> ## Documentation Index
> Fetch the complete documentation index at: https://docs.airmdr.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Sonicwall

> The SonicWall integration enables AirMDR to securely connect with SonicWall firewalls for monitoring, investigation, alert enrichment, and automated security operations workflows.

## Purpose

The SonicWall integration enables AirMDR to connect with a SonicWall firewall and retrieve security, network, and firewall-related information for investigation, enrichment, and automated response workflows.

This guide explains how to collect the following values from the SonicWall UI:

| Required Field | Description |
| :- | :- |
| Firewall IP | IP address used to access the SonicWall firewall management interface |
| Username | SonicWall administrator or read-only administrator username |
| Password | Password for the selected SonicWall user account |

<Note>
  Use a dedicated read-only or least-privilege administrator account wherever possible.
</Note>

## Supported Versions

| Component | Supported Details |
| :- | :- |
| Product | SonicWall Firewall |
| Management Interface | SonicOS web-based management UI |
| Recommended Access | HTTPS management interface |
| Authentication Type | Username and password |
| API Support | SonicOS API, if enabled |

<Note>
  SonicWall confirms that SonicOS firewalls can be managed through the local web-based management interface by accessing the LAN or WAN IP address and signing in with an administrator account.
</Note>

## Authentication

AirMDR uses SonicWall firewall credentials to authenticate with the SonicWall firewall.

### Required Credentials

| Field | Required | Example |
| :- | :- | :- |
| Firewall IP | Yes | `https://192.168.1.1` |
| Username | Yes | `airmdr-readonly` |
| Password | Yes | `********` |

### Role-Based Access Considerations

Recommended user role:

| Role Type | Recommendation |
| :- | :- |
| Read-only administrator | Preferred for monitoring and investigation |
| Full administrator | Use only if AirMDR requires response or configuration actions |
| Shared admin account | Avoid |

<Warning>
  Do not use a personal admin account for integrations. Create a dedicated SonicWall user account for AirMDR
</Warning>

### Pre-requisites

> <Check>
>   Users must have Administrator access to the **SonicWall** management UI with sufficient privileges to create or manage users and verify firewall settings.
> </Check>
>
> <Check>
>   The SonicWall management interface must be accessible from the AirMDR Remote Agent over HTTPS (default port `443`).
> </Check>
>
> <Check>
>   AirMDR Remote Agent and Network Connectivity installed and active (if required by deployment model).
> </Check>

### Setup Steps

<Steps>
  <Step title="Identify the SonicWall Firewall IP">
    1. Log in to the SonicWall firewall UI using an administrator account.
       ```text theme={null}
       https://<sonicwall-firewall-ip>
       ```
    2. Navigate to **Network → System → Interfaces**.
    3. In the **Interface Settings** table, locate the interface used for management access. **Common examples:**
       | Interface | Typical Use |
       | :- | :- |
       | X0 / LAN | Internal firewall management |
       | X1 / WAN | External management, if enabled |
       | MGMT | Dedicated management interface |
    4. Copy the IP address shown for the selected interface.
    5. Use this value as the **Firewall IP** in AirMDR.
           <Tip>
             SonicWall’s interface table lists configured interfaces and their zones, including LAN, WAN, WLAN, DMZ, and MGMT where applicable.
           </Tip>
           <Note>
             Prefer the internal LAN or dedicated MGMT IP. Avoid exposing firewall management over the public WAN unless required and secured.
           </Note>
  </Step>

  <Step title="Verify HTTPS Management Access">
    1. Navigate to **Device → Settings → Administration**.
    2. Open the **Management** section.
    3. Confirm that HTTPS management is enabled.
    4. Confirm the HTTPS port.\
       Default: `443`\
       Test browser access: `https://<firewall-ip>`
           <Tip>
             SonicWall recommends using HTTPS to log in to the SonicOS management interface, while HTTP management is disabled by default.
           </Tip>
           <Warning>
             Avoid using HTTP for firewall administration because credentials may be exposed in transit.
           </Warning>
  </Step>

  <Step title="Create a Dedicated SonicWall User">
    1. Log in to SonicWall UI.
    2. Navigate to **Device →  Users →  Local Users & Groups**.
    3. Click **Add User**.
    4. In the **Settings** tab, enter:
       | Field | Example |
       | :- | :- |
       | Name | `airmdr-readonly` |
       | Password | Enter a strong password |
       | Confirm Password | Re-enter password |
    5. Save the **user**.
           <Tip>
             SonicWall documentation states that local users are managed from **Device → Users → Local Users & Groups**.
           </Tip>
  </Step>

  <Step title="Assign User to the Required Group">
    1. In the same user configuration window, open the **Groups** tab.
    2. Add the user to the required administrator group. Recommended options:
       | Group | Use Case |
       | :- | :- |
       | Read-Only Admins | Monitoring, investigation, log review |
       | SonicWall Administrators | Full administrative access |
    3. Click **Save** or **Accept**.
           <Check>
             SonicWall allows local users to be assigned to groups from the **Groups** tab under local user settings.
           </Check>
           <Note>
             For AirMDR monitoring-only use cases, assign the minimum permissions required.
           </Note>
  </Step>
</Steps>

