SonicWall

Purpose

The SonicWall connector reads firmware, security service and firewall rule state from SonicOS appliances to assess management exposure and patch currency for gateway devices.

Requirements

• SonicOS 7.x with management API access enabled
• A read-only administrator account
• SNMP enabled for interface and system metrics, or API-only polling where supported

Permissions

• Administrator with the Auditor/Read-Only privilege level
• API key or credential scoped to that account for HTTPS management API polling

Setup

1. 1
   Enable the management API

   Under Manage > Appliance > Base Settings, enable the SonicOS API.
2. 2
   Create a read-only administrator

   Create an administrator account assigned the Auditor role.
3. 3
   Restrict management access

   Limit API/management access to the AssurIQ collector's source address.
4. 4
   Add the credential to AssurIQ

   Store the account credential in the Credential Vault and add the device under Integrations.
5. 5
   Confirm collection

   Verify firmware, license and rule evidence populate on the next cycle.

Verification

• Device appears in Attack Surface with current firmware version
• Security service (Gateway AV, IPS) license status is visible
• Firewall rule count and NAT policy summary populate in evidence

Data collected

• Firmware version and security service license status
• Firewall access rules and NAT policy summary
• Interface configuration and internet-facing status
• System resource and session metrics

Security model

The Auditor role is read-only across the SonicOS management interface and cannot alter configuration. Management API access is restricted to the collector's source address and travels over HTTPS.

Common errors

• AIQ-CRD-001Credentials failing
  Stored credentials were rejected by one or more targets.

Troubleshooting

• If firmware shows out of date, confirm the appliance has synced with MySonicWall for advisory metadata.
• If rules are missing, confirm the Auditor role has visibility into the relevant security zone.

Disconnect

1. Remove the device from AssurIQ Integrations.
2. Delete or disable the Auditor administrator account on the appliance.