Monitoring Traffic and Connections

In This Section: SmartView Monitor Features To Start the Monitoring Views Immediate Actions Deploying Monitoring Monitoring and Handling Alerts Monitoring Suspicious Activity Rules How SmartView Monitor Works Configuring SmartView Monitor Monitoring Gateway Status Monitoring Tunnels Monitoring Traffic or System Counters Monitoring Users Cooperative Enforcement Solution

SmartView Monitor gives you a complete picture of network and security performance. Use it to respond quickly and efficiently to changes in gateways, tunnels, remote users and traffic flow patterns or security activities.

SmartView Monitor is a high-performance network and security analysis system. This system helps you to establish work habits based on learned system resource patterns. Based on Check Point Security Management Architecture, SmartView Monitor provides a single, central interface, to monitor network activity and performance of Check Point Software Blades.

SmartView Monitor Features

SmartView Monitor allows administrators to easily configure and monitor different aspects of network activities. You can see graphical from an integrated, intuitive interface.

Defined views include the most frequently used traffic, counter, tunnel, gateway, and remote user information. For example, Check Point System Counters collect information on the status and activities of Check Point products (for example, VPN or NAT). With custom or defined views, administrators can drill-down the status of a specified gateway and/or a segment of traffic. That way, administrators identify top bandwidth hosts that can influence network performance. If suspicious activity is detected, administrators can immediately apply a Firewall rule to the applicable Security Gateway to block that activity. These Firewall rules can be created dynamically through the graphical interface and be set to expire in a specified time period.

You can generate Real-time and historical graphical reports of monitored events. This provides a comprehensive view of gateways, tunnels, remote users, network, security, and performance over time.

The monitoring views show real-time and historical graphical views of:

• Gateway status
• Remote users (SmartView Monitor only)
• System Counters
• VPN tunnel monitoring (SmartView Monitor only)
• Cooperative Enforcement, for Endpoint Security Servers
• Traffic

In SmartView Monitor you can create customized monitoring view.

SmartView Monitor scenarios

Examples of scenarios for which SmartView Monitor can help:

• If the Internet access of a company is slow, a Traffic view and report can be created. This makes sure what can clog up the company's gateway interface. The view can be based on an inspection of: Specific Services, Firewall rules or Network Objects, that can be known to impede the flow of Internet traffic. If the SmartView Monitor Traffic view indicates that users aggressively use such Services or Network Objects (for example, Peer to Peer application or HTTP), the cause of the slow Internet access is determined. If aggressive use is not the cause, the network administrator have to look at other avenues. For instance, performance degradation can be the result of memory overload.
• If employees that work away from the office cannot connect to the network a Counter view. A report can be created to determine what can prevent network connections. The view can be based on CPU Use %, to collect information about the status, activities hardware and software use of Check Point products in real-time. The SmartView Monitor Counter view can indicate that there are more failures than successes. Therefore, it is possible that the company cannot accommodate the mass number of employees that try to log on at once.

To Start the Monitoring Views

To open the monitoring views in SmartConsole:

1. From the Gateways & Servers view, select a Gateway.
2. Click Monitor.

To open SmartView Monitor:

1. Open SmartConsole > Logs & Monitor.
2. Open the catalog (new tab).
3. Click Tunnel & User Monitoring.

Immediate Actions

If the status shows an issue, you can act on that network object.

For example:

• Disconnect client - Disconnect one or more of the connected SmartConsole clients.
• Start/Stop cluster member - You can see all Cluster Members of a Gateway Cluster in SmartView Monitor. You can start or stop a selected Cluster Member.
• Suspicious Action Rules - You can block suspicious network activity while you investigate the real risk or to quickly block an obvious intruder.

Deploying Monitoring

To monitor a Gateway in the Logs & Monitor view of SmartConsole, or in SmartView Monitor:

• You need a Security Management Server and one or more Security Gateways.
• Enable the Monitoring blade on the Security Management Server and Security Gateways.

No other deployment steps are necessary.

Monitoring and Handling Alerts

Alerts provide real-time information about possible security threats, and how to avoid, minimize, or recover from the damage. The administrator can define alerts to be sent for different gateways and for certain policies or properties.

The gateways send alerts to the Security Management Server. The Security Management Server forwards these alerts to SmartView Monitor. By default, an alert is sent as a pop-up message to the administrator desktop when a new alert arrives to SmartView Monitor.

You can set global alert parameters for all gateways in the system, or specify an action to send an alert for a particular gateway.

Alerts are sent when:

• Rules or attributes which are set to be tracked as alerts are matched by a passing connection.
• System events (also called System Alerts) are configured to cause an alert when different predefined thresholds are surpassed.

System Alerts are sent for predefined system events or for important situation updates. For example, if free disk space is less than 10%, or if a security policy is changed. System Alerts can also be defined for each product. For example, you can define System Alerts for Unified Package and other System Alerts for Check Point QoS.

Viewing Alerts

Alert commands are set in SmartConsole > Global Properties > Log and Alert > Alerts page. The Alerts in this window apply only to Security Gateways.

To see alerts:

1. Click the Alerts icon in the toolbar.

   The Alerts window opens.

2. Set alert attributes and delete shown alerts.

System Alert Monitoring Mechanism

The Check Point Security Management Server System Alert monitoring mechanism uses the defined System Alert thresholds. If a threshold is reached, it activates the defined action.

To activate System Alert monitoring:

Go to Tools > Start System Alert Daemon.

To stop the System Alert monitoring:

Go to Tools > Stop System Alert Daemon.