SmartView Monitor shows fantasy values when monitoring VPN Tunnels

[Thomas_Eichelbu]

Hello Checkmates,

i have a weird symptom on a customers Checkpoint installation.

in SmartView Monitor sometimes you see a peak connection of serveral Gigabits, but the physical internet connection cannot exceed 200Mbits. This has caused concerns by the customer what is going on ...

in the screenshot u can see that the object: FW-WIB-HIB-01 once had a maxium of 10.197.173 bits ... thats enormous and cannot be true. even when we know the remote sites are not better connected then 100mbits

the central firewall ISP Link is only 200Mbits.

in the cpview of course you dont see this burst, the traffic shown there is much slower.

so what can cause this behavior? is it real or not?

could it be a delayed sending of monitoring data which could trigger a burst?

there is a  SK´s describing to lower or to raise the sampling rate from 30 (defualt) to a lower value...

altough it could performance to lower the value i set all values to zero.

sk83440 "When using SecureXL, the line flips from real speed to zero all the time."

i tried this ... but i guess it only reduced the effect but the effect with gigabit burst is still present ...

the SMS is R80.10 the gateway are all embedded GAiA´s, i will provide you with more detailed infos about versions later.

you have any ideas?

thank you for helping out.

best regards

Thomas.