SonicWALL ViewPoint User manual

SonicWALL ViewPoint
User's Guide

Page 1
CONTENTS
Copyright Notice ........................................................................... 2
Software License Agreement ...................................................... 3
1 INTRODUCTION ............................................................................ 5
2 GETTING STARTED ........................................................................ 6
System Requirements .................................................................. 6
Network Configuration for ViewPoint ....................................... 6
3 REGISTERING VIEWPOINT............................................................. 7
4 UPDATING SONICWALL FIRMWARE ............................................ 9
5 CONFIGURING THE SONICWALL ................................................ 11
6 INSTALLING VIEWPOINT ............................................................. 12
Installing the ViewPoint Software ............................................ 12
7 MANAGING VIEWPOINT ............................................................ 14
Logging into the ViewPoint Web Interface .............................. 14
Configuring ViewPoint Settings ................................................. 15
Configuring SonicWALL Settings ............................................... 16
Configuring Syslog Settings ....................................................... 18
Setting the ViewPoint Report Date .......................................... 20
8 VIEWPOINT WEB INTERFACE ..................................................... 21
9 REPORT DESCRIPTIONS .............................................................. 23
General Reports ......................................................................... 23
Bandwidth Reports ..................................................................... 24
Services Reports ......................................................................... 25
Web Usage Reports ................................................................... 26
Web Filter Reports ..................................................................... 27
FTP Usage Reports ..................................................................... 29
Mail Usage Reports .................................................................... 29
Attack Reports ........................................................................... 30
10 ACCESSING VIEWPOINT REMOTELY .......................................... 32
APPENDIX ................................................................................... 33
Uninstalling ViewPoint ............................................................... 33
ViewPoint Server Across a VPN ................................................. 33
ViewPoint Administrative Tools ................................................ 34
ViewPoint Software Components ............................................. 35
Active ViewPoint Services .......................................................... 35
NOTES ......................................................................................... 36

Page 2 SonicWALL ViewPoint
Copyright Notice
© 2001 SonicWALL, Inc. All rights reserved.
Under the copyright laws, this manual or the software de-
scribed within, may not be copied, in whole or part, without
the written consent of the manufacturer, except in the nor-
mal use of the software to make a backup copy. The same
proprietary and copyright notices must be affixed to any per-
mitted copies as were affixed to the original. This exception
does not allow copies to be made for others, whether or not
sold, but all of the material purchased (with all backup cop-
ies) may be sold, given, or loaned to another person. Under
the law, copying includes translating into another language
or format.
SonicWALL is a registered trademark of SonicWALL, Inc.
Other product and company names mentioned herein may
be trademarks and/or registered trademarks of their respec-
tive companies.
Specifications and descriptions subject to change without
notice.

Page 3
Software License Agreement for ViewPoint
This Software License Agreement (SLA) is a legal agreement between you and SonicWALL, Inc. (SonicWALL)
for the SonicWALL software product identified above, which includes computer software and any and all
associated media, printed materials, and online or electronic documentation (SOFTWARE PRODUCT). By open-
ing the sealed package(s), installing, or otherwise using the SOFTWARE PRODUCT, you agree to be bound by
the terms of this SLA. If you do not agree to the terms of this SLA, do not open the sealed package(s), install
or use the SOFTWARE PRODUCT. You may however return the unopened SOFTWARE PRODUCT to your place
of purchase for a full refund.
• The SOFTWARE PRODUCT is licensed as a single product.
• You may install and use one copy of the SOFTWARE PRODUCT, or any prior version for the same operating
system. The installation script may install the SOFTWARE PRODUCT on more than one computer.
• You may also store or install a copy of the SOFTWARE PRODUCT on a storage device, such as a network
server, used only to install or run the SOFTWARE PRODUCT on your other computers over an internal
network.
• You may not resell, or otherwise transfer for value, the SOFTWARE PRODUCT.
• You may not rent, lease, or lend the SOFTWARE PRODUCT.
• You may not remove any product identification, copyright, or other notices from the SOFTWARE PRODUCT.
• The SOFTWARE PRODUCT is trade secret or confidential information of SonicWALL or its licensors. You
shall take appropriate action to protect the confidentiality of the SOFTWARE PRODUCT. You shall not
reverse-engineer, de-compile, or disassemble the SOFTWARE PRODUCT, in whole or in part. The provisions
of this section will survive the termination of this SLA.
• You agree and certify that neither the SOFTWARE PRODUCT nor any other technical data received from
SonicWALL, nor the direct product thereof, will be exported outside the United States except as permit-
ted by the laws and regulations of the United States which may require U.S. Government export approval/
licensing. Failure to strictly comply with this provision shall automatically invalidate this License.
LICENSE
Subject to and conditional upon the terms of this SLA, SonicWALL grants you a non-exclusive, nontransferable
license to use the SOFTWARE PRODUCT only in conjunction with a single SonicWALL Internet Security Appli-
ance. Support for additional SonicWALL Internet Security Appliances is subject to a separate upgrade license.
OEM
If the SOFTWARE PRODUCT is modified and enhanced for a SonicWALL OEM partner, you must adhere to the
software license agreement of the SonicWALL OEM partner.
SUPPORT SERVICES
SonicWALL may provide you with support services related to the SOFTWARE PRODUCT (“Support Services”).

