GMS SonicWALL Global Management System 6.0 If you are upgrading from SonicWALL GMS 5.1 to 6.0, and your database is larger than 40 GB, please use the Pre- Upgrade Tool. This tool helps avoid a significant increase in time for completion of the upgrade, which could result in substantial downtime for GMS. The Pre-Upgrade Tool is available on www.mysonicwall.com. Contents Platform Compatibility...1 New Features...3 Known Issues...7 SonicWALL GMS Pre-Upgrade Tool...8 Related Technical Documentation...10 Platform Compatibility Operating System Requirements SonicWALL GMS 6.0 is supported on the following Windows operating systems: Windows Server 2008 SBS 64-bit Windows Server 2008 Standard 32-bit and 64-bit (SP1) Windows Server 2003 32-bit and 64-bit (SP2) In all instances SonicWALL GMS is running as a 32-bit application. Note: Running this version of SonicWALL GMS on a virtual machine is not supported. For use on a virtual machine, the SonicWALL GMS Virtual Appliance is available separately. See the release notes at: http://www.sonicwall.com/downloads/sonicwall_gms_virtual_appliance_6.0_release_notes.pdf Database Requirements For fresh installations or after upgrading from 5.1, SonicWALL GMS 6.0 supports the following databases: MySQL 32 bit version 5.0.83 for Windows, bundled with SonicWALL GMS Microsoft SQL Server 2008, 32-bit and 64-bit Microsoft SQL Server 2005 (SP2), 32-bit and 64-bit, as follows: o SQL Server 2005 Workgroup o SQL Server 2005 Standard o SQL Server 2005 Enterprise o SonicWALL GMS does not support Microsoft SQL 2005 Express Microsoft SQL Server 2000 (SP4) The requirements for the bundled MySQL database server on Windows are as follows: Minimum 3 GHz dual-core CPU Intel processor Windows 2000 (SP4) and above NTFS file system 300 GB hard disk free space Minimum 2 GB RAM Not a Virtual Machine (VM) The MySQL 5.0 separate installer that was provided with SonicWALL GMS 5.0 is still supported.
Java Support SonicWALL GMS 6.0 automatically downloads the Java Plug-in 1.6 and uses Tomcat 6.0.20. Hardware for Single Deployment Minimum 3 GHz processor Server dual-core CPU Intel processor Minimum 4GB RAM 300 GB hard disk free space Hardware for Distributed Server Deployment GMS Server: Minimum 3 GHz processor single-cpu Intel processor Minimum 2 GB RAM 300 GB hard disk free space Database Server: Minimum 3 GHz processor dual-core CPU Intel processor Minimum 2 GB RAM 300 GB hard disk free space SonicWALL Appliances Supported for Management SonicWALL GMS 6.0 supports the following SonicWALL appliances and firmware versions: SonicWALL Platforms Firewall / UTM / VPN Appliances: SonicWALL NSA Series, E-Class NSA Series SonicWALL TZ Series SonicWALL PRO Series SonicWALL CSM Series Email Security/ Anti-Spam Appliances: SonicWALL Email Security Series Secure Remote Access Appliances: SonicWALL SMB SSL-VPN Series SonicWALL Aventail Series Backup and Recovery Appliances: SonicWALL CDP Series SonicWALL Firmware Version SonicOS Enhanced 5.0 or newer SonicOS Enhanced 3.2 or newer SonicOS Standard 3.1 or newer SonicOS Enhanced 3.2 or newer SonicOS CF 2.0 or newer Email Security 7.1 or newer SonicOS SSL-VPN 2.0 or newer Aventail 9.0 or newer SonicWALL CDP 2.3 or newer; For Multi-Solution Management, SonicWALL CDP 5.1 or newer is required 2
New Features The following are new features in the SonicWALL GMS 6.0 release: Multi-Solution Management...3 Live Monitoring...3 Application Firewall Reporting...3 SonicOS 5.5 Support...3 Custom and Granular Reports for SSL-VPN...3 SQL Server 2008 Support...4 Multiple Authentication Servers Support...4 RADIUS Authentication Support for GMS Login...4 Web Services API...4 Enhanced CLI Support...4 Enhanced Summarizer Capacity Planning...4 Inheritance Enhancements...4 Inheritance Support for Reporting Screens...5 Simplified Certificate Management...5 Name Resolution Crawler...5 Other Noteworthy Features...5 Multi-Solution Management The Multi-Solution Management feature in GMS provides next generation management capability by allowing administrators to manage multiple appliance types such as CDP and Email Security through their respective web user interfaces over HTTP and HTTPS. This enhancement enables the configuration of GMS Core Management functionalities through the GMS user interface. Now functions such as creating tasks, posting policies, scheduling tasks, and more are easily completed across multiple appliances at Unit Node and Group Node levels. Live Monitoring The