topic Re: No logs in Firewall & Security Management

No logs

KomisarzRyba — Fri, 31 May 2024 09:04:18 GMT

Hello,

The case is as follows: We have a specific source address and a specific destination address. There is no problem with communication, but there are no logs. Logging is turned on. The IP addresses are on different networks, so traffic should go through the gateway. When we ping others' destination IP address, we see logs. Any ideas why we can't see the logs for specific addresses? What can we check or change?

BR,

Mateusz

Re: No logs

the_rock — Fri, 31 May 2024 09:59:38 GMT

Those are ONLY logs you dont see?

Re: No logs

KomisarzRyba — Fri, 31 May 2024 10:03:43 GMT

Yes, those are only logs I don't see.

Re: No logs

PhoneBoy — Fri, 31 May 2024 14:44:18 GMT

Have you confirmed with a tcpdump and/or a traceroute that the traffic is actually passing through the gateway?

Re: No logs

the_rock — Fri, 31 May 2024 19:57:11 GMT

I second what Phoneboy said, you need to verify with tcpdump if its even reaching the gateway. Though, I assume it must be, since you said ping is fine, but nothing else. Did you try maybe old school tracker to see if that works?

Andy

Re: No logs

Amir_Senn — Sun, 02 Jun 2024 08:34:44 GMT

This might be matched on another rule in the rule base than other protocols.

I would suggest checking if all relevant rules have logging and also try to turn on logging of implied rules:

Re: No logs

KomisarzRyba — Mon, 03 Jun 2024 09:30:04 GMT

Here we can see the result of the ping and tracert test.
Src: 172.21.1.60,
Dst: 172.21.16.201
CheckPoint interface IP address: 172.21.0.1/20
Below we can see logs from pinging other addresses. These logs can be seen in Smartconsola. There are no logs to the destination address.
All rules have logging enabled. Log Implied Rules are enabled.
Any ideas?

Re: No logs

Amir_Senn — Mon, 03 Jun 2024 09:58:04 GMT

From the looks of it logs might not behave the same since this is also relates to VPN. For ping we would usually expect firewall blade. Also this is not the actual ping since this is not the same IP as dst, those look like remote GW in the VPN community?

Also you have hops missing in the tracert? This might happen because of VPN encryption.

If you try to use tcpdump, check which port/service. Probably VPN ports/services.

Re: No logs

KomisarzRyba — Mon, 08 Jul 2024 13:52:25 GMT

Yes, the traffic is passing through the gateway - confirmed with a tcpdump.

Re: No logs

the_rock — Mon, 08 Jul 2024 14:37:10 GMT

Try "old school" tracker, if that works, then its most likely indexing issue.

Andy

Re: No logs

the_rock — Mon, 08 Jul 2024 14:43:33 GMT

Alsso, make sure this is enabled on mgmt server object.

Andy

Re: No logs

KomisarzRyba — Thu, 11 Jul 2024 07:07:11 GMT

The problem was solved by replacing the device with a newer one.