### Integration Credential Requirements

Use the following placeholder values while configuring the SonicWall integration in AirMDR.

| Field | Placeholder | Description |
| :- | :- | :- |
| Firewall IP | `https://<sonicwall-firewall-ip>` | SonicWall management interface IP or hostname |
| Username | `<sonicwall-admin-username>` | SonicWall administrator or read-only username |
| Password | `<sonicwall-password>` | Password associated with the SonicWall user account |
| Remote Agent | `<remote-agent-name>` | AirMDR Remote Agent used to establish connectivity |
| HTTPS Port | `443` | Default SonicWall management HTTPS port |
| API Access (Optional) | `Enabled / Disabled` | Indicates whether SonicOS API access is enabled |

### SonicWall Credential Reference Table

| Credential / Field | Where to Find in SonicWall UI | Description |
| :- | :- | :- |
| Firewall IP | `Network > System > Interfaces` | Displays the management IP address configured on interfaces such as X0, X1, or MGMT |
| Username | `Device > Users > Local Users & Groups` | Displays the local administrator or read-only user accounts configured on the firewall |
| Password | `Device > Users > Local Users & Groups` | Password is not visible after creation. It can only be set or reset by editing the user account |
| HTTPS Management Port | `Device > Settings > Administration` | Shows the HTTPS management port used to access the SonicWall UI (default: 443) |
| SonicOS API Access | `Device > Settings > Administration > SonicOS API` | Used to verify whether API access is enabled for integrations |
| User Role / Permissions | `Device > Users > Local Users & Groups > Edit User > Groups` | Displays the administrator or read-only groups assigned to the integration user |
| Remote Management Settings | `Device > Settings > Administration` | Used to verify whether HTTPS management access is enabled internally or externally |
| Firmware / SonicOS Version | `Device > Settings > Firmware & Backups`or `System > Status` | Displays the current SonicOS version running on the firewall |
| Firewall Hostname | `Device > System > Administration` | Displays the configured firewall device name or hostname |
| Interface Zone Details | `Network > System > Interfaces` | Displays whether the interface belongs to LAN, WAN, DMZ, or MGMT zones |

### Validate Connectivity

Use the following sample token request only for validation from an approved secure environment:\
**Parameter Details:**

| Parameter | Description |
| :- | :- |
| `-k` | Ignores SSL certificate validation for self-signed certificates |
| `-u` | Supplies SonicWall username and password |
| `-X GET` | Sends a GET request |
| `/api/sonicos/version` | SonicOS API endpoint used to validate connectivity and authentication |

<AccordionGroup>
  <Accordion title="Example POST Request using cURL:">
    ```text theme={null}
    curl -k -u "<username>:<password>" \
    -X GET "https://<firewall-ip>/api/sonicos/version"
    ```
  </Accordion>

  <Accordion title="Sample Successful Response">
    "status": "success": true , "firmware\_version": "SonicOS 7.0.1", "model": "NSa 2700", "serial\_number": "123456789", "hostname": "sonicwall-fw"
  </Accordion>

  <Accordion title="Sample Authentication Failure Response">
    "status":

    "success": false

    ,

    "message": "Authentication failed"
  </Accordion>

  <Accordion title="Sample Connection Failure">
    curl: (7) Failed to connect to 192.168.1.1 port 443: Connection refused
  </Accordion>
</AccordionGroup>

**Common Causes**

| Error | Possible Cause |
| :- | :- |
| Authentication failed | Incorrect username or password |
| Connection refused | Firewall IP unreachable or HTTPS disabled |
| SSL certificate issue | Self-signed or invalid certificate |
| 401 Unauthorized | Insufficient permissions or invalid credentials |
| API endpoint not found | SonicOS API not enabled |

### Configure Sonicwall in AirMDR Integrations Dashboard

1. Navigate to [AirMDR](https://app.airmdr.com/auth/login), provide the credentials and click **Login**
2. Navigate to the AirMDR Integrations Dashboard in the left navigation pane and select **Integrations**.
3. Use the search option, enter the keyword "**SonicWall**", select the **Connections** tab, and click **+ Create** button.
4. Enter an unique name to the Instance (e.g., `your org name-SonicWall`) to easily identify the user connection by AirMDR.
5. Enter the application credentials like **Firewall IP, Username** and **Password** in the Authentication Details field params, and click **Save**.

