> ## Documentation Index
> Fetch the complete documentation index at: https://kb.mspprocess.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SonicWall firewalls (SonicOS)

> Connect each client's SonicWall firewall to Triggr directly through its SonicOS API, with the firewall's administrator username and password.

Triggr reads and changes a firewall's configuration through its SonicOS API: objects, rules, NAT, users, VPNs, security services and backups. In Triggr it's called SonicWall. To manage firewalls through NSM, use [SonicWall NSM](https://kb.mspprocess.com/integrations/sonicwall/nsm.md); for Cloud Secure Edge, use [SonicWall CSE](https://kb.mspprocess.com/integrations/sonicwall/cse.md).

You need SonicOS 7, the built-in administrator account (`admin` unless renamed) signing in without a one-time code, and a public IP address or hostname for the firewall's WAN interface.

## Set up the firewall

Repeat on each client's firewall.

**1. Turn on the SonicOS API**

In **Device | Settings > Administration**, open Audit / SonicOS API (SonicOS API in 7.3). Enable the SonicOS API and RFC-2617 HTTP Basic Access authentication, then click Accept. See SonicWall's [SonicOS API guide](https://www.sonicwall.com/support/technical-documentation/docs/sonicos-7-1-device_settings/Content/Audit_SonicOS_API/SonicOS-API-enabling.htm).

**2. Allow HTTPS management on the WAN**

In **Network | System > Interfaces**, click Configure on the WAN interface, select HTTPS under Management and click OK.

**3. Limit management to Triggr**

Create a WAN address group of [Triggr's IP addresses](https://kb.mspprocess.com/security/ip-allowlist.md), plus your own if you manage the firewall over the internet, and set it as the Source of each WAN to WAN management rule in **Policy | Rules and Policies > Access Rules**. See SonicWall's [guide to restricting management access](https://www.sonicwall.com/support/knowledge-base/how-can-i-restrict-sonicwall-management-access-for-specific-ip-address-es-only/221121093639177).

**4. Check the port and certificate**

In Device | Settings > Administration > Management, note the HTTPS Port if it isn't `443`. The firewall uses a self-signed certificate unless you import one from a public certificate authority.

## Connect it in Triggr

**1. Open the client's configuration**

Go to **Integrations > SonicWall** and click **Configure** on the client's row on the Per-Client Configuration card, or on the Base Configuration card for your own firewall.

![The Per-Client Configuration card listing Acme Corp and Globex, each Not Configured with Admin Consent Not Required and a Configure button.](https://mintcdn.com/triggr/nyuVXZ1rouDTTEvu/images/integrations-common/per-client-configuration.png?fit=max\&auto=format\&n=nyuVXZ1rouDTTEvu\&q=85\&s=11464b4946bea0b580c73330d9114a41)

**2. Enter the firewall's address and login**

Enter the Appliance URL with `https://`, the port if it isn't 443 and no path, such as `https://fw.example.com`, then the Admin Username and Admin Password. Turn on Allow insecure TLS if the firewall uses its self-signed certificate, and click Save Configuration.

![The SonicWall configuration window with Appliance URL, Admin Password and Admin Username fields, an Allow insecure TLS switch under Advanced, and a Save Configuration button.](https://mintcdn.com/triggr/nyuVXZ1rouDTTEvu/images/sonicwall-sonicos/configure.png?fit=max\&auto=format\&n=nyuVXZ1rouDTTEvu\&q=85\&s=df2f503e70e275398574ae2f36c1ed30)

Per-client integrations never fall back to the Base Configuration when a workflow runs for a client.

SonicOS stages every change: run Commit Pending after changes, then Logout. Only one administrator can change the configuration at a time, so don't run workflows that change the same firewall at once.

## Troubleshooting

> [accordion] no SonicWall integration is configured for this client
>
> Configure the client's firewall on the Per-Client Configuration card.

> [accordion] Connection fails or times out
>
> Check the Appliance URL and port, that HTTPS management is on for the WAN, and that the management rules allow [Triggr's IP addresses](https://kb.mspprocess.com/security/ip-allowlist.md).

> [accordion] Certificate errors
>
> Turn on Allow insecure TLS, or install a public certificate that matches the hostname.

> [accordion] 401 or 403 errors
>
> 401: check the username, password and RFC-2617 HTTP Basic Access authentication. 403: the SonicOS API is turned off.

> [accordion] 503 errors
>
> The firewall has reached its maximum number of sessions, usually because another API client or workflow is still signed in. Wait for it to end, then retry.

> [accordion] Changes don't take effect
>
> Run Commit Pending before Logout, make sure no one else is changing the firewall, and use the built-in administrator.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.