- Products
- Network Security
Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
Security ServicesComprehensive security for your network security solution
Network Security ManagerModern Security Management for today’s security landscape
- Advanced Threat Protection
Capture ATPMulti-engine advanced threat detection
Capture Security applianceAdvanced Threat Protection for modern threat landscape
- Access Security
Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
Secure Mobile AccessRemote, best-in-class, secure access
Wireless Access PointsEasy to manage, fast and secure Wi-FI
SwitchesHigh-speed network switching for business connectivity
- Email Security
Email SecurityProtect against today’s advanced email threats
- Cloud Security
Cloud App SecurityVisibility and security for Cloud Apps
Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
- Endpoint Security
Capture ClientStop advanced threats and rollback the damage caused by malware
Content Filtering ClientControl access to unwanted and unsecure web content
- Product Widgets
- Product Menu Right Image
-
- Network Security
- Solutions
- Solutions Widgets
- Solutions Image Widgets
-
- Solutions Widgets
- Partners
- Partner Widgets
- Partners Image Widgets
-
- Partner Widgets
- Support
- Support Widget
- Support Image Widgets
-
- Support Widget
- Products
- Network Security
- Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
- Security ServicesComprehensive security for your network security solution
- Network Security ManagerModern Security Management for today’s security landscape
- Advanced Threat Protection
- Capture ATPMulti-engine advanced threat detection
- Capture Security applianceAdvanced Threat Protection for modern threat landscape
- Access Security
- Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
- Secure Mobile AccessRemote, best-in-class, secure access
- Wireless Access PointsEasy to manage, fast and secure Wi-FI
- SwitchesHigh-speed network switching for business connectivity
- Email Security
- Email SecurityProtect against today’s advanced email threats
- Cloud Security
- Cloud App SecurityVisibility and security for Cloud Apps
- Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
- Endpoint Security
- Capture ClientStop advanced threats and rollback the damage caused by malware
- Content Filtering ClientControl access to unwanted and unsecure web content
- Product Widgets
- Product Menu Right Image
-
- Network Security
- Solutions
- Solutions Widgets
- Solutions Image Widgets
-
- Solutions Widgets
- Partners
- Partner Widgets
- Partners Image Widgets
-
- Partner Widgets
- Support
- Support Widget
- Support Image Widgets
-
- Support Widget
Security Services (GAV, Network AV, IPS, CFS, Firewall Registration) Ports and Protocol Usage
03/26/2020 
164 People found this article helpful
101,185 Views
Description
The SonicWall Security Services require the use of various ports and protocols to function properly:
• Content Filtering Service
• Network Anti-Virus
• Gateway Anti-Virus
• Intrusion Prevention Service
• Firewall Registration
Resolution
Content Filtering
The Content Filtering Service equips SonicWall Internet security appliances to monitor usage and control access to objectionable Web content according to established Acceptable Use Policies.
The Content Filtering service uses DNS (Port 53 UDP & TCP) to look up the rating of any visited website.
If a site has numerous ratings (i.e. different directories on the server have different ratings), the firewall will send the lookup request to the CFS servers to port 2257 UDP.
Network Anti-Virus
SonicWall Network Anti-Virus is a distributed, gateway-enforced solution that ensures always-on, always-updated anti-virus software for every client on the network.
There are multiple components that make up the Network Anti-Virus service.
- Firewall Gateway
When the Network Anti-Virus service is activated, the firewall will connect to the Anti-Virus servers to check for the latest version of Virus Definitions and to see if any Virus Alerts have been issued. This is done via a secure HTTP connection to port 443 TCP (HTTPS). This is done once an hour. It is also possible for SonicWall to “push” a Virus Alert message to the SonicWall firewall. The anti-virus servers record the WAN IP address of the firewall that is connecting to our servers. The push is answered by the firewall on port 59155 UDP.
When an Anti-Virus enforced node attempts to access the internet, the firewall will send a request to the Network Anti-Virus client on port 59152 UDP. This is a request to the Network Anti-Virus software to make sure that the client has the latest Virus Definition file.
- Network Anti-Virus Software Client
The Network Anti-Virus software client resides on each workstation in the network. This provides the client computer with an on-access and on-demand file scanner. This is the component that downloads and stores the Virus Definition files.
The software client gets installed and does it’s Virus Definition updates all via a web based connection on Port 80 TCP to virusscanasap.mcafeeasap.com. The client will also try to update itself 6 minutes after a user logs into the machine, and then every 24 hours after the first successful update.
When an Anti-Virus enforced node attempts to access the internet, the firewall will send a request to the Network Anti-Virus client to port 59152 UDP. This is a request to the Network Anti-Virus software to make sure that the client has the latest
Gateway Anti-Virus:
Gateway Anti-Virus integrates a high performance Real-Time Virus Scanning Engine and dynamically updated signature database to deliver continuous protection from malicious virus threats at the gateway.
When the Gateway Anti-Virus service is activated, the firewall will connect to the Anti-Virus servers to check for the latest version of the Anti-Virus Signature Database. This is done via a secure HTTP connection to port 443 TCP (HTTPS). This is done once an hour.
Intrusion Prevention:
Intrusion Prevention integrates a high-performance Deep Packet Inspection architecture and dynamically updated signature database to deliver complete network protection from application exploits, worms and malicious traffic. In addition, Intrusion Prevention provides access control for Instant Messenger (IM) and Peer-to-Peer (P2P) applications.
When the Intrusion Prevention service is activated, the firewall will connect to the IPS database servers to check for the latest version of the Intrusion Prevention Signature Database. This is done via a secure HTTP connection to port 443 TCP (HTTPS).
Firewall Registration:
The firewall needs to be registered and have a connection to the internet at all times. The firewall connects to SonicWall’s registration server via a secure HTTPS connection to port 443 TCP (HTTPS).
Related Articles
- Parserror on Event logs.
- Switch from the Policy mode to classic mode on Gen 7 appliances
- Analyzing TCP reset(RST)packets
Categories
- Firewalls > TZ Series
- Firewalls > SonicWall SuperMassive E10000 Series
- Firewalls > SonicWall SuperMassive 9000 Series
- Firewalls > SonicWall NSA Series
YES
NO