topic Re: Monitoring of connection tables in Firewall & Security Management

Monitoring of connection tables

Leandro_Nicolet — Fri, 15 Mar 2019 12:20:15 GMT

I'm looking for a way to monitor and alert on connection table usage and wondered if anyone has come across a way to do it this effectively. This could either be based on a figure or percentage. Ideally I would like some sort of SNMP trap or email when a table reaches 75-80% of its capacity. This is something I would then like use on all our firewalls.

Our current setup is R80.10 management (take 189) with a mixture of R80.10 / R77.30 gateways all running VSX which the exception of one stand alone firewall.

Re: Monitoring of connection tables

Timothy_Hall — Fri, 15 Mar 2019 13:15:56 GMT

If you have the IPS blade, enable the Aggressive Aging signature with the parameters you want, then set the Track for that signature to Email or SNMP Trap. Email recipient and/or trap receiver is configured under Global Properties...Log & Alert...Alerts.

Re: Monitoring of connection tables

Scott_Paisley — Fri, 15 Mar 2019 15:15:15 GMT

You can certainly monitor the number of connections, CheckPointfwNumConn, (not exactly connection table) via SNMP. We monitor that with Solarwinds, and could probably alert from there.

Re: Monitoring of connection tables

JozkoMrkvicka — Sun, 17 Mar 2019 10:28:59 GMT

Thats actually really great idea to have monitoring of provided (or all) kernel tables in place.

I can imagine to have syntax something like:

snmpwalk <kernel_table> <threshold>

On the other hand, is there way to check name of all kernel tables ?

Re: Monitoring of connection tables

PhoneBoy — Sun, 17 Mar 2019 15:22:31 GMT

fw tab (no arguments) should show you all the different kernel table names.

Re: Monitoring of connection tables

Leandro_Nicolet — Mon, 18 Mar 2019 14:39:24 GMT

Thanks everyone. Will probably have a look at what we can do with SNMP and Solarwinds.

Re: Monitoring of connection tables

tavi0906 — Fri, 20 Oct 2023 07:28:40 GMT

if i am not wrong when we enable the AA with the parameters, it will only delete the connections ?

how to get alerts when concurrent connections reach to max 80% ?

want to know the exact steps to set up alert .

Re: Monitoring of connection tables

Chris_Atkinson — Fri, 20 Oct 2023 07:51:05 GMT

These are the options Timothy has referenced:

Re: Monitoring of connection tables

tavi0906 — Fri, 20 Oct 2023 09:56:05 GMT

Yes, i have gone through this options before but my doubt is can we an alert when we set this options, when the concurrent connections reaches 80 % percent ?

Re: Monitoring of connection tables

tavi0906 — Thu, 26 Oct 2023 02:59:45 GMT

we have 5 VSX , we need to monitor the concurrent connections from solar winds. so, need OID values to monitor the concurrent connections ?

and also OID for all the VSX is same or different ?

i have gone through with the sk90860 and i am not sure what the exact OID values to use to monitor concurrent connections.

Re: Monitoring of connection tables

Chris_Atkinson — Thu, 26 Oct 2023 05:13:02 GMT

80% of memory capacity or 80% of a static specified connection limit value, unless this is VSX the connection limit is usually "auto" and not defined with a set upper limit.

The above would trigger when aggressive aging becomes active based on the AA defined thresholds.

If your application is different potentially SNMP monitoring or Skyline might be better suited to your use case.

What memory population does your system have versus what's possible for that system / appliance model?

Source: How to configure SNMP on Gaia OS (checkpoint.com)

Re: Monitoring of connection tables

tavi0906 — Tue, 31 Oct 2023 02:40:43 GMT

Is this OID can use for VSX ?

Because we already tries using this but couldn't get any results .

and OID's for all the VSX same or different ?