• SonicOS 7.1
• About SonicOS
  • Working with SonicOS
  • SonicOS Workflow
  • How to Use the SonicOS Administration Guides
  • Guide Conventions
• About Device
  • Device AppFlow
• Flow Reporting
  • Statistics
    • External Flow Reporting Statistics
    • Internal AppFlow Reporting Statistics
    • Total IPFIX Statistics
  • Settings
    • Settings Configuration
    • Local Server Settings
    • Other Report Settings
  • AppFlow Agent
  • External Collector
  • SFR Mailing
    • SFR Email Settings
    • Scheduling SFR Reports by Email
      • Scheduling One-Time Delivery of the SFR
      • Scheduling Recurring Delivery of the SFR
      • Deleting Scheduled Reports
  • NetFlow Activation and Deployment Information
  • User Configuration Tasks
    • Configuring NetFlow Version 5
    • Configuring NetFlow Version 9
    • Configuring IPFIX (NetFlow Version 10)
    • Configuring IPFIX with Extensions
    • Configuring AppFlow Agent to Include Logs Through IPFIX
    • Configuring Netflow with Extensions with SonicWall Scrutinizer
  • NetFlow Tables
    • Static Tables
    • Dynamic Tables
    • Templates
      • NetFlow Version 5
      • NetFlow Version 9
      • IPFIX (NetFlow Version 10)
      • IPFIX with Extensions
• AppFlow Agent
  • Connecting to an AppFlow Agent
    • Basic Mode
    • Advanced Mode
  • Use cases
• SonicWall Support
  • About This Document

AppFlow Agent

This enables sending AppFlow and Real-Time data to the AppFlow Agent. An AppFlow Agent can either be a SonicWall Flow Analytics, GMS or NSM.

To send AppFlow and Real-Time data to your AppFlow Agent

1. Navigate to DEVICE > AppFlow > AppFlow Agent.

   

2. For AppFlow Agent Configuration Mode, select either Basic or Advanced modes. When Advanced is selected, additional Advanced Configuration options become available to configure alternate flow server and advanced flow settings.
3. For Auto-Synchronize AppFlow Agent, the AppFlow Agent needs static data from the firewall before it can display it on the AppFlow Monitor, AppFlow Report, and AppFlow Dashboard. By enabling this checkbox, the firewall automatically synchronizes data to the AppFlow Agent.
4. For Advanced Flow Server Config Mode, using Active Standby mode, flows are directed to AppFlow Agent 1 (when AppFlow Agent 1 is Up). When AppFlow Agent 1 is Down, and when AppFlow Agent 2 is Up, then the flows are directed to AppFlow Agent 2. In Load Balancing mode, you are able to select between Load Balancing Modes; Mirror and Share-Load. These radio buttons are enabled only when Load Balancing mode is selected. When Share-Load is selected and both flow servers are Up, the flows are divided equally amongst the two AppFlow Agent. When mirroring is selected, all the flows are sent to both the flow servers.
5. Under the AppFlow Agent Address option IP, the device sends AppFlows and real-time data to the specified IP address/address object. If AppFlow Agent is reachable through a VPN tunnel, then you can specify the source IP to use for the VPN tunnel. Note that the AddrObj address object can only be of type Host or FQDN.
6. For the Source IP to use over VPN Tunnel option, when the AppFlow Agent is reachable through the VPN tunnel, you can specify that IP here. Choose an IP from the VPN policy.
7. Use Server Communication Timeout to redirect data to the Dashboard. From the SonicWall firewall GUI, Dashboard data can be pulled from the AppFlow Agent. A Timeout specified is a number of seconds to wait before failing when the data has been fetched from the AppFlow Agent. The minimum value is 60, maximum value is 120 and default value is 60.
8. Test Connectivity connects to the AppFlow Agent and gathers registration information, image versions, and counters.
9. Static data can be sent manually to the AppFlow Agent using the Synchronize Server option. This can only be done one time after starting of the AppFlow Agent and registering with the firewall.
10. Synchronize Log Settings sends the necessary fields of log settings to the AppFlow Agent for log display.