Sonicwall Reporting

[Nick88]

Hi,

 

Does anyone use Sonicwall for web filtering and reporting? We have the NSA 4600, the internal memory isn't good enough to store more than a few hours worth of data. Dell suggested buying the Analyzer add on for reporting, has anyone used this before? Can you do per user reporting? If so how?????

 

Many thanks

 

Nick

[m25man]

Analyser is a one off purchase, it's effectively an advanced syslog server with predefined reporting.

Once setup it will email you daily reports and a log summary.

 

You can login to the web interface and drill down on most activity in great detail.

Actual detailed user activity will depend on how you have set the Sonicwall up.

If your using full AD authentication and have the agents setup correctly Sonicwall extracts the client info via WMI

It's not the easiest system to work with but once you find your way around it you can drill down to a specific date/time and see what packets were going where.

The cost is linked to the size of the appliance.

So Analyzer for a 4600 is more expensive than a 3600.

Around £300 + Vat

Ideally, you need to run it on a dedicated PC/server and connect it to the same lan segment/switch the management interface is connected to so your syslog traffic has minimum hops from SW to Syslog.

 

Is it worth it?

1. It's better than nothing.

2. User details/activity recorded depend on your authentication methods.

3. Reports produced are highly configurable but hard work is needed to master them.

 

I thought you could download and install it for a trial period?

[Nick88]

Thanks for the info m25man, I have installed the trial version and had a play around with it. One issue i'm currently having with it it is the site name recognition, alot of sites are appearing as akamai technologies or lhr25s09 etc. I quickly spoke to tell who said it was due to the sites being HTTPS. Our DPI-SSL will only allow 350 connections and we currently have around 2000 staff and students. Any ideas on how to get it register the requested website and not where its hosted?