SonicWall NetFlow Integration with WatchGuard NDR

The SonicWall firewall uses the NetFlow protocol to export data about IP traffic that enters its interfaces and exports this data as NetFlow fields to a NetFlow collector. The NetFlow collector is a server used to collect network traffic and upload to WatchGuard NDR to analyze for security, administration, accounting, and troubleshooting.

WatchGuard provides integration instructions to help customers configure WatchGuard products to work with products created by other organizations. If you want more information or technical support about how to configure a third-party product, go to the documentation and support resources for that product.

This document describes how to integrate the SonicWall with WatchGuard NDR using the NetFlow protocol.

Contents

• SonicWall NetFlow Integration with WatchGuard NDR
  • Contents
  • Integration Summary
  • Topology
  • Configure the WatchGuard NDR Collection Agent
  • Configure the SonicWall
    • Configure NetFlow on SonicWall
  • Test the Integration

Topology

This diagram shows the integration topology of the SonicWall firewall and WatchGuard NDR.

Configure the WatchGuard NDR Collection Agent

Make sure the WatchGuard NDR Collection Agent is installed on your Windows or Linux computer, and the status of the collection agent is Success. For detailed instructions about the WatchGuard NDR Collection Agent installation, go to Configure Collection Agents for WatchGuard NDR (Windows Computers) or Configure Collection Agents for WatchGuard NDR (Linux Computers).

Configure the SonicWall

Before you can configure SonicWall NetFlow, configure these basic settings.

1. Log in to the SonicWall management UI at https://<IP address of the SonicWall device>.
2. Configure the management IP, external IP and DNS servers.
   SonicWall configures the route rules and access rules to the Internet automatically.



3. Configure the zones for the different networks management. In our example, we created internal-1.



4. Configure the interface. In our example, we assigned zone internal-1 which we created in the previous step to Interface X6.
   SonicWall configures the route rules, NAT rules, and access rules to the Internet automatically.



5. Click OK.

For more information, go to the SonicWall documentation.

Configure NetFlow on SonicWall

To configure your SonicWall as a NetFlow exporter:

1. Log in to the SonicWall management UI.
2. From the top navigation, click DEVICE.
3. From the left navigation, select AppFlow > Flow Reporting > Settings.
4. In the Report Connections section, select Interface-based.
5. Enable Enable Aggregate AppFlow Report Data Collection.
6. Enable Enable Real-Time Data Collection [*].
7. In the Local Server Settings section, enable Enable AppFlow To Local Collector.
8. For other settings, keep the default values.
9. Click Accept.



10. From the top navigation, click DEVICE.
11. From the left navigation, select AppFlow > Flow Reporting > External Collector.
12. Enable Send Flows and Real-Time Data To External Collector [*].
13. From the External Flow Reporting Format drop-down list, select Netflow version-9 .
14. In the External Collector's Server Address section, check IP.
15. In the text box under AddrObj, enter the collector ip. In our example, we entered 10.12.0.20.
16. In the External Collector's UDP Port Number text box, enter the collector port number that receives NetFlow traffic. In our example, we entered 2055.
17. Enable Send IPFIX/Netflow Templates At Regular Interval.
18. Enable Report On Connection OPEN.
19. Enable Report On Connection CLOSE.
20. Enable Report Connection On Active Timeout.
21. For other settings, keep the default values.
22. Click Accept.



23. After the configuration is saved, there will be a warning at the top of the page. Click Restart to save the configuration.
    It might take several minutes to complete the reboot.

Test the Integration

To test the SonicWall integration with WatchGuard NDR:

1. Log in to your WatchGuard Cloud account.
2. Select Configure > NDR Integrations > Collection Agents. If you have a Service Provider account, you must select an account from Account Manager.
3. Select the NDR Collection Agents tab to view the Last Activity column of your collection agent. This column shows the last time the collection agent uploaded the NetFlow records to WatchGuard NDR. It might take a few hours for the first upload.



4. From the navigation menu, select Monitor > NDR to view the Network Summary page.

For more information about NDR, go to NDR.