Live Monitoring feature provides users with the ability to monitor an entire network through the correlation of syslogs received from appliances throughout a deployment. The collected syslogs are run against user-defined rules and turned into alerts. Viewing alerts in the new Live Monitoring screen in GMS 6.0, users now have greater flexibility to monitor a network, and to analyze traffic based on protocols, web usage and productivity, or even to detect viruses and attacks in the network. Application Firewall Reporting Application Firewall Reporting introduces detailed reporting on the application firewall feature of fifth generation UTM devices. Reports include but are not limited to top categories, top applications, top users, and top policies. Users can drill down within reports. This feature allows reports to be generated for Dynamic Policies and Custom Policies. Useful examples for this feature include, viewing a report by category such as Instant Messaging, or applying Bandwidth Management by monitoring the activity of streaming media. SonicOS 5.5 Support This feature brings GMS support for the UTM product line to the recently released SonicOS 5.5. New features now manageable by GMS include SonicPoint N support, SSL VPN NetExtender, UTM anti-spam, and active/active failover, and more SonicOS 5.5 support renders GMS applicable to a wider range of UTM appliance features and makes the GMS administrator more productive. Custom and Granular Reports for SSL-VPN This feature allows the GMS administrator to create custom reports using the raw logs collected from Aventail and SMB SSL VPN devices under management. GMS customers can now create granular reports on who accessed what applications at what time for forensic analysis and troubleshooting. Using data from these reports can help increase employee productivity and network uptime. 3
SQL Server 2008 Support GMS now supports the latest major release of SQL Server. This feature allows GMS to be used within a broader range of customer environments. Multiple Authentication Servers Support The GMS administrator can define multiple authentication servers per GMS Domain. Many customers use multiple authentication domains within their network. This feature allows GMS to be used within a broader range of customer environments. RADIUS Authentication Support for GMS Login The login module for GMS now supports RADIUS authentication. Many customers use RADIUS as part of their authentication infrastructure. RADIUS authentication support allows GMS to be used within a broader range of customer environments. It is also part of the upcoming PCI 1.2 requirements. Web Services API The Web Services Application Programming Interface (API) is a new Web Services infrastructure to facilitate GMS integration with third party applications from vendors such as ConnectWise and Autotask, communication between GMS agents, and uploading data from SonicWALL devices under management. GMS administrators typically use several other consoles to manage their network or, in the case of an MSP, their customers' networks. The web services API facilitates integration between GMS and other management consoles and greatly increases the productivity of the internal IT staff. Enhanced CLI Support The new Command Line Interface (CLI) does not require a user to do an OS level login into the GMS server. With this feature users are able to send commands to GMS from a remote host in a secure manner. This feature enables the automation of the interaction between GMS and other systems used by the customer. It facilitates execution of commands on the GMS CLI if the user can not access the GMS Console host using Remote Desktop. In addition, a third party application can interact with the GMS CLI from a remote host using the GMS CLI Client and Server. Lastly, a user can automate tasks on the GMS CLI from a remote host by using the GMS CLI Client application in batch/shell scripts. This feature enhances the productivity of the internal IT staff of enterprise and service provider customers. Enhanced Summarizer Capacity Planning GMS 6.0 includes enhanced tools to assess hardware utilization for collection of syslog data and summarization for reporting. This feature also includes an estimation tool to determine total capacity of the hardware in use. The impact of a variety of parameters such as number of users and types of reports enabled is taken into consideration both at the global level and for