Traffic is not visible on management.

[RemoteUser]

Hi Mates.

The customer pointed out something unusual:

We can see traffic on the firewall via tcpdump, but no corresponding logs appear in SmartConsole (management).

Additional, the latest logs available in date back to a week ago, although traffic is clearly flowing through the firewall.

Do you have any ideas on what could be causing this behavior on S1C R82?

Thanks,

[PhoneBoy]

What explicit rules do you have that involve SIP (i.e. where SIP or related services are mentioned)?
Relevant to the following, which may help: https://support.checkpoint.com/results/sk/sk65072 

[Lesley]

voice is data stream, now rule is set to ''any'' try to create a rule above the any rule with a specific service that you need. 

Maybe use custom service and make sure to disable match for any under the service. 

second, not sure if this traffic applies to this but check global properties in Smart Console -> firewall -> enable log implied rules (if there are any enabled)

[RemoteUser]

Hi Lesley,

We tried adding a rule with a specific service, following the ATRG: VoIP guidelines.
However, it seems that the rule is not appearing in the logs.

[the_rock]

Bro, did you check with TAC?

[RemoteUser]

yes, we're working togheter 

[the_rock]

Hope its fixed soon!

[the_rock]

Hey bro,

Please do share how this gets solved.

Thanks so much in advance.

Andy

[JozkoMrkvicka]

If the connection is using all the time same source port, same source IP, same destination port, same destination IP and same protocol, then the only log connection you see is very first 3-way handshake. Even if it happened 2 months ago, but connection was never removed from connection table.

It is seen for long-lasting services like NTP and syslog. It makes sense as it will kill logserver with heavy log volume for the same connection.

The only way how to see fresh log is to cut the connection from connection table or force the client to use new source port (restart the service).

[the_rock]

Its still odd Jozko that its ONLY for voip traffic...

Andy

[JozkoMrkvicka]

If this is a case then yeah, strange indeed ...

[the_rock]

Indeed... @RemoteUser has TAC case going, so will let us know once they have a solution.

Best,

Andy