Application Firewall Reporting

Transcription

1 Application Reporting Document Scope This document describes how to use the Application Reporting feature in SonicWALL GMS 6.0. This document contains the following sections: Feature Overview section on page 1 Viewing Application Reports section on page 3 Feature Overview This section provides an introduction to the SonicWALL GMS Application Reporting feature. This section contains the following subsections: What is Application Reporting? section on page 1 Benefits of Application Reporting section on page 2 How Does Application Reporting Work? section on page 2 Supported Platforms for Application Reporting section on page 2 What is Application Reporting? The Application feature is available on SonicWALL NSA and SonicWALL TZ 210 Series appliances running SonicOS Enhanced 5.0 and higher. SonicWALL GMS 6.0 provides reporting capabilities for this feature for the first time. The following Application reports are available at the group level: Summary Over Time The following Application reports are available at the unit level: Summary Over Time Top Applications Top Users Top Policies SonicWALL GMS 6.0 Application Reporting 1

2 Feature Overview Clickable reports (Graphs and Data) are supported, providing drill-down reporting information by clicking the graphical elements (such as pie chart slices) and data rows. For example, you can drill down to the User report level by clicking a user in one of the Top reports. This improves the overall workflow. A search bar is provided in the GMS management interface for filtering Application report data. Scheduled Application reports are also supported. Note Only PDF and XML Data formats are supported. See the SonicWALL GMS 6.0 Administrator s Guide for information about searching and scheduling reports. Benefits of Application Reporting Application Reporting provides the following benefits: Reports provide visibility into the impact and effectiveness of Application policies on SonicWALL UTM appliances Visibility into effective use of policies can increase employee productivity and efficiency of network usage Drill-down capabilities improve workflow by allowing you to access detailed information about a user or other element by clicking on that element in a higher level report Search capabilities provide filtering so you can quickly find the information you need from the Application Reporting data Scheduled reports provide the information you need for tracking and comparisons at regular intervals without requiring additional interaction How Does Application Reporting Work? SonicWALL GMS 6.0 uses syslog messages to enable accurate reporting of Application events. To achieve accurate reporting, several key data points are provided to SonicWALL GMS by the SonicOS Enhanced system running Application, including the following: Policy information Service description Action taken Bytes transferred (if any) Object detected Supported Platforms for Application Reporting Application Reporting is supported on SonicWALL GMS 6.0 or higher software and on the SonicWALL UMA EM5000 running GMS 6.0 or higher. SonicOS Enhanced Application is supported on the following platforms running SonicOS Enhanced 5.0 and higher: SonicWALL NSA EClass Series (NSA E7500/E6500/E5500) SonicWALL NSA Series (NSA 5000/4500/3500/2400/240) SonicWALL TZ 210 Series (TZ 210 / TZ 210 Wireless) 2 SonicWALL GMS 6.0 Application Reporting

3 Viewing Application Reports See the following sections: Viewing the Application Summary Report on page 3 Viewing the Application Over Time Report on page 4 Viewing Application Top Applications on page 4 Viewing Application Top Users on page 5 Viewing Application Top Policies on page 6 Viewing the Application Summary Report The Application Summary report contains information on the number of connections incurring Application activity logged by a SonicWALL appliance during each hour of the specified day, or at the global or group level, by each group of SonicWALL appliances for the day. To view the Application Summary report, perform the following steps: 2. Select the global icon, a group, or a SonicWALL appliance. 3. Expand the Application tree and click Summary. The Summary page displays. Figure 1 ReportsUTM > Application > Summary Hour when the sample was taken 5. The GMS Reporting Module shows yesterday s report. To change the date of the report, click the Start and End fields to access the drop-down calendars, select the desired dates, and then click Search. The GMS Reporting Module displays the report for the selected day or date range. SonicWALL GMS 6.0 Application Reporting 3

4 Viewing the Application Over Time Report The Application Over Time report displays the amount of Application usage handled by a SonicWALL appliance or a group of SonicWALL appliances for the specified time period. To view the Application Over Time report, perform the following steps: 2. Select the global icon, a group, or a SonicWALL appliance. 3. Expand the Application tree and click Over Time. The Over Time page displays. Figure 2 ReportsUTM > Application > Over Time Date when the sample was taken 5. To change the date of the report, click the Start and End fields to access the drop-down calendars, select the desired dates, and then click Search. The GMS Reporting Module displays the report for the selected date range. Viewing Application Top Applications The Top Applications report displays the applications that were most logged and/or blocked by Application on the specified date. The Top Applications report is available at the unit level. To view the Top Applications report, perform the following steps: 2. Select a SonicWALL appliance. 4 SonicWALL GMS 6.0 Application Reporting

5 3. Expand the Application tree and click Top Applications. The Top Applications page displays. Figure 3 ReportsUTM > Application > Top Applications Application Name the type of application, such as HTTP, FTP, and so on Action Type either No Action, Logged, or Blocked 5. To change the date of the report, click the Start field to access the drop-down calendar, select the desired date, and then click Search. The GMS Reporting Module displays the report for the selected date. Viewing Application Top Users The Top Users report displays the users who made the most logged and/or blocked connections by Application on the specified date. The Top Users report is available at the unit level. To view the Top Users report, perform the following steps: 2. Select a SonicWALL appliance. SonicWALL GMS 6.0 Application Reporting 5

6 3. Expand the Application tree and click Top Users. The Top Users page displays. Figure 4 ReportsUTM > Application > Top Users User Name the user s name or IP address Host Name the host name or IP address of the computer that made the connection Action Type either No Action, Logged, or Blocked 5. To change the date of the report, click the Start field to access the drop-down calendar, select the desired date, and then click Search. The GMS Reporting Module displays the report for the selected date. Viewing Application Top Policies The Top Policies report displays the Application policies that were triggered the most on the specified date. The Top Policies report is available at the unit level. To view the Top Policies report, perform the following steps: 2. Select a SonicWALL appliance. 6 SonicWALL GMS 6.0 Application Reporting

7 3. Expand the Application tree and click Top Policies. The Top Policies page displays. Figure 5 ReportsUTM > Application > Top Policies Policy Name the Application policy name Action Type either No Action, Logged, or Blocked 5. To change the date of the report, click the Start field to access the drop-down calendar, select the desired date, and then click Search. The GMS Reporting Module displays the report for the selected date. Solution Document Version History Version Number Date Notes 1 11/23/2009 This document was created by Susan Weigand. PN Rev A SonicWALL GMS 6.0 Application Reporting 7

8 8 SonicWALL GMS 6.0 Application Reporting