Skip to main content
Triggr reads and changes a firewall’s configuration through its SonicOS API: objects, rules, NAT, users, VPNs, security services and backups. In Triggr it’s called SonicWall. To manage firewalls through NSM, use SonicWall NSM; for Cloud Secure Edge, use SonicWall CSE. You need SonicOS 7, the built-in administrator account (admin unless renamed) signing in without a one-time code, and a public IP address or hostname for the firewall’s WAN interface.

​
Set up the firewall

Repeat on each client’s firewall.
1

Turn on the SonicOS API

In Device | Settings > Administration, open Audit / SonicOS API (SonicOS API in 7.3). Enable the SonicOS API and RFC-2617 HTTP Basic Access authentication, then click Accept. See SonicWall’s SonicOS API guide.
2

Allow HTTPS management on the WAN

In Network | System > Interfaces, click Configure on the WAN interface, select HTTPS under Management and click OK.
3

Limit management to Triggr

Create a WAN address group of Triggr’s IP addresses, plus your own if you manage the firewall over the internet, and set it as the Source of each WAN to WAN management rule in Policy | Rules and Policies > Access Rules. See SonicWall’s guide to restricting management access.
4

Check the port and certificate

In Device | Settings > Administration > Management, note the HTTPS Port if it isn’t 443. The firewall uses a self-signed certificate unless you import one from a public certificate authority.

​
Connect it in Triggr

1

Open the client's configuration

Go to Integrations > SonicWall and click Configure on the client’s row on the Per-Client Configuration card, or on the Base Configuration card for your own firewall.
The Per-Client Configuration card listing Acme Corp and Globex, each Not Configured with Admin Consent Not Required and a Configure button.
2

Enter the firewall's address and login

Enter the Appliance URL with https://, the port if it isn’t 443 and no path, such as https://fw.example.com, then the Admin Username and Admin Password. Turn on Allow insecure TLS if the firewall uses its self-signed certificate, and click Save Configuration.
The SonicWall configuration window with Appliance URL, Admin Password and Admin Username fields, an Allow insecure TLS switch under Advanced, and a Save Configuration button.
Per-client integrations never fall back to the Base Configuration when a workflow runs for a client. SonicOS stages every change: run Commit Pending after changes, then Logout. Only one administrator can change the configuration at a time, so don’t run workflows that change the same firewall at once.

​
Troubleshooting

Configure the client’s firewall on the Per-Client Configuration card.
Check the Appliance URL and port, that HTTPS management is on for the WAN, and that the management rules allow Triggr’s IP addresses.
Turn on Allow insecure TLS, or install a public certificate that matches the hostname.
401: check the username, password and RFC-2617 HTTP Basic Access authentication. 403: the SonicOS API is turned off.
The firewall has reached its maximum number of sessions, usually because another API client or workflow is still signed in. Wait for it to end, then retry.
Run Commit Pending before Logout, make sure no one else is changing the firewall, and use the built-in administrator.