- CheckMates
- :
- Products
- :
- Quantum
- :
- Management
- :
- Re: fw rule set to track none but still logging
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
fw rule set to track none but still logging
Hey all,
I want to disable the logs on a http/https firewall rule that generate tons of log, the goal is to get only the logs generated by the application control and url filtering blades.
I simply configure the firewall rule track action to "none" but I'm still get the logs of that rules.
someone can explain me why?
thank you.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Check if the traffic you are seeing being logged belongs to any of the "Implied" rules and if you have "Log Implied Rules" setting enabled:
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
i’ts not an implied rule because on the log i see the rule number that is configured to not log
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
what does the "rule number" column in the log card say?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
i see the rule number that i set to no logging.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Are you sure that you installed that particular policy on that particular gateway?
If you did, please open a ticket so that Check Point Support will be able to investigate.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have only one cluster of gw, I'll open a tac.
thank you.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Please first check your logs and rulebase regardless of the presented rule number - it may well be that a wrong rule number is reported in the logs, so please double-check with source and dest of the packets.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm with Tomer, please open a TAC case so we can investigate.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try to install database to sync the rule number from the policy with the number represented in the logs. I am not sure if it will help, but I believe it is something that definitely need to do first and will not cost you anything.
R77.30 - Go to SmartDashboard -> Menu (top left corner)-> Policy -> Install Database
R80.10 - Go to SmartConsole -> Menu (top left corner) -> Install Database
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
FYI,
This rule number mismatch in the logs is fixed in R80 and later versions. Install database not required.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Has anyone fixed this issue. I also have a rule that I changed the "Track" from Log to None. I have tried multiple things without success. Here is what I have tried and what I am seeing:
I have (2) Gateways- One is a 2200 (having issues) and other is 3200 (no issue)
I have separate policies for each Gateway
Changed the Track on Both policies from LOG to NONE for DNS Traffic.
Pushed both policies 2200 still logging DNS traffic under Rule#2
Tried DELETING rule and Re-Creating in thinking there was a database issue or something hung, still didn't fix it.
Any advice would be greatly appreciated.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Just for kicks, please create a duplicate rule by hand under the one that is misfiring.
Disable original rule and install the policy.
Let us know if you are seeing the DNS traffic logged and if number of hits on the new rule is incrementing.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yeah I have already tried that and it adopted the new rule # while logging. I also moved it down the policy a few columns and it followed as well. I am not sure what is going on with it this firewall policy.
Just weird I have the 3200 working fine but the 2200 is not. The only other thing I have noticed is with the HFA's. I have them scheduled to download auto with manual install, but on the 2200 I am still on HFA 70 and when I search either through CPUSE on WebUI or CLI it says I am current??? While the 3200 is at HFA154.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Please post the full log card with the IP addresses (and any other identifying information) redacted. Make sure to expand all sections and show everything on all tabs. Wondering if these logs are coming from some other part of the Access Policy such as Inspection Settings, Geo Policy, Mobile Access, or QoS; perhaps even Implied Rules although Danny mentioned those earlier in the thread.
--
Second Edition of my "Max Power" Firewall Book
Now Available at http://www.maxpowerfirewalls.com
March 27th with sessions for both the EMEA and Americas time zones
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I don't know if I should do a manual update of CPUSE Agent and HFA or is there some sort of limitation on the 2200. I did notice the build are the same along with the Kernel.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I just faces this problem on my system, and fix it like this:
1. I deleted CleanUp rule and I get next message on bottom of Access List (firewall policy): Missing cleanup rule - Unmatched traffic will be dropped and not be logged.
After this, there is no more logs on Clean Up rule
BTW: This happen on Check Point Maestro system.
Bye,
Petar
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I just faces this problem on my system, and fix it like this:
1. I deleted CleanUp rule and I get next message on bottom of Access List (firewall policy): Missing cleanup rule - Unmatched traffic will be dropped and not be logged.
After this, there is no more logs on Clean Up rule
BTW: This only valid when you have unwanted logging on cleanup rule.
Bye,
Petar
