External IDS Configuration on the SonicWall Appliance

03/26/2020 635 10556

DESCRIPTION:

This article will guide you through the process of configuring the SonicWall appliance to work with the External IDS virtual appliance.  For information on installing the virtual appliance and deploying the OVA, see the getting started guide.

NOTE: The External IDS feature is only supported on the 6th generation NSA series 3600 and higher.  It is also supported on the Supermassive series up to but not including the 9800.

RESOLUTION:

1. Log in to the SonicWall with your admin account.
2. Click Manage in the top navigation menu.
3. Navigate to Network | DHCP Server.
4. Click ADD DYNAMIC to create a new DHCP scope 
5.  Fill-in Range Start, Range End, Default Gateway, and Subnet Mask to fit the interface in which the External IDS Appliance is connected to.

   NOTE: The External IDS Server requires DHCP to be setup and configured.

    

6. Verify the newly created DHCP scope is tied to the correct interface.
   
7. Access the EIDS Server client.  Select Renew DHCP lease and press Enter.
   
   
8. Press Enter to return to the main menu, select Show Network Settings and press Enter.
9. Verify the virtual appliance received a DHCP lease from the SonicWall
   
10. Return to the SonicWall and Navigate to External IDS | Settings page.
    
11. Click the Configure Icon next to Ext. IDS Interface.  The Ext. IDS Interface configuration window appears.
12. Select the Interface in which the External IDS appliance is connected. Ensure Keep existing interface configuration is selected as this ip address will be used to locate and communicate with the IDS appliance.
    
13. Click OK to save the settings and close the window.
14. Ensure the Appliance status and IDS Service Status both turn Green.

    NOTE: If these do not turn green, you may need to click Probe to scan for the EIDS server.

    
15. Click SSH to access the SSH Console Window.
16. When prompted with COPROC login:  type root and press Enter.
17. The EIDS appliance will prompt you to choose a new password and enter it twice.