Firewall Activity Report

[Filippos_Tsikog]

Hi, when we were at version R77 there was a nice report called Firewall Activity which had performance activity of firewalls.

Now we are at version R80.30 and that report is missing from the predefined. We need that report because we could see the folowing

1. Firewall Activity by Gateway
2. Top Gateways by Concurrent Connections (Average)
3. Top Gateways by Concurrent Connections (Maximum)
4. Top Gateways by Accepted Packets
5. Top Gateways by Rejected Packets
6. Top Gateways by Dropped Packets
7. Firewall Activity by Date
8. Concurrent Connections (Average) by Date
9. Accepted Packets by Date
10. Rejected Packets by Date
11. Dropped Packets by Date
12. Firewall Activity by Day of the Week
13. Firewall Activity by Hour of the Day

Can anybody help we that?

[PhoneBoy]

The reporting infrastructure changed substantially in R80.x and does not include some of the reports that were available in SmartReporter.
More specifically, we generate reports more on sessions versus individual packets/log entries.
Of the items listed, which are the most critical?

[Amir_Senn]

I suggest taking a look at the "Network Activity" view, I think it contains relevant information for you.

I think you should be able to see concurrent connections in SmartView Monitor, activate "Monitoring" blade on the GW and take a look.

A few thing about SmartView and the new views/reports:

1) All the information is derived from the logs. So the thumb rule is as long it's in the logs and the logs/field are indexed by the SmartEvent.

2) SmartEvent doesn't index connection logs so if you have relevant info I would advise to go to the relevant rule and mark in track options "Session".

3) In SmartView (SmartEvent app that is in charge of views/reports) is that it's very intuitive to create your own "widgets" which performs a query on the logs and bring the desired information. I attached a small file you can use.

Amir Senn