topic Re: Incorrect data download amount in monitoring GUI in Spark Firewall (SMB)

Incorrect data download amount in monitoring GUI

zkg — Thu, 04 Jul 2024 16:22:14 GMT

Dear all,

We use a locally managed Quantum Spark 1800 appliance R81.10.10 (996002945). We have noticed that the reports under home>monitoring displayed on the GUI do not match the actual usage on the hourly report.

As an example, we have downloaded the Ubuntu 24.04 LTS .iso file (https://ubuntu.com/download/desktop, 5.7GB, 16:35 to 16:42, > 12.4Mbit/s).
Please find the screenshots of the monitoring and the corresponding report in the attached files (240703_02.png to 240703_06.png). Neither the monitoring nor the report show the proper data amount of the 5.7 GB download. However, the download can be tracked under "Overview - System" on the right-hand side under "Monitoring" (240703_02.png). For our data security, we have to make sure that the firewall is not missing massive data down- and upload.

With this post, we are wondering whether other users are experiencing similar behavior with their firewall (GUI) when downloading for example the above mentioned .iso file (https://ubuntu.com/download/desktop)? This would be really helpful!

Thank you very much! Kind regards,

Giancarlo Tomio

Re: Incorrect data download amount in monitoring GUI

Lesley — Fri, 05 Jul 2024 20:41:14 GMT

Are you doing HTTPS inspection? If not firewall will not be able to inspect the traffic. If you have, I see 99% of the data is QUIC UDP protocol. This cannot be inspected by https inspection.

HTTPS Inspection on Locally Managed 700/910/1200R/1400/1500 appliances (and 1800)

https://support.checkpoint.com/results/sk/sk121214

HTTPS traffic to Google services (over QUIC) from Chrome cannot be inspected by HTTPS inspection rules:

https://support.checkpoint.com/results/sk/sk111754

Re: Incorrect data download amount in monitoring GUI

the_rock — Sun, 07 Jul 2024 21:01:53 GMT

I would make sure ssl inspection is enabled and you are using latest firmware.

Andy