Upgrade from CFS 3.0 App Rules Mode to CFS 4.0

03/26/2020 1,325 People found this article helpful 487,006 Views

Description

This article will provide an example to discuss the differences in policy settings between CFS 3.0 and CFS 4.0 and describe upgrading from CFS 3.0 App Rules mode to CFS 4.0.

Note: there are no significant changes for Websense between CFS4.0 and the previous releases, the upgrading process for Websense will not be discussed.

Cause

As there are big changes between the new 4.0 and the old 3.0 CFS (e.g. Users and Zones mode and App Rules mode are handled by CFS policies in CFS4.0), although the firmware will do its best to automatically migrate almost all the polices, the resulting policies may not exactly match the original policies when upgrading from CFS 3.0 to CFS 4.0.

The complete objects are configured differently than when they were configured in CFS 3.0
CFS 3.0 employed some settings that are no longer used and are discarded when migrating to CFS 4.0.

Resolution

Upgrading CFS 3.0 to 4.0 for App Rules mode

There are two sections which will be discussed here:

Merging Process for CFS 3.0 (App Rules Mode) to CFS 4.0
Upgrading Steps for CFS 3.0 (App Rules Mode) to CFS 4.0

For CFS upgrading demonstration, here uses the following example (6 users in 3 groups and configured with 4 different CFS App Rules):

1. Merging Process for CFS 3.0 (App Rules Mode) to CFS 4.0

For each App Rule whose Policy Type is CFS and Action is CFS Block Page, HTTP Block page or BWM, CFS 4.0, SonicOS executes the following steps to automatically complete the policy merging process. To migrate from App Rules mode:

a. CFS URI List Objects generated from Allow/Excluded and Forbidden/Included lists of current App Rules are assigned to the Profile Object as Allowed URL List and to Forbidden URL List, respectively.

In CFS 3.0, the Allow/Excluded and Forbidden/Included lists are configured at Firewall | Match Objects page.

In CFS 4.0, after Upgrading, the lists will be merged to URI List Objects area at Firewall | Content Filter Objects page.

In CFS 3.0, the CFS Block page is defined at Security Services | Content Filter page.

In CFS 4.0, after Upgrading the CFS Block Page will be merged to CFS Action Objects area at Firewall | Content Filter Objects page. Click the relevant action in CFS Action Objects area, and select tab Block.

In CFS 3.0, the HTTP Block page is defined at Firewall | Action Objects page.

In CFS 4.0, after Upgrading the HTTP Block Page will be merged to CFS Action Objects area at Firewall | ContentFilter Objects page but the color setting will be abandoned. Click the relevant action in CFS Action Objects area, and select tab Block.

In CFS 3.0, the BWM is defined at Firewall | Action Objects page.

In CFS 4.0, after Upgrading the BWM action will be merged to CFS Action Objects area at Firewall | ContentFilter Objects page. Click the relevant action in CFS Action Objects area, and select tab BWM.

In CFS 3.0, the CFS Category List is defined at Firewall | Match Objects page.

In CFS 4.0, the CFS Category is merged to CFS Profile Objects at Firewall | Content Filter Objects page.

NOTES: Depending on the selected categories in the App Rule’s Match Object, they are set as either Block or BWM in the Profile Object according to the relevant App Rules.

For CFS Forbidden/Included list, if the action using BWM in CFS 3.0, then the Forbidden URI List will be set to None after upgrading.

d. The App Rule name is used as the Policy name. To generate a CFS Policy, the following should take place:

NOTE: After all App Rules have been migrated to CFS Policies, CFS attempts to keep the same priorities, generating a Default CFS Policy at the end of the list.

2. Upgrading Steps for CFS 3.0 (App Rules Mode) to CFS 4.0

When going to upgrade from CFS 3.0 (App Rules Mode) to CFS 4.0, please follow the below steps.

1. Navigate to System | Setting page | Export the original settings for backup.

2. Upgrade the firmware to CFS 4.0.

3. After upgrading, as some of the generated CFS objects and policies might be duplicated and the priority order of some new policies might be wrong. Administrators should clean and adjust the priorities. When go to Security Services | Content Filter page, automatically generated CFS policies are listed as below.

In this case, after upgrading the policy CFS_Paul_BW is not triggered as policy CFS_Group_2A has higher priority. So administrator should adjust the priority of CFS_Paul_BW higher to ensure the CFS behaviors are the same as before upgrading. Click the priority icon for policy CFS_Paul_BW, and input 2 to make the priority higher than policy CFS_Group_2A.

Notes: 1. Before upgrading, please check your original firmware version, if you are using SonicOS 6.2.5, we recommend you to upgrade to 6.2.5.1 firstly then upgrade to the firmware with CFS 4.0.

2. If there are amount of CFS policies generated, to adjust the priority of these auto generated policies may take time. We also recommend that you can follow the below steps after upgrading.

Keep the automatically generated CFS URI List Objects and CFS Action Objects.

Remove the generated CFS Policies and CFS Profile Objects.

Create the CFS Profile Objects and CFS Polices from scratch, providing descriptive names for each object.

3. SonicOS does not support downgrade from CFS 4.0 to CFS 3.0 so far.
Related Articles
How to Block Google QUIC Protocol on SonicOSX 7.0?
How to block certain Keywords on SonicOSX 7.0?
How internal Interfaces can obtain Global IPv6 Addresses using DHCPv6 Prefix Delegation
Categories

Firewalls > SonicWall SuperMassive 9000 Series > Content Filtering Service

Firewalls > SonicWall NSA Series > Content Filtering Service

Firewalls > TZ Series > Content Filtering Service
Not Finding Your Answers?
ASK THE COMMUNITY