Chat now with support
Chat with Support

Security Analytics Engine 1.1 - SonicWALL Configuration Guide

Overview

By using the Security Analytics Engine’s SonicWALL™ plugin, an application is able to incorporate SonicWALL user and IP address activity data into a risk calculation thus minimizing the risk of a malicious user or browser gaining access to the application.
Support for SonicWALL user and IP address activity data in the Security Analytics Engine requires some minimum configuration settings in the SonicWALL firewall configuration, as well as the deployment and configuration of the SonicWALL Processor service. Additional configuration options that affect user and IP address activity details are also outlined in this guide.
SonicWALL requirements
One of the following SonicOS versions is required:
•
SonicOS 5.8
•
SonicOS 5.9
•
SonicOS 6.0
•
SonicOS 6.1
•
SonicOS 6.2

SonicWALL Processor Service Installation and Configuration

•
Introduction
•
SonicWALL Processor service installation
•
SonicWALL Processor service configuration

Introduction

The Security Analytics Engine utilizes the SonicWALL Processor service, which processes and forwards data received from the SonicWALL device pertaining to user and IP address activities. Prior to making the required SonicWALL firewall configuration changes, we recommend that the SonicWALL Processor service be installed and configured as follows.
* 
NOTE: If Windows® Firewall is enabled and running on the installation destination server, the SonicWALL Processor service will automatically configure firewall rules to allow SonicWALL AppFlow data communications from the firewall to the service. However, if a third-party firewall is installed, it may be necessary to configure the firewall to allow UDP traffic on the configured AppFlow port.

SonicWALL Processor service installation

The following procedure covers installing the SonicWALL Processor service.
* 
NOTE: In order to install the SonicWALL Processor service, you must have Administrator privileges.
To install the SonicWALL Processor service
1
Copy the Security Analytics Engine Installer - SonicWALL Processor Service.msi file to the installation destination server.
2
From the installation destination server, install the Security Analytics Engine Installer - SonicWALL Processor Service.msi file with the default parameter values.
* 
NOTE: During a default installation if the Security Analytics Engine is detected on the server, the installer will automatically detect the INSTALLFOLDER and REPORTERKEY options as well as the REPORTERURL option in the following order:
1
HTTPS bindings on any port (for example, https://server.domain.local:10443/SecurityAnalyticsEngine)
2
HTTP binding on the default port with no host name filter (for example, http://localhost/SecurityAnalyticsEngine)
3
HTTP binding on any port with a host name filter (for example, http://mysite:88/SecurityAnalyticsEngine)
OR
From the installation destination server, install the Security Analytics Engine Installer - SonicWALL Processor Service.msi file and provide command line parameter options to specify the following configuration values:
•
INSTALLFOLDER - This command overrides the default installation folder for the SonicWALLProcessor folder.
•
REPORTERURL - This command overrides the default Security Analytics Engine URL (http://localhost/SecurityAnalyticsEngine if auto-detection cannot determine the Security Analytics Engine web site bindings).
•
REPORTERKEY - This command overrides the auto-detected key value used to send user and IP address activity records to the Security Analytics Engine.
* 
IMPORTANT: Copying encrypted key values from configuration files on different computers is NOT supported.
* 
NOTE: For simple, single-server installations of both the Security Analytics Engine and the SonicWALL Processor service, the installers will auto-generate an encrypted shared key which will be stored in the appropriate configuration files. Therefore, these types of installations do not require use of the REPORTERKEY.
For complex installations where the same shared key must be configured on multiple servers, the REPORTERKEY is required and must be set to the same text as the MALWAREPROVIDERKEY used during the installation of the Security Analytics Engine. See the procedure below for information on resetting the key.
In both cases upgrades are handled automatically, where the same key will be retained, and providing the installer key parameters during upgrades will reset the shared key to the new value.
NOTE: If you are unable to provide the key used in the installation of the Security Analytics Engine during the installation of the SonicWALL Processor, you can reset the key post-install without needing to uninstall the Security Analytics Engine.
To reset the key for the SonicWALL Processor and the Security Analytics Engine
1
Run the Dell.SecurityAnalyticsEngine.SonicWALL.Processor.Utility.exe (Dell | SecurityAnalyticsEngine | SonicWALLProcessor).
2
In the Key Generator section, use one of the following methods to reset the key:
•
In the Provider Key field, enter your preferred key.
•
Click the Generate button to generate a random key.
3
An encrypted key will be automatically generated. Click the Update button to update the configuration file with the new key.
IMPORTANT: Resetting a key when the SonicWALL Processor and the Security Analytics Engine are installed in different systems requires that the utility be run in both systems individually. In that case, you must enter the same key into the Provider Key field.
•
APPFLOWPORT - This command overrides the default SonicWALL AppFlow port number (2055).
3
After installing the SonicWALL Processor service, verify that the service is running and that no errors or warnings are logged to the service log file.
* 
NOTE: By default, the installation path for the SonicWALL Processor service is:
C:\Program Files\Dell\Security Analytics Engine\SonicWALLProcessor
Self Service Tools
Knowledge Base
Notifications & Alerts
Product Support
Software Downloads
Technical Documentation
User Forums
Video Tutorials
RSS Feed
Contact Us
Licensing Assistance
Technical Support
View All
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating