NSM - Never used - should i?
MPERU99
Newbie ✭
I have not used NSM, but recently purchasing agent purchased NSM without discussing with me, after reading several of the community complaints I do not feel comfortable enabling NSM on our main production firewall. Things like Login loops, rebooting, X1 only issues. just to name a few are red flags. Lots of comments on its not mature enough.
I feel this like this product is a disaster, and should I even attempt it. Personally I don't mind managing it locally. I grew up in that era and just been a part of my life. Cloud has its place but not sure managing production firewalls is one of them. My worry / concern is some of the things that have been reported and even recently (Jun 2021) so that is pretty recent. I have a couple of TZ350s that i could do a trial on.
It seems the general census is DO NOT USE IT.
Best Answers
-
CORRECT ANSWER
Larry
All-Knowing Sage ✭✭✭✭
My view on NSM is simple (and I've posted enough rants to warrant advice to tone it down): If you manage only a handful of devices, and have no requirement for any analytics, there is simply no need to use this product. However, if you have a large, dispersed fleet - either at one client site or multiple sites - then it might be a time-saving offering for overall management.
But, if you want to use it, you'll have to realize that it is a product that was released without full functionality. It is being built on a continual basis. This means that features that either aren't present may (or may not) be on a roadmap. Broken items have unknown fix dates only in future releases (it seems there's no such thing as a "hot fix" for the cloud). For example: Capture ATP reporting for licensed AGSS devices hasn't been available in the NSM Dashboard since it was released. Supposedly it will arrive by the end of June 2021 with 2.3.x.
So, if you can live with that kind of uncertainty, go ahead. Otherwise, there is no need to spend your clients' money.
1 -
CORRECT ANSWER
TKWITS
Community Legend ✭✭✭✭✭
I agree with Larry's comments. I have a handful of firewalls on NSM and barely touch it. Most of these devices I have access to either via a server local to the firewall or its direct WAN interface.
I had used their pre-cloud GSM years ago and found it lacking. Analytics was a big reason we tried NSM and as mentioned it's not quite there yet.
I can totally see NSM use for a distributed helpdesk that covers a large geographical footprint with a mix of ISPs. I do not advocate for cellular connectivity, but NSM could be the best way to manage firewalls on cell services (because otherwise you are stuck behind carrier-grade NAT and not able to manage directly remotely).
I really dislike agile development (I call it fr-agile) and thats what SW's latest offerings are.
2 -
CORRECT ANSWERmontanadave
Newbie ✭
Flat out answer: NO.
They release things without proper testing, training, nor support. Save yourself a ton of headaches and wait a year.
Try applying a template to a firewall. The template "engine" doesn't pull in newly created zones so you can't use them in the rest of the config. Try changing the time to log out as admin due to inactivity (default is 5 min). The template won't save and throws an error.
I've spent hours configuring a template to see only portions of it apply to a firewall.
Love the direction SNWL is going but they seem to be more concerned about moving forward than getting stuff to work.
And when it comes to their switches, make sure they are cloud managed and not managed by firewall if you are using VLAN's amongst wired and wireless clients. Firewall managed switches and WAP's have issues -- cloud management all the way.
The amount of hours I have spent with support is ridiculous. No one knows the product suite including support.
Keep it simple and stick to the basic functionality and strength of the firewall. NSM isn't ready.
0
Answers
Ya I only have like 5 production office firewalls, 3 production remote user firewalls and 2 non production TZ350 (lab) firewalls to play with. So basically a handful , definitely not a fleet , I dont even use CSC on any of them. I have only known how to maintain locally ( I kind of prefer that anyhow.) and for the kind of management I want to do, you still cannot do under the cloud based. Like exporting all the IPs out of one firewall and importing them into another firewall.. using the simple GUI. and no not using the CLI either. what the point of the CLI when i can copy and paste faster using the GUI, the CLI offers no efficiency and I spend more time struggling on how to use the CLI then actually getting anything done. I have complained about this lack of simple useful export of IPs for a while. Its sad that so many other firewalls can do this and yet sonicwall cannot.
Larry, thanks for you input, it is valued, I appreciate someone with more experience reaching out and providing a lighted path, so that others do not fall into the darkness of the unknown.
One of our most used features on sonicwall is the Public Server / NAT config wizard. My very first experience with using NSM was to click on the wizard and discover that the Public Server wizard is missing. All the other wizards are there though?! This seems kind of crazy. I then found this on their FAQ, so much for NSM making our life easier, sigh:
https://www.sonicwall.com/support/knowledge-base/sonicwall-network-security-manager-nsm-faq/200803090636870/
This a roadmap feature under consideration. This feature will have wizards to create large scale VPNs and SDWAN, etcetera.
Here's my 2 cents as someone in IT that's only worked with Sonicwall firewalls at my company and now I'm using NSM, deployed at the beginning of 2021.... the product looks very nice and it would be awesome if it actually worked, but it doesn't.
Issues I've had:
I could probably keep going but that is the most common issues I've been having
@lostbackups - just to clear up this statement:
When you call into get NSM support, they always ask for the serial number, which the cloud hosted NSM doesn't even have a serial number so you have to give them the firewall unit serial, so then the ticket gets placed in the support queue for that firewall support category and not NSM. So when you call back you always get stuck in that loop of talking to the wrong person.
