topic Re: fw monitor in Firewall and Security Management

fw monitor

valterj — Thu, 29 Jul 2021 15:41:59 GMT

Hi All.

Where can I find a document or content about fw monitor outputs? I'd like to understand more deeply all columns, and which represents each field (module, chain position, function pointer, mode, etc).

Best Regards.

Valter Junior

Re: fw monitor

HeikoAnkenbrand — Thu, 29 Jul 2021 21:06:17 GMT

Hi @valterj,

Unfortunately, there is no overview of the chain modules.
However, you can find some information in the CCTE training materials.

I have written a few articles on the new parameters. Maybe that will help you:
- R8x - Security Gateway Architecture (Logical Packet Flow)
- R80.20 - New FW Monitor inspection points
- R80.20 - New Chain Modules?
- R80.20 - SecureXL + new chain modules + fw monitor

You can also found more information here:
Performance Tuning R81 Administration Guide -> fw monitor

Re: fw monitor

HeikoAnkenbrand — Fri, 30 Jul 2021 10:30:57 GMT

SecureXL has been significantly revised in R80.20. It now works in user space. This has also led to some changes in "fw monitor"

There are new fw monitor chain (SecureXL) objects that do not run in the virtual machine.

The new fw monitor chain modules (SecureXL) do not run in the virtual machine (vm).

SecureXL inbound (sxl_in)                 > Packet received in SecureXL from network
SecureXL inbound CT (sxl_ct)          > Accelerated packets moved from inbound to outbound processing (post routing)
SecureXL outbound (sxl_out)            > Accelerated packet starts outbound processing
SecureXL deliver (sxl_deliver)          > SecureXL transmits accelerated packet

There are more new chain modules in R80.20

vpn before offload (vpn_in) > FW inbound preparing the tunnel for offloading the packet (along with the connection)
fw offload inbound (offload_in) > FW inbound that perform the offload

fw post VM inbound (post_vm) > Packet was not offloaded (slow path) - continue processing in FW inbound

---

There are new fw monitor inspection points when a packet passes through a R80.20+ Security Gateway:

Inspection point	Name of fw monitor inspection point	Relation to firewall VM	Available since version
i	Pre-Inbound	Before the inbound FireWall VM (for example, `eth1:i`)	always
I	Post-Inbound	After the inbound FireWall VM (for example, `eth1:I`)	always
id	Pre-Inbound VPN	Inbound before decrypt (for example, `eth1:id`)	R80.20
ID	Post-Inbound VPN	Inbound after decrypt (for example, `eth1:ID`)	R80.20
iq	Pre-Inbound QoS	Inbound before QoS (for example, `eth1:iq`)	R80.20
IQ	Post-Inbound QoS	Inbound after QoS (for example, `eth1:IQ`)	R80.20
o	Pre-Outbound	Before the outbound FireWall VM (for example, `eth1:o`)	always
O	Post-Outbound	After the outbound FireWall VM (for example, `eth1:O`)	always
e oe	Pre-Outbound VPN	Outbound before encrypt (for example, `eth1:e`) in R80.10 (for example, `eth1:oe`) in R80.20	R80.10 R80.20
E OE	Post-Outbound VPN	Outbound after encrypt (for example, `eth1:E`) in R80.10 (for example, `eth1:OE`) in R80.20	R80.10 R80.20
oq	Pre-Outbound QoS	Outbound before QoS (for example, `eth1:oq`)	R80.20
OQ	Post-Outbound QoS	Outbound after QoS (for example, `eth1:OQ`)	R80.20

---

New in R80.20+:

In Firewall kernel (now also SecureXL), each kernel is associated with a key witch specifies the type of traffic applicable to the chain modul.

Key	Function
ffffffff	all packets
00000001	stateful mode
00000002	wire mode
00000003	all packets
00000000	SecureXL offloading

Re: fw monitor

HeikoAnkenbrand — Thu, 29 Jul 2021 21:20:13 GMT

Example for Client Side NAT flow:

The packet that was sent to Server's NATed IP 172.16.0.100, arrives on the "Source/Client" side at the inbound interface eth0 of the Security Gateway (Pre-Inbound chains).
The packet passes the Security Policy rules (inside Virtual Machine).
If accepted, the connection is recorded in the Connections Table (Table ID 8158).
The packet is matched against NAT rules for the Destination. The packet is translated if a match is found - in this case, from IP 172.16.0.100 to IP 10.0.0.100.
The packet passes additional inspection (Post-Inbound chains).
The packet arrives at the TCP/IP stack of the underlying operating system, and is routed to the outbound interface eth1.
The packet goes through the outbound interface eth1 (Pre-Outbound chains).
The packet passes the Security Policy rules (inside Virtual Machine).
The packet is matched against NAT rules for the Source (if such rules exist). The packet is translated if a match is found - in this case, no translation occurs.
The packet passes additional inspection (Post-Outbound chains).
The packet leaves the Security Gateway machine.