Page 4 SonicWALL ViewPoint
U.S. GOVERNMENT RESTRICTED RIGHTS
If you are acquiring the Software including accompanying documentation on behalf of the U.S. Government,
the following provisions apply. If the Software is supplied to the Department of Defense (“DoD”), the Software
is subject to “Restricted Rights”, as that term is defined in the DOD Supplement to the Federal Acquisition
Regulations (“DFAR”) in paragraph 252.227 7013(c) (1). If the Software is supplied to any unit or agency of the
United States Government other than DOD, the Government’s rights in the Software will be as defined in
paragraph 52.227 19(c) (2) of the Federal Acquisition Regulations (“FAR”). Use, duplication, reproduction or
disclosure by the Government is subject to such restrictions or successor provisions. Contractor/Manufacturer
is: SonicWALL, Inc. 1160 Bordeaux Drive, Sunnyvale, California 94089.
LIMITED WARRANTY
Media. For a period of ninety (90) days from the date of license, SonicWALL warrants to you only that the media
containing the SOFTWARE (but not the SOFTWARE itself) is free from physical defects.
NO OTHER EXPRESS WARRANTIES ARE MADE OR AUTHORIZED WITH RESPECT TO THE MEDIA. ALL IMPLIED
WARRANTIES WITH RESPECT TO THE MEDIA, INCLUDING WITHOUT LIMITATION, WARRANTIES OF MER-
CHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT, ARE LIMITED IN DURATION
TO THE WARRANTY PERIOD. SOME STATES DO NOT ALLOW LIMITATIONS ON HOW LONG AN IMPLIED WAR-
RANTY LASTS, SO THE ABOVE LIMITATIONS MAY NOT APPLY TO YOU.
PRODUCTS EXCLUDED FROM WARRANTY COVERAGE
Misuse, Damage, Etc. Products which have been abused, misused, damaged in transport, altered, neglected or
subjected to unauthorized repair or installation as determined by SonicWALL are not covered by this Limited War-
ranty.
SOFTWARE PROGRAMS. SOFTWARE IS PROVIDED “AS IS’’ AND SONICWALL MAKES NO WARRANTY OR
REPRESENTATION, WHETHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRAN-
TIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. WITH RESPECT
TO ANY SOFTWARE, YOU BEAR THE ENTIRE RISK AS TO QUALITY AND PERFORMANCE. SHOULD THE SOFT-
WARE PROVE DEFECTIVE FOLLOWING LICENSE, YOU (AND NOT SONICWALL OR ANY DISTRIBUTOR OR
RETAILER) ASSUME THE ENTIRE COST OF ALL NECESSARY SERVICING OR REPAIR.
LIMITATION OF REMEDIES
SONICWALL’S ENTIRE LIABILITY AND LICENSEE’S EXCLUSIVE REMEDY FOR BREACH OF THE FOREGOING
WARRANTY SHALL BE, AT SONICWALL’S OPTION AND EXPENSE: (1) REPAIR, (2) REPLACEMENT OR (3) REFUND
(IF REPAIR OR REPLACEMENT IS IMPRACTICAL) OF MEDIA NOT MEETING SONICWALL’S “LIMITED WAR-
RANTY’’ WHICH IS RETURNED TO SONICWALL ACCORDING TO THE CLAIM PROCEDURE BE LOW. IN NO EVENT
WILL SONICWALL BE LIABLE FOR ANY LOST PROFITS, COST OF PROCUREMENT OF SUBSTITUTE PRODUCTS OR
ANY INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE SUCH
PRODUCT EVEN IF SONICWALL HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO
NOT ALLOW THE EXCLUSION OR LIMITATION OF INCIDENTAL OR CONSEQUENTIAL DAMAGES, SO THE ABOVE
LIMITATION AND EXCLUSIONS MAY NOT APPLY TO YOU (LICENSEE).
WARRANTY CLAIM PROCEDURE
Any claim under this Limited Warranty must be submitted before the end of the warranty period to SonicWALL
at the address listed below. SonicWALL will use reasonable commercial efforts to repair, replace or refund
within thirty (30) days of receipt of the media.
THIS WARRANTY GIVES YOU (LICENSEE) SPECIFIC LE GAL RIGHTS, AND YOU MAY HAVE OTHER RIGHTS
WHICH VARY FROM STATE TO STATE.
SonicWALL, Inc. 1160 Bordeaux Drive, Sunnyvale, California 94089, 408-745-9600
MISCELLANEOUS
This SLA represents the entire agreement concerning the subject matter hereof between the parties and
supercedes all prior agreements and representations between them. It may be amended only in writing ex-
ecuted by both parties. This SLA shall be governed by and construed under the laws of the State of California
as if entirely performed within the State and without regard for conflicts of laws. Should any term of this SLA
be declared void or unenforceable by any court of competent jurisdiction, such declaration shall have no effect
on the remaining terms hereof. The failure of either party to enforce any rights granted hereunder or to take
action against the other party in the event of any breach hereunder shall not be deemed a waiver by that party
as to subsequent enforcement of rights or subsequent actions in the event of future breaches.
TERMINATION
This SLA is effective upon your opening of the sealed package(s), installing or otherwise using the SOFTWARE
PRODUCT, and shall continue until terminated. Without prejudice to any other rights, SonicWALL may termi-
nate this SLA if you fail to comply with the terms and conditions of this SLA. In such event, you agree to return
or destroy the SOFTWARE PRODUCT (including all related documents and components items as defined above)
and any and all copies of same.
Manufacturer is SonicWALL, Inc. with headquarters located at 1160 Bordeaux Drive, Sunnyvale, CA 94089-1209,
USA.

