ViewPoint SonicWALL ViewPoint 5.0

Contents Platform Compatibility........................................................................................................................................................1 New Features and Enhancements ....................................................................................................................................2 Known Issues ....................................................................................................................................................................5 Resolved Issues ................................................................................................................................................................5 Installation Procedure........................................................................................................................................................6 Related Technical Documentation.....................................................................................................................................7

Platform Compatibility The SonicWALL ViewPoint 5.0 release supports the following operating systems:

Windows 2003 (SP2) Windows 2000 Server (SP4) Windows 2000 Professional (SP4) Windows XP Professional (SP2)

SonicWALL ViewPoint 5.0 supports the following databases:

MySQL version 5.0 for Windows, bundled with SonicWALL ViewPoint 5.0 Microsoft SQL Server 2005 (SP2) Microsoft SQL Server 2000 (SP4)

The requirements for the MySQL server are as follows: Windows 2000 (SP4) and above NTFS file system Minimum 6 GB hard disk free space Minimum 2 GB RAM

Note: It is not supported to use a Virtual Machine as the SonicWALL ViewPoint server or MySQL server.

The minimum recommended size for the SonicWALL ViewPoint server hard disk is 200 gigabytes.

SonicWALL ViewPoint 5.0 automatically downloads the Java Plug-in 1.6 and uses Tomcat 5.5.26.

SonicWALL ViewPoint 5.0 supports the following SonicWALL firmware versions:

SonicWALL security appliances SonicWALL Firmware 6.1.2.0 or higher SonicOS Standard 1.0 or higher SonicOS Enhanced 2.0 or higher

SonicWALL NSA appliances SonicOS Enhanced 5.0 or higher

SonicWALL SSL VPN 200/2000/4000 appliances

SonicOS SSL-VPN 2.1 or higher

SonicWALL CSM series appliances SonicOS CF 1.0 or higher

New Features and Enhancements This section contains a list of new features and enhancements in the SonicWALL ViewPoint 5.0 release.

Database Enhancements and Changes

MySQL 5.0 Support SonicWALL ViewPoint 5.0 introduces support for the MySQL 5.0 database for Windows. Only the version of MySQL that is bundled with SonicWALL ViewPoint 5.0 is supported.

Reporting Features

Custom Reports SonicWALL ViewPoint 5.0 provides the Custom Reports feature that lets you filter raw syslog data to generate granular reports customized by date and time ranges and by highly flexible data filters customized for your own needs. In the Internet Activity custom report, you can see the date and timedown to the secondof all Internet activity passing through a monitored SonicWALL security appliance, and view detailed information not available in reports generated from summarized data.

Enhanced No Data Messages The No Data message is often displayed when a report is not available. SonicWALL ViewPoint 5.0 displays the most likely reason for the lack of data and points you to the screen where you can make the necessary adjustments.

Best Practices Notification If the selected appliance does not have a valid subscription for the service youve requested, a sample report is displayed with information about that service and how to get it, along with links to the global SonicWALL dashboard report. This feature is available for Virus Attacks, Anti-Spyware, and Intrusion Prevention reports.

Appliance Subscription Status in Scheduled Reports All scheduled reports include the status of any subscription services licensed on the appliance(s) that are expiring within the next 7 or 30 days, or which have expired within the past 7 or 30 days.

Web Event Consolidation For faster performance and better database/hard disk usage, SonicWALL GMS 5.0 provides the ability to consolidate multiple syslog messages pertaining to a single activity (such as access to www.cnn.com) as a single event.

Syslog Tail Filters In SonicWALL ViewPoint 5.0, you can now use regular expressions to filter real-time syslog output.

Password Protection of PDF Reports When configuring scheduled reports, SonicWALL ViewPoint 5.0 allows password protection of reports in PDF format.

