SonicWALL ViewPoint manual

SonicW ALL V iewPoint User's Guide[...]

Page 1 CONTENTS Copyright Notice ........................................................................... 2 Software License Agreement ...................................................... 3 1 INTRODUCTION ............................................................................ 5 2 GETTING ST ARTED ..........................................[...]

Pag e 2 SonicWALL ViewPoint Copyright Notice © 2001 SonicWALL, Inc. All rights reserved. Under the copyright laws, this manual or the software de- scribed within, may not be copied, in whole or part, without the written consent of the manufacturer , except in the nor - mal use of the software to make a backup copy . The same proprietary and copyri[...]

Page 3 Software License Agreement for ViewPoint This Software License Agreement (SLA) is a legal agreement between you and SonicWALL, Inc. (SonicWALL) for the SonicWALL software product identified above, which includes computer software and any and all associated media, printed materials, and online or electronic documentation (SOFTWARE PRODUCT). B[...]

Pag e 4 SonicWALL ViewPoint U.S. GOVERNMENT RESTRICTED RIGHTS If you are acquiring the Software including accompanying documentation on behalf of the U.S. Government, the following provisions apply . If the Software is supplied to the Department of Defense (“DoD”), the Software is subject to “Restricted Rights”, as that term is defined in t[...]

Page 5 1 INTRODUCTION Monitoring critical network events and activity , such as secu- rity threats, inappropriate Web use, and bandwidth levels, is an essential component of network security . SonicW ALL ViewPoint compliments SonicWALL's Internet security offer- ings by providing detailed and comprehensive reports of network activity . SonicWA[...]

Pag e 6 SonicWALL ViewPoint 2 GETTING ST AR TED SonicWALL ViewPoint is a software reporting solution that may be installed on any computer on the SonicWALL's LAN. The computer used to host the reporting software will be referred to as the “V iewPoint Server .” System Requirements The following is a list of the minimum requirements for the [...]

Page 7 3 REGISTERING VIEWPOINT The following instructions describe the procedure to register and activate the ViewPoint Upgrade for the SonicWALL PRO. Registering the ViewPoint Upgrade is not required for the SonicWALL PRO-VX or SonicWALL GX. From a W eb browser , go to the SonicWALL registration site at http://www .mysonicwall.com and enter your U[...]

Pag e 8 SonicWALL ViewPoint 3. In the "My SonicWALL Service Management" window , select the Activate button displayed next to the ViewPoint service. An "Activate Service" window will be displayed. 4. Enter the ViewPoint Activation Key displayed on the back of this manual in the Activation Key field. 5. Click the Submit button. O[...]

Page 9 4 UPDA TING SONICW ALL FIRMWARE Y ou must upgrade the SonicWALL firmware to version 6.1.0.0 to support V iewPoint. Y ou may skip this section if you are using firmware version 6.1.0.0 or greater . 1. From a W eb browser , go to http://www .sonicwall.com and navigate to the Download Center to download the latest version of SonicWALL firmware [...]

P age 10 SonicWALL ViewPoint 4. Click the Upload Firmware Now button. 5. A Save Pr eferences window will appear . When firm- ware is updated, your SonicW ALL ’ s settings may be erased, so it is recommended to save the SonicW ALL ’ s preferences. If you have saved the SonicWALL ’ s prefer- ences file to your local disk, click Ye s . 6. Click [...]

Page 11 5 CONFIGURING THE SONICWALL Configure the SonicWALL to direct syslog to the V iewPoint Server . 1. Click the Log button on the left side of the browser window and then click the Log Settings tab at the top of the window . A window similar to the following will be displayed. 2. Enter the IP address or domain name of the ViewPoint Server in t[...]

P age 12 SonicWALL ViewPoint 6 INST ALLING VIEWPOINT Installing the ViewPoint Software Y ou may install ViewPoint from the V iewPoint Upgrade CD or you may download the ViewPoint software file from the SonicWALL, Inc. Web site. The ViewPoint server must be running Windows 2000 or Win- dows NT SP 4 or greater and it must have a static IP address. No[...]

Page 13 The installation wizard will guide you through the set up and install ViewPoint reporting software and syslog server , T omcat Web Server , and MySQL Database. Please refer to the Appendix for more information about these software components. The ViewPoint setup program will detect whether the de- fault Web, syslog or MySQL ports are in use[...]

P age 14 SonicWALL ViewPoint 7 MANAGING VIEWPOINT Logging Into the ViewPoint Web Interface Y ou will need to configure several settings in the ViewPoint Web Interface in order to view network reports. From a W eb browser , type http://LocalHost or http://<V iewPoint Server IP Address> into the Location or Address field or launch ViewPoint fro[...]

Page 15 Configuring ViewPoint Settings ViewPoint requires that users successfully authenticate to ac- cess reports. This authentication mechanism prevents unknown users from viewing sensitive network data. The ViewPoint Con- figuration window allows you to modify the ViewPoint user name and password. 1. From the ViewPoint Web Interface, expand the [...]

P age 16 SonicWALL ViewPoint 6. Click the Update button to update the configuration. Note: If you lose or forget the ViewPoint user name or pass- word, you will need to uninstall and then reinstall the ViewPoint software. Configuring SonicWALL Settings ViewPoint transparently authenticates to your SonicWALL Internet security appliance for status an[...]

Page 17 2. Enter the LAN IP Address of your SonicWALL in the IP Address field. 3. Enter the SonicWALL serial number in the Serial Num- ber field. The 12 character , alphanumeric serial number is displayed on the General Status window of the SonicWALL Web Management Interface. Note: The Serial Number field is not case sensitive. 4. Enter the current[...]

