Prove SonicWall is working — first tool + proof field

1. Why “is it working?” is five questions

Concept: Operators collapse five failures into one sentence. The packet never became a connection. A Deny (or Discard) wrote a log. The rule you are staring at has zero traffic statistics since Restore. The tunnel is in Currently Active VPN Tunnels while 10.50.0.0/24 is missing from Destination Networks. Capture ATP is holding the download until a verdict returns. Those are five first clicks.

Path: Write the 5-tuple + UTC. Then pick the tile: Connections → System Logs → Access Rule hits → Currently Active VPN Tunnels → Capture ATP. The factory taught the stamps (X-port, zone, access rule, NAT, ARP, DPI-SSL, proxy ID). Here you learn the five SonicOS tools you actually open when someone asks you to prove the firewall is working.

Do: Quote one official field before you change POLICY | Capture ATP, bounce IKE, or add a second LAN→WAN Allow. Lab identities below are RFC 5737 / example.com only.

Hero · five tiles, one ticket

2. Mental model — five proof tools

Memorise five named objects before you click. Each tool is allowed to prove one thing. Over-claiming a field is how you disable Capture ATP at 02:00 for a SYN that never left X0.

3. Decision flow — ticket → first tool

Flowchart first. Do not open POLICY | Capture ATP until a diamond says the file is the question.

Path · pick the branch before the menu

4. How to choose — first tool + proof field

Print this next to the SonicOS tab. If you cannot recite the proof field, you are not ready to change anything.

5. Runbook Side A → B → C

Side A proves the session and the Access Rule hit. Side B proves the log store. Side C proves the overlay — IPsec and Capture ATP. On a messy Sev-2, do them in this order until a field lights up. Every step cites SonicWall technical documentation.

Side A — Session + Access Rule hit

1. Open Connections, not Capture ATP

   Path: MONITOR | Tools & Monitors > Connections. Official: Viewing Connections — click IPv4 or IPv6. The appliance “maintains a connections log for tracking all active connections.” Use Filter so the table shows only the ticket 5-tuple. Source: SonicOS 7.0 / 7.3 / 8 Monitor — Connections.

2. Quote the official columns that close a session ticket

   Documented Viewing Connections columns include Src IP (IP address of the source device), Src Port (port number of the source device), Dst MAC, Dst Vendor. Match 10.10.8.22 (lab) to the destination you were given. A matching row means SonicOS built a connection. An empty filtered table means the packet never became a session — stop. Do not hunt a verdict.

3. If someone claims “the rule allows,” open traffic statistics

   Path: POLICY | Rules and Policies > Access Rules. Use the Zone Matrix Selector or From Zone / To Zone. Open Settings > Grid Settings and display traffic statistics. Official: to restart the counts, click Restore. Quote the named rule’s statistics after a reproduce. Action values on the rule are Allow, Deny, or Discard. Source: SonicOS 7.1 Rules and Policies for Classic Mode — Display Traffic Statistics.

4. Empty session + zero statistics = factory, not ATP

   If Connections has no row and the intended rule’s traffic statistics did not increment, the packet never reached that rule. Confirm X-port / Zone on Network | Interfaces, then the first-match Access Rule for that zone pair. That is the factory, not this desk’s Capture ATP ticket.

Side B — Log > Monitor (System Logs)

1. Open System Logs, not the policy editor

   Path: MONITOR | Logs > System Logs. Operators: Log > Monitor. Official: navigate to MONITOR | Logs > System Logs, then use the Filter icon. Grid Settings chooses which columns display. Source: SonicOS 7.3 Monitor — System Logs display options / filter view / functions.

2. Read Access Rule Name — that is the ticket

   Official column: Access Rule Name — “Name of the Access Rule triggering the event, if any.” Also documented under Access and IDP Rules. Filter source 10.10.8.22 (lab) + the UTC window. Quote the name, not “a deny somewhere.”

3. Empty System Logs is not “SonicWall is down”

   If Connections already showed a session and System Logs has no row, check Grid Settings, the Filter, and the time window. Logging can be off on that Access Rule. That is a Track / logging problem — not a reason to add Any-Any “so we get a log.” Packet Monitor (MONITOR | Tools & Monitors > Packet Monitor) is a different isolate tool; it is not one of this desk’s five first tiles.

