• SonicOS 7.1
• About SonicOS
  • Working with SonicOS
  • SonicOS Workflow
  • How to Use the SonicOS Administration Guides
  • Guide Conventions
• About Device
  • Device AppFlow
• Flow Reporting
  • Statistics
    • External Flow Reporting Statistics
    • Internal AppFlow Reporting Statistics
    • Total IPFIX Statistics
  • Settings
    • Settings Configuration
    • Local Server Settings
    • Other Report Settings
  • AppFlow Agent
  • External Collector
  • SFR Mailing
    • SFR Email Settings
    • Scheduling SFR Reports by Email
      • Scheduling One-Time Delivery of the SFR
      • Scheduling Recurring Delivery of the SFR
      • Deleting Scheduled Reports
  • NetFlow Activation and Deployment Information
  • User Configuration Tasks
    • Configuring NetFlow Version 5
    • Configuring NetFlow Version 9
    • Configuring IPFIX (NetFlow Version 10)
    • Configuring IPFIX with Extensions
    • Configuring AppFlow Agent to Include Logs Through IPFIX
    • Configuring Netflow with Extensions with SonicWall Scrutinizer
  • NetFlow Tables
    • Static Tables
    • Dynamic Tables
    • Templates
      • NetFlow Version 5
      • NetFlow Version 9
      • IPFIX (NetFlow Version 10)
      • IPFIX with Extensions
• AppFlow Agent
  • Connecting to an AppFlow Agent
    • Basic Mode
    • Advanced Mode
  • Use cases
• SonicWall Support
  • About This Document

Connecting to an AppFlow Agent

The DEVICE | AppFlow > AppFlow Agent page enables you to establish a connection to a AppFlow Agent.

The AppFlow Agent role can be used in a distributed deployment. In this role, the AppFlow Agent runs a single service that collects SonicWall Flows on the default ports.

The single service that runs in this role is SonicWall Universal Management Suite - Flow Server. The flows are collected and stored in internal databases. To create reports out of these flows, you must have an AppFlow Agent in deployment, and set with the role of Console or All in One. You also need to ensure that these ports are open:

• UDP 2055
• UDP 5055
• TCP 9063
• TCP 9064
• TCP 9065
• TCP 9066
• TCP 9067

The AppFlow Agent has a fixed Syslog Facility (Local Use 0), Syslog Format (Default), and Server ID (firewall). Although the Event Profile value for the AppFlow Agent is set to 0 by default, all events are reported to your AppFlow Agent regardless of the profile. The AppFlow Agent is also exempted from Rate Limiting. AppFlow Agents can be enabled/disabled only in the Advanced Management section of the DEVICE | AppFlow > Flow Reporting | Settings page and not in the DEVICE | Log > Syslog page.

• Basic Mode
• Advanced Mode