How to Configure NetFlow on SonicWall Gen 7 Firewalls

These instructions assume:

• The SonicWall device is running SonicOS version 7.0 or higher.
• The date, time and time zone are correctly set on the firewall.
• You have administrative access to the firewall.
• The IP address of your Auvik collector is known.

To access the SonicWall web interface

1. 1. Open a web browser and type in your SonicWall’s  IP address.
   2. Log into the web admin console.

Enable  the NetFlow collector

1. 1. Navigate to Device, AppFlow, Flow reporting, then Settings.
   2. Check “Enable Real-Time Data Collection”, if necessary (*).
   3. (Optional) Enable interface-based reporting if you prefer the flows to be tagged from the interfaces of the firewall.
   4. Click Accept to save the settings.
   5. Navigate to AppFlow, Flow Reporting, then External Collector.
   6. Select “Send Flows and Real-Time Data to External Collector”.
   7. Under “External Flow Reporting Format”, select NetFlow Version-9.
   8. In the “External Collector’s Server Address” section, check IP and enter the Auvik collector IP address.
   9. In the “External Collector’s UDP Port Number” field, enter the port number you’d like to use. Choose from any of these ports: 2055, 2056, 4432, 4739, 6343, 9995, or 9996.
   10. Enable “Send IPFIX / Netflow Templates At Regular Intervals”.
   11. Enable “Report On Connection OPEN”.
   12. Enable “Report on a Connection CLOSE”.
   13. Click the Generate ALL Templates button.
   14. Click Accept to save the settings.

NetFlow should now be enabled on your SonicWall Gen 7 firewall device.

(*) You must reboot the device for this change to take effect.