Path:              MONITOR | Logs > System Logs   (aka Log > Monitor)
Filter:            Source 10.10.8.22 + UTC window
Quote:             Access Rule Name = LAN WAN Cleanup Deny
If empty + session: Grid Settings / Filter / logging on that rule
Do not:            add Any-Any “to generate a log”

Side C — VPN status + Capture ATP

1. Prove the tunnel from Currently Active VPN Tunnels

   Path: NETWORK | IPSec VPN > Rules and Settings. Official: a list of currently active VPN tunnels is displayed; Refresh the active tunnels at the top of the Policies view. Policy Type on the General screen includes Site to Site. Source: SonicOS/X 7 IPSec VPN — Currently Active VPN Tunnels; site-to-site policies.

2. Then open Local Networks / Destination Networks

   Active in the table is not the printer subnet. Open the VPN Policy → Network. Quote Local Networks and Destination Networks (the proxy ID / interesting traffic). Official: when adding VPN Policies, SonicOS auto-creates non-editable Access Rules so traffic can traverse Trusted Zones and the VPN Zone — those auto-rules are not a substitute for listing 10.50.0.0/24. Do not bounce IKE first.

3. If the ticket is a hung download, prove the verdict

   Path: POLICY | Capture ATP > Settings. Official enable set: Capture ATP, Gateway Anti-Virus (GAV), and Cloud Gateway Anti-Virus. Official hold: Block file download until a verdict is returned — “ensures no packets get through until the file is completely analyzed.” Dashboard: Dashboard | Capture ATP (status of files sent to the backend). Files can remain in Files Blocked Until Completely Analyzed. Capture ATP stops working when GAV or Cloud GAV is disabled — unchecking GAV is not isolate. Source: SonicOS 7.0 / 7.1 / 8 Capture ATP; SonicOS 7.3 Monitor Dashboard — Capture ATP.

6. Five tickets as full stories

These five land every quarter. Memorise first tool + proof field. Times and identities below are lab-only.

Proof · named field, then Closed

SWEVD-01 — Prove the session (Connections)

01:42 · P2. Priya: Finance HTTPS to 198.51.100.80:443 is stuck. Someone pasted a green HOME / System Status screenshot. L1 already drafted “disable Capture ATP.”

First tool: MONITOR | Tools & Monitors > Connections → IPv4 → Filter Src IP = 10.10.8.22 (lab host).

If empty: SonicOS never built a connection. Quote the empty Filter. Next station is the factory — X-port / zone / first-match Access Rule / ARP on the egress X-port — not POLICY | Capture ATP. The factory dummy lab would then print state=SYN_SENT and bytes=…/0; that is isolate language for “forward done, return not done.” Official Connections proof is still the row (or its absence) with Src IP + Src Port.

If a row exists: you proved a session. You are now allowed to open System Logs for Access Rule Name, or Capture ATP if the symptom is a hung file. The Connections row is not a verdict.

SWEVD-02 — Prove the event (System Logs)

02:05 · P2. A cleanup change shipped at 01:18. Outlook on the Web opens from some desks. Priya’s host cannot reach 198.51.100.80. Someone wants “another LAN→WAN Allow at the top.”

First tool: MONITOR | Logs > System Logs. Filter Source = 10.10.8.22, last hour.

Proof field: Access Rule Name = LAN WAN Cleanup Deny (lab). That name is the ticket. Change that one rule — or the object it missed — then reproduce and re-read the same column. If Category points at an IDP / security-service event under Access and IDP Rules, you are not in a missing-Allow story.

SWEVD-03 — Prove the hit (Access Rule traffic statistics)

02:20 · P2. L1: “Rule 14 already Allows HTTPS. SonicWall is broken.” They are looking at the Action column, not the counters.

First tool: POLICY | Rules and Policies > Access Rules. Zone pair LAN → WAN. Settings > Grid Settings → display traffic statistics. Note the counts. Click Restore if you need a clean window. Reproduce once. Re-read the same rule.

