One read-only API administrator on the firewall gives SmartTile identity, health, VPN tunnels, access and NAT rules with a change history, configuration backups and SonicOS update advisories — next to the rest of the network. BETA: built and installed, switched on per company, and being proven on a first real firewall.
/api/sonicos) on the HTTPS management port, signed in as a read-only administrator.A SonicWall watched by ping alone says up or down and nothing else. The SonicOS API answers what a NOC actually asks, and SmartTile only ever reads it: it signs in, reads, and always signs out — it never enters config mode, commits, restarts or pre-empts an administrator's session. Up/down stays with SmartTile's ping and SNMP checks; the API adds everything behind it. Beta: the integration is complete in the product and ships switched off per company until it has been proven on a real firewall.
Model, serial, SonicOS version, firewall name and MAC are written to the device record through the shared identity writer, marked “SonicWall SonicOS API”. A value typed by a person is never overwritten.
High availability, interfaces with zone and IP, connection count and table use, security-service licences, registration, signed-in users and the SonicOS update the firewall offers — on the Health tab.
HA peer lost, licence expired or expiring in 30 days, tunnel interface down, connection table 80%+ full, restart required, not registered, SonicOS update — opened once, closed on recovery.
Access rules (or security policies in policy mode) and NAT policies read hourly. The first read is the baseline; every rule added, removed, changed or moved after it is recorded on the Changes tab.
The E-CLI configuration export pulled over the API on the device's backup schedule, saved, hashed and diffed in Config Backups like every other vendor.
Tunnel-interface VPNs with live state; site-to-site policies with peer and subnets. Watch a tunnel-interface VPN in VPNAutomate and it is read live on every poll.
Administrator sign-ins, failed sign-ins and sign-outs from the firewall's event log, and configuration changes from its audit log. SmartTile's own API sign-ins are labelled, never judged.
A newer SonicOS the firewall offers becomes a FirmwareAutomate advisory; SmartTile never installs it. A Workflow trigger, “A SonicWall firewall reports a problem”, fires once per problem.
443). Allow SmartTile's address 157.245.117.9.| Switch | Default |
|---|---|
| Platform switch (SmartChoice, Engine Safety) + kill switch | Off in code — ships dark until proven on a real SonicWall. |
| Company switch (DeviceAutomate → SonicWall) | Off. Nothing is read from the company's firewalls until a company admin turns it on. |
| Per firewall: saved API administrator | Not connected until saved. |
| Rule inventory · firmware advisories · Workflow events | On · off · off — each its own platform switch. |
The only non-GET calls are signing in and signing out. Sessions are serialised per firewall, so SmartTile never ends an administrator's session or holds config mode.
Sealed with AES-256-GCM to that device the moment it is saved; the API returns only “password set”; the audit row lists which fields changed, never a value.
Test captures the firewall's certificate fingerprint. A different certificate is refused before the password is sent. Or require a CA-issued certificate.
Every SonicWall route is tenant-guarded; changes need write access to the firewall's location and are blocked for viewers. Company switches are admin-only and scoped to companies you can reach.
/api/sonicos/authsign in · always sign out/version · /reporting/status/systemidentity, uptime, connections; the Test call/reporting/high-availabilityHA mode and peer state/reporting/interfaces/ipv4/status · /macinterfaces, zones, MACs/reporting/tunnel-interfaces/vpn/statustunnel-interface VPN state/vpn/policies/ipv4/site-to-sitesite-to-site VPN policies/reporting/status/security-services · /firmware-updatelicences · SonicOS offered/access-rules/ipv4 · /security-policies/ipv4 · /nat-policies/ipv4the rule base (ledger)/reporting/log/view · /log/audit/view · /user/status/logged-in/allAccessAutomate, signed-in users/export/current-config/cliconfiguration backup| Area | Status |
|---|---|
| Identity, health, rules + ledger, config backups, AccessAutomate, VPNAutomate, firmware advisories, Workflow trigger | Built, unit-tested and installed; every part gated by the switches above. |
| HA, audit-log and signed-in-user replies; digest session security | Endpoint paths are SonicWall's own; their reply shapes are parsed defensively until seen on a real firewall. |
| Policy-based site-to-site VPNs | Listed with peer and subnets; SonicOS publishes no live-state call, so they show unknown, never down — watch a device behind the tunnel. |
| Firmware install | Never by SmartTile (it restarts the firewall). An engineer installs in the window; SmartTile reads the running version afterwards. |
| Objection | Answer |
|---|---|
| “You would have write access to our firewall.” | No. The administrator is in Read-Only Admins and every data call is a GET. Nothing commits or restarts. |
| “Is the password safe with you?” | Encrypted at rest, never shown back, never logged, sent only in the HTTPS Authorization header to the pinned certificate. |
| “Will a problem flood our ITSM system?” | No. Problems open once and close on recovery; Workflow events and firmware advisories are off until switched on, and advisories follow the company's firmware ticketing. |