URLs Not Displaying in AppFlow Monitor

10/14/2021 106 16643

DESCRIPTION:

This article explains troubleshooting scenarios where App flow Monitor shows No Entries for URLs even though App Flow Reporting is Enabled.

This issue is most often caused by the Content Filtering Service (CFS) or an inability for the SonicWall to correctly resolve DNS.

• In CFS 3.0 the service needs to be Enabled on the specific zone to see Reporting Data.
• In CFS 4.0 if Flow Reporting is not Enabled for the CFS Action Object the URL Data will not be Reported.
• On all Firmware version DNS needs to be set for the SonicWall in order for it to resolve URLs.

RESOLUTION:

Resolution for SonicOS 6.5

This release includes significant user interface changes and many new features that are different from the SonicOS 6.2 and earlier firmware. The below resolution is for customers using SonicOS 6.5 firmware.

Enabling AppFlow

   1. Login to the SonicWall Management GUI.

   2. Navigate to Manage | AppFlow Settings | Flow Reporting | Settings and Enable the check box next to AppFlow To Local Collector, as shown below:

CFS 4.0

In CFS 4.0, the option to Enable Flow Reporting is under the CFS Action Object under Manage | Objects | Content Filter Objects | CFS Action Objects.

Testing

   1. Navigate to Investigate | AppFlow Logs and click on URLs Tab - URLs should then be displayed.

NOTE: Analyzer/GMS software could also be used to generate reports based on URLs (Content Filtering Service does not need to be enabled on the appliance).
However, it will require a valid license for Analyzer or GMS.

Resolution for SonicOS 6.2 and Below

The below resolution is for customers using SonicOS 6.2 and earlier firmware. For firewalls that are generation 6 and newer we suggest to upgrade to the latest general release of SonicOS 6.5 firmware.

Enabling AppFlow

   1. Login to the SonicWall Management GUI.

   2. Navigate to AppFlow | Flow Reporting | Settings and Enable the check box next to AppFlow To Local Collector, as shown below:

CFS 3.0

In order to view URLs in "AppFlow Monitor", CFS engine needs to be enabled on the Required Zones on SonicWall Firewall.

   1. Navigate to Network | Zones and click on Configure for the LAN Zone as shown below:

   2. Enable Enforce Content Filtering Service for the desired Zone(s) and select a Policy from drop down options, for example, screenshot below shows Default CFS Policy being enforced on LAN Zone:

   3. If CFS is not required to block any content, configure the default or custom CFS Policy, uncheck all the categories, and don't add any Forbidden Domains or Blocked Categories.

   4. Navigate to Security Services | Content Filter and click on Configure as shown below:

   5. Add a new Policy or edit an existing one.

   6. Uncheck all the Categories.

   7. After enabling CFS on required Zone a green ticked arrow will appear under Content Filtering column, as shown below:

CFS 4.0

In CFS 4.0, the option to Enable Flow Reporting is under the CFS Action Object under Firewall | Content Filter Objects.

Testing

   1. Navigate to Dashboard | AppFlow Monitor or navigate to AppFlow | AppFlow Monitor and click on URLs Tab - URLs should then be displayed, as shown below:

 NOTE: Analyzer/GMS software could also be used to generate reports based on URLs (Content Filtering Service does not need to be enabled on the appliance).
However, it will require a valid license for Analyzer or GMS.