SD-WAN Monitoring

Monitoring SD-WAN Status in Check Point Portal

  1. Log in to Check Point Portal.

  2. Click the top left Menu > in the section Hybrid Mesh Network Security, click SD-WAN.

  3. From the left navigation panel, click Monitor.

  4. In the middle section, click Dashboard.

  5. From the top, click the General tab.

The General tab shows these widgets:

  • Gateways

  • Overlay Tunnels

    The link View Details opens the dedicated tab with more data - see Monitoring Overlay Tunnels in Check Point Portal.

  • Steering Hits

    This percentage breakdown is based on the the names of the Steering Hits that Security Gateways send in their logs.

  • Link Swaps

    The link View Details opens the dedicated tab with more data - see Monitoring ISP Link Attributes in Check Point Portal.

  • Overall SLA

    The link View Details opens the dedicated tab with more data.

  • Top Applications

    Notes:

    • To see this data:

      1. The relevant license must exist in the corresponding User Center account.

      2. It is necessary to enable Log Sharing in SmartConsole on the on-premises Management Server.

        See Part 2 - Configure Object Sharing and Log Sharing.

    • By default, this widget shows the data from all Security Gateways.

      You can click All Gateways and select only specific Security Gateways.

  • Top Users

    Notes:

    • To see this data:

      1. The relevant license must exist in the corresponding User Center account.

      2. It is necessary to enable Log Sharing in SmartConsole on the on-premises Management Server.

        See Part 2 - Configure Object Sharing and Log Sharing.

    • By default, this widget shows the data from all Security Gateways.

      You can click All Gateways and select only specific Security Gateways.

Monitoring ISP Link Attributes in Check Point Portal

  1. Log in to Check Point Portal.

  2. Click the top left Menu > in the section Hybrid Mesh Network Security, click SD-WAN.

  3. From the left navigation panel, click Monitor.

  4. In the middle section, click Dashboard.

  5. From the top, click the Live Monitoring tab.

Note - When you hover over the plotted line for the threshold (dashed line), the tooltip shows the threshold value as it was configured in the Steering Behavior object at the exact time you see the tooltip.

Monitoring Overlay Tunnels in Check Point Portal

  1. Log in to Check Point Portal.

  2. Click the top left Menu > in the section Hybrid Mesh Network Security, click SD-WAN.

  3. From the left navigation panel, click Monitor.

  4. In the middle section, click Dashboard.

  5. From the top, click the Overlay Tunnels Monitoring tab.

Monitoring SD-WAN Steering Events in Check Point Portal

  1. Log in to Check Point Portal.

  2. Click the top left Menu > in the section Hybrid Mesh Network Security, click SD-WAN.

  3. From the left navigation panel, click Monitor.

  4. In the middle section, click Events.

Notes:

  • In the top left corner, you can select the applicable time (the default is last 7 days).

  • In the top search field, you can use Check Point Query Language.

    The basic query syntax is:

    [<Field>:] "<Filter Criterion>"

    To run a query for many criteria at the same time, use Boolean operators:

    [<Field 1>:] "<Filter Criterion 1>" {AND|OR|NOT} [<Field 2>:] "<Filter Criterion 2>" ...

  • In the top right corner, you can refresh the search results and enable an automatic refresh.

  • In the top right corner, you can export the search results.

  • From the left side of search results, you can pull out the Statistics pane (click the arrows icon at the top) that shows a summary for the current search results.

  • From the right side of search results, you can pull out the Card pane (click the arrows icon at the top) that shows data from the selected row.

Monitoring SD-WAN Traffic Logs in Check Point Portal

Important:

  • For the on-premises Management Server, you must enable the Log Sharing in SmartConsole (see Optional: Enable Log Sharing:).

  • In Smart-1 Cloud, the Log Sharing is enabled by default.

  1. Log in to Check Point Portal.

  2. Click the top left Menu > in the section Hybrid Mesh Network Security, click SD-WAN.

  3. From the left navigation panel, click Monitor.

  4. In the middle section, click Logs.

Notes:

  • In the top left corner, you can select the applicable time (the default is last 7 days).

  • In the top search field, you can use Check Point Query Language.

    The basic query syntax is:

    [<Field>:] "<Filter Criterion>"

    To run a query for many criteria at the same time, use Boolean operators:

    [<Field 1>:] "<Filter Criterion 1>" {AND|OR|NOT} [<Field 2>:] "<Filter Criterion 2>" ...

  • In the top right corner, you can refresh the search results and enable an automatic refresh.

  • In the top right corner, you can export the search results.

  • From the left side of search results, you can pull out the Statistics pane (click the arrows icon at the top) that shows a summary for the current search results.

  • From the right side of search results, you can pull out the Card pane (click the arrows icon at the top) that shows data from the selected row.

Monitoring SD-WAN Policy in Check Point Portal

To see which policy the Security Gateways enforce, follow one of the procedures below.

  1. From the left navigation panel, click Network.

  2. A notification at the top shows the policy version.

    After you click the x icon on the right side of this notification, it does not appear anymore.

    Example:

  1. From the left navigation panel, click Network.

  2. In the middle section, click Profiles.

  3. Click a profile.

    See The "Network" View > Profiles.

  4. Click the Advanced tab.

  5. In the Advanced Settings section, refer to the policy version in the line Get enforced policy.

    Example:

Monitoring the Connected Security Gateways in Check Point Portal

  1. From the left navigation panel, click Network.

  2. In the middle section, click Agents.

    See The "Network" View > Agents.

