Firewall reporting – licensing

Firewall reporting – licensing shows how your firewall reporting licenses are allocated to each firewall.

Restriction These options may not be available for all users.
To view Firewall reporting – licensing:
  1. Click your account name (upper right of the user interface) and select Licensing.
  2. In the License Details table, for firewall reporting licenses, click Manage.

Each license represents a specific amount of storage capacity in Sophos Central. This storage is used to store the data for generating reports. When the capacity has been reached, the oldest data is no longer stored. Data is deleted on a first-in, first-out basis. The amount of time for which data is available depends on the incoming volume of data and licensed capacity. A license also gives you access to advanced firewall reporting features.

Note High availability (HA) pairs share Central Firewall Reporting licenses. A HA pair is treated as a single logical device for reporting purposes.

Summary

The summary above the table shows the following:

  • Licenses used / available. The number of firewall reporting licenses you are using as a proportion of the number you have. Each license allows you a specific amount of storage capacity. You can have one or more per firewall.
  • Firewall reporting expiration date. The date on which the firewall reporting licenses expire.

Firewall table

The firewall table shows each firewall with the number of licenses allocated to it and its usage. The columns include the following:

  • Central Storage Used. The amount of storage used as a proportion of the amount made available by the licenses.
  • Allocate Licenses. The number of licenses that are allocated to the firewall. You can click the plus and minus buttons to adjust the number and, therefore, the total storage. The number of licenses that you can allocate depends on the firewall model. For example, you can allocate more licenses to a more advanced firewall. Click Save to save any changes that you make to the allocation of licenses for one or more firewalls. Similarly, click Cancel to cancel all changes that you have made to license allocation.
  • Estimated Storage. An estimate of how long your total storage will last. When you click the plus button to increase the number of licenses, an estimate of the additional time it will take to use up the total storage is shown in green. When you click the minus button to decrease the number of licenses, an estimate of how much less time is shown in red.
  • Oldest Saved Data. The date of the oldest data record for the firewall.
  • Tier. Firewall reporting licensing is divided into two tiers:
    • Central Firewall Reporting, which is shown in the table as a dash. Reporting on your firewall is free. However, if you do not buy any reporting licenses for a firewall, you have only a small amount of storage, which varies according to the firewall model. You can store data for up to seven days. After this, the oldest data is no longer stored. Data is deleted on a first-in, first-out basis.
    • Advanced. If you do buy reporting licenses, you have more storage, which varies according to the firewall model. In addition, you can store data for up to 365 days before it is deleted.
  • Actions. Click the ellipsis button (…) to manage your storage and licenses. You can perform the following actions:
    • Associate licenses and data with replacement device. If you have a firewall that has licenses allocated to it and you want to deactivate it, select this and choose which firewall you want to transfer the licenses to. The licenses are transferred and the two firewalls are shown in the table as a single cluster. To view each firewall and its data usage, click the arrow to the left of the cluster to expand it. You cannot transfer licenses from a cluster, only from an individual firewall.
    • Reclaim all licenses (convert to free). If you have a firewall that has licenses allocated to it and you want to use these licenses for another firewall, select this. The licenses are returned to the central license pool and the firewall’s Tier status changes to a dash. If the firewall is in a cluster, you cannot select this option from the firewall itself. You can only select the option from the cluster.
    • Delete log data. If you have a firewall that you want to deactivate, select this to delete all the data that is stored for that firewall. If the firewall is in a cluster, you cannot select this option from the firewall itself. You can only select the option from the cluster and this deletes all the data that is stored for all firewalls in the cluster.
  • HA Status. In the nested table that is displayed when you expand a firewall cluster, the HA Status column shows whether the cluster is a high-availability cluster.

As well as individual firewalls, the table may also show clusters of firewalls. These are indicated by an arrow to the left of them in the table. Click this to expand the cluster. There are two types of cluster:

  • A high-availability cluster includes two firewalls that are configured to provide continuous protection. If one firewall has a problem, the other can take over.
  • A cluster that includes one or more deactivated firewalls and an active firewall. If you want to deactivate a firewall, perhaps because it is faulty, you can transfer its licenses to a working firewall. The licenses are transferred and the two firewalls are shown in the table as a single cluster.

In each case, the licenses that you allocate to the cluster are shared between the firewalls in the cluster, and the data usage of each firewall is aggregated to a single figure for the cluster.