ISP Crash Analysis

[Arturxr]

Hello, is there a mechanism for analyzing provider outages? We had a provider switch, but we can't find a way to track it for incident investigation. The logs show that the NAT changed and that's all.

[Chris_Atkinson]

Of the below which technology are you leveraging in this context?

• Dynamic Routing
• ISP Redundancy
• SD-WAN
• Other?
  
  

[Arturxr]

• ISP Redundancy

[Chris_Atkinson]

You could try the track/alert option as explained here if not already... 

https://community.checkpoint.com/t5/Security-Gateways/ISP-Redundancy-Tracking/td-p/99891 

Otherwise the debug option perhaps:

https://community.checkpoint.com/t5/Security-Gateways/ISP-redundancy-link-health-status/td-p/204914 

SNMP may also be helpful per:
https://community.checkpoint.com/t5/Security-Gateways/ISP-Redundancy-SNMP-OID-for-monitoring-backup-... 

[Arturxr]

If I understand correctly, we don't have any of this configured and we won't be able to view any logs of the incident that occurred?

[Chris_Atkinson]

You can also review the contents of /var/log/messages or /var/log/messages.n to see if there a clues recorded there in lieu of the above.

[Arturxr]

And another question, if I set the Logs parameter in the ISP Redundancy settings, where will these logs be displayed?

[Chris_Atkinson]

SmartView/SmartConsole

[the_rock]

You can also search by blade in the logs, though not sure if isp redundancy would be there, as its not technically a blade.