Page 5
1 INTRODUCTION
Monitoring critical network events and activity, such as secu-
rity threats, inappropriate Web use, and bandwidth levels, is
an essential component of network security. SonicWALL
ViewPoint compliments SonicWALL's Internet security offer-
ings by providing detailed and comprehensive reports of
network activity.
SonicWALL ViewPoint is a software application that creates
dynamic, Web-based network reports. SonicWALL ViewPoint
generates both real-time and historical reports to offer a com-
plete view of all activity through your SonicWALL Internet
security appliance. With SonicWALL ViewPoint, you are able
to monitor network access, enhance security and anticipate
future bandwidth needs.
SonicWALL ViewPoint:
•Displays bandwidth use by IP address and service
•Identifies inappropriate Web use
•Provides detailed reports of attacks
•Collects and aggregates system and network errors
•Shows VPN events and problems
•Presents visitor traffic to your Web site
SonicWALL ViewPoint software may be installed on a server
running Windows 2000 or NT located on the SonicWALL's
LAN. SonicWALL ViewPoint 1.1 is available as a standard fea-
ture for the SonicWALL PRO-VX and the SonicWALL GX and
an optional upgrade for the SonicWALL PRO.

Page 6 SonicWALL ViewPoint
2 GETTING STARTED
SonicWALL ViewPoint is a software reporting solution that
may be installed on any computer on the SonicWALL's LAN.
The computer used to host the reporting software will be
referred to as the “ViewPoint Server.”
System Requirements
The following is a list of the minimum requirements for
the ViewPoint Server:
• Microsoft Windows 2000 or NT 4.0 Service Pack 4 or greater
• 500 MHz Processor
• 512 MB available disk space
• 256 MB memory
• Internet Explorer 4.0 or later or
Netscape Navigator 4.0 or greater
Note: More disk space may be required for large networks.
Network Configuration for ViewPoint
The following diagram illustrates the network configura-
tion for SonicWALL ViewPoint:
The SonicWALL ViewPoint Server may be any computer or
server located on the SonicWALL's LAN running Windows
2000 or Windows NT 4.0 SP 4 or greater and meeting the
minimum system requirements.
LAN Network
LAN Network
Segment
Segment
SonicW
SonicW
ALL
ALL
Syslog
Syslog
ViewPoint
iewPoint
Ser
Ser
ver
ver
Note: The ViewPoint Server must have a static, permanent
IP address.

Page 7
3 REGISTERING VIEWPOINT
The following instructions describe the procedure to register
and activate the ViewPoint Upgrade for the SonicWALL PRO.
Registering the ViewPoint Upgrade is not required for the
SonicWALL PRO-VX or SonicWALL GX.
From a Web browser, go to the SonicWALL registration site at
http://www.mysonicwall.com and enter your User Name and
Password to login. If you do not have a mysonicwall.com
user account, you will need to create one.
To register your SonicWALL Internet security appliance:
1. Select the My Products option on the menu at the top
