How does GMS "Acquire" a Firewall?

03/26/2020 1231 15110

DESCRIPTION:
How does GMS "Acquire" a Firewall?

RESOLUTION:

Before GMS can manage a unit, a unit needs to be added. After adding a Unit, GMS will then need to "Acquire" the unit. Firewalls that are not "Acquired" can not be managed.

Units can be managed by one of the following Management Methods:

- Using Existing Tunnel or LAN (HTTPS Management on local network or over already existing VPN tunnel);
- Using Management VPN Tunnel (HTTPS Management over Management VPN Tunnel from GMS Gateway);
- Using HTTPS/SSL Management (Direct HTTPS Management).

After adding a unit, unit status is in yellow. When adding a unit, GMS will create default tasks for this unit in order to complete the acquisition.

Due to these tasks a lightning bolt will appear over the yellow unit icon. 

According to the Management Mode, the Unit will start sending Heartbeats and Syslog data to the GMS server. GMS identifies the managed address according to the source address of the received syslogs. Once heartbeats are received via Syslog, GMS will attempt to login to the unit to fetch settings and complete synchronization.

Management Methods:

Using Existing Tunnel or LAN

Unit will send heartbeats and syslog data to configured GMS Server address. GMS will attempt login directly to the unit.

Using Management Tunnel

Once the tunnel is created (on the Unit by configuring GMS Management and on the GMS Gateway by GMS itself), the remote firewall's heartbeat message will establish the tunnel.
Heartbeats and Syslog data are sent over the management tunnel to GMS server. GMS will attempt login using HTTPS over the Management tunnel.

Using HTTPS Management

Unit will send heartbeats and syslog data to configured GMS host or NAT address. GMS will attempt login directly to the unit.

Only AFTER receiving Heartbeats and Syslog data and successful login/fetch of settings file is a unit actually "Acquired".  Once acquired the unit will turn Blue.  As long as the four tasks are still pending, the yellow lightning bolt will remain until the tasks are successfully executed.

In some cases a unit is already registered to a different MySonicWall.com account, in this case the "Register to MySonicWall.com" task can not be executed, and will remain in the scheduled tasks queue. Scheduled tasks that remain in the queue MIGHT prevent other tasks from being executed. In this case please delete the Registration task.

When a status icon of a unit is NOT blue, this could have two causes:

1) No Heartbeats and syslog is being received from the unit, possibly due to a firewall that is in between GMS and the unit (even a misconfigured GMS gateway) not allowing the Syslog data through to the GMS server.

2) GMS can not login to the unit, possibly due to a firewall that is in between GMS and the unit (for example firewall rules or NAT policies) not allowing GMS to access the unit, or an admin is already logged in to the unit, and the unit is configured not to let GMS pre-empt a logged in admin.