In Part 1 I talked about how to configure your SonicWALL NetFlow / IPFIX exporting firewall to properly send NetFlow to a 3rd party NetFlow Reporting tool. Now I want to share with you the information that you can report on with that 3rd party NetFlow collector. All of this comes with SonicWALL using IPFIX, the proposed standard in NetFlow technology.
Example of reports on SonicWALL IPFIX exports:
- Application Conversations (App Conv)
- Application
- Intrusions
- Spyware
- URLs
- Users
- Viruses
The ability to report on these types of traffic is huge! You can now report on Applications by source and destination, or report on what is the most commonly used application on your network. This is done with SonicWALL’s Application Intelligence control & visualization.
“Scanning every byte of every packet of all network traffic, SonicWALL provides complete application intelligence and control—regardless of port or protocol—by determining exactly what applications are being used and who is using them….Administrators can easily create bandwidth management policies based on logical pre-defined categories (such as social media or gaming), individual applications, or even users and groups.” – SonicWALL, Inc.
As mentioned above, you can create users and groups in the SonicWALL devices. With your IPFIX collector you can also report on these users individually.
With the newest version of your NetFlow and IPFIX Analyzer you should be getting a new IPFIX Dashboard for SonicWALL flows. This shows all available reports for SonicWALL squished into one page, very similar to the Top Dashboard. If you click IPFIX report type (top right) you will be able to set the time they reload at. If you click any of those types of reports NetFlow Reporting Tool will run those reports individually.
For more information about reporting on SonicWALL devices or IPFIX in general you can contact us or SonicWALL for more information.
