- Local User Groups
I am Dr. Dorit Dor
Ask Me Anything
Protect IoT from
Check Point for Beginners
Welcome to the
Working From Home
Review Check Point,
Win Apple AirPods!
CheckMates GO: Check Point
Enterprise Security Framework
I would like to ask about the status for this 1470 firewall.
Regarding the LDAP traffic which is about 40MB.
Does it mean it is using the site to site traffic or some internet connection got ldap protocol?
That should be possible by checking the LDAP server IP and the VPN community settings. All traffic to the remote site on SMBs goes thru the VPN tunnel, in WebGUI we only can exclude admin access traffic to the gateway by the Advanced Setting > VPN Site to Site global settings - Override 'Route all traffic to remote VPN site' configuration for admin access to the device. Or, you can use a special configuration file, see Locally managed SMBs vpn_table.def file.
Strange is that you are using this 1470 like a 770 - using central management would make it easy to exclude services from VPN, also enable the second processor core and even give you logs with names ...
Do you have accept logs enabled? Hosts using LDAP service usually make connections every few minutes. So checking the logs with the filter "service:ldap" should show you where the traffic is going.
If you see ldap traffic going both to the internet and to VPN sites, then you will not be able to check how much of the 40MB went to each destination. This would only be possible on a central management with SmartEvent.