Submit a ticketCall us

AnnouncementsTHWACKcamp 2018 is here

2018 is the seventh year for THWACKcamp™, and once again we’ll be live October 17 – 18 with packed session tracks covering everything from network monitoring and management, to change control, application management, storage, cloud and DevOps, security, automation, virtualization, mapping, logging, and more.

Register for online sessions.

Home > Success Center > Log & Event Manager (LEM) > LEM - Knowledgebase Articles > Integrate SonicWall firewalls with SolarWinds LEM

Integrate SonicWall firewalls with SolarWinds LEM

Table of contents
Created by Justin Rouviere, last modified by James Moore on Sep 27, 2018

Views: 2,434 Votes: 1 Revisions: 19

Updated: September 27, 2018

Overview

This article discusses how to forward SonicWall logs with the LEM Manager and how to add a SonicWall connector in the LEM Console.

Environment

  • All LEM versions
  • All SonicWall versions

Steps

Forward SonicWall logs to your LEM Manager

  1. Connect to your SonicWall firewall using a web browser on a computer that is on the SonicWall LAN.

  2. Log in using administrator credentials for your SonicWall firewall.
  3. Click Log > Log Settings.
  4. In the Syslog Server field, enter the IP address of your LEM Manager which you can find in the LEM console under Manage > Appliances. 
  5. Verify that the Local Interface and Outbound Interface selections are correct.
  6. Click Submit. 
  7. When SonicWall prompts you to restart the firewall, click Restart. This should apply your changes. 

 

Add a SonicWall connector in your LEM Console

  1. On the LEM console toolbar, navigate to Manage > Appliances, and then log on to the LEM Manager where you can configure the connector. 

  2. Next to the LEM Manager, click the Gear icon, and then select Connectors.
  3. In the Connector Configuration window, enter SonicWall in the search box at the top of the Refine Results pane.
  4. Next to the SonicWall connector, click the Gear icon, and then select New.
  5. Replace the Alias value with a more descriptive connector alias. We recommend using the word firewall in your firewall connector alias. This helps the Firewall filter to function correctly.
  6. Leave the Log File value set to its default value. This is because SonicWall does not allow you to change the logging location of its log files.
  7. Click Save.
  8. Next to the new connector, click the Gear icon, and then select Start. The Status icon will turn green to indicate the connector has started.
  9. To exit the Connector Configuration window, click Close.

Once the connector starts running, the default Firewall filter will begin displaying alerts from your SonicWall firewall, provided you assigned the appropriate alias in Step 5.

The conditions for the default firewall filter read... Any Alert.ToolAlias = *Firewall*, where the asterisks serve as wildcard characters. If the connector alias defined in Step 5 does not contain the word firewall, the default filter will not work until it has been edited to match the alias you defined.

 

 

Last modified

Tags

Classifications

Public