Firewall reporting – licensing
Firewall reporting – licensing shows how your firewall reporting licenses are allocated to each firewall.
These options may not be available for all users.
To view Firewall reporting – licensing:
- Click your account name (upper right of the user interface) and select Licensing.
- In the License Details table, for firewall reporting licenses, click Manage.
Each license represents a specific amount of storage capacity in Sophos Central. This storage is used to store the data for generating reports. When the capacity has been reached, the oldest data is no longer stored. Data is deleted on a first-in, first-out basis. The amount of time for which data is available depends on the incoming volume of data and licensed capacity. A license also gives you access to advanced firewall reporting features.
There are three types of license:
- Central Firewall Reporting: Reporting on your firewall is free. However, if you don't buy any reporting licenses for a firewall, you only have a small amount of storage, which varies according to the firewall model.
- Advanced (regular): This is a paid license. One license represents a storage unit of 100GB.
- Advanced (MSP): This is a paid license. One license represents a storage unit of 25GB.
High availability (HA) pairs share Central Firewall Reporting licenses. A HA pair is treated as a single logical device for reporting purposes.
The summary above the table shows the following:
- For Advanced (regular) you see can see the number of firewall reporting licenses you're using and how many are available. Each license allows you a specific amount of storage capacity. You see the storage capacity given by one license. You can have one or more licenses per firewall. You can also see the expiration date for your firewall reporting licenses.
- For Advanced (MSP), you see how many licenses you have and the size of one license.
The firewall table shows each firewall with the number of licenses allocated to it and its usage. The columns include the following:
- Central Storage Used. The amount of storage used as a proportion of the amount made available by the licenses.
- Allocate Licenses. The number of licenses that are allocated to the firewall. You can click the plus and minus buttons to adjust the number and, therefore, the total storage. The number of licenses that you can allocate depends on the firewall model. For example, you can allocate more licenses to a more advanced firewall. Click Save to save any changes that you make to the allocation of licenses for one or more firewalls. Similarly, click Cancel to cancel all changes that you have made to license allocation.
- Storage Period. An estimate of how long your total storage will last. When you click the plus button to increase the number of licenses, an estimate of the additional time it will take to use up the total storage is shown in green. When you click the minus button to decrease the number of licenses, an estimate of how much less time is shown in red.
- Oldest Stored Data. The date of the oldest data record for the firewall.
- License Type. Firewall reporting licensing is divided into two tiers, Central Firewall Reporting and Advanced. These are shown in the table as follows:
- Central Firewall Reporting licenses are shown in the table as a dash. With this type of license, you can store data for up to seven days. After this, the oldest data is no longer stored. Data is deleted on a first-in, first-out basis.
- Advanced licenses are shown in the table as Advanced. With this type of license, you can store data for up to 365 days before it is deleted.
- Actions. Click the ellipsis button (…) to manage your storage and licenses. You can perform the following actions:
- Associate licenses and data with replacement device. If you have a firewall that has licenses allocated to it and you want to deactivate it, select this and choose which firewall you want to transfer the licenses to. The licenses are transferred and the two firewalls are shown in the table as a single cluster. To view each firewall and its data usage, click the arrow to the left of the cluster to expand it. You cannot transfer licenses from a cluster, only from an individual firewall.
- Reclaim all licenses (convert to basic). If you have a firewall that has licenses allocated to it and you want to use these licenses for another firewall, select this. The licenses are returned to the central license pool and the firewall’s License Type status changes to a dash. If the firewall is in a cluster, you cannot select this option from the firewall itself. You can only select the option from the cluster.
- Delete log data. If you have a firewall that you want to deactivate, select this to delete all the data that is stored for that firewall. If the firewall is in a cluster, you cannot select this option from the firewall itself. You can only select the option from the cluster and this deletes all the data that is stored for all firewalls in the cluster.
- HA Status. In the nested table that is displayed when you expand a firewall cluster, the HA Status column shows whether the cluster is a high-availability cluster.
As well as individual firewalls, the table may also show clusters of firewalls. These are indicated by an arrow to the left of them in the table. Click this to expand the cluster. There are two types of cluster:
- A high-availability cluster includes two firewalls that are configured to provide continuous protection. If one firewall has a problem, the other can take over.
- A cluster that includes one or more deactivated firewalls and an active firewall. If you want to deactivate a firewall, perhaps because it is faulty, you can transfer its licenses to a working firewall. The licenses are transferred and the two firewalls are shown in the table as a single cluster.
In each case, the licenses that you allocate to the cluster are shared between the firewalls in the cluster, and the data usage of each firewall is aggregated to a single figure for the cluster.