Monitoring SD-WAN on the Security Gateway

On the Security Gateway / Active Cluster Member, you can examine:

  • If the Nano-Agent is installed properly.

  • If the Security Gateway / Active Cluster Member is paired with Check Point Portal.

Note - SD-WAN does not support ClusterXL in the Load Sharing modes. In ClusterXL High Availability mode, SD-WAN runs only on the Active Cluster Member.

  1. Connect to the command line on the Security Gateway / Active Cluster Member.

  2. Log in to the Expert mode.

  3. Examine the status of the required Nano-Services:

    cpnano -s

    The section "Service settings" in the output must show "Status: Running" for these services:

    • Check Point Orchestration Nano Service

    • Check Point Messaging Proxy Nano Service

    • Check Point SDWan Nano Service

    • Check Point Cpview Metric Provider Nano Service

    • Check Point SD-WAN Logger Nano Service 

    ---- Check Point Nano Agent ----
Version: 1.2239.416868
Status: Running
Last update attempt: 2022-10-06T14:11:40.034582
Last update: 2022-10-06T14:11:40.049963
Last update status: Succeeded
Policy version: 327
Last policy update: 2022-10-04T09:52:55.393009
Last manifest update: 2022-10-02T13:40:49.711230
Last settings update: 2022-10-04T09:52:55.393009
Registration status: Succeeded
Manifest status: Succeeded
Upgrade mode: automatic
Fog address: XXX.checkpoint.com
Agent ID: XXX
Profile ID: XXX
Tenant ID: XXX
Registration details:
    Name:
    Type: Quantum
    Platform:
    Architecture:
Service policy:
    fileSecurity: /etc/cp/conf/fileSecurity/fileSecurity.policy
    ips: /etc/cp/conf/ips/ips.policy
    sdwan: /etc/cp/conf/sdwan/sdwan.policy
    waap: /etc/cp/conf/waap/waap.policy
Service settings:

---- Check Point Orchestration Nano Service ----
Type: Public, Version: 1.2215.326566, Created at: 2022-04-12T08:56:36+0300
Status: Running

---- Check Point Messaging Proxy Nano Service ----
Type: Public, Version: 1.2215.326566, Created at: 2022-04-12T08:56:36+0300
Status: Running

---- Check Point SDWan Nano Service ----
Type: Public, Version: 1.2215.326566, Created at: 2022-04-12T08:56:36+0300
Status: Running

---- Check Point Cpview Metric Provider Nano Service ----
Type: Public, Version: 1.2215.326566, Created at: 2022-04-12T08:56:36+0300
Status: Running

  4. Examine the SD-WAN policy:

    cpsdwan stat 

    [Expert@MyGW:0]# cpsdwan stat
SD-WAN Policy Status:
Policy Version: 322
SD-WAN Policy ID: XXX
SD-WAN Steering Policy ID: XXX (1)
Policy Installation Date and Time: 02/10/2022 13:43:26.298
[Expert@MyGW:0]#

  5. Examine the data in CPView:

    1. Run:

      cpview

    2. From the top, click Advanced > SDWAN.

      • All "State" columns must show "UP".

      • The section Overlay Probing Results shows the current tunnels.

    |--------------------------------------------------------------------------------------------------------------------------------------------
| CPVIEW.Advanced.SDWAN                                                                                                                      
|--------------------------------------------------------------------------------------------------------------------------------------------
| Overview SysInfo Network CPU I/O Software-blades Hardware-Health Advanced                                                                  
|--------------------------------------------------------------------------------------------------------------------------------------------
| CPU-Profiler Memory Network SDWAN SecureXL ClusterXL CoreXL PrioQ Streaming NAT MUX Routed RAD Conn-Tracker UP HTTP-Parser SSH-Parser CPAQ 
|--------------------------------------------------------------------------------------------------------------------------------------------
| Probing SDWAN-APPI                                                                                                                         
|--------------------------------------------------------------------------------------------------------------------------------------------
| Local Breakout Probing Results                                                                                                             
|                                                                                                                                            
| Probe Target        ISP       Probe Method        ISP State         Latency(ms)          Jitter(ms)         Packet Loss                    
| 192.168.40.221      ISP2      Ping                UP                          2                   1                  3%                    
| 192.168.40.221      ISP1      Ping                UP                          2                   1                  4%                    
| -------------------------------------------------------------------------------------------------------------------------------------------
| Nexthop Probing Results                                                                                                                    
|                                                                                                                                            
| Probe Target        ISP       Probe Method        ISP State   Consecutive drops         Latency(ms)          Jitter(ms)         Packet Loss
| 172.30.153.1        ISP1      Ping                UP                          0                   1                   1                  0%
| 172.30.154.1        ISP2      Ping                UP                          0                   1                   1                  0%
| -------------------------------------------------------------------------------------------------------------------------------------------
| Overlay Probing Results                                                                                                                    
|                                                                                                                                            
| ISP       Source IP Peer IP   Main peer IP        Probe Method        State       Consecutive drops         Latency(ms)          Jitter(ms)
| -         -         -         -                   -                   -                           -                   -                   -
| -------------------------------------------------------------------------------------------------------------------------------------------
| Steering Objects Status                                                                                                                    
|                                                                                                                                            
| Steering            ISP       State                       Latency Threshold(ms)          Jitter Threshold(ms)         Packet Loss Threshold
| Swap-no tie-20      ISP2      SELECTED                                       20                            20                           20%
| Swap-no tie-20      ISP1      NOT SELECTED                                   20                            20                           20%