User guide

ManageEngine Firewall Analyzer :: User Guide
259
Zoho Corp.
7. Why don't trend reports take time values or top-n values into account?
Trend reports show historical data for the corresponding traffic statistics shown in
the report. Hence time changes from the Global Calendar, or top-n value changes
from the Show bar on the report, do not affect these reports.
8. Why the Un-used Rules Report is empty?
To view the "Un Used Rules Reports", you need to configure Firewall Analyzer to
fetch rules from device via Telnet or SSH. After this configuration the reports will
be available. However, this advanced feature is available only for Premium
License Users of Firewall Analyzer.
CheckPoint Firewall Reports
1. All the traffic reports are showing bytes value as zero?
Make sure you have set the Track value of your rules to Account in your
CheckPoint management station. You can use Check Point Smart console to do
the same. You can set the track value as Account for the rules that are allowing
the traffic through your firewall's.
2. I am not getting VPN reports for CheckPoint firewall?
Firewall Analyzer looks for either the vpn_user or peer gateway attributes in
the logs received from your CheckPoint firewall's to generate VPN reports.
Example log is as follows:
id=leafirewall time="23Oct2006 9:49:30" action="encrypt" orig="testing"
i/f_dir="inbound" i/f_name="eth-s4p1 c0" has_accounting="1" product="VPN-1
& FireWall-1" __policy_id_tag="product=VPN-1 & FireWall-1[db_tag={C59340B0
-6276-11DB-B086-
00000000C2C2};mgmt=testing;date=1161594819;policy_name=RKR_Policy]"
src="xxx.xxx.xxx.xxx" s_port=" 40555" dst="xxx.xxx.xxx.xxx" service="https"
proto="tcp" rule="15" scheme:="IKE" dstkeyid="0x31b52e56" methods:="ES P:
AES-256 + SHA1" peer gateway="mygateway" community="SECU"
start_time="23Oct2006 9:49:30" segment_time="23Oct 2006 9:49:30"
elapsed="0:00:09" packets="3" bytes="180" client_inbound_packets="3"
client_outbound_packets="0 " server_inbound_packets="0"
server_outbound_packets="3" client_inbound_bytes="180"
client_outbound_bytes="0" server_inbound_bytes="0"
server_outbound_bytes="360" client_inbound_interface="eth-s4p1c0"
server_outbound_inter face="eth-s3p1c0" __pos="7" __nsons="0"
__p_dport="Unknown"
All the received logs are stored in
Firewall_Analyzer_Home\server\default\archive\ directory. You can browse
through those logs to troubleshoot the problem.
If you find vpn related logs with other fields, then kindly send us the sample logs
by uploading them to the following link:
http://bonitas.zohocorp.com/upload/index.jsp?to=fwanalyzer-
[e-mail]