Connect SonicWall SonicOS (Local Connector)

A collector installed on one of your Windows servers reads the firewall's SonicOS API over HTTPS once a day and sends the result to HARVEN. HARVEN never connects to the firewall, and the collector never changes its configuration.

For the general flow of adding a source, see Connect Data Sources.

Prerequisites

• SonicOS 7 with the SonicOS API enabled

• A Windows server (PowerShell 5.1 or later) that reaches the firewall's management address over HTTPS, and your HARVEN domain on port 443

• A local SonicWall account in the SonicWALL Read-Only Admins group, without two-factor authentication

• Administrator rights on that server for the install

Setup

Step 1 — Prepare the firewall and the server

On the firewall

Once, in the SonicOS management interface:

1. Device → Settings → Administration: enable the SonicOS API, with basic or digest authentication. The collector handles both.

2. Device → Users → Local Users & Groups: create a local user for HARVEN and add it to the SonicWALL Read-Only Admins group. Leave two-factor authentication off for it.

3. Network → System → Interfaces: on the interface the collector connects to, enable User Login: HTTPS. Without it, SonicOS refuses every account except the built-in admin.

The collector only reads. It never changes the firewall's configuration.

⚠️ Use a read-only account. A full administrator account logs out anyone working in the web interface each time the task runs.

Network

Install on a Windows server that reaches the firewall's management address. Not on a domain controller.

Outbound HTTPS 443 to api., dbapi. and auth. under your HARVEN domain.

Outbound HTTPS to the firewall's management address and port. It is often not 443 when the SSL-VPN portal uses that port.

No inbound rule is needed.

Behind a proxy, pass -ProxyUrl or set HTTPS_PROXY machine-wide. The proxy is used for HARVEN only, never for the firewall.

Firewall certificate

SonicWall appliances usually present a self-signed certificate. Trust it in one of two ways:

• Pin it: the installer's -TrustSourceCertificate reads the certificate and pins its SHA-256 fingerprint (certificate_sha256). Compare the fingerprint it prints with the one the firewall shows.

• Or set ca_file to the PEM of your own certificate authority, if it issued the firewall's certificate.

To read the fingerprint beforehand, run on the collector's server:

$appliance = '<APPLIANCE-ADDRESS>'
$port = 443
$client = [Net.Sockets.TcpClient]::new($appliance, $port)
$stream = [Net.Security.SslStream]::new($client.GetStream(), $false, { $true })
$stream.AuthenticateAsClient($appliance)
([BitConverter]::ToString([Security.Cryptography.SHA256]::Create().ComputeHash(
    $stream.RemoteCertificate.GetRawCertData())) -replace '-').ToLower()
$stream.Dispose(); $client.Dispose()

Step 2 — Download and verify the archive

Download the archive from this page, on the server itself: the link expires within minutes.

Get-FileHash — checks the archive's SHA-256 against the one shown here.

Get-AuthenticodeSignature — checks the signature of the binary and the scripts.

Step 3 — Get the enrolment code

1. Save this data source

2. Click Generate a code

3. Copy it: it is shown once, works once and expires after 24 hours

Step 4 — Install

Run the installer. It installs the collector, enrols it, stores the firewall account, then checks that it can read the firewall.

.\install.ps1 -Source sonicos `
    -SourceOptions '{"address":"<APPLIANCE-ADDRESS>"}' `
    -TrustSourceCertificate -SourceUsername <SONICWALL-ACCOUNT>

It prompts for the enrolment code, then for the firewall account's password.

To change the firewall account's password later:

& "$env:ProgramData\Harven\Collector\harven-collector.exe" source-credentials `
    -connector sonicos -username <SONICWALL-ACCOUNT> -grant-read 'NT AUTHORITY\LOCAL SERVICE'

If the final check fails, the install stops with an error. Fix the cause and run the same command again.

Step 5 — Check the first collection

Start the task by hand: Task Scheduler → \Harven\, or Start-ScheduledTask.

The run then appears in this page's history.

Fields to fill in HARVEN

Collected data

• sonicos_access_rules — Access rules or security policies: zones, action, logging, action profile

• sonicos_security_services — Security services: licence, expiry, signature updates

• sonicos_security_service_settings — Security service settings: on or off, block or detect, exclusions

• sonicos_security_action_profiles — Policy Mode action profiles: what each security policy inspects

• sonicos_ssl_vpn — SSL-VPN portal: zones, authentication, certificate, timeout

• sonicos_device — The firewall: model, firmware, admin password policy, lockout, NTP, SNMP

• sonicos_zones — Zones: trust level, interfaces, services applied

• sonicos_interfaces — Interfaces: zone, address, management and user login services

• sonicos_nat_policies — NAT policies, including inbound port forwards

• sonicos_vpn_policies — Site-to-site VPN tunnels: authentication and encryption

• sonicos_certificates — Certificates and their expiry

• sonicos_local_users — Local user accounts: groups, second factor, SSL-VPN access

• sonicos_syslog_servers — Syslog destinations

• sonicos_address_objects — Address objects

• sonicos_address_groups — Address groups

• sonicos_service_objects — Service objects and groups

Never collected

The collector reads the tables above and nothing else. It never collects:

• Any configuration change: it only reads

• Traffic logs or security events

• Passwords, pre-shared keys, SNMP communities or private keys

• Local users' email addresses and display names

The audit log on your server records counts and outcomes, never data or credentials.

Operation

• Files: %ProgramData%\Harven\Collector (configuration, credentials, logs).

• Scheduled task: \Harven\ in Task Scheduler, one per connector. Disable it to stop collecting.

• Change the firewall password: harven-collector source-credentials -connector <name> -username <account>.

• Windows Event Log, source Harven Local Connector: 1000 started, 1001 committed, 1002 committed with warnings, 1003 failed, 1010 enrolled.

After a restore or a reinstall

Stored credentials are bound to the machine and do not survive a restore or a clone. Generate a new code on this page, run the installer again, then source-credentials.

Troubleshooting

The task history shows an exit code:

Uninstall

• uninstall.ps1 -Connector <name> removes the task, its profile and its credentials. -All removes everything; -KeepLogs keeps the audit log.

• Delete the SonicWall account on the firewall.

• Delete this data source in HARVEN, or disable its collector.

Official documentation

• SonicWall technical documentation

• SonicOS API reference

Need help? Contact [email protected].