User manual SONICWALL SONICOS 5.8 NETFLOW REPORTING FEATURE MODULE REV A

[. . . ] NetFlow Reporting Document Scope Rapid growth of IP networks has created interest in new business applications and services. These new services have resulted in increases in demand for network bandwidth, performance, and predictable quality of service as well as VoIP, multimedia and security oriented network services. Simultaneously, the need has emerged for measurement technology to support this growth by efficiently providing the information required to record network and application resource utilization. NetFlow provides solutions for each of these challenges. [. . . ] Report Flows on User Detection--Enable this to report flows specific to users. The SonicWALL appliance associates flows to a user-based detection based on its login credentials. Once identified, the flow is reported again. Report Flows on VPN Tunnel Detection--Enable this to report flows sent through the VPN tunnel. Once flows sent over the VPN tunnel are identified, the flow is reported again. Report Flows on Kilo BYTES exchanged--Enable this to report flows based on a specific number of traffic, in kilobytes, is exchanged. This option is ideal for flows that are active for a long time and need to be monitored. ­ Kilobytes exchanged--When the above option is enabled, specify the number of kilobytes · · · exchanged to be reported. ­ Report Once--When the Report Flows on Kilo BYTES exchanged option is enabled, enabling this option will send the report only once. Leave it unselected if you want reports sent periodically. · · · Report Flows on Connection CLOSED--Enable this to report flows when the Connection is closed. Report DROPPED Flows--Enable this to report dropped flows. This applies to flows that are dropped due to firewall rules. Skip Reporting of STACK Flows (connections)--Enable this to skip the reporting of STACK flows for connections. Note that all flows as a result of traffic initiated or terminated by the firewall itself are considered stack traffic. Include following URL types--Select the type of URLS to be generated into a flow. Values include: Gifs, Jpegs, Pngs, Js, Xmls, Jsons, Css, Htmls, Aspx, and Cms. Note: This option is applies to both App Flow (internal) and external reporting when used with IPFIX with extensions. · SonicOS 5. 8 NetFlow Reporting Feature Guide 11 User Configuration Tasks User Configuration Tasks Depending on the type of flows you are collecting, you will need to determine which type of reporting will work best with your setup and configuration. This section includes configuration examples for each supported NetFlow solution, as well as configuring a second appliance to act as a collector. · · · · "NetFlow version 5 Configuration Procedures" section on page 12 "NetFlow version 9 Configuration Procedures" section on page 13 "IPFIX (NetFlow version 10) Configuration Procedures" section on page 14 "IPFIX with Extensions Configuration Procedures" section on page 15 NetFlow version 5 Configuration Procedures To configure typical Netflow version 5 flow reporting, follow the steps listed below. Step 1 Step 2 Select the checkbox to Enable flow reporting. Note that if this is disabled, both internal and external flow reporting are also disabled. Select the Report to EXTERNAL flow collector checkbox to enable flows to be reported to an external flow collector. Note that you may enable this option if you prefer to receive external flows, rather than the SonicWALL visualization. Remember, not all collectors will work with all modes of flow reporting. Enable INTERFACE based reporting by selecting the checkbox. Once enabled, the flows reported are based on the initiator or responder interface. [. . . ] You can perform a Diagnostic Report of your own Netflow Configuration by navigating to the System > Diagnostics screen, and click the Download Report button in the "Tech Support Report" section. 20 Appendix NetFlow version 5 The NetFlow version 5 datagram consists of a header and one or more flow records, using UDP to send export datagrams. The first field of the header contains the version number of the export datagram. The second field in the header contains the number of records in the datagram, which can be used to search through the records. Because NetFlow version 5 is a fixed datagram, no templates are available, and will follow the format of the tables listed below. [. . . ]