Using the One-Touch DPI and Stateful Firewall high security applies the following configurations to the system. A system restart is then required for the updates to take full effect.

 

System>Administration

1. Password must be changed every 90 days
2. Bar repeated password changes for 4 changes
3. Enforce password complexity: Require alphabetic, numeric and symbolic characters
4. Apply the above password constraints for: all user categories
5. Enable administrator/user lockout
6. Failed Login attempts per minute before lockout: 7
7. Enable inter-administrator messaging
8. Inter-administrator Messaging polling interval (seconds): 10

Network>Interfaces

9. Any interface allowing HTTP management is replaced with HTTPS Management
10. Any setting to 'Add rule to enable redirect from HTTP to HTTPS' is disabled
11. Ping Management is disabled on all interfaces

Network>Zones

12. Intrusion Prevention is enabled on all applicable default Zones
13. Gateway Anti-Virus protection is enabled on all applicable default Zones
14. Anti-Spyware protection is enabled on all applicable default Zones
15. App Rules is enabled on all applicable default Zones
16. SSL Control is enabled on all default Zones

Network>DNS

17. Enable DNS Rebinding protection
18. DNS Rebinding Action: Log Attack & Drop DNS Reply

Firewall>Access Rules

19. Any Firewall policy with an Action of Deny, the Action is changed Discard
20. Source IP Address connection limiting with a threshold of 128 connections is enabled for all firewall policies

Firewall>App Rules

21. If licensed, the Enable App Rules setting is turned on

Firewall Settings>Advanced

22. Turn on Enable Stealth Mode
23. Turn on Randomize IP ID
24. Turn off Decrement IP TTL for forwarded traffic
25. Connections are set to: DPI Connections (DPI services enabled with additional performance optimizations)
26. Turn on Enable IP header checksum enforcement
27. Turn on Enable UDP checksum enforcement

Firewall Settings>Flood Protection

28. Turn on Enforce strict TCP compliance with RFC 793 and RFC 1122
29. Turn on Enable TCP handshake enforcement
30. Turn on Enable TCP checksum enforcement
31. Turn on Enable TCP handshake timeout
32. SYN Flood Protection Mode: Always proxy WAN client connections

Firewall Settings>SSL Control

33. Turn on Enable SSL Control
34. Set Action to: Block connection and log the event
35. For Configuration, enable all categories

VPN>Advanced

36. Turn on Enable IKE Dead Peer Detection
37. Turn on Enable Dead Peer Detection for Idle VPN sessions
38. Turn on Enable Fragmented Packet Handling
39. Turn on Ignore DF (Dont Fragment) Bit
40. Turn on Enable NAT Traversal
41. Turn on Clean up Active tunnels when Peer Gateway DNS name resolves to a different address
42. Turn on Preserve IKE port for Pass Through Connections

Security Services>Gateway Anti-Virus

43. If licensed, Enable Gateway Antivirus
44. Configure Gateway AV Settings: Turn on Disable SMTP Responses
45. Configure Gateway AV Settings: Turn off Disable detection of EICAR test virus
46. Configure Gateway AV Settings: Turn on Enable HTTP Byte-Range requests with Gateway AV
47. Configure Gateway AV Settings: Turn on Enable FTP REST request with Gateway AV
48. Configure Gateway AV Settings: Turn off Enable HTTP Clientless Notification Alerts

Security Services>Intrusion Prevention

49. If licensed, Enable IPS
50. Turn on Prevent All and Detect All for High Priority Attacks
51. Turn on Prevent All and Detect All for Medium Priority Attacks
52. Turn on Prevent All and Detect All for Low Priority Attacks

Security Services>Anti-Spyware

53. If licensed, Enable Anti-Spyware
54. Turn on Prevent All and Detect All for High Priority Attacks
55. Turn on Prevent All and Detect All for Medium Priority Attacks
56. Turn on Prevent All and Detect All for Low Priority Attacks
57. Configure Anti-Spyware Settings: Turn on Disable SMTP Responses
58. Configure Anti-Spyware Settings: Turn off Enable HTTP Clientless Notification Alerts

AppFlow>Flow Reporting

59. Turn on Send AppFlow To Local Collector
60. Turn on Enable Real-Time Data Collection

Log>Log Monitor

61. Set Logging Level: Debug

Log>Name Resolution

62. Set Name Resolution Method to: DNS then NetBIOS

Internal Settings

63. Turn on Protect against TCP State Manipulation DoS
64. Turn on Apply IPS Signatures Bidirectionally
65. Allow launching of AppFlow Monitor in a stand-alone browser frame
66. Enable Visualization UI for Non-Admin/Config users

 

Source

http://www.sonicwall-sales.com/help-and-advice/sonicwall-one-touch-configuration.html