• SonicOS 7.1
• About SonicOS
  • Working with SonicOS
  • SonicOS Workflow
  • How to Use the SonicOS Administration Guides
  • Guide Conventions
• About Device
  • Device AppFlow
• Flow Reporting
  • Statistics
    • External Flow Reporting Statistics
    • Internal AppFlow Reporting Statistics
    • Total IPFIX Statistics
  • Settings
    • Settings Configuration
    • Local Server Settings
    • Other Report Settings
  • AppFlow Agent
  • External Collector
  • SFR Mailing
    • SFR Email Settings
    • Scheduling SFR Reports by Email
      • Scheduling One-Time Delivery of the SFR
      • Scheduling Recurring Delivery of the SFR
      • Deleting Scheduled Reports
  • NetFlow Activation and Deployment Information
  • User Configuration Tasks
    • Configuring NetFlow Version 5
    • Configuring NetFlow Version 9
    • Configuring IPFIX (NetFlow Version 10)
    • Configuring IPFIX with Extensions
    • Configuring AppFlow Agent to Include Logs Through IPFIX
    • Configuring Netflow with Extensions with SonicWall Scrutinizer
  • NetFlow Tables
    • Static Tables
    • Dynamic Tables
    • Templates
      • NetFlow Version 5
      • NetFlow Version 9
      • IPFIX (NetFlow Version 10)
      • IPFIX with Extensions
• AppFlow Agent
  • Connecting to an AppFlow Agent
    • Basic Mode
    • Advanced Mode
  • Use cases
• SonicWall Support
  • About This Document

AppFlow Agent

This screen allows you to send AppFlow and Real-time data to an AppFlow Agent. AppFlow Agents are SonicWall Flow Analytics, GMS, or NSM.

• Send AppFlow to SonicWall AppFlow Agent – The SonicWall appliance sends AppFlow data through IPFIX to a SonicWall AppFlow Agent. This option is not enabled by default.
• If this option is disabled, the SonicWall AppFlow Agent does not show AppFlow Monitor, AppFlow Report, and AppFlow Dashboard charts on the AppFlow Agent or through redirection of another SonicWall appliance.
• When enabling/disabling this option, you might need to reboot the device to enable/disable this feature completely.
• Send Real-Time Data to SonicWall AppFlow Agent – The SonicWall appliance sends real-time data through IPFIX to the SonicWall AppFlow Agent. This option is disabled by default.
• If this option is disabled, the SonicWall AppFlow Agent does not display real-time charts on the AppFlow Agent or through redirection on a SonicWall appliance.
• Send System Logs to SonicWall AppFlow Agent – The SonicWall firewall sends system logs through IPFIX to the SonicWall AppFlow Agent. This option is not selected by default.
• Report on Connection OPEN – The SonicWall appliance reports when a new connection is opened. All associated data related to that connection might not be available when the connection is opened. This option enables flows to show up on the AppFlow Agent as soon as a new connection is opened. This option is disabled by default.
• Report on Connection CLOSE – The SonicWall appliance reports when a new connection is closed. This is the most efficient way of reporting flows to the AppFlow Agent. All associated data related to that connection are available and reported. This option is enabled by default.
• AppFlow Reporting Format – Select either IPFIX with Extension or IPFIX with Extension v2.
• Report Connections on Following Updates – The firewall reports when a specified update occurs. Select the updates from the drop-down menu. By default, no update is selected.
  • Threat detection
  • Application detection
  • User detection
  • VPN tunnel detection
  • URL detection
• Send Dynamic AppFlow For Following Tables – The firewall sends data for the selected tables. By default, all the tables are selected.
  • Connections
  • Users
  • URLs
  • URL ratings
  • VPNs
  • Devices
  • SPAMs
  • Locations
  • VOIPs
• In IPFIX with extension mode, the firewall can generate reports for selected tables. As the firewall does not cache this data, some of the flows not sent could create failures when correlating flows with other related data.