Proof field: traffic statistics still zero after reproduce → this rule never saw the packet (wrong zone pair, shadowed by a higher-priority rule, or the session never started — go back to Connections). Statistics increment and Action = Allow → the rule is doing its job; the next station is ARP / NAT / DPI-SSL (factory) or Capture ATP if the file is the hold.

SWEVD-04 — Prove the tunnel (Currently Active VPN Tunnels)

02:40 · P2. DC printers on 10.50.0.0/24 are dead. The channel screenshot shows the site-to-site policy Enabled. L1 wants IKE bounced.

First tool: NETWORK | IPSec VPN > Rules and Settings. Refresh. Confirm the policy is in Currently Active VPN Tunnels.

Proof field: the tunnel is in the active table, and Destination Networks does not list 10.50.0.0/24. Active ≠ the subnet. Official Network objects on the VPN Policy are Local Networks and Destination Networks. Auto-added Access Rules between Trusted Zones and the VPN Zone only pass what the policy’s networks include. Do not bounce IKE. Do not change Phase 1.

SWEVD-05 — Prove the file (Capture ATP)

03:00 · P3. Finance cannot download finance-q4.xlsx. Connections already shows Src IP 10.10.8.22. System Logs Access Rule Name is the HTTPS Allow. L1 typed “disable Capture ATP” in the channel.

First tool: POLICY | Capture ATP > Settings and Dashboard | Capture ATP.

Proof field: Block file download until a verdict is returned is On, and the file is in Files Blocked Until Completely Analyzed (or the dashboard shows analyzing / the later verdict). Official: that option holds packets until analysis finishes. Official: Capture ATP stops when GAV or Cloud Gateway Anti-Virus is disabled — unchecking GAV to “make the download work” turns the sandbox off. Wait for the verdict, or use a documented exclusion after change-control — do not disable the service from a Sev-3 download.

7. Traps + close-the-ticket proof

Weak closes reuse a screenshot. Strong closes reuse a named SonicOS field.

Sources

• SonicOS 7.0 Tools & Monitors — Viewing Connections (Src IP, Src Port, Dst MAC; IPv4 / IPv6)
• SonicOS 7.0 Tools & Monitors — Filtering the Connection Log (Filter the Connections table)
• SonicOS 7.3 Monitor — Connections (Src Port, Dst MAC, Dst Vendor)
• SonicOS 8 Monitor — Connections (connections log for all active connections)
• SonicOS 7.3 Monitor — System Logs display options (Access Rule Name; Access and IDP Rules; Grid Settings)
• SonicOS 7.3 Monitor — System Logs filter view (MONITOR | Logs > System Logs · Filter icon)
• SonicOS 7.3 Monitor — System Logs functions
• SonicOS 7.1 Rules and Policies (Classic) — Display Traffic Statistics (Settings > Grid Settings; Restore restarts counts)
• SonicOS 7.1 Rules and Policies (Classic) — Access Rules settings
• SonicOS 7.0 Rules and Policies (Classic) — Access Rules create (Zone Matrix Selector)
• SonicOS/X 7 IPSec VPN — Currently Active VPN Tunnels (Refresh)
• SonicOS/X 7 IPSec VPN — Site-to-site VPNs
• SonicOS/X 7 IPSec VPN — Create site-to-site (Policy Type Site to Site) (NETWORK | IPSec VPN > Rules and Settings)
• SonicOS/X 7 IPSec VPN — Auto-added Access Rules (Trusted Zones ↔ VPN Zone)
• SonicOS 7.0 Capture ATP
• SonicOS 7.1 Capture ATP — Enable (POLICY | Capture ATP > Settings; GAV + Cloud GAV)
• SonicOS 7.0 Capture ATP — Files blocked until a verdict
• SonicOS 7.0 Capture ATP — Disabling GAV (ATP stops when GAV or Cloud GAV is disabled)
• SonicOS 7.3 Monitor Dashboard — Capture ATP
• SonicOS 8 Capture ATP — Config
• SonicOS 7 About SonicOS — Capture ATP dashboard

Related: Blog 1 · SonicWall session factory · SonicWall interview hub · Dummy lab (simulator key sonicwall) · Access rules and NAT · DPI-SSL deep dive