of the browser window. The SonicWALL Product Regis-
tration page will be displayed.
2. In the "Add New Product" section, enter the Serial Num-
ber of your SonicWALL.
3. Enter a Friendly Name that you will use to identify your
SonicWALL.
4. Click the Register button.
To activate your ViewPoint Upgrade:
1. Return to the home page by selecting My SonicWALL.
2. Select the friendly name that you created for your
SonicWALL to display the registration information. A win-
dow similar to the following will be displayed.

Page 8 SonicWALL ViewPoint
3. In the "My SonicWALL Service Management" window,
select the Activate button displayed next to the
ViewPoint service. An "Activate Service" window will be
displayed.
4. Enter the ViewPoint Activation Key displayed on the back
of this manual in the Activation Key field.
5. Click the Submit button.
Once the Activation Key has been registered, a ViewPoint Li-
cense Key will be displayed. Record this activation key carefully
or copy the License Key to your Windows Clipboard.
1. Log into SonicWALL Web Management Interface.
2. Click the Log button on the left side of the browser win-
dow and then click the ViewPoint tab at the top of the
window. The ViewPoint Upgrade window will be displayed.
3. Enter the ViewPoint License Key displayed on the
mysonicwall.com registration site into the Enter upgrade
key field in the SonicWALL PRO.
4. Click the Update button and then restart the SonicWALL
for the change to take effect.

Page 9
4 UPDATING SONICWALL FIRMWARE
You must upgrade the SonicWALL firmware to version
6.1.0.0 to support ViewPoint. You may skip this section if
you are using firmware version 6.1.0.0 or greater.
1. From a Web browser, go to http://www.sonicwall.com
and navigate to the Download Center to download the
latest version of SonicWALL firmware to your local disk.
2. Login to your SonicWALL Internet security appliance.
3. Click the Tools button on the left side of the browser
window and then click the Firmware tab at the top of
the window. A window similar to the following will be
displayed.
Note: You must register your SonicWALL Internet se-
curity appliance at http://www.mysonicwall.com before
you may upgrade firmware.

Page 10 SonicWALL ViewPoint
4. Click the Upload Firmware Now button.
5. ASave Preferences window will appear. When firm-
ware is updated, your SonicWALL’s settings may be
erased, so it is recommended to save the SonicWALL’s
preferences. If you have saved the SonicWALL’s prefer-
ences file to your local disk, click Yes.
6. Click the Browse button and select the SonicWALL
firmware file from your computer’s local disk.
7. Click the Upload button to upload the firmware file.
8. Restart the SonicWALL for the change to take effect.
Note: When uploading firmware to the SonicWALL, it is
important not to interrupt the Web browser by closing the
window, clicking a link, or loading a new page. If the browser
is interrupted, it may corrupt the SonicWALL firmware.

