• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 687
  • Last Modified:

SonicWALL System Alerts

Hello,

We recently installed a SonicWALL NSA 2400 at our corporate location.  This device has locked up twice and has also maxed out its cores once.  It's been in for a week.

From the research that I've been able to do, it seems like these issues are probably stemming from too many connections open.  This is somewhat strange because during the day, I'm seeing the connections maxing out at less than 5,000.  The limit is 32,000.  The last time it locked up was at about midnight last night when no one should have been on the system.

My plan of attack is two-fold.  I am setting up ViewPoint so I can monitor the traffic a bit closer but I would also like to configure email alerts when the number of connections hit a certain threshold or the cores hit a certain percent threshold.  Is anyone doing this?  I'm not sure what software/approach is the best way to go.

Any help would be appreciated.

Thanks,
Christine
0
clarkincit
Asked:
clarkincit
  • 2
1 Solution
 
fbcbloodcenterCommented:
clark, a couple of questions:

What firmware are you on/is it the latest?
Do you use IPS/Content Filter/GAV/APP firewall/AS/etc?
Do you have sonicwall support?

I'm not an expert, but I don't know of a way to have core usage threshold trigger an email. I run an NSA 5500 and I've seen it lock up because of firmware issues and configuration issues but never connections/core usage.

0
 
clarkincitAuthor Commented:
I have the latest firmware installed.  
We have IPS, no content filter currently running, no GAV, no APP firewall, no Anti-SPAM or Spyware, etc.
I do have support with SonicWALL.  They have so far been incredibly slow to respond and only partially helpful.  I figured that I would probably get a better response here.  What they have told me so far is that there isn't a way with the SonicWALL management console to trigger these alerts.
0
 
fbcbloodcenterCommented:
yes, support is sometimes good sometimes bad, depends who you get. either way you have to stay on top of them. Don't be afraid to try and force an escalation or ask to speak to a supervisor if you are not happy.

I had a similar issue with my 5500 shortly after we got it setup and running- random reboots. Luckily we have two in HA so it didn't impact operations that much. It took sonicwall a few weeks to find the problem and then they issued us a custom firmware fix. After that everything was great.

As for Viewpoint, it has potential and can be a great tool but it will take some time to get used to it and to get it configured the way you want.

I would encourage you to focus your efforts on getting Sonicwall to fix the problem.

Good luck!
0

Featured Post

KuppingerCole Reviews AlgoSec in Executive Report

Leading analyst firm, KuppingerCole reviews AlgoSec's Security Policy Management Solution, and the security challenges faced by companies today in their Executive View report.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now