- Products
- Network Security
Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
Security ServicesComprehensive security for your network security solution
Network Security ManagerModern Security Management for today’s security landscape
- Advanced Threat Protection
Capture ATPMulti-engine advanced threat detection
Capture Security applianceAdvanced Threat Protection for modern threat landscape
- Access Security
Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
Secure Mobile AccessRemote, best-in-class, secure access
Wireless Access PointsEasy to manage, fast and secure Wi-FI
SwitchesHigh-speed network switching for business connectivity
- Email Security
Email SecurityProtect against today’s advanced email threats
- Cloud Security
Cloud App SecurityVisibility and security for Cloud Apps
Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
- Endpoint Security
Capture ClientStop advanced threats and rollback the damage caused by malware
Content Filtering ClientControl access to unwanted and unsecure web content
- Product Widgets
- Product Menu Right Image
- Network Security
- Solutions
- Solutions Widgets
- Solutions Image Widgets
- Solutions Widgets
- Partners
- Partner Widgets
- Partners Image Widgets
- Partner Widgets
- Support
- Support Widget
- Support Image Widgets
- Support Widget
- Products
- Network Security
- Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
- Security ServicesComprehensive security for your network security solution
- Network Security ManagerModern Security Management for today’s security landscape
- Advanced Threat Protection
- Capture ATPMulti-engine advanced threat detection
- Capture Security applianceAdvanced Threat Protection for modern threat landscape
- Access Security
- Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
- Secure Mobile AccessRemote, best-in-class, secure access
- Wireless Access PointsEasy to manage, fast and secure Wi-FI
- SwitchesHigh-speed network switching for business connectivity
- Email Security
- Email SecurityProtect against today’s advanced email threats
- Cloud Security
- Cloud App SecurityVisibility and security for Cloud Apps
- Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
- Endpoint Security
- Capture ClientStop advanced threats and rollback the damage caused by malware
- Content Filtering ClientControl access to unwanted and unsecure web content
- Product Widgets
- Product Menu Right Image
- Network Security
- Solutions
- Solutions Widgets
- Solutions Image Widgets
- Solutions Widgets
- Partners
- Partner Widgets
- Partners Image Widgets
- Partner Widgets
- Support
- Support Widget
- Support Image Widgets
- Support Widget
How to Configure Botnet Filtering with Firewall Access Rules
10/14/2021 
155 People found this article helpful
41,194 Views
Description
This article covers how to use SonicWall Botnet security service with access rule. This article will demonstrate how to create a firewall access rule for a mail server so that the mail server will be protected from going to a Botnet command and control website while the rest of the network traffic will be passed without being scanned by the Botnet security service.
NOTE: When implementing Botnet Security to website(s) make sure to evaluate all depending business applications; blocking access to a Botnet listed website(s) may impact dependent applications/process.
Resolution
Resolution for SonicOS 6.5
This release includes significant user interface changes and many new features that are different from the SonicOS 6.2 and earlier firmware. The below resolution is for customers using SonicOS 6.5 firmware.
Step 1: Create an Address Object for the Mail Server.
- Click Manage in the top navigation menu
- Navigate to Objects | Address Objects
- Click on Add
- Enter the Mail Server IP address
- Click on OK to Save
Step 2: .
- Click Manage in the top navigation menu
- Navigate to Security Services | Botnet filter
- Enable Botnet Filter Blocking based on the Firewall Access Rules and Enable Logging
- Click on ACCEPT to Save
Step 3: Create an Access Rule that we want to apply the Botnet Filter service to.
- Click Manage in the top navigation menu
- Navigate to Rules | Access Rules
- Click on Add
- In our example we will create an access rule from the LAN>WAN to enable Botnet Filtering from the Mail Server.
- Enable Botnet filter
- Click on OK to Save
Any traffic going to the Internet from the Mail Server will be scanned via the Botnet Filter Security Service, all other network traffic will not be scanned.
Resolution for SonicOS 6.2 and Below
The below resolution is for customers using SonicOS 6.2 and earlier firmware. For firewalls that are generation 6 and newer we suggest to upgrade to the latest general release of SonicOS 6.5 firmware.
Step 1: Create an Address Object for the Mail Server.
Step 2: Enable Botnet Filter Blocking based on the Firewall Access Rules and Enable Logging.
Step 3: Create an Access Rule that we want to apply the Botnet Filter service to. Enable the Botnet Filtering Checkbox on the Access Rule.
In our example we will create an access rule from the LAN>WAN to enable Botnet Filtering from the Mail Server.
Any traffic going to the Internet from the Mail Server will be scanned via the Botnet Filter Security Service, all other network traffic will not be scanned.
Related Articles
- Troubleshooting Single Sign-on (SSO) related errors
- How to enable and configure NTP?
- Cannot edit App Control Signatures, "Error: property 'value' can't be empty value"
Categories
- Firewalls > TZ Series > Geo-IP & Botnet Filter
- Firewalls > SonicWall NSA Series > Geo-IP & Botnet Filter
- Firewalls > SonicWall SuperMassive 9000 Series > Geo-IP & Botnet Filter
- Firewalls > SonicWall SuperMassive E10000 Series > Geo-IP & Botnet Filter
YES
NO