Additional Currency Types in Bandwidth Cost SonicWALL ViewPoint 5.0 supports more than 20 different currencies from around the world, which can be configured in the summarizer settings page. The selected currency is used in Bandwidth reports that include the cost of bandwidth.

2

Log Entry Enhancements for Report Data Summarized Report Data Summarized log entries include the number of syslog messages that were processed and the amount of time required for the summarization to complete. For example, a log entry might be: Report data summarized. 469,500 messages processed in 41.10 minutes.

Scheduled Reports for Bandwidth Usage Between Interfaces You can generate Bandwidth Usage reports between interfaces by entering a source and destination. Click Configure Filters/Options at the bottom of the Scheduled Report Configuration window to specify the interfaces.

Installer Enhancements

Syslog Collection Continues During Installation or Upgrade In previous versions of SonicWALL ViewPoint, the installation or upgrade installer automatically stopped the syslog collector, causing a syslog storm upon restart. This proved problematic for users with remote access to the SonicWALL ViewPoint system. SonicWALL ViewPoint 5.0 continues to listen for syslog packets being transferred remotely when the syslog collector is stopped during the installation or upgrade process.

Applet Jar File Uses Current System Timestamp A new feature with the TreeControl Applet Jar file is that the timestamp is now updated to the current system timestamp. You will notice that other files also have timestamps, which are the build times, not the current time. This new change of the timestamp is significant: It allows users to download the latest Applet Jar file and see the newest upgraded features once the SonicWALL ViewPoint application is accessed.

Phase-2 Installer Verifies Database Consistency In a fresh installation of SonicWALL ViewPoint 5.0, the Phase-2 installer will check for consistency between the database host and URL entries. These entries are used by MySQL and Microsoft SQL to access the database for upgrades, and must be consistent in order for the databases to communicate with each other.

Installer Provides Personal Firewall Alert An alert will remind you at the end of SonicWALL ViewPoint 5.0 installation or upgrade that your personal firewall may block incoming syslog packets and SMTP traps. The firewall may also prevent certain functions of SonicWALL ViewPoint 5.0 from working properly.

Miscellaneous Enhancements

SonicToday SonicWALL ViewPoint 5.0 introduces a new SonicToday panel in the management interface. The SonicToday panel can be configured to display any of the following in real time:

Monitors for ViewPoint logs or current sessions Headline news links and RSS feeds from Web sites of your choice

Configurable Database Threshold Alerts SonicWALL ViewPoint 5.0 provides two new status alert types: Database Size and Database Log Size. Both of these can be configured to adjust the size threshold for the alert and the destination and schedule for sending the alert.

3

Enhanced Search in ViewPoint Logs SonicWALL ViewPoint 5.0 provides the ability to search through ViewPoint Application Logs using multiple phrases.

Database Entries in sgmsConfig.xml Database connectivity entries, such as dbusername, dbhost, dburl, and dbpassword are configured only in sgmsConfig.xml, and no longer need to be configured in web.xml.

Searches Provide Auto Suggestions SonicWALL ViewPoint 5.0 introduces auto suggestion in search fields throughout most of ViewPoint. As you begin typing a search value, this feature suggests a list of possible matches based on unique strings for users, Web sites and IP addresses contained in the actual data that you are searching.

Syslog Collector and Scheduler Listen on All Interfaces The SonicWALL ViewPoint syslog collector and SonicWALL ViewPoint scheduler services no longer bind to interface cards or IP addresses provided during installation. Instead, SonicWALL ViewPoint 5.0 listens on all interfaces for traffic. This allows the syslog collector to collect messages from any interface, while the scheduler monitors appliances.

4

Known Issues The following are known issues in the SonicWALL ViewPoint 5.0 release:

Symptom Condition / Workaround Issue SonicWALL ViewPoint 5.0 installation does not complete under certain circumstances.

