topic Check which blades are inspecting a single connection in General Topics

Check which blades are inspecting a single connection

Shahar_Grober — Fri, 26 Apr 2019 15:22:25 GMT

Hi,

Is there a way to see which blades are inspecting a single connection?

To be more specific, I want to make sure that a connection which is encrypted by S2S VPN is inspected by Threat Prevention blades (IPS, AV/AB) before it goes through the VPN tunnel. Is there a way to see the chain per connection?

Re: Check which blades are inspecting a single connection

PhoneBoy — Fri, 26 Apr 2019 19:03:25 GMT

There’s an option in fw monitor that shows the packet as it goes through the various chains, if you really want to confirm, but in general, yes, all the blades should inspect the traffic.

fw ctl chain shows your up that encryption happens early in the process inbound (must be decrypted before inspection) and late in the process outbound (after most inspections).

Re: Check which blades are inspecting a single connection

Shahar_Grober — Sun, 28 Apr 2019 20:32:32 GMT

thanks Dameon,

I will dig in fw montior and fw ctl chain