each device under management. Enhanced performance assessment facilitates finding the root cause of peak hardware usage and proper capacity expansion planning and therefore allows the GMS administrator to time his new hardware purchases and associated expenses appropriately as he grows his business and brings more devices under management. Inheritance Enhancements Within GMS 6.0, users can now use reverse inheritance to push policy settings up the hierarchy from a unit or group node to parent nodes above. Previously, only forward inheritance was allowed, pushing settings from the group level down to the unit level. This new capability is a considerable timesaver for administrators, enabling the user to copy existing configurations from a well-configured device, and to create predefined SonicWALL configurations. 4
Inheritance Support for Reporting Screens Adds inheritance support for setting configurations for GMS reports. This allows a new unit to be added to a group which then can inherit the GMS report settings for that group. This feature increases the GMS administrator s productivity. Simplified Certificate Management Allows the administrator to configure both CA and Local certificates in one place, simplifying the process of viewing, editing, and creating new certificates. GMS 6.0 includes GUI improvements and automation steps to facilitate certificates management for UTM devices. Enhanced certificates management increases the productivity of the GMS administrator. Name Resolution Crawler A new host name resolution feature provides a Name Resolution Crawler that periodically resolves host names for IP addresses found in reporting data. Once the host name is resolved, the name will appear in place of the IP address in reports that contain it. Over time, more host names appear in the report data as they are added to the list. The administrator can enable or disable this feature and configure the interval for the name resolution crawler to run (by default, every 24 hours). Other Noteworthy Features The following features are also included in GMS 6.0: File Import/Export Support in Appliance UI: In previous GMS versions, users did not have OS level access to the UMA and thus no secure file import/export mechanism from the UI. GMS 6.0 includes UI level support for importing and exporting files. Only specific pre-defined folders/files in the system on which export/delete actions can be performed by user are exposed in this view. This is a GMS administrator productivity feature as it eliminates the need to access the appliance via SSH. Group Level Interfaces: Allows interface management to be applied at a group level. Administrators are now able to manage all UTM appliance interface features with a few clicks, including configuration of network interfaces, WAN connection models, DNS servers, and more. Support for Operators in GMS Views: Administrators can use operators such as equals, starts with, ends with, contains, does not equal, does not contain for GMS Views. GMS View settings determine what devices are shown in GMS for each user. This new feature enables a more granular selection of devices to be shown. This is especially useful for service provider customers. Granular Summarizer Control: This feature provides the ability to specify detailed settings at the device and application level for various services associated with the syslog Summarizer. This is a MSP enablement feature. Granular control over the Summarizer function allows a service provider to customize its offering to each customer. VPN SA modification enhancements: The GMS administrator can modify a VPN SA for Standard OS UTM devices to do in-place editing of the SA instead of deleting the existing SA and creating a new one. This feature increases the GMS administrator's productivity as it eliminates the need to locally log into the remote device. Enhanced Purge Settings for Syslog Data: GMS 6.0 allows the administrators to specify separate purge settings for file-based raw syslogs (used for archival purposes) versus raw syslogs stored in the database (required for custom reporting). This feature manages usage of the database and the required storage to keep the database. This is a cost efficiency feature. Control on Show/Hide of Switch Link and Icon: This feature provides control to the GMS Administrator on who can view the "Switch" icon and link to switch between the application interface and the system interface. This is a security feature. Only the main GMS administrator should have the ability to switch between interfaces. Limited access admins, e.g. MSP customers, should not be able to see the system interface. Multiple Forbidden/ Allowed Domains at One Time: This feature encompasses the ability to add multiple Forbidden or Allowed Domains for web filtering at one time using a file import mechanism. This is a GMS administrator productivity feature. 5
