• SonicOS 7.1
• About SonicOS
  • Working with SonicOS
  • SonicOS Workflow
  • How to Use the SonicOS Administration Guides
  • Guide Conventions
• About Device
  • Device AppFlow
• Flow Reporting
  • Statistics
    • External Flow Reporting Statistics
    • Internal AppFlow Reporting Statistics
    • Total IPFIX Statistics
  • Settings
    • Settings Configuration
    • Local Server Settings
    • Other Report Settings
  • AppFlow Agent
  • External Collector
  • SFR Mailing
    • SFR Email Settings
    • Scheduling SFR Reports by Email
      • Scheduling One-Time Delivery of the SFR
      • Scheduling Recurring Delivery of the SFR
      • Deleting Scheduled Reports
  • NetFlow Activation and Deployment Information
  • User Configuration Tasks
    • Configuring NetFlow Version 5
    • Configuring NetFlow Version 9
    • Configuring IPFIX (NetFlow Version 10)
    • Configuring IPFIX with Extensions
    • Configuring AppFlow Agent to Include Logs Through IPFIX
    • Configuring Netflow with Extensions with SonicWall Scrutinizer
  • NetFlow Tables
    • Static Tables
    • Dynamic Tables
    • Templates
      • NetFlow Version 5
      • NetFlow Version 9
      • IPFIX (NetFlow Version 10)
      • IPFIX with Extensions
• AppFlow Agent
  • Connecting to an AppFlow Agent
    • Basic Mode
    • Advanced Mode
  • Use cases
• SonicWall Support
  • About This Document

Configuring Netflow with Extensions with SonicWall Scrutinizer

One external flow reporting option that works with Netflow with Extensions is the third-party collector, SonicWall Scrutinizer. This collector displays a range of reporting and analysis that is both Netflow and SonicWall-flow aware.

To verify your Netflow with Extensions reporting configurations

1. Click Settings.

2. In the Settings section, for Report Connections, select All.

   This step is optional, but is required if flow reporting is done on selected interfaces.

3. Click External Collector.

4. Click Send Flows and Real-Time Data To External Collector.

   When enabling this option, you might need to reboot the device to enable this feature completely.

5. Select IPFIX with extensions from the External Flow Reporting Format drop-down menu.
6. Specify the External Collector’s IP address in the provided field.

7. Optionally, if the external collector must be reached by a VPN tunnel, specify the source IP in the Source IP to Use for Collector on a VPN Tunnel field.

   This step is required if the external collector must be reached by a VPN tunnel.

8. Specify the External Collector’s UDP port number in the provided field. The default port is 2055.
9. Click Send Static AppFlow At Regular Interval.

10. Select the tables you wish to receive static flows for from the Send Dynamic AppFlow For Following Tables drop-down menu.

    Currently, Scrutinizer supports Applications and Threats only. Future versions of Plixer supports the following Static Flows: Location Map, Services, Rating Map, Table Map, and Column Map.

11. Click Generate Static AppFlow Data.
12. Click Accept.
13. Navigate to NETWORK > System > Interfaces.
14. Confirm that Flow Reporting is enabled per interface by clicking the Configure icon of the interface you are requesting data from. The Edit Interface dialog displays.
15. On the Advanced tab, ensure Enable flow reporting is selected.
16. Click OK.
17. Log in to SonicWall Scrutinizer. The data displays within minutes.