SonicOS 8 Device AppFlow
Table of Contents
IPFIX Enhancements
SonicOS 8.2.2 introduces enhancements to AppFlow-based IPFIX reporting, enabling expanded telemetry export to SonicWall NSM and Unified Management. These enhancements extend AppFlow visibility to include audit logs, bandwidth management statistics, protocol and user monitoring data, and enriched URL reputation analytics.
These capabilities provide centralized visibility and analytics across multiple firewalls without requiring direct device access.
The following data types can be exported via IPFIX to NSM:
| Data Type | IPFIX Template ID | Description |
|---|---|---|
| Audit Log | 284 |
Audit log data is exported via IPFIX to provide centralized tracking of administrative configuration changes. It include:
Audit log export enables compliance monitoring and centralized change tracking in NSM. |
| BWM Monitor | 285 (Extension V2) |
BWM Monitor data provides real-time bandwidth usage statistics.
Supports network performance analysis and bandwidth optimization across distributed deployments. |
| Protocol Monitor | 286 |
Protocol Monitor data tracks ingress and egress traffic rates for network protocols. Supported protocols:
Provides protocol-level traffic analytics for deeper network visibility and troubleshooting. |
| User Monitor | 286 |
User Monitor data exports the number of active logged-in users. User session visibility Security and access monitoring in NSM. |
| URL (Unified) | 457 |
This feature enhances IPFIX flow reporting by embedding URL reputation and rating data into the URL IPFIX Template (Template 457), enabling NSM to receive enriched URL analytics for centralized reporting and threat visibility. The legacy URL reporting templates — Template 262 (URL) and Template 278 (URL Rating) — are replaced by a unified Template 457. Ensure all integrations are updated accordingly. |
