cancel
Showing results for 
Search instead for 
Did you mean: 
Create a Post

R1200 Gateway Monitor Interface

Hi all,

I have a R1200 gateway with a interface running in monitor mode with a mirror on a switch pointing to the monitor interfaces. We notice that after we connect the interface to the switch all the tcp session that where already estabilshed dont see in the logs or application categorization, only tcp sessions that the syn-synack and ack was seen in the monitor mode appers in the log/events. Is this behavior normal for a monitor interface.

Thanks

Patricio

9 Replies
Admin
Admin

Re: R1200 Gateway Monitor Interface

By default, connections where the TCP handshake is not observed are considered "out of state" and would be dropped if the gateway were inline.

As such, what you're seeing is expected behavior.

You can disable this "out of state" check a couple of ways:

Note this applies for all interfaces (not just mirror port).

0 Kudos

Re: R1200 Gateway Monitor Interface

Hi,

Thanks for the reply. We already have use that option but with no success. The setup that we have is the R1200 with a interface in monitor mode capturing all the traffic from the switch, the traffic is a mix from tcp and udp, for udp we don’t have this issue but for tcp we don’t see any traffic as all the sessions are already stablished and we can not reset then as this is an industrial environment with SCADA traffic.

Thanks for your help,

Patricio

0 Kudos
Admin
Admin

Re: R1200 Gateway Monitor Interface

UDP traffic is stateless, so that makes sense.

Are you managing the 1200R locally or using a SmartCenter management? 

0 Kudos

Re: R1200 Gateway Monitor Interface

Hi,

We are managing with smart center.

Thanks

0 Kudos

Re: R1200 Gateway Monitor Interface

Re: R1200 Gateway Monitor Interface

Same problem.

Checkpoint cant decode estabilished sessions working on monitor mode, this is big problem for scada.

On SCADA tcp sessions  ,can last open , for months or years , since the RFP  don't seems to enforce any timeout, is up to the SCADA vendor to define.

In the end if you put checkpoint in monitor mode and connect to scada network via port mirror .... YOU WILL SEE NOTHING !!!

0 Kudos
Admin
Admin

Re: R1200 Gateway Monitor Interface

Application Control can only identify traffic it sees enough traffic on in order to make a determination.

It's quite possible that there is so little traffic being seen that it's unable to say, conclusively, "it's Application X."

Please get packet traces of the relevant traffic and open a TAC case so we can investigate. 

0 Kudos
Admin
Admin

Re: R1200 Gateway Monitor Interface

0 Kudos
Employee
Employee

Re: R1200 Gateway Monitor Interface

Yes, that as been tried.

The point here is that even in monitor mode we need to see the  TCP 3 way handshake to detect a session being formed. After this we can see the scada commands inside the TCP session.

However, if the gateway reboots for example, you will loose visibility on the already established sessions. 

This will force the costumer to reset the TCP sessions on the scada devices or at least to have someone looking on them, rebooting them, and so on...

In very large environments that is not pratical in the costumer perspective