topic Re: Session logs not showing Xlate information in Firewall and Security Management

Session logs not showing Xlate information

bibinpaul — Mon, 30 May 2022 10:47:30 GMT

Hello All,

Good day!!

Today I have been troubleshooting and issue and observed the connection logs shows Xlate information but the session log entries are not showing the Xlate information

Is that an expected behavior in Checkpoint logs?

One of my Internal IP is trying to access Azure AD and it is not working. This is a new deployment.

The connection logs shows proper source address translation details but not the session logs

Under tracking details we have enabled log generation per session and per connection and per session

Thanks and Regards

Bibin

Re: Session logs not showing Xlate information

PhoneBoy — Tue, 31 May 2022 16:05:01 GMT

Believe that is expected behavior, yes.
@Timothy_Hall mentioned it in his presentation at CPX this year: https://community.checkpoint.com/t5/Member-Exclusive-Content/Max-Gander-The-Hidden-World-of-Log-Generation-and-Log/m-p/139699#M85

Re: Session logs not showing Xlate information

Timothy_Hall — Tue, 31 May 2022 18:58:00 GMT

I did mention it in my CPX speech, but credit for bringing this to my attention should go to @Vladimir.

Re: Session logs not showing Xlate information

bibinpaul — Tue, 31 May 2022 21:24:45 GMT

Thanks heaps

Given below is as per the speech

"Be aware that NAT information will not be added to logs of type Session; only connections logged as type Connection with the "Per Connection" log generation checkbox set will contain NAT information. This seems to be a bug and may well change in the future"

Re: Session logs not showing Xlate information

_Val_ — Wed, 01 Jun 2022 06:42:06 GMT

I do not think this is a bug. Session logs are in fact aggregation of multiple connection logs. Each one of those has different XLATE data. How would you aggregate those? An exception is with static NAT, but I think the general principle here is not to aggregate NAT data by design

Re: Session logs not showing Xlate information

Timothy_Hall — Wed, 01 Jun 2022 13:24:46 GMT

I can see your point Val, but the lack of any NAT information in a log card implies that no NAT occurred at all. So in the case of a session log one might conclude that there was no NAT performed when in fact there was. I wouldn't mind seeing a message in a session log when NAT has occurred on any of the connections stating something like "NAT information not included - see connection logs" or something like that; if there was no NAT on any of the connections that message isn't there.

By the same token it would be nice to see something like "no NAT performed" in a connection log when there are no NAT rules hit instead of just showing nothing at all in the log card. This would also make it easier to troubleshoot when a connection should have been NATted but wasn't due to a misconfiguration.

Re: Session logs not showing Xlate information

_Val_ — Wed, 01 Jun 2022 12:35:10 GMT

I certainly understand and agree with your point here

Re: Session logs not showing Xlate information

Timothy_Hall — Tue, 13 Jan 2026 13:01:49 GMT

To update this old thread, full NAT information is now added into session logs at the following code levels:

R82.10 GA
R82 JHFA Take 36
R81.20 JHFA Take 111