Can't get Scrutinizer to receive flows

[mascoloj]

I have a Sonicwall NSA 2400 (5.8.1.0) that I configured for Scrutinizer but I cannot seem to receive any flows. I used the video instructions on the Plixer website to configure the firewall and Scrutinizer is installed on Windows 7 (Professional with SP1). Everything appears to be setup correctly, I've checked it a few times and retraced all my steps but I still can't seem to figure this out. Any help would be greatly appreciated.

Thanks

[BenjaminM]

Hi mascoloj,

We may need more information on the configuration on the SonicWALL. Can you post an image of the NetFlow configuration?

Sometimes you need to set the NetFlow to send every 100 Bytes on the NetFlow config because SonicWALL devices do not have an option for active timeout.

Does this help?

Thanks,
Ben

[mascoloj]

Here are 2 screen shots of the sonicwall "log>Flow Reporting" page. The interface settings I did not capture but they are checked off to enable flow reporting. Let me know what you think.

Thanks

sonicwall1.gif (16.91 KiB) Viewed 831 times

sonicwall2.gif (14.14 KiB) Viewed 831 times

[BenjaminM]

Hi mascoloj,

Excellent, Kilobytes exchanged is checked and set to 100.

I would try to uncheck "Report Once" from the configuration. Does this help?

Thanks,
Ben

[mascoloj]

I just unchecked it and have been waiting to see if it made a difference but nothing so far. This is really mind boggling. I have also stopped the firewall service on my workstation and disabled it from running. Any other suggestions?

[BenjaminM]

Hi mascoloj,

I'm curious to see if there is something else listening on port 2055?

Also try unchecking the option of "Skip reporting of STACK flows (connections)"

To check to see if the flows are coming into the Scrutinizer box, you can download wireshark application and see if the flows from the SonicWALL are coming into the server.

This is a great link with a problem similar to yours
http://www.plixer.com/blog/scrutinizer/ ... any-flows/

Please let me know the progress and if there is anything else I can help with.

Thanks,
Ben