Page 11
5 CONFIGURING THE SONICWALL
Configure the SonicWALL to direct syslog to the ViewPoint Server.
1. Click the Log button on the left side of the browser
window and then click the Log Settings tab at the
top of the window. A window similar to the following
will be displayed.
2. Enter the IP address or domain name of the ViewPoint
Server in the Syslog Server field.
Note: The ViewPoint Server must have a static IP address.
Confirm that the server has a permanent IP address in the
server’s TCP/IP Properties window.
3. Enter “0” in the Syslog Individual Event Rate field
to send all syslog messages without filtering.
4. Confirm that the Syslog Format menu is set to "Default".
5. Click the Update button at the bottom of the browser
window, then restart your SonicWALL.

Page 12 SonicWALL ViewPoint
6 INSTALLING VIEWPOINT
Installing the ViewPoint Software
You may install ViewPoint from the ViewPoint Upgrade CD
or you may download the ViewPoint software file from the
SonicWALL, Inc. Web site.
The ViewPoint server must be running Windows 2000 or Win-
dows NT SP 4 or greater and it must have a static IP address.
Note: The Windows DNS configuration must be properly con-
figured, or domain and host names will not be displayed in
the ViewPoint reports.
Before you attempt the installation, confirm that your server
meets the system requirements described on page 6.
CD Installation
To install ViewPoint from the ViewPoint Upgrade CD, load
the CD into a Windows NT or 2000 server. The ViewPoint setup
program will launch automatically.
Internet Download Installation
To download and install the software from the Internet, save
the ViewPoint executable file to your hard drive and then
double click the file to run the executable.
Software License Agreement
Before the program files are copied to your system, the Soft-
ware License Agreement is presented.
• If you agree to the stated terms, click Yes.
• If you do not agree, click No to exit the setup program
without installing.
Note: When you install ViewPoint, be sure to close all other
applications on your computer.

Page 13
The installation wizard will guide you through the set up
and install ViewPoint reporting software and syslog server,
Tomcat Web Server, and MySQL Database. Please refer to
the Appendix for more information about these software
components.
The ViewPoint setup program will detect whether the de-
fault Web, syslog or MySQL ports are in use. If the default
Web port is active, the setup program will automatically
recommend an alternative Web port, port 8080. If either
syslog port 514 or MySQL port 3306 are active, the ViewPoint
setup program will display an error message.
Note: If you have a syslog server already installed on your
computer, you must remove the existing program and install
the syslog server provided with SonicWALL ViewPoint.
The Installation Wizard will prompt you to define the
ViewPoint Web Server port. The default Web (HTTP) port is
port 80.
Note: If you have a Web server already installed on your com-
puter, then configure the ViewPoint’s Web server to run on
an unused HTTP port, such as the recommended port, 8080.
The Installation Wizard will prompt you to define additional
settings, such as the SonicWALL LAN IP address and the
SonicWALL administrator password.
Once the programs have been installed, you may close the
ViewPoint Installation Wizard window. You will need to re-
start your computer for the changes to take effect.

Page 14 SonicWALL ViewPoint
7 MANAGING VIEWPOINT
Logging Into the ViewPoint Web Interface
You will need to configure several settings in the ViewPoint
Web Interface in order to view network reports.
From a Web browser, type http://LocalHost or http://<ViewPoint
Server IP Address> into the Location or Address field or
launch ViewPoint from the SonicWALL folder in the Win-
dows Start menu. An authentication window similar to the
following will be displayed.
Note: If you configured the ViewPoint Web server to use a
different port than port 80, then add the port number to
the URL, for example, http://LocalHost:8080.
1. Type the User Name and Password.
Note: The default User Name is "admin" and the default
Password is "password."
Note: The password that was configured during the ViewPoint
installation is used to authenticate to your SonicWALL, it does
not provide access to ViewPoint.
2. Click the Login button to login to the Web Interface.
Note: Confirm that the authentication screen has finished
loading before attempting to log in. Also note that the
ViewPoint password is case-sensitive.

