What is a portshield interface

I was running a Sonicwall lunch and learn with Jeremy and Louis yesterday and it became pretty clear that there was a lot of confusion about zones and Portshield groups.  I figured if they were confused there is a pretty good chance that a lot of other people would be, as well.  So, here is my quick and dirty primer!

A zone on a Sonicwall implies a network (or networks) that sit behind a firewall “barrier”.  All Sonicwalls ship with at lest 2 pre-configured zones – LAN and WAN – and the zones are each bound to one or more ports on the box.  Traffic between the zones MUST pass through the firewall barrier and, by definition, the firewall rules that are set for that zone.  When you look at the rules matrix (like the following) it’s easy to picture the flow between zones:

You can see that there are firewall “barriers” between the LAN and the WAN and vice versa as well as barriers between the other zones; each of the blue buttons implies a firewall barrier.

You need to think about how your network traffic flows and where you need to impose firewall rules in order to figure out what zones you might need to create.  Keep in mind that zones also allow you to control how the various security services/features are applied (gateway a/v, IPS, anti-spyware, etc), it’s not just about firewall rules.  You could, for example, impose IPS or Content Filtering controls on one zone but not on another.  You can see what controls are enabled on a zone from the ZONE screen:

For the most part, zones encompass physical ports on the Sonicwall but there are zones that are “virtual” such as VPN, MULTICAST and SSLVPN.  The virtual zones work in the same fashion as the zones that contain physical ports but their rules essentially “overlay” other zones. As an example, there are rules that apply to all traffic passing from the WAN to the LAN.  However, a client connecting over the SSL VPN connection should have a different set of rules applied even though they are connecting to the LAN via the WAN port, hence the need for the “virtual” zones.

So, to recap: zones are a group container for one or more networks that then sit behind a specific firewall barrier that imposes a specific set of firewall rules that controls traffic flow into and out of the group (zone).

OK, this is all well and good; zones make sense.  So how do you create zones and/or assign physical ports to a zone?  Glad you asked!

There are two distinct steps, creating the new zone and then manipulating ports.  Zone creation is accomplished from the ZONE screen by clicking the Add button and following the prompts (the following screenshot is form the newest 5.9 firmware, your machine may not show as many options).

The name can be anything descriptive that you would like.  The Security Type defines what the auto-generated firewall rules will be between this zone and other zones.  In this case I have selected Trusted as I’m defining this zone to be similar to my LAN zone.  The other options pretty much speak for themselves.

Once created the new zone shows up on the ZONE page:

At this point I don’t have anything attached to the zone so now I have to go and assign a port to the zone and this leads into the discussion about Portshield.

Portshield is a fancy name for “port aggregation”.  In other words, Portshield allows me to group two or more ports together so that those ports function in the same way in the same zone.   When you runs the Sonicwall Setup Wizard one of the things that you are prompted for is the port layout you would like:  LAN/WAN, LAN/OPT/WAN or LAN/WAN/LAN2.  This is simply setting up the default Portshield groups.  If you select LAN/WAN then X1 is assigned to the WAN and X0 (and all of the rest of the Xn ports) are assigned to the LAN.  This means there are two Portshield groups, one for the WAN and the rest for the LAN.  Of course, your Portshield groups may look different (depending on your unit) but you get the drift.

Here are the Portshield groups on my TZ215 at this point:

I have a LAN Portshield group with one port (X1), a WAN Portshield group with 2 ports (X1 and X6) and the rest of my ports are unassigned meaning they are not in any Portshield group and are available for use in a new group.  I want to assign X5 to my new TEST Network zone and assign appropriate IP addressing for that Zone to the port.  To do this I need to go to Network –> Interfaces and configure the interface.  When I click on the edit button for the X5 interface I get the following screen:

Note the is no Zone, it is “Unassigned”.  I have to pick a Zone from the dropdown:

Once I pick the zone I can fill in all of the appropriate IP info:

Clicking OK will save the config and I will have completed the setup; X5 is now live as the gateway on the TEST Network.  My firewall matrix screen will be updated with the new Zone and default firewall rules will be in place between this new zone and all of the pre-existing zones.

I can remove the port from the Zone by reversing my previous steps and simply put the port back into Unassigned status.  This effectively pulls the zone from the firewall matrix.

Now for a slight variation on the theme.  In the last case I added the port to a zone and set IP addressing on it which made it the gateway for that zone.  What if I just want to add another port to an existing zone that already has a gateway?  The port does not need an address in this case.  This is pretty simple!

Go to Network –> Portshield Groups and click on the edit button for the port.

Clicking on the Portshield Interface dropdown allows me to select a zone gateway port (a Portshield Interface) to attach to:

By selecting the X0 interface we add the X5 port onto the same network as the X0 port and use X0 as the gateway.

Now there are two ports on the X0 Portshield.

I hope this discussion helps you to better understand Zones and Portshield groups on your Sonicwall.