topic Re: Event Forwarding in Check Point – "No Traffic detected" in Portal

Event Forwarding in Check Point – "No Traffic detected"

User130442 — Wed, 28 May 2025 09:08:15 GMT

Hi all!

I’m running into an issue with Event Forwarding in Check Point Quantum Security Management and wanted to check if anyone here has experienced something similar:

Setup summary:
We’re running a Syslog server on Ubuntu that receives logs from our firewall and other systems and forwards them to Microsoft Sentinel.

I’ve set up a destination for Event Forwarding, and after successfully uploading the certificates, the test runs fine. The test event shows up in Microsoft Sentinel as expected once it’s sent to the Syslog server.

However, as soon as I create a forwarding rule, no logs are being sent. Instead, I get the message “No Traffic detected.”

We do have a valid license for Event Forwarding, so that shouldn’t be the problem.

Has anyone seen this behavior before or have an idea what might be causing it?
Any help or insight would be greatly appreciated!

Thanks and best regards!

Re: Event Forwarding in Check Point – "No Traffic detected"

PhoneBoy — Wed, 28 May 2025 16:08:48 GMT

TAC would need to investigate here.

Re: Event Forwarding in Check Point – "No Traffic detected"

User130442 — Fri, 30 May 2025 06:05:51 GMT

Great idea! But they already did and they couldn't help...

Re: Event Forwarding in Check Point – "No Traffic detected"

PhoneBoy — Fri, 30 May 2025 17:32:52 GMT

Please send me the SR in a PM.

Also, it's not clear where the screenshot you've attached is coming from.
More details about what you've configured might be helpful.
More complete screenshots also helpful (redacting any sensitive details, of course).

Re: Event Forwarding in Check Point – "No Traffic detected"

User130442 — Mon, 02 Jun 2025 07:56:47 GMT

Hi PhoneBoy!

Thanks for the reply.

This Screenshot comes from the Event Forwarding page in our Checkpoint Account Settings.

I can provide the following details:

We did set up a syslog server who we send all events and logs from our systems to (NAS, Azure VM's etc...).

In Microsoft Azure we us a loadbalancer as entry point for incoming traffic from our Quantum Firewall (On Premise).

This Loadbalancer forwards the traffic to the syslog server.

We did set up NAT and Firewall policies so everything gets routed correctly.

----------------------------------

As mentioned: When I create the Destination in the Checkpoint Account settings under Event Forwarding the "Connectivity Test" is successful but after I created the Forwarding Rule it says "No traffic detected".

I hope this helps you to understand the case better.

Kind regards!

Re: Event Forwarding in Check Point – "No Traffic detected"

PhoneBoy — Mon, 02 Jun 2025 19:52:12 GMT

Please send me the relevant case in a PM.

Re: Event Forwarding in Check Point – "No Traffic detected"

TobiFW — Wed, 20 Aug 2025 10:38:11 GMT

Hi, have you been able to solve the issue? I'm facing the same.

Thanks