topic Re: How to Monitor VPN Tunnel Traffic on Standalone 1550 Appliances? in Spark Firewall (SMB)

How to Monitor VPN Tunnel Traffic on Standalone 1550 Appliances?

Mk_83 — Wed, 21 May 2025 11:37:55 GMT

Hello everyone,

Appliance: 2x 1550
Mode: Standalone
Version: R81.10.10

I have set up an IPSec Site-to-Site VPN connection between these two 1550 appliances, and the tunnel is successfully UP.

However, I’m facing a small issue:

I want to monitor which traffic is going through the VPN tunnel, specifically to see which sessions or services are consuming the most bandwidth inside the tunnel.

Currently, under the Monitor and Reports tabs, the system displays the total traffic of the appliance, not specific traffic for the VPN tunnel.

Is there a way to filter or view tunnel-specific traffic statistics on a standalone Quantum Spark 1550 appliance?

I would greatly appreciate any guidance or suggestions on this.

Thank you, guys, so much.

Re: How to Monitor VPN Tunnel Traffic on Standalone 1550 Appliances?

Danny — Wed, 21 May 2025 12:30:37 GMT

For advanced VPN tunnel bandwidth monitoring on Check Point standalone SMB appliances I recommend using packet capturing on the CLI in expert mode. Neither the built-in monitoring via Web UI nor the "Traffic Monitoring" tab would provide that level of detail you are looking for. This is usually a demand for centrally managed SMB appliances, not purely locally configured ones as in your case. Also SNMP monitoring for VPN won't provide you the insights you asked for.

Re: How to Monitor VPN Tunnel Traffic on Standalone 1550 Appliances?

G_W_Albrecht — Wed, 21 May 2025 12:39:38 GMT

You have to use the SMP Infinity Portal (license is included) to see such statistics:

Re: How to Monitor VPN Tunnel Traffic on Standalone 1550 Appliances?

Mk_83 — Wed, 21 May 2025 12:51:38 GMT

Hello Danny,

Thank you for your information.

As I understand, using packet capture tools like tcpdump only provides packet-level data and does not offer aggregated traffic statistics — such as total bandwidth usage per services. Please correct me if I’m mistaken.

What I’m specifically looking for is a way to view a breakdown of source-destination-service pairs that are consuming the most bandwidth through the VPN tunnel, ideally in a summarized or report-style format.

Previously, I’ve worked with Check Point appliances running Gaia OS, which included the Monitoring blade and support for SmartView Monitor — allowing visibility into detailed traffic statistics. However, I haven’t found a similar feature available on this Gaia Embedded 1550.

Re: How to Monitor VPN Tunnel Traffic on Standalone 1550 Appliances?

Mk_83 — Wed, 21 May 2025 12:53:00 GMT

Thank you so much!! I will try this portal.

Re: How to Monitor VPN Tunnel Traffic on Standalone 1550 Appliances?

Danny — Thu, 22 May 2025 11:39:12 GMT

You asked for advanced dashboards and reports for standalone SMB appliances that are not available by the product itself, so I suggested to build them on your own regarding to your needs.

Wireshark – You can filter packets and use its built-in graphs to show bandwidth usage and connections between sources and destinations.
Grafana + Prometheus + Others – Import your packet captures and logs and create the dashboards you are looking for.
JavaScript - Just like other projects in our Toolbox, e.g. SARchart, you could utilize JavaScript libraries to convert your packet captures into charts and reports
GitHub - There are many PCAP analyzing & visualizing tools available. Just search for one that suits your needs.

Re: How to Monitor VPN Tunnel Traffic on Standalone 1550 Appliances?

Martin_Raska — Fri, 23 May 2025 07:56:02 GMT

SMP portal will show some statistics but I don't think it will show you the cumulative traffic between hosts.

If you have capture you can use Check Point tool for analysis - sk103212

Re: How to Monitor VPN Tunnel Traffic on Standalone 1550 Appliances?

Mk_83 — Sat, 24 May 2025 01:14:42 GMT

Hello Martin,

As I see the tool CPMonitor in sk103212 only support Gaia, Linux OS and doesn't support Gaia Embedded right?

Thanks & Best Regards.

Re: How to Monitor VPN Tunnel Traffic on Standalone 1550 Appliances?

G_W_Albrecht — Mon, 26 May 2025 08:59:54 GMT

That is correct ! Only supported by GAiA / Linux.

Re: How to Monitor VPN Tunnel Traffic on Standalone 1550 Appliances?

G_W_Albrecht — Tue, 27 May 2025 07:46:04 GMT

But no need to run it on the GW - use a Linux PC or GAiA VM to analyze thr captures. So you will see what you wanted in the post!