u/Aardvark_Life

Is there a way to nuke/wipe Gen6 TZ's via the serial console? We have to process dozens and this would make it much easier to crank through them on a workbench.

NSM 4.2 (on-prem but prob doesn't matter). Many tenants each with one or more firewalls. I understand groups are the intended way to manage settings across multiple devices but that won't work for me since groups are not cross-tenant.

I created tenants because the NSM admin guide best practices says, "create a separate tenant for each customer to simplify the management and provide controlled access to the interface as needed." Besides that I believe it's the correct choice because there are some tenant based settings (auto-sync, etc.) that we want to control individually by client.

In GMS we could make a change in the root of Company View and it would affect every managed firewall. We used this to easily manage things like address objects that pertain to our managed services or custom blacklists.

Now in NSM I find myself wanting to tweak the logging configuration for every managed firewall. That's going to take forever doing manually for each tenant.

Is there really no way to do this across the board?

I started working with the API and can list tenants, firewalls, and pull the firewall configs but I haven't yet found how to change a firewall setting.

I'm curious how are others handling this.

NSM 4.2 on-prem.

What is the Global Default Tenant for? I haven't found a use for it other than an annoyance I have to click out of it each time I log in. Can I configure a default view so upon login it takes me to All Tenants > Firewalls . Inventory?

Secondly, is there better docs than the Getting Start Guide and Admin Guide? Even though they're over 100 and 300 pages respectively I often find errors, obsolete data, and a of lack details which leaves me creating tickets or posting to Reddit.

Migrating from on-prem GMS to on-prem NSM. GMS has a "determine automatically" option for managed address of firewalls. No DDNS needed, I guess it just got the IP from incoming syslogs.

Now I'm facing my first dynamic WAN firewall in NSM and there is no "automatic" option. I'm not using zero touch. Please don't tell me this is yet another deficiency in NSM vs. GMS.

We told our on-prem GMS server to forward all SonicWall syslogs (post decryption) to another in-house syslog server that generates custom reports, alerts, tickets, etc. How do I tell NSM to forward syslogs? I can't seem to find it. Thanks.

Which CSE license to replace SSLVPN which is only used for RDP? I see there are Internet and Private, Advanced and Basic. I want to try it to explore shutting down SSLVPN exposure.

A TZ280 w/3y APSS also includes 1y CSE and MSW shows CSE Keys for SIA and SPA.

How many licenses are included, just one or numerous?

Does the 1-year start at unit registration or when I activate CSE?

Are CSE licenses tied to a user or pooled like SSLVPN licenses?

We're using NSM on-prem. The tenants are local to our NSM instance and don't relate to MSW tenants. All firewalls are registered to one MSW tenant but built out in separate local NSM tenants for management. Will that affect anything in regards to activating CSE licenses, with lots of firewalls being registered to one MSW tenant?

Thank you.

NSM 4.1 on-prem fails with "Request failed with status code 400." displayed on a red banner when trying to upload firmware files (TZ270 & TZ280). This happens on the NSM firmware upload page where you browse and upload the file from your computer before deploying it to the unit, which would be the next step if it had not failed. I tried various browsers and re-downloading the binaries from MSW.

Are there any internal NSM logs I can review to get an idea what the problem is?

TZ270w (one of our test/lab units) running 7.3.3-7015 managed by our on-prem NSM 4.1 instance. From NSM I'm unable to view, create, or edit virtual access points because the Device > Internal Wireless > Virtual Access Point > Virtual Access Point Objects tab is totally blank. It doesn't even show the default sonicwall-ABCDEF VAP (which is currently broadcasting and functional). There's also no Add, Delete, or Refresh buttons on that tab. Same for the Virtual Access Point Profiles tab.

If I log directly into the TZ270w all of those settings are present and I can configure them, add VAP's, etc. but those changes never appear in NSM, even after syncing. I tried deleting it from NSM then resetting to defaults and re-acquiring, same thing.

I've got some Gen8 units on the way that I'm going to need to manage wireless on so I hope this doesn't affect them too. Has anyone else experienced this?

The NSM on-prem admin guide indicates to navigate to Manager View > Home > Firewalls > Firmwares > Firmwares tab. That exists in cloud NSM but not our NSM 4.1 on-prem instance. In-fact there is no Firmwares option under the Firewalls menu, only Inventory, Groups, Backups, and Config Migration.

In GMS on-prem I just dump firmware binaries to a folder on the GMS server and they become available to push out to devices as I see fit.

I would expect NSM has some sort of firmware repository too, as the documentation implies? It would seem silly to have to re-upload the binaries each time I want to update a device. We have many like devices but unless it's a critical patch we don't upgrade them all in one whack, in case of issues.

Anyone else with on-prem, do you have the Firmwares menu?

Thanks.

MSP shifting from GMS on-prem to NSM on-prem. I created a few tenants in NSM and added NFR Sonicwalls to each... so far so good.

In GMS we didn't have tenants, each unit was tagged with a company name and we used Company View to apply settings that inherited to just that clients devices. Also we had some global settings we would apply at the root level and they would inherit down to every device for every client. Those were things like address objects and rules pertaining to our managed services which we wanted universal across all managed firewalls.

I'm not grasping how to do that in NSM. Groups aren't cross-tenant so that won't work. I can create a golden template but it sounds like they're only good for initial deployment and not managing global settings over time. What am I missing?

Thanks

We're deploying NSM on-prem after using GMS on-prem for a decade, and replacing all the firewalls with new models. We own and manage all the units, clients don't have access to GMS and won't to NSM either. In GMS we have the units tagged to Companies (our clients) and mostly work from the "Company View" unless we're doing firmware updates. We have some global settings that all managed devices inherit. There's also some client specific settings that only inherit to device for that client/company. All the units are registered to one tenant in our MSW account.

I'm trying to get clarification what NSM on-prem configuration can best translate to what we have in GMS. Do we still have to create separate MSW tenants for each client to achieve an NSM equivalent of the GMS Company View? Or can that just be done by "Group Name" instead? It sounds to me like Groups are the closer equivalent to GMS's Companies, all within a single tenant. I've got NSM on-prem running and am about to test this with some NFR units but would appreciate some input to help avoid pitfalls and save time.

Thanks