topic Re: Monitor VPN data usage in General Topics

Monitor VPN data usage

Lesley — Thu, 07 Nov 2024 12:39:52 GMT

Hi everyone,

I am trying to get data usage from a site to site VPN tunnel into an overview. (how much mbit is the tunnel using)

This could be SmartEvent or SmartView Monitor.

The tunnel is from Check Point towards another vendor firewall.

I have played with SmartView Monitor and there we only can get the live data. There is a history option that you can set under the gateway object but this is limited. Only live data is not sufficient for this case.

Also tried to make many Smart Event reports but it does not show data. (for example: https://community.checkpoint.com/t5/SmartEvent/Enhanced-VPN-Dashboard/m-p/100235#M6)

On the VPN rule we made sure accounting is enabled on the logging.

I am out of ideas. Customer is running R81.10

You guys have any idea?

Re: Monitor VPN data usage

the_rock — Thu, 07 Nov 2024 13:19:21 GMT

I know someone mentioned cpview for this in the past, but dont believe that gives any vpn info.

Andy

Re: Monitor VPN data usage

Lesley — Thu, 07 Nov 2024 13:23:09 GMT

Thanks for the reply.

cpview is a great tool but not for this request. It shows more general stuff about tunnels. For example:

| Overview SysInfo Network CPU I/O Software-blades Hardware-Health Advanced |
|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Overview VPN SSL-Inspection IDA DLP Threat-Prevention Threat-Emulation Advanced Content-Awareness QoS URLF Application-Control |
|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Overview Detailed SecureXL |
|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| IKE errors: |
| |
| No response from peer 1 |
| Total initiator errors 523 |
| Total responder errors 2,159 |
| Proposal mismatch 6,457 |
| CRL validation 0 |
| Certificates errors 0 |
| Pre-shared key mismatch 0 |
| IKEv2 Narrowing 1,148 |
| No valid SA errors 2,548

Re: Monitor VPN data usage

the_rock — Thu, 07 Nov 2024 13:34:02 GMT

Let me log into S1C portal for one of the customers we manage and will see what I can find there in sv monitor. Its R81.20, but Im sure its same as R81.10 options you get.

Andy

Re: Monitor VPN data usage

the_rock — Thu, 07 Nov 2024 13:39:22 GMT

Not sure if below helps. I do see there are way more options for VPN monitoring in R82 lab I built.

Andy

https://community.checkpoint.com/t5/Management/Monitor-a-S2S-VPN-for-bandwidth-utilization/td-p/219581

Re: Monitor VPN data usage

PhoneBoy — Fri, 08 Nov 2024 14:35:51 GMT

When you say the history options are "limited" can you elaborate?

I would think if you log the various rules where VPN is relevant (either with accounting or detailed/extended logs) that you could aggregate that in SmartEvent.

I also know there is better VPN monitoring in R82, but nothing specific to your request (bandwidth used).

Re: Monitor VPN data usage

Lesley — Mon, 11 Nov 2024 14:55:37 GMT

Thanks for reaching out.

Of course here the steps from Smartview Monitor.

First I make sure all below options are enabled on the relevant VPN gateway.

After that I move to the ''External application" -> Smarview Monitor

In there I press File -> New -> Traffic view. If you pick in under Type, real-time you have more tabs visible like filter and settings.

If you select history instead if real-time many options disappear indicating that those options are not possible in history mode.

With the live view I simply can filter the relevant source IP that is inside the VPN tunnel and it will show me a good live overview.

The customer would like to have this view in history.

Regarding SmartEvent, I have tried many ways also templates from Check Point to make an overview. I make sure accounting is enabled on the rule itself but I am not able to get the data into a report.

Thanks for any tips.

Lesley

Re: Monitor VPN data usage

the_rock — Mon, 11 Nov 2024 18:52:47 GMT

Hey Phoneboy,

I built R82 lab couple of weeks back, enabled mon. blade and all the options available, but I cant see anything extra to monitor for vpn tunnel compared to R81.20.

Andy

Re: Monitor VPN data usage

PhoneBoy — Mon, 11 Nov 2024 20:43:33 GMT

The enhanced monitoring shows in cpview...starting from R82.
You also have "network probe" objects which can be used for non-VPN purposes also.

Re: Monitor VPN data usage

PhoneBoy — Mon, 11 Nov 2024 20:44:31 GMT

I assume we do not track this stuff historically speaking, which is why it's not shown as an option in the UI.
That is probably an RFE.

Re: Monitor VPN data usage

the_rock — Mon, 11 Nov 2024 20:47:03 GMT

Kk, got it, thank you. Will check in the lab tomorrow.

Andy

Re: Monitor VPN data usage

JozkoMrkvicka — Mon, 11 Nov 2024 22:33:24 GMT

there was some CLI command which gives you all inbound and outbound VPN traffic stats. It had to be enabled first and only after that you were able to see stats. It was also mentioned by TAC that enabling it may cause performance issues.

It was back while running R80.30, but will search some docu to find that fancy command 🙂

EDIT: It is "vpn tu tlist state" once enabled (vpn tu tlist start).

Re: Monitor VPN data usage

the_rock — Mon, 11 Nov 2024 23:16:55 GMT

Im curious what that gives, though I think I ran it while ago and it was pretty basic, but will check in the lab.

Andy

Re: Monitor VPN data usage

Lesley — Tue, 12 Nov 2024 10:13:31 GMT

Great tip thanks!

It looks like this:

vpn tu tlist start

[FW]# vpn tu tlist state
Tunnel List volume statistics are on.

[FW]# vpn tu tlist -t -p 1.1.1.1
+-----------------------------------------+-----------------------+
| Peer: 1.1.1.1 | 😧 674.76 KB - 22.59% |
| Number of TSs: 1 | E: 0.99 MB - 99.72% |
+-----------------------------------------+-----------------------+

I will suggest this to customer. Maybe I will put it on a script that it will run this command every couple minutes and put the output in a file.

Re: Monitor VPN data usage

Lesley — Tue, 12 Nov 2024 10:14:37 GMT

Thanks, let's for now forget about SmartView monitor. I think RFE for (a bit) legacy app is maybe no the correct way 🙂

Re: Monitor VPN data usage

Lesley — Tue, 12 Nov 2024 10:15:38 GMT

A screenshot will be highly appreciated or any insight regarding R82 and VPN monitoring.

Thank you

Re: Monitor VPN data usage

the_rock — Tue, 12 Nov 2024 10:48:32 GMT

Once I see what it looks like in the lab, will send it.

Re: Monitor VPN data usage

the_rock — Tue, 12 Nov 2024 14:14:54 GMT

If I can find the option, happy to send a screenshot. @PhoneBoy , can you please advise where that advanced monitoring setting is? I cant seem to find it in my R82 lab from cpview options.

Andy

Re: Monitor VPN data usage

PhoneBoy — Tue, 12 Nov 2024 19:03:27 GMT

What's there is in Software Blades > VPN > Tunnel Monitoring (I believe).

Re: Monitor VPN data usage

the_rock — Tue, 12 Nov 2024 19:19:13 GMT

I guess need to have my eyes checked lol

I see it now.

Andy