topic Re: High bandwidth consumed by blocked traffic in Smart Event Report in Firewall & Security Management

High bandwidth consumed by blocked traffic in Smart Event Report

Bishal_Upadhyay — Wed, 22 May 2019 10:49:32 GMT

Hi Everyone,

Smart Event report is showing blocked traffic consuming heavy bandwidth which is shown in the high bandwidth category.

We are not able to comprehend why it is being shown on high bandwidth application category and does our internet traffic is affected by checkpoint blocking rules?

Screenshot is attached herewith.

Re: High bandwidth consumed by blocked traffic in Smart Event Report

Nick_Doropoulos — Wed, 22 May 2019 11:06:17 GMT

Hi Bishal,

Do you have drop optimization enabled by any chance? If not, it might be worth reading sk90861.

I hope this helps.

Re: High bandwidth consumed by blocked traffic in Smart Event Report

Bishal_Upadhyay — Wed, 22 May 2019 11:43:03 GMT

Hi Nick,
No it is not enabled.

With Regards,
Bishal

Re: High bandwidth consumed by blocked traffic in Smart Event Report

Nick_Doropoulos — Wed, 22 May 2019 14:02:24 GMT

Hi Bishal,

Given that most of the traffic displayed on the graph you provided is "drop" traffic, I think it is definitely worth enabling drop optimization since when a new connection matches the Drop Template, subsequent connections are dropped without performing a rule match and therefore are accelerated. Along with the sk I have already mentioned, have a look at the "Drop Template" section on sk98722 for more information.

Once enabled, you can monitor the traffic over a period of time and see what results you get on SmartEvent.

I hope this helps.

Re: High bandwidth consumed by blocked traffic in Smart Event Report

Bishal_Upadhyay — Wed, 22 May 2019 16:50:41 GMT

Hi Nick,

Thanks for the information.
Yes we will monitor over some period of time and then report back.

With Regards,
Bishal