AppFlow Agent

This screen allows you to send AppFlow and Real-time data to an AppFlow Agent. AppFlow Agents are SonicWall Flow Analytics, GMS, or NSM.

• Send AppFlow to SonicWall AppFlow Agent – The SonicWall appliance sends AppFlow data through IPFIX to a SonicWall AppFlow Agent. This option is not enabled by default.
• If this option is disabled, the SonicWall AppFlow Agent does not show AppFlow Monitor, AppFlow Report, and AppFlow Dashboard charts on the AppFlow Agent or through redirection of another SonicWall appliance.
• When enabling/disabling this option, you might need to reboot the device to enable/disable this feature completely.
• Send Real-Time Data to SonicWall AppFlow Agent – The SonicWall appliance sends real-time data through IPFIX to the SonicWall AppFlow Agent. This option is disabled by default.
• If this option is disabled, the SonicWall AppFlow Agent does not display real-time charts on the AppFlow Agent or through redirection on a SonicWall appliance.
• Send System Logs to SonicWall AppFlow Agent – The SonicWall firewall sends system logs through IPFIX to the SonicWall AppFlow Agent. This option is not selected by default.
• Report on Connection OPEN – The SonicWall appliance reports when a new connection is opened. All associated data related to that connection might not be available when the connection is opened. This option enables flows to show up on the AppFlow Agent as soon as a new connection is opened. This option is disabled by default.
• Report on Connection CLOSE – The SonicWall appliance reports when a new connection is closed. This is the most efficient way of reporting flows to the AppFlow Agent. All associated data related to that connection are available and reported. This option is enabled by default.
• AppFlow Reporting Format – Select either IPFIX with Extension or IPFIX with Extension v2.
• Report Connections on Following Updates – The firewall reports when a specified update occurs. Select the updates from the drop-down menu. By default, no update is selected.

• threat detection	VPN tunnel detection
  application detection	URL detection
  user detection

• Send Dynamic AppFlow For Following Tables – The firewall sends data for the selected tables. By default, all the tables are selected.

• Connections	Devices
  Users	SPAMs
  URLs	Locations
  URL ratings	VOIPs
  VPNs

• In IPFIX with extension mode, the firewall can generate reports for selected tables. As the firewall does not cache this data, some of the flows not sent could create failures when correlating flows with other related data.