Occurs after uninstalling a previous 5.0 installation if the ViewPoint5\MySQL folder contains files, such as the actual database, that were created after the original installation. The uninstall process does not remove the MySQL folder if it contains such files. Workaround: After uninstalling ViewPoint, manually delete the MySQL folder or the entire ViewPoint5 folder. Alternatively, install the new ViewPoint version in a different folder.

70420

SonicWALL ViewPoint does not generate PDF versions of reports when attempting to generate By Site and By User report types.

Occurs on the Firewall > Configuration > Scheduled Reports > Add Scheduled Report page when the By Site or By User report types are selected. Workaround: Generate HTML reports instead of PDF.

69406

When subscription services are scheduled to receive reports on next Expiring or already Expired services, the report does not include services with a free 30-day trial; only Licensed Services are included.

Occurs when a scheduled report is configured for Add a Scheduled Report for Subscription Services Expiring in Next 30 Days and an appliance on the SonicWALL ViewPoint has a free 30-day trial.

68210

The report Web Usage: By User has a field Number of Hits in the main row that does not match the number of hits in the detailed information.

Occurs when certain hits are not counted in the detailed information field, resulting in an inconsistency between the reports.

49002

Resolved Issues The following issues are resolved in the SonicWALL ViewPoint 5.0 release:

Symptom Condition / Workaround Issue The SSL-VPN Authentication report displays the duration of user logins as not available.

Occurs when generating SSL-VPN Authentication reports. The data of user login and logout times are being recorded, but not displayed in the report.

63725

The data in the SSL-VPN Bandwidth report cannot be sorted based on hours.

Occurs when trying to sort the SSL-VPN Bandwidth summary report by hour.

50733

5

Installation Procedure You can either perform a fresh installation of SonicWALL ViewPoint 5.0 using the installer or upgrade a previous installation of SonicWALL ViewPoint 4.1.x. To upgrade from a version of ViewPoint prior to 4.1, you must first upgrade to SonicWALL ViewPoint 4.1 and then run the SonicWALL ViewPoint 5.0 installation.

Version of SonicWALL ViewPoint Upgrade Path to SonicWALL ViewPoint 5.0

4.1 Use SonicWALL ViewPoint 5.0

4.1.1 Use SonicWALL ViewPoint 5.0 The MySQL 5.0 database is only applied for new installations. The MSDE database is used for upgrades to existing installations of ViewPoint software.

Installation Notes If the SonicWALL ViewPoint Console (Web server) is set up for HTTPS management, the upgrade to ViewPoint 5.0 will preserve the HTTPS settings for the ViewPoint Web server.

The installation folder path name should not contain spaces.

6

Related Technical Documentation SonicWALL documentation is available in the SonicWALL Technical Documentation Online Library:

http://www.sonicwall.com/us/Support.html For basic and advanced deployment examples, refer to SonicWALL guides and technotes available on the Web site.

P/N: 232-001561-00 Rev B Last updated: 8/8/2008

7

ContentsPlatform Compatibility New Features and EnhancementsDatabase Enhancements and ChangesMySQL 5.0 Support

Reporting FeaturesCustom ReportsEnhanced No Data MessagesBest Practices NotificationAppliance Subscription Status in Scheduled ReportsWeb Event ConsolidationSyslog Tail FiltersPassword Protection of PDF ReportsAdditional Currency Types in Bandwidth Cost Log Entry Enhancements for Report Data SummarizedScheduled Reports for Bandwidth Usage Between Interfaces

Installer EnhancementsSyslog Collection Continues During Installation or UpgradeApplet Jar File Uses Current System TimestampPhase-2 Installer Verifies Database ConsistencyInstaller Provides Personal Firewall Alert

Miscellaneous EnhancementsSonicTodayConfigurable Database Threshold Alerts Enhanced Search in ViewPoint LogsDatabase Entries in sgmsConfig.xmlSearches Provide Auto SuggestionsSyslog Collector and Scheduler Listen on All Interfaces

Known IssuesResolved Issues Installation ProcedureInstallation Notes

Related Technical Documentation