This option is selected by default.
Global Settings
-
To enable the Custom Botnet List, select Enable Custom Botnet List. This option is not selected by default.
If Enable Custom Botnet List is not selected, then only the Botnet database that resides on the network security appliance is searched. Go to Step x. Enabling a custom list by selecting Enable Custom Botnet List can affect country identification for an IP address:
- During Botnet identification, the custom Botnet list is searched first.
- If the IP address is not resolved, the firewall's Botnet database is searched.
If an IP address is resolved from the custom Botnet list, it can be identified as either a Botnet IP address or a non-Botnet IP address, and action taken accordingly.
-
Click Enable Dynamic Botnet List to affect the botnet identification, for an IP address, in the following ways:
- If "Enable Dynamic Botnet List" is enabled, the IP address is looked up against the dynamic botnet list. If not found, the default list from the backend database will be searched.
- When "Enable Custom Botnet List" is enabled, the custom list will take precedence over the dynamic botnet list. So an IP in the dynamic botnet list will be allowed by the Firewall if it is marked as "not a botnet" in the custom list.
Dynamic Botnet List File Format
• The dynamic botnet file is a .txt file that lists all the IPs seperated by end-of-line character.
• Comment lines should start with # symbol.
• Blocking of only individual IP addresses are supported. If the file contains subnets, they will be ignored.
• Blocking of only public IP addresses are supported. Private IP addresses in the list will be ignored.
• Empty Lines are OK.
• Max file size cannot exceed 32KB.
• Max number of IPs cannot exceed 2000.
• Example file
#------------------------------------
# Sample botnet file (botnet.txt).
#------------------------------------
# Botnet IPs List 1
1.1.1.1
2.2.2.2
# Botnet IPs List 2
1.1.210.16
1.1.210.17
#------------------------------------
# End of Dynamic Botnet List File.
#------------------------------------
-
Select Enable Logging to log Botnet Filter-related events.
-
Optionally, you can configure an exclusion list of all IPs belonging to the configured address object/address group. All IPs belonging to the list are excluded from being blocked. To enable an exclusion list, select an address object or address group from the Botnet Exclusion Object list.
- Click Accept.
Was This Article Helpful?
Help us to improve our support portal