How to Monitor VPN Tunnel Traffic on Standalone 1550 Appliances?

[Mk_83]

Hello everyone,

Appliance: 2x 1550
Mode: Standalone
Version: R81.10.10

I have set up an IPSec Site-to-Site VPN connection between these two 1550 appliances, and the tunnel is successfully UP.

However, I’m facing a small issue:

I want to monitor which traffic is going through the VPN tunnel, specifically to see which sessions or services are consuming the most bandwidth inside the tunnel.

Currently, under the Monitor and Reports tabs, the system displays the total traffic of the appliance, not specific traffic for the VPN tunnel.

 

Is there a way to filter or view tunnel-specific traffic statistics on a standalone Quantum Spark 1550 appliance?

I would greatly appreciate any guidance or suggestions on this.

Thank you, guys, so much.

[Danny]

For advanced VPN tunnel bandwidth monitoring on Check Point standalone SMB appliances I recommend using packet capturing on the CLI in expert mode. Neither the built-in monitoring via Web UI nor the "Traffic Monitoring" tab would provide that level of detail you are looking for. This is usually a demand for centrally managed SMB appliances, not purely locally configured ones as in your case. Also SNMP monitoring for VPN won't provide you the insights you asked for.

[Mk_83]

Hello Danny,

Thank you for your information.

As I understand, using packet capture tools like tcpdump only provides packet-level data and does not offer aggregated traffic statistics — such as total bandwidth usage per services. Please correct me if I’m mistaken.

What I’m specifically looking for is a way to view a breakdown of source-destination-service pairs that are consuming the most bandwidth through the VPN tunnel, ideally in a summarized or report-style format.

Previously, I’ve worked with Check Point appliances running Gaia OS, which included the Monitoring blade and support for SmartView Monitor — allowing visibility into detailed traffic statistics. However, I haven’t found a similar feature available on this Gaia Embedded 1550.

[Danny]

You asked for advanced dashboards and reports for standalone SMB appliances that are not available by the product itself, so I suggested to build them on your own regarding to your needs.

• Wireshark – You can filter packets and use its built-in graphs to show bandwidth usage and connections between sources and destinations.

• Grafana + Prometheus + Others – Import your packet captures and logs and create the dashboards you are looking for.
• JavaScript - Just like other projects in our Toolbox, e.g. SARchart, you could utilize JavaScript libraries to convert your packet captures into charts and reports
• GitHub - There are many PCAP analyzing & visualizing tools available. Just search for one that suits your needs.

[G_W_Albrecht]

You have to use the SMP Infinity Portal (license is included) to see such statistics:

[Mk_83]

Thank you so much!! I will try this portal.

[Martin_Raska]

SMP portal will show some statistics but I don't think it will show you the cumulative traffic between hosts.

If you have capture you can use Check Point tool for analysis - sk103212

[Mk_83]

Hello Martin,

As I see the tool CPMonitor  in sk103212 only support Gaia, Linux OS and doesn't support Gaia Embedded right?

Thanks & Best Regards.

[G_W_Albrecht]

That is correct ! Only supported by GAiA / Linux.

[G_W_Albrecht]

But no need to run it on the GW - use a Linux PC or GAiA VM to analyze thr captures. So you will see what you wanted in the post!