SonicWall Network Security Virtual (NSV) XS Appliance
Deep security for public, private or hybrid cloud environments

The SonicWall Network Security virtual NSv XS/S/M/L Firewalls deliver enterprise-class security, streamlined management, complete visibility, and flexible deployment, while delivering superior performance for virtual workloads.

Vulnerabilities within virtual environments yield serious security implications and challenges. But protecting all these security vectors requires consistently applying the right security policy to the right network control point, as some security failures can be attributed to ineffective policies or misconfigurations.

NSv firewall series helps security teams reduce these types of security risks and vulnerabilities, which can cause serious disruption to business-critical services and operations. It enables enterprises to control dynamic traffic passing through a firewall and provides visibility and insight into disparate policies. It helps simplify management tasks, reduces configuration errors and speeds up deployment time, all of which contribute to a better overall security posture.

---

SonicOSX and Security Services

The SonicOSX architecture is at the core of NSv XS/S/M/L firewalls. It is powered by the feature-rich SonicOSX 8 operating system with an intuitive user interface (UI), advanced security, networking and management capabilities. Easily provision layer 3 to layer 7 controls in a single rule base on every firewall, providing a centralized location for configuring policies. The new web interface provides graphical visualizations of critical threat information and displays actionable alerts prompting you to configure contextual security policies with point-and-click simplicity.

NSv further integrates SD-WAN, TLS 1.3 support, real-time visualization, high-speed virtual private networking (VPN) and other robust security features.

Unknown threats are sent to SonicWall’s cloud-based Capture Advanced Threat Protection (ATP) multiengine sandbox for analysis. Capture ATP harnesses Real-Time Deep Memory Inspection (RTDMI), a SonicWall patented technology, to discover and block malware and zero-day threats that reside in memory.

With the combination of Capture ATP, RTDMI technology, and advanced security services, NSv firewall series stops malware at the gateway before it gets to your critical systems.

Flexible licensing for your unique needs includes Secure Connect¹, Essential Protection Security Suite (EPSS), Advanced Protection Security Suite (APSS), and Managed Protection Security Suite (MPSS). MPSS augments IT resources with managed firewall services from the SonicSentry Network Operation Center (NOC).

When operating in Global Mode, users can leverage a new Cloud Secure Edge (CSE) Connector integration to gain a centralized, easy-to-manage way to secure access to their private applications. This approach ensures that user and device trust are repeatedly verified before granting access to specific applications, regardless of location and endpoint type.

¹ Secure Connect is only available for NSv XS. For more information on Secure Connect and Security Suites, please refer to: SonicWall Security Services

---

Cyber Warranty

An embedded cyber warranty is included with your security suite to mitigate the costs of a security breach, meet compliance requirements, and promote peace of mind.

Firewall

• Stateful packet inspection
• Reassembly-Free Deep Packet Inspection
• DDoS attack protection (UDP/ICMP/SYN flood)
• IPv4/IPv6 support
• Biometric authentication for remote access
• DNS proxy
• REST APIs
• Reputation-based Content Filtering Service (CFS 5.0)
• DNS filtering
• SD-WAN
• SD-WAN Scalability
• SD-WAN Intelligent routing
• SD-WAN Usability Wizard
• Switch between Classic/Global and Policy mode

Unified Policy

• Combines layer 3 to layer 7 rules: Source/Destination IP/Port/Service
• Application Control
• CFS/Web Botnet/GeoIP
• Rule Diagram
• Single Pass Security
• Services enforcement: IPS/GAV/AS/Capture ATP
• Profile Based Objects for Endpoint Security/BWM/QoS/CFS/Intrusion Prevention
• Action Profiles for Security/DoS Rules
• Rule management: cloning, shadow rule analysis, in-cell editing, rule export
• Managing views: used/un-used rules, active/in-active rules, sections/custom grouping, customizable grid/layout