### Skills provided by this Integration

| **Skill ID** | **Purpose** |
| :- | :- |
| Get SonicWall IPv4 NAT Policies | Retrieve IPv4 NAT policies from SonicWall firewall. |
| Get SonicWall IPv4 Route Policies | Retrieve IPv4 route policies from SonicWall firewall. |
| Get SonicWall IPv4 Access Rules | Retrieve IPv4 access rules from SonicWall firewall. |
| Get SonicWall IPv4 Interfaces | Retrieve IPv4 interfaces from SonicWall firewall. |
| Get SonicWall Service Groups | Retrieve service groups from SonicWall firewall. |
| Get SonicWall Zones | Retrieve zones from SonicWall firewall. |

<Tip>
  To view the details of Input Parameters and Output for the respective skills

  * Go to [AirMDR → SonicWall](https://app.airmdr.com/integrationsv2/a7b9c5d3-2e1f-4a8b-9c6d-5e4f3a2b1c8d/skills?search=sonic) Integration page.
  * Select the **Skills** tab and click on the required listed skills.
</Tip>

## Additional Information

<AccordionGroup>
  <Accordion title="🧰 Error Handling">
    | Issue | Possible Cause | Resolution |
    | :- | :- | :- |
    | Connection failed | Firewall IP is incorrect | Verify the IP from Network > System > Interfaces |
    | Authentication failed | Incorrect username or password | Reset password or verify credentials |
    | Access denied | User lacks required permissions | Assign user to correct admin/read-only group |
    | Timeout | Remote agent cannot reach firewall | Check routing, firewall rules, and port access |
    | API request failed | SonicOS API disabled | Enable SonicOS API in Administration settings |
    | SSL certificate warning | Self-signed firewall certificate | Validate certificate trust policy before allowing connection |
  </Accordion>

  <Accordion title="🔄 Monitoring & Logs">
    ### SonicWall UI Logs

    Navigate to \
    **Monitor → Logs → System Logs**\
    or\
    **Investigate → Logs**\
    depending on SonicOS version.

    ### What to Monitor

    | Log Type | Purpose |
    | :- | :- |
    | Login events | Validate AirMDR authentication attempts |
    | Admin activity | Track configuration or access changes |
    | API activity | Confirm API requests, if enabled |
    | System events | Identify firewall-side errors |

    ### Sample Log Entry

    User login successful: user=airmdr-readonly source=\<remote-agent-ip>

    User login failed: user=airmdr-readonly reason=Invalid credentials
  </Accordion>

  <Accordion title="🛑 Security & Access Best Practices">
    | Best Practice | Description |
    | :- | :- |
    | Use Least-Privilege Access | Assign only the minimum permissions required for the integration. Prefer read-only administrator roles whenever possible. |
    | Use Dedicated Integration Accounts | Create a separate SonicWall account specifically for AirMDR integration to improve auditing and access tracking. |
    | Enforce Strong Password Policies | Use complex passwords with uppercase, lowercase, numbers, and special characters. Rotate passwords periodically based on organizational policy. |
    | Restrict Management Access | Limit SonicWall management UI access to trusted IP ranges or internal management networks only. |
    | Use HTTPS Only | Ensure the firewall management interface is accessible only over HTTPS to protect credentials during transmission. |
    | Enable Audit Logging | Monitor administrator logins, configuration changes, and authentication failures through SonicWall system logs. |
    | Periodically Review Permissions | Regularly validate user roles, access groups, and API permissions associated with the integration account. |
    | Disable Unused Management Services | Turn off unused services such as HTTP or WAN management access if not required. |
    | Protect Remote Agent Connectivity | Ensure secure communication between the AirMDR Remote Agent and SonicWall firewall using approved firewall and network policies. |
    | Review Failed Login Attempts | Investigate repeated authentication failures or suspicious login activity immediately. |
  </Accordion>

  <Accordion title="👉 Support & Maintenance">
    * 📧 Contact [**AirMDR Support**](mailto:support@airmdr.com) through your designated support channel.
    * 🔁 Rotate credentials regularly. Recommended cadence: Every 90 days or as per internal security policy
    * 🔄 Reconnect in AirMDR when secrets are changed.
    * Access Review Review the SonicWall integration user periodically.
      | Review Item | Recommended Frequency |
      | :- | :- |
      | User account status | Quarterly |
      | Assigned permissions | Quarterly |
      | API access | Quarterly |
      | Firewall management exposure | After every major network change |
  </Accordion>

  <Accordion title="🛑 Data Flow & Security">
    ### Data Exchanged

    | Data Type | Description |
    | :- | :- |
    | Firewall metadata | Device and interface details |
    | Security events | Firewall alerts, events, and logs |
    | Network details | IPs, zones, sessions, or policy-related information |
    | Authentication data | Username/password used for connection |

    ### Ports and Endpoints

    | Purpose | Protocol | Default Port |
    | :- | :- | :- |
    | SonicWall HTTPS management | HTTPS | `443` |
    | SonicWall HTTP management | HTTP | `80` |
    | API communication | HTTPS | `443` |

    <Note>
      Allow connectivity from the AirMDR remote agent to the SonicWall management IP on the required port.
    </Note>
  </Accordion>
</AccordionGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.