Access Control Reports did not show the total traffic bandwidth

[BigHec]

Hi All,

Just wondering why is the Access Control report did not show the total traffic bandwidth when I filtered specific source and destination host IP. I can see there are logs related to the specific source and also destination IP. Just no total traffic bandwidth

[emmap]

Do you have Accounting enabled on the logs? If it's just Firewall blade traffic, bandwidth is not logged unless you enable Accounting on the log option of each rule you would like to log the bandwidth on.

[BigHec]

Hi @emmap,

I would like to ask because this specific connection is actually a machine upload the backup file to the cloud storage. The cloud storage using is wasabi(wasabi.com). After I check on the Application Control database and it seems like the wasabi application is not listed and recognized by the CheckPoint.

If in this case, even after the Accounting Logs is enabled, is it still able to log the bandwidth of this particular connection?

Thank you

[Amir_Senn]

Hi,

SmartEvent only indexes non-connections. By default, Application Control creates a Session log for matching on the rule and SmartEvent index it and you see it in views/reports.

If the application is not found in the list or not recognized for some reason, this probably matched a firewall rule which by default doesn't generate session logs.

You have 2 choices to solve this:

1) Add the application manually as a custom site and create a rule for it with accounting and session logs. This will create URL Filtering logs with accounting information.

2) Go to the matched rule for the traffic and beside accounting, enable session logs for this rule. This will create firewall session logs.