Improved Raw Syslog Upload Performance: This feature separates the raw syslog upload process from the summarization process and accelerates the time between syslog collection and availability for custom reporting. It s an ease of use feature. SNMP Manager Service: SNMP Manager Service is now folded into Monitoring Manager Service. Email Alerts: Email alerts are sent if the system detects abnormal or suboptimal Summarizer performance. Upgrade History: History of Software Upgrade, HotFixes and Patches can now be viewed. Anonymous Reports: Reports can now be created that excludes user specified IPs and User Names. Troubleshooting: Troubleshooting interfaces have been exposed so that users can check connectivity of the GMS servers to the Database Server, SMTP Server, License Manager and MySonicWALL.com backend systems. Enhanced SSO: Users can specify the following selection in the GMS URL for automatic login to the desired page and appliance: Login credentials Screen selection Appliance selection in the TreeControl Tips and Tutorials: Context sensitive Tips icon displays where the Help icon is displayed if the product detects a useful tip/whitepaper/video etc for the currently displaying page in the interface. HA Status: The status of the HA is now displayed in the TreeControl. Icon with letter 1 displays for a Primary unit that is active. If the Standby becomes active, the letter changes to letter 2. CSV/Excel Exports: CSV/Excel support has been added as an export format for Custom Reports. Custom Report: Website Filtering has been added as a new Custom Report for UTM appliances. SSL Certificates: SSL Certificates for HTTPS support of the GMS Web Server can now be imported and setup using the System UI, instead of having to do this manually. 6
Known Issues The following are known issues in the SonicWALL GMS 6.0 release: Symptom Condition / Workaround Issue The synchronizing of SonicPoints does not work in GMS; some SonicPointNs do not display. Occurs when adding a SonicPointN to a SonicWALL NSA appliance. When verifying if the appliance is displayed on the Policies > SonicPoint > SonicPoints page, it will appear as not seen in GMS. This only happens for SQL Server systems upgrade installs; MySQL systems are not affected. Workaround: Remove the unit and then re-add the unit. 86410 The Keying mode of a non-interconnected VPN SA at the Group level cannot be modified. The Aventail status reports do not display in GMS. An Error on Page message displays when adding single or multiple allowed/forbidden domains on the Website Blocking customization screen. The Password protect the Zip file option does not work for Netmonitor Scheduled Reports. Days to store XML reports do not delete the older reports. On a fresh install of GMS 6.0, the Instance units do not appear in the tree control. All SSL-VPN units appear as Not Registered after upgrading from ViewPoint to the GMS Free Trial. Occurs when attempting to modify the VPN SA Keying mode from Manual Key to IKE using Preshared at the Group level. However, modifying IKE to Manual Key mode updates at the Group level. This is an issue specific only to StandardOS units under GMS management. Occurs when summarizing reports on GMS, and attempting to view Aventail status reports. The following Aventail reports do not display: Summary, OverTime, Down-Time Summary, and Down-Time Over Time. Occurs when attempting to add single or multiple domains using the allowed domain text field on the Policies > Website Blocking > Customization page. A few single domains will be added, but the error message displays when single or multiple allowed domains are added through the text field. Occurs when unzipping the Scheduled reports after the Password protect the Zip file option has already been enabled. Upon unzipping, the user should be prompted to provide a password. Occurs when navigating to the Reports > Configuration > Summarizer settings page. After configuring the Days to store XML reports, archived files should be deleted after an interval of time. Occurs when adding a ViewPoint Instance to GMS. The Remote Instance units should synchronize with GMS, and appear in the tree control. Workaround: Restart the Web Server service or the entire server after upgrading to or installing GMS 6.0. Note that this only affects distributed deployments. Occurs when attempting to upgrade to the GMS Free Trial. After manually enabling GMS on the SSL-VPN units, as they are not automatically configured for GMS, all SSL-VPN units are shown as Not Registered. 86405 86378 86355 86325 85861 85713 80419 7