If you log into your MySonicWall account, select your Tenant, then My Products, and click on the firewall's serial number, a details window appears on the right-hand side. Scrolling down that window reveals the Cloud Management section, which contains the NSM serial number. That is the one to use when calling in for support.
Now, I'd much prefer the Support dialog let us identify the firewall, select whether it is a hardware or cloud issue, thus pulling the appropriate information directly from MSW, but that's not going to happen anytime soon.
My original question was left back in June , I still have not gone to NSM and frankly we are looking for a replacement Firewall, the fact that it is 2021 and you cannot export or import IP address / FQDN from the gui is absurd to say the least. Support is lacking very few i speak with actually know what they are doing or even care to listen to the exact issue(s) I been playing with PFsense but its interface and the intuitiveness is a zombie apocalypse and have YET to be able to make a site to site connection regardless of all the claims it can be done. I think Sonicwall is the only firewall that allows you to make multiple network path connections under 1 site to site tunnel , and that is our dilemma, hindered by the way sonicwall was initially setup when i inherited it.
So NSM is still garbage and has no purpose that i can see for our small setup.
@MPERU99 NSM Version 2.3.2-R8 was released on October 10, 2021. Several significant problems have been resolved with this release.
However, if you are disheartened with SonicWall appliances and their implementation, I suggest taking a look at Fortinet's appliances. They may solve the situation(s) you face.
Four months since my last comment and I agree with Larry that NSM (with firewalls on the latest firmware release) has significantly improved. It's not perfect, but improved.
For 'small' setups it's probably useless. For MSPs or medium to large helpdesks it can be very useful compared to direct management.
I guess I don't get why people make a fuss about exporting / importing objects. On that note there are 'global' objects in NSM that you can apply across multiple firewalls and a now functional template system, so thats something...
And four months ago I was overly optimistic:
Capture ATP reporting for licensed AGSS devices hasn't been available in the NSM Dashboard since it was released. Supposedly it will arrive by the end of June 2021 with 2.3.x.
This is a significantly harder effort than was originally thought.
Now, with the imminent arrival of the "Unified Insight" dashboard in CSC 3.x, I'm not sure if it is going to appear sooner (say early 2022) or be delayed longer (into 2023).
Coming back to this discussion in February 2022. (And posted in the Partners community earlier today.)
NSM is now on Version 2.3.3-Hotfix 1 (imagine, a hotfix for a cloud product!).
Support cases I opened throughout 2021 are still being worked on with no end in sight. This, despite having biweekly meetings with NSM project management and staff during the summer months. And with more frequent use, I'm finding new problems with each and every passing day.
I am - at the start of the year - exhausted by the sheer amount of time sucked out of me to document the problems in Support Cases, demonstrate those problems in hour-long remote sessions to CSRs who don't seem to get it, and then have to deal with follow-up emails from those CSRs who insist upon obtaining firewall EXPs, TSRs, and Trace Logs for a cloud-based product.
My conclusion, after making on-going attempts for one year: There is no "value add" to my business from using this product offering.
Despite the marketing, I cannot globally administer my devices. Despite the documentation, I cannot easily and quickly create the necessary templates for Address Objects. I cannot - and this is new - download logs that are stored in the cloud. This has just turned into a huge waste of my time. It is easier - and significantly faster - to tend to the devices one at a time and even repeat keystrokes.
Effective June 1, I will change the setting for "Managed by" and return all devices to "on box." I will let all NSM Advanced licenses lapse, and eliminate the monthly line item on my client's invoices.
Sad that it came to this, but relieved at how much more time I'll have to tend to my business and market to new prospects.
Hi Larry thanks for all the updates. that sounds like NSM Cloud is in beta state.
Hopefully the NSM on-prem version is better.
Since GMS seems to not get any further updates and we need to do analytics this feels like we shall look out for another next generation firewall solution for 2023
Ah NSM... Considering I haven't even logged in to it since the last Sonicwall deployment I did in August, and Larrys latest update, I'll stand by what I said in my last post.
"For 'small' setups it's probably useless. For MSPs or medium to large helpdesks it can be very useful compared to direct management."
Note I didn't mention anything about reporting or any of the other promised features.
I have decided not to use NSM, waste of money for only 5 firewalls. I can just copy paste what i need to do. , I still just cannot believe its 2022 and you still cannot export Address objects out of one firewall and import them into another.. its mind boggling this hasnt been available.
I never liked the idea of cloud control anyways, ON prem is what i prefer.
From a personal stand point I no longer use sonicwall, Untangle is my weapon against cyberattacks, the fact i can export every single item, I can create tags for just about anything and trigger rules off those tags. very useful for seperating devices in the house, that are mine vs kids, the ease of setting a tag on a kids device and that tag tells what profile to use (consisting of content filtering, app control, firewall, antivirus, etc..) and do so much more. easily.
and the price.. you just cannot beat it. $50 for a year for personal license that includes IPSEC site to site capabilities
Hi All,
Thanks for your feedback.
I've been following this discussion and have flagged it with our Product Management team for their consideration. The SonicWall Community does have Product Ideas on our roadmap, wherein your feedback will be more streamlined and actionable.
Let me know if you have any questions.