smartview installation questions

[zn-me]

Hi All,

Pardon my questions.. I am very new Checkpoint.

I need to install smartview on a customer NG R55 running on Nokia IPSO.

My understanding of the overview setup is
- In Voyager, browse to manage install and select 'ON' for smartview.
- In Dashboard, browse to gateway properties and select smartview.

My questions
1. Is the setup correct?
2. Do I need to restart the servers after doing installation? Do I need a scheduled downtime for this setup?

Thank you
zn-me

[abusharif]

Smartview? If you are thinking of smartