User manual SONICWALL SONICOS 5.8 NETFLOW REPORTING FEATURE MODULE REV A

[. . . ] NetFlow Reporting Document Scope Rapid growth of IP networks has created interest in new business applications and services. These new services have resulted in increases in demand for network bandwidth, performance, and predictable quality of service as well as VoIP, multimedia and security oriented network services. Simultaneously, the need has emerged for measurement technology to support this growth by efficiently providing the information required to record network and application resource utilization. This SonicOS 5. 8. 0 feature module guide provides an overview of NetFlow benefits and includes technical overview of features, details about the NetFlow cache, export formats and NetFlow operation. [. . . ] Report Flows on Application Detection--Enable this to report flows specific to applications. Upon performing a deep packet inspection, the SonicWALL appliance is able to detect if a flow is part of a certain application. Report Flows on User Detection--Enable this to report flows specific to users. The SonicWALL appliance associates flows to a user-based detection based on its login credentials. Report Flows on VPN Tunnel Detection--Enable this to report flows sent through the VPN tunnel. Once flows sent over the VPN tunnel are identified, the flow is reported again. Report Flows on Kilo BYTES exchanged--Enable this to report flows based on a specific number of traffic, in kilobytes, is exchanged. This option is ideal for flows that are active for a long time and need to be monitored. ­ Kilobytes exchanged--When the above option is enabled, specify the number of kilobytes · · · exchanged to be reported. ­ Report Once--When the Report Flows on Kilo BYTES exchanged option is enabled, enabling this option will send the report only once. Leave it unselected if you want reports sent periodically. · · · Report Flows on Connection CLOSED--Enable this to report flows when the Connection is closed. Skip Reporting of STACK Flows (connections)--Enable this to skip the reporting of STACK flows for connections. Note that all flows as a result of traffic initiated or terminated by the firewall itself are considered stack traffic. Include following URL types--Select the type of URLS to be generated into a flow. Values include: Gifs, Jpegs, Pngs, Js, Xmls, Jsons, Css, Htmls, Aspx, and Cms. Note: This option is applies to both App Flow (internal) and external reporting when used with IPFIX with extensions. · SonicOS 5. 8 NetFlow Reporting Feature Guide 11 User Configuration Tasks User Configuration Tasks Depending on the type of flows you are collecting, you will need to determine which type of reporting will work best with your setup and configuration. This section includes configuration examples for each supported NetFlow solution, as well as configuring a second appliance to act as a collector. · · · · "NetFlow version 5 Configuration Procedures" section on page 12 "NetFlow version 9 Configuration Procedures" section on page 13 "IPFIX (NetFlow version 10) Configuration Procedures" section on page 14 "IPFIX with Extensions Configuration Procedures" section on page 15 NetFlow version 5 Configuration Procedures To configure typical Netflow version 5 flow reporting, follow the steps listed below. Step 1 Step 2 Select the checkbox to Enable flow reporting. Note that if this is disabled, both internal and external flow reporting are also disabled. Select the Report to EXTERNAL flow collector checkbox to enable flows to be reported to an external flow collector. Note that you may enable this option if you prefer to receive external flows, rather than the SonicWALL visualization. Remember, not all collectors will work with all modes of flow reporting. Once enabled, the flows reported are based on the initiator or responder interface. Once enabled, the flows reported are based on already existing firewall rules. Note that this step is optional, but is required if flow reporting is done on selected interfaces. [. . . ] Core Utilization--This table reports all Core utilization by percentage. Memory Utilization--This table reports all Memory utilization (Free, Used, Used by DB) of the SonicWALL appliance. VoIP--This table reports all VoIP/H323 calls through the SonicWALL appliance. SPAM--This table reports all email exchanges through the SPAM service. [. . . ]