SonicWALL GMS Pre-Upgrade Tool For large deployments with a SonicWALL GMS DB database size of 40 GB or more, the database schema upgrade can take a long time to finish. The SonicWALL GMS upgrade installation requires a large amount of system resources to create the necessary indices. This means that the Summarizer service will need to be turned off during the course of the run. To mitigate this, a pre-upgrade utility is available that builds the required indices. This tool is available on www.mysonicwall.com for Microsoft SQL and MySQL server-based GMS deployments. Use the following procedure: 1. Extract all files from the SonicWALL GMS 6.0 zip folder: Preupgrade_tool.zip A new directory with the name Preupgrade_tool will be created at the target directory. 2. Run the wizard to complete the SonicWALL GMS Upgrade Install. It is also recommended that you read the Readme.txt file to learn more about how to run the Pre-Upgrade Tool. Note: This pre-upgrade procedure will not reduce the overall upgrade time, but it will reduce the downtime for Syslog Collector. The pre-upgrade utility does not require that Syslog Collector stop running. After performing the pre-upgrade procedure, the actual upgrade will complete much faster. Upgrade Metrics Table: Database Size * GMS on Windows + MySQL UMA GMS on Windows + Microsoft SQL 4 Million 12 Minutes 13 Minutes 31 Minutes 20 Million 1 Hour, 8 Minutes 1 Hour, 13 Minutes 4 Hours, 42 Minutes 40 Million 2 Hours, 27 Minutes 2 Hours, 34 Minutes 80 Million 5 Hours, 31 Minutes 5 Hours, 34 Minutes 120 Million 9 Hours, 51 Minutes 8 Hours, 48 Minutes 200 Million 16 Hours, 48 Minutes 15 Hours, 34 Minutes Disclaimer: These numbers are for estimation purposes only. The actual run times in production environments will vary and is driven by a number of factors such as: How often database maintenance procedures are run Available system memory Available free disk space GMS + MSSQL Running on Same Hardware: CPU: Intel Core 2 Duo CPU E6550 2.33 GHz RAM: 2 GB Hard Disk: 300GB OS: Windows 2003 Standard server GMS + MySQL Server CPU: Intel Xeon CPU 2.40 GHz RAM: 2 GB Hard Disk: 234 GB OS: Windows 2003 Enterprise server You can use the above information to gauge or estimate the run time on your GMS/ViewPoint installation. * The Database Size is the total number of rows from four tables. Execute the SQL commands to print out the four table names and the number of rows in each of those tables, then add up the four numbers and compare the total with the values in the Database Size column of the table. 8
The following SQL commands will give you the total number of rows for the four tables being upgraded as part of the pre-upgrade tool. Add up the four numbers and match the total to the number in the Database Size column of the above table. SQL Server: MySQL: use sgmsdb SELECT [TableName for SGMSDB] = so.name, [RowCount] = MAX(si.rows) FROM sysobjects so, sysindexes si WHERE so.xtype = 'U' AND si.id = OBJECT_ID(so.name) AND so.name in ('vp_top_detail','vp_top_summary','vp_by_site_detail','vp_by_site_summary') GROUP BY so.name ORDER BY 2 DESC use sgmsdb_archive SELECT [TableName for SGMSDB-Archive] = so.name, [RowCount] = MAX(si.rows) FROM sysobjects so, sysindexes si WHERE so.xtype = 'U' AND si.id = OBJECT_ID(so.name) AND so.name in ('vp_top_detail','vp_top_summary','vp_by_site_detail','vp_by_site_summary') GROUP BY so.name ORDER BY 2 DESC SELECT table_schema, table_name, table_rows FROM information_schema.tables WHERE table_name IN ('vp_top_detail','vp_top_summary','vp_by_site_detail','vp_by_site_summary'); 9
Related Technical Documentation SonicWALL documentation is available in the SonicWALL Technical Documentation Online Library: http://www.sonicwall.com/us/support.html For basic and advanced deployment examples, refer to SonicWALL guides and technotes available on the Web site. SonicWALL GMS 6.0 P/N: 232-001803-00 Rev D Last updated: 6/3/2010 10