P age 18 SonicWALL ViewPoint Configuring Syslog Settings The Syslog Configuration window allows you to change the UDP port number that ViewPoint syslog server listens on, to configure ViewPoint to forward syslog data to other servers, and to limit the database size. 1. From the ViewPoint Web Interface, expand the Config- ure option on the left side[...]

Page 19 5. Y ou may configure the maximum size of the ViewPoint datab ase. T o limit the database by number of days, se- l ec t the Maximum Number of Days in Database radio button and enter the number of days that syslog mes- sages should be saved in the corresponding field. T o limit the database by size, select the Maximum Da- tabase Size in Mega[...]

P age 20 SonicWALL ViewPoint Setting the ViewPoint Report Date Y ou may change the ViewPoint report date quickly and easily . 1. T o change the report date, click the Date option in the top right corner of the browser window . A window simi- lar to the following will appear . 2. The current report date will be highlighted in the ViewPoint date cale[...]

Page 21 8 VIEWPOINT WEB INTERF ACE This section briefly describes the ViewPoint Web Interface and the Web-based help options. The ViewPoint Web Interface may be accessed from a Web browser from any computer located on the same network as the V iewPoint Server . Note: Please use Internet Explorer 4.0 or greater or Netscape Navigator 4.0 or greater t[...]

P age 22 SonicWALL ViewPoint ViewPoint Report Layout Most ViewPoint reports include a chart and a table. The chart displays information such as the amount of bandwidth through the SonicWALL over time. The table provides a summary of the data displayed in the chart. Several reports deviate from this layout: the General Status report pre- sents state[...]

Page 23 9 REPORT DESCRIPTIONS General Reports Status The General Status report displays comprehensive informa- tion about the current status of the SonicWALL. The Status report includes the SonicW ALL serial number , firmware version, ROM version, enabled upgrades and subscriptions, the number of users connected to the SonicWALL, and other state in[...]

P age 24 SonicWALL ViewPoint The Failed Login report table displays the time and the name or IP address of the machine that attempted to au- thenticate to the SonicWALL. VPN Events The VPN Events report lists all VPN events, including VPN SA negotiation attempts, VPN key exchanges, VPN heart- beat messages and VPN connection errors. The VPN Events [...]

Page 25 that occurred during the hour , the number of MBytes trans- ferred, and the MBytes as a percentage of the total MBytes for the report day . Both the chart and the table include inbound and outbound traffic through the LAN, WAN, and DMZ interfaces. Bandwidth Monitor The Bandwidth Monitor report displays a real-time graph of all network activ[...]

P age 26 SonicWALL ViewPoint Service Monitor The Service Monitor report displays a real-time graph of network activity by a service over the past 5 minutes. The Service Monitor shows FTP , HTTP , ICMP , NetBIOS, DNS, NTP , SMTP , and other services in KBytes or MBytes transferred per second. The Service Monitor includes traffic through the LAN, WAN[...]

Page 27 T op Users of W eb The T op Users of Web report shows the most active users accessing Web sites on the Internet or on the LAN or DMZ network segments. This report displays the number of Web site hits and the amount of bandwidth transferred, identi- fying inappropriate or excessive Web usage. The T op Users of Web report displays a pie chart[...]

P age 28 SonicWALL ViewPoint The Web Filter Summary report displays a bar graph of at- tempts to access objectionable Web sites by the number of blocked attempts. The table displays the hour of the day , the number of attempts to access objectionable Web con- tent during the hour , and the number of attempts as a percentage of the total attempts du[...]

Page 29 The T op Objectionable Web Sites By User report displays a table of the users blocked by the SonicWALL, the top 5 Web sites the users attempted to access, and the number of attempts to access each Web site. If more than 5 users at- tempted to access objectionable Web sites, the additional users’ Web activity may be displayed by clicking t[...]

P age 30 SonicWALL ViewPoint The Mail Usage Summary Report displays a bar graph of Mail traffic through the SonicWALL in KBytes transferred. The table displays the hour of the day , the number of Mail events that occurred during the hour , the number of KBytes transferred for Mail, and the number of KBytes as a per- centage of the total KBytes for [...]

Page 31 The T op Sources of Attacks report displays a pie chart of the top 10 sources by the number of attacks. The report table lists the top 10 sources displayed in the chart, the number of attacks generated by the source, and the number of at- tacks as a percentage of the total attacks during the report period. Number of Attacks by Category The [...]

P age 32 SonicWALL ViewPoint 10 ACCESSING VIEWPOINT REMOTEL Y Because the ViewPoint Interface is Web browser-based, any user on the SonicWALL's LAN may login and look at ViewPoint network reports. Even users located across a VPN or accessing network resources through applications such as pcAnywhere should be able to contact the ViewPoint Web I[...]

Page 33 APPENDIX Uninstalling ViewPoint Uninstall the ViewPoint program and all of its components from your system by relaunching the ViewPoint setup pro- gram. 1. If you installed ViewPoint from a CD, load the CD into your server and run the ViewPoint setup program. If you downloaded the ViewPoint executable file from the SonicWALL Web site, then [...]

P age 34 SonicWALL ViewPoint V iewPoint Administrative T ools The ViewPoint software includes several utilities to improve management and reliability . These utilities include a Re- pair Database tool, and Startup and Shutdown commands. ViewPoint Repair Database If the V iewPoint Server temporarily loses power , the ViewPoint database files may bec[...]

Page 35 ViewPoint Software Components The ViewPoint software program consists of several differ- ent components. These components include: MySQL Database, T omcat Web server , a syslog server , and SonicWALL ViewPoint software files. MySQL Database MySQL is a relational database management system. It is open source software that uses SQL, or Struct[...]

P age 36 SonicWALL ViewPoint NOTES[...]