Configuring Netflow with Extensions with SonicWall Scrutinizer

One external flow reporting option that works with Netflow with Extensions is the third-party collector, SonicWall Scrutinizer. This collector displays a range of reporting and analysis that is both Netflow and SonicWall-flow aware.

To verify your Netflow with Extensions reporting configurations

1. Click Settings.

2. In the Settings section, for Report Connections, select All.

   This step is optional, but is required if flow reporting is done on selected interfaces.

3. Click External Collector.

4. Click Send Flows and Real-Time Data To External Collector.

   When enabling this option, you might need to reboot the device to enable this feature completely.

5. Select IPFIX with extensions from the External Flow Reporting Format drop-down menu.
6. Specify the External Collector’s IP address in the provided field.

7. Optionally, if the external collector must be reached by a VPN tunnel, specify the source IP in the Source IP to Use for Collector on a VPN Tunnel field.

   This step is required if the external collector must be reached by a VPN tunnel.

8. Specify the External Collector’s UDP port number in the provided field. The default port is 2055.
9. Click Send Static AppFlow At Regular Interval.

10. Select the tables you wish to receive static flows for from the Send Dynamic AppFlow For Following Tables drop-down menu.

    Currently, Scrutinizer supports Applications and Threats only. Future versions of Plixer supports the following Static Flows: Location Map, Services, Rating Map, Table Map, and Column Map.

11. Click Generate Static AppFlow Data.
12. Click Accept.
13. Navigate to NETWORK > System > Interfaces.
14. Confirm that Flow Reporting is enabled per interface by clicking the Configure icon of the interface you are requesting data from. The Edit Interface dialog displays.
15. On the Advanced tab, ensure Enable flow reporting is selected.
16. Click OK.
17. Log in to SonicWall Scrutinizer. The data displays within minutes.