Why differents interfaces in logs that concern to ... - Check Point CheckMates

CPX ‍360 2023
The Industry’s Premier Cyber Security Summit and Expo

LEARN MORE

CHECK POINT is #1
in Miercom NGFW Security Benchmark 2023

GET THE REPORT

YOU DESERVE THE BEST SECURITY
Stay Up To Date

UPGRADE NOW!

CheckMates Go:
Protect Yourself

LISTEN NOW

Saludos.... we have a 1490 smb appliance as perimeter firewall. Two devices at LAN (192.168.3.8, 192.168.3.9) connect to a server (13.82.177.x). ...but I have doubts about logs:

even though each device connect to server more than once in a period of time, appliance only logs one time. I am sure that it makes more than one connection, because in each one,, an email is received, and I have the precaution of waiting to receive such email before "firing" another event that causes a connection
Why in the logs the interface WAN appears in one occasion and in another the LAN? randomly I do not think ... but I can not find the pattern !!

It is worth mentioning that the logs are saved in a sdcard memory inserted in the appliance, and recently had to be reinserted because the logs were not being saved.

Thanks!!

1 Reply

What you're seeing in the logs are sessions, which correlate data across several connections.

As to why it's logging LAN versus WAN sometimes, it may be related to the first packet seen on session correlation, which is based on (in)activity.