topic Re: Amount of traffic in Firewall and Security Management

Amount of traffic

Magnus-Holmberg — Sun, 22 Nov 2020 14:15:29 GMT

Hi,

Do anyone knows if its possible to check the amount of traffic generate from specific servers behind the firewall?
In this case how many Mbit or traffic amount in GB, i guess netflow would do the trick...

Am aware how to check number of connections/logs etc.
But is it possible to get traffic numbers?

Will smartevent catch this or is that limited to webtraffic such as HTTP/HTTPS?
We are running VSX, R80.30 HFA219.

As far as iknow you need to configure generic netflow and not able to have one destination per VS.
So this complicate things within VSX aswell.

Regards
Magnus

Re: Amount of traffic

JackPrendergast — Sun, 22 Nov 2020 14:31:53 GMT

Magnus,

I believe it is possible from SmartEvent.

smartevent has a particular generic template with total bandwidth etc.

with some modification to the template, I believe you could achieve this.

I will try create this for you at some point tomorrow if you don’t beat me to it!

Re: Amount of traffic

Magnus-Holmberg — Sun, 22 Nov 2020 14:43:37 GMT

hehe thanks!
Smartevent is not my strong side so am sure you will beat me to it 🙂
Only ever used it for websurfing for clients so haven't tried within the network so to say.

Re: Amount of traffic

JackPrendergast — Sun, 22 Nov 2020 20:01:40 GMT

Magnus,

Here you go.

The report is abit rough cosmetically, but it will do the job.

Let me know if you want it tidying up.

This will show the top sources on bandwidth usage. To search for the specific source you want, just simply do the usual search in the search bar - "src:xxx.xxx.xxx.xxx"

Note - Make sure accounting is ticked under your log options for your rules!! This is a must! 🙂

https://www.dropbox.com/s/zfd5rvp7wgjxnzp/Application_and_URL_Filtering_Nov_22__2020_7_47_36_PM.cpr?dl=0

Re: Amount of traffic

Magnus-Holmberg — Sun, 22 Nov 2020 20:34:19 GMT

Thats quick!, i will try to check it out during the week then.
Still need to install a smartevent box and add to the MDS/MLM 🙂

Accounting on the rules.. That's a pain, 1000rules+ and already logging 50G+ per day.

/Magnus

Re: Amount of traffic

PhoneBoy — Sun, 22 Nov 2020 21:01:34 GMT

You should be able to directly attach the .cpr file to a message (or worst case, after zipped).

Re: Amount of traffic

JackPrendergast — Mon, 23 Nov 2020 19:58:32 GMT

I tried attaching it directly and it stripped it out. Next time I’ll try zip it! Thanks!

Re: Amount of traffic

JackPrendergast — Mon, 23 Nov 2020 20:00:27 GMT

Accounting is necessary unfortunately. Do you have extended log on any of them rules? Maybe you could look at your logging to try reduce.

Much more and you may need to consider additional correlative units for SmartEvent if you want to use it heavily in production

Re: Amount of traffic

Magnus-Holmberg — Fri, 27 Nov 2020 20:41:53 GMT

Now i have installed a smartevent server attached it to the global domain.
added the specific CMA/CLM within Initial settings correlation units and the CMA in object domains
Installed DB, changed all rules to accounting, left it a few hours but well more or less nothing. i get it like 30.000 events system status says OK.
Firewall is generating like 400.000 logs/hour

Will this actually work with FW only? based on your file @JackPrendergast am guessing i do need to activate application controll & url filtering aswell
In this case am looking for bandwidth uses within the check point between interfaces.

Regards,
Magnus

Re: Amount of traffic

JackPrendergast — Sat, 28 Nov 2020 14:29:55 GMT

Shouldnt have to enable URLF&APPC - should be fine with FW only with logs set to accounting

Unless I am wrong.. but that should work.

Let me know 🙂

Re: Amount of traffic

Magnus-Holmberg — Sat, 28 Nov 2020 16:23:16 GMT

Sadly not get it to work, so currently checking on the possibilitys to do it via netflow.

Re: Amount of traffic

yunier88 — Fri, 15 Apr 2022 15:15:03 GMT

Hello,

I need to know how much traffic (GB or MB) has passed through our firewall in a year for example. Does anyone know how I can get this information?

Thanks