TLS/SSL/SSH Decryption and Inspection

• TLS 1.3 with enhanced security
• Deep packet inspection for TLS/SSL/SSH
• Inclusion/exclusion of objects, groups or hostnames
• TLS controls
• Granular DPI TLS controls per zone or rule

Capture Advanced Threat Protection¹

• Real-Time Deep Memory Inspection
• Cloud-based multi-engine analysis
• Virtualized sandboxing
• Hypervisor level analysis
• Full system emulation
• Broad file type examination
• Automated & manual submission
• Real-time threat intelligence updates
• Block until verdict
• Capture Client

Intrusion Prevention¹

• Signature-based scanning
• Automatic signature updates
• Bi-directional inspection engine
• Granular IPS rule capability
• GeoIP enforcement
• Botnet filtering with dynamic list
• Regular expression matching

Anti-malware¹

• Stream-based malware scanning
• Gateway anti-virus
• Gateway anti-spyware
• Bi-directional inspection
• No file size limitation
• Cloud malware database

Application Identification¹

• Application control
• Application bandwidth management
• Custom application signature creation
• Data leakage prevention
• Application reporting over NetFlow/IPFIX
• Comprehensive application signature database

Traffic Visualization and Analytics

• User activity
• Application/bandwidth/threat usage
• Cloud-based analytics

Web Content Filtering¹

• URL filtering
• Proxy avoidance
• Keyword blocking
• Reputation-based Content Filtering Service (CFS 5.0)
• DNS filtering
• Policy-based filtering (exclusion/inclusion)
• HTTP header insertion
• Bandwidth manage CFS rating categories

VPN & ZTNA

• Secure SD-WAN
• Auto-provision VPN
• IPSec VPN for site-to-site connectivity
• SSL VPN and IPSec client remote access
• Redundant VPN gateway
• Mobile Connect for iOS, Mac OS X, Windows, Chrome, Android and Kindle Fire
• Route-based VPN (RIP/OSPF/BGP)
• Secure Private Access to Cloud Secure Edge

Enhanced Dashboard

• Enhanced device view
• Top traffic and user summary
• Insights to threats
• Notification center
• Enhanced packet monitoring
• SSH terminal on UI
• New design/template
• Industry and global average comparison

Networking

• PortShield
• Jumbo frames
• Path MTU discovery
• Enhanced logging
• Layer-2 QoS
• Port security
• Dynamic routing (RIP/OSPF/BGP)
• SonicWall wireless controller
• Policy-based routing (ToS/metric and ECMP)
• NAT
• DHCP server
• Bandwidth management
• Link aggregation (static and dynamic)
• A/P high availability with state sync
• Inbound/outbound load balancing
• L2 bridge, wire/virtual wire mode, tap mode, NAT mode
• Asymmetric routing
• Common Access Card (CAC) support

Decryption Policy

• Unified Policy for SSL/TLS traffic

DoS Policy

• Unified Policy for DoS/DDoS attack prevention

VoIP

• Granular QoS control
• Bandwidth management
• DPI for VoIP traffic
• H.323 gatekeeper and SIP proxy support

Management and Monitoring

• SonicWall Unified Management and SonicWall AI for Monitoring and Insight (SAMI)
• Centralized management and reporting¹ with Network Security Manager (NSM)
• Capture Threat Assessment (CTA) v2.0
• New design or template
• Industry and global average comparison
• New UI/UX, intuitive feature layout: dashboard, device information/application/threats, topology view, simplified policy creation and management, policy/objects usage statistics, used vs unused, active vs inactive, global search for static data
• Web GUI
• Command-line interface (CLI)
• Zero-Touch registration & provisioning
• SonicExpress mobile app support
• SNMPv2/v3
• Logging
• Netflow/IPFix exporting
• Cloud-based configuration backup
• BlueCoat security analytics platform
• Application and bandwidth visualizer
• IPv4 and IPv6 Management
• Off-box reporting (Scrutinizer)

Debugging and Diagnostics

• Enhanced packet monitoring
• SSH terminal on UI