Incorrect data download amount in monitoring GUI

[zkg]

Dear all,

We use a locally managed Quantum Spark 1800 appliance R81.10.10 (996002945). We have noticed that the reports under home>monitoring displayed on the GUI do not match the actual usage on the hourly report.

As an example, we have downloaded the Ubuntu 24.04 LTS .iso file (https://ubuntu.com/download/desktop, 5.7GB, 16:35 to 16:42, > 12.4Mbit/s).
Please find the screenshots of the monitoring and the corresponding report in the attached files (240703_02.png to 240703_06.png). Neither the monitoring nor the report show the proper data amount of the 5.7 GB download. However, the download can be tracked under "Overview - System" on the right-hand side under "Monitoring" (240703_02.png). For our data security, we have to make sure that the firewall is not missing massive data down- and upload.

With this post, we are wondering whether other users are experiencing similar behavior with their firewall (GUI) when downloading for example the above mentioned .iso file (https://ubuntu.com/download/desktop)? This would be really helpful!

Thank you very much! Kind regards,

Giancarlo Tomio

[Lesley]

Are you doing HTTPS inspection? If not firewall will not be able to inspect the traffic. If you have, I see 99% of the data is QUIC UDP protocol. This cannot be inspected by https inspection. 

HTTPS Inspection on Locally Managed 700/910/1200R/1400/1500 appliances (and 1800)

https://support.checkpoint.com/results/sk/sk121214

HTTPS traffic to Google services (over QUIC) from Chrome cannot be inspected by HTTPS inspection rules:

https://support.checkpoint.com/results/sk/sk111754

[the_rock]

I would make sure ssl inspection is enabled and you are using latest firmware.

Andy