Page 15
Configuring ViewPoint Settings
ViewPoint requires that users successfully authenticate to ac-
cess reports. This authentication mechanism prevents unknown
users from viewing sensitive network data. The ViewPoint Con-
figuration window allows you to modify the ViewPoint user
name and password.
1. From the ViewPoint Web Interface, expand the Con-
figure option on the left side of the browser window
and then click ViewPoint. A window similar to the
following will be displayed.
2. To change the ViewPoint user name, highlight the text in
the User Name field and replace it with your new user
name.
3. To change the ViewPoint password, enter your current
ViewPoint password in the Old Password field.
4. Enter the new ViewPoint password in the New Password
and Confirm New Password fields.
Note: When setting the ViewPoint password for the first time,
remember that the default ViewPoint password is “password”.

Page 16 SonicWALL ViewPoint
6. Click the Update button to update the configuration.
Note: If you lose or forget the ViewPoint user name or pass-
word, you will need to uninstall and then reinstall the
ViewPoint software.
Configuring SonicWALL Settings
ViewPoint transparently authenticates to your SonicWALL
Internet security appliance for status and state information.
ViewPoint uses the SonicWALL administrator password and
IP address configured during ViewPoint installation to au-
thenticate. If the SonicWALL IP address or password is
changed, you will need to modify the ViewPoint settings
to reflect these changes.
1. From the ViewPoint Web Interface, expand the Con-
figure option on the left side of the browser window
and then click SonicWALL. A window similar to the
following will be displayed.

Page 17
2. Enter the LAN IP Address of your SonicWALL in the IP
Address field.
3. Enter the SonicWALL serial number in the Serial Num-
ber field. The 12 character, alphanumeric serial number is
displayed on the General Status window of the
SonicWALL Web Management Interface.
Note: The Serial Number field is not case sensitive.
4. Enter the current SonicWALL administrator password
in the Old Password field.
5. Enter the new SonicWALL administrator password in
the New Password and Confirm New Password
fields.
Note: This password must match the password of your
SonicWALL.
Note: When setting the SonicWALL administrator password
for the first time, remember that the default SonicWALL
administrator password is “password”.
Click the Update button to update the configuration. Then
logout of ViewPoint and reauthenticate in order for these
changes to take effect.
Note: If you lose or forget the password that had been de-
fined in the SonicWALL Configuration window and ViewPoint
cannot authenticate to your SonicWALL, you will need to
uninstall and reinstall the ViewPoint software, and then de-
fine the correct SonicWALL administrator password.

Page 18 SonicWALL ViewPoint
Configuring Syslog Settings
The Syslog Configuration window allows you to change the
UDP port number that ViewPoint syslog server listens on, to
configure ViewPoint to forward syslog data to other servers,
and to limit the database size.
1. From the ViewPoint Web Interface, expand the Config-
ure option on the left side of the browser window and
then click Syslog. A window similar to the following will
be displayed.
2. To change the UDP port number that the ViewPoint syslog
server listens on, enter the new port number in the Port
Number field.
Note: SonicWALL Internet security appliances write syslog
traffic on port number 514.
3. To forward syslog data to a backup server, enter the IP
address of the secondary server in the IP Address field.
4. Enter the port number that the syslog data will be sent on
in the Port Number field.

Page 19
5. You may configure the maximum size of the ViewPoint
database. To limit the database by number of days, se-
lect the Maximum Number of Days in Database radio
button and enter the number of days that syslog mes-
sages should be saved in the corresponding field.
To limit the database by size, select the Maximum Da-
tabase Size in Megabytes radio button and enter
the number of megabytes of memory that the data-
base will store in the corresponding field.
Note: By default, Viewpoint will save database records for
seven days.
6. Click the Update button.
Note: Maintenance on the ViewPoint database is completed
every night, after midnight. Changes to the database size will
not take effect until database maintenance is performed.