Overview

SonicWall NSM Inspector (Beta)

SonicWall Network Security Manager (NSM) is SonicWall's cloud console for centrally managing a fleet of SonicWall firewalls. The SonicWall NSM Inspector (Beta) connects to a customer's NSM tenant via the MySonicWall API, discovers every firewall that tenant manages, and reports firmware posture, configuration backups, change history, alerts, and security-service status back into Liongard — so an offline firewall, a missing backup, or a disabled security service surfaces without logging into NSM.

What you can monitor

The SonicWall NSM Inspector collects tenant-level and per-firewall data, including:

• Managed firewall inventory by model and SonicOS version
• Offline firewalls and firewalls that haven't checked in for 24 hours
• NSM admin users, including accounts without MFA and stale accounts
• Firmware version and whether newer firmware is available, per firewall
• Configuration backup recency and recent configuration commits
• Active and critical alerts
• Gateway Anti-Virus, Intrusion Prevention (IPS), and Content Filtering status

How it works

Each parent launchpoint is scoped to one customer's NSM tenant, using a MySonicWall API Key and that customer's NSM Tenant ID. The parent discovers every firewall the tenant manages, and Liongard creates a child launchpoint for each firewall, suggesting an Environment based on the NSM tenant name. Map each firewall to the same Environment as its parent so one Environment maps to one customer, with per-firewall posture tracked independently.

Benefits

• Maintain continuous visibility into every NSM-managed firewall across your customer base.
• Catch offline or silent firewalls before a customer reports an outage.
• Confirm every firewall has a recent configuration backup so a recovery is always possible.
• Flag outdated firmware and disabled security services that weaken cyber resilience.
• Track NSM admin accounts without MFA, and changes in the number of NSM admin users.
• Run side by side with the existing SonicWall and SonicWall Capture Client Inspectors — the NSM Inspector complements them, it doesn't replace them.

Inspector Setup Preparation

Step 1: Generate a MySonicWall API Key

1. Sign in to MySonicWall with the account the inspector will use.
2. Navigate to My Workspace > User Groups > User List.
3. Select Generate API Key.
4. Copy the key immediately and store it securely — MySonicWall doesn't let you view the key again after creation.

MySonicWall API keys are valid for 1–12 months. Note the expiration date so you can rotate the key before it lapses.

Step 2: Locate the Customer's NSM Tenant ID

1. Sign in to the SonicWall NSM console.
2. Open the tenant list and copy the customer's Tenant ID. The Tenant ID is alphanumeric (letters and numbers), not a plain number.
3. Confirm the customer's firewalls are assigned to that tenant. Newly added firewalls land in the Global Default Tenant until you assign them, and the inspector won't discover them until they're in the customer's tenant.

Inspector Setup:

Step 3: Configure the SonicWall NSM Inspector in Liongard

1. Log in to the Liongard platform.
2. In Liongard, navigate to Admin > Inspectors > Inspector Types > Navigate to the SonicWall NSM Inspector > Select Add System.

Each SonicWall NSM parent Inspector covers one customer's NSM tenant and auto-discovers a "Child" Inspector for each firewall in that tenant. Repeat this step for each customer — a Partner managing 50 customers creates 50 parent launchpoints.

Fill in the following information:

• Type of Inspector: Parent
• Environment: Select the customer's Environment
• Friendly Name: Suggested Naming: [Customer Name] SonicWall NSM Parent
• Agent: Select the On-Demand Agent
• Inspector Version: Latest
• MySonicWall Account Email: The login email of the MySonicWall account that holds the API key
• MySonicWall API Key: The API key generated in Step 1
• NSM Region: Select US West or EU Central
• NSM Tenant ID: The alphanumeric Tenant ID for this customer from Step 2
• Scheduling: The Inspector will default to run once a day at the time it's set up. Here you can adjust the schedule
• Select Save. The Inspector will now be triggered to run within the minute.

Step 4: Child Inspector Setup

After the first run of the Parent Inspector, each firewall in the customer's tenant will be auto-discovered and surfaced in the Discovered Systems tab on the Inspectors > SonicWall NSM Inspector page. Child Inspectors are named SonicWall NSM - [Firewall Name] and inherit credentials from the parent. Liongard suggests an Environment for each based on the NSM tenant name. If your Environment is named differently, select the customer's Environment before activating.

• Activate or Archive your Discovered Systems by ensuring they're mapped to the correct Environment > Check the checkbox to the left of Inspector(s) > Select the Actions drop-down menu > Activate Launchpoints (or Archive Launchpoints).
• Click Save.

The SonicWall NSM Inspector ships 12 alert rules. All are disabled by default, so enable the ones you want to use. See the SonicWall NSM Inspector Summary for the full list.

Troubleshooting

• Setup error on the first run, or the inspector reports invalid credentials: The API key is mistyped, expired, or revoked, or MySonicWall API access isn't enabled on the account. SonicWall can return an HTML login redirect instead of a clear error for a bad key — generate a new key, confirm API access with SonicWall Support, and re-enter it.
• Authentication fails even with a valid key: Two-factor authentication is enabled on the API account. Disable 2FA on that account (a dedicated service account is recommended).
• API access stopped working after a firmware migration: A Gen6 to Gen7 migration can disable MySonicWall API access. Re-enable it through SonicWall Support and regenerate the key.
• A firewall is missing from Discovered Systems: The firewall is still in the Global Default Tenant or another tenant. Assign it to the customer's tenant in NSM, then re-run the parent.
• Error says "no tenant with id … is visible to this MySonicWall account": The NSM Tenant ID is mistyped, the MySonicWall Account Email isn't the account that generated the API key, or that account can't access the tenant. Copy the Tenant ID again from the NSM tenant list and check the email.
• Error mentions the "NSM token exchange" step: Check the NSM Region first. This is the first step that uses the selected region.
• The parent runs successfully but discovers no firewalls: No firewalls are assigned to this tenant in NSM yet. Assign them to the customer's tenant, then re-run the parent.
• Error says the credential was rejected (HTTP 401): The MySonicWall API Key is invalid, expired, or revoked. Generate a new key in MySonicWall and re-enter it on the parent launchpoint.
• Error says Managed Firewalls or Firewall Detail was refused (HTTP 403 or 404): The MySonicWall account can't reach this tenant or firewall. Confirm the NSM Tenant ID and that the account has access to that tenant, then re-run the parent.
• A data view is empty and is listed in the Skipped Collections table: NSM refused that one collection (HTTP 403 or 404) for this account, so the inspector skipped it and collected everything else. This can affect any optional collection, such as NSM Admin Users, Backups, or Alerts. Check the account's NSM permissions; the view fills in on the next run once access is granted. Until then, related metrics show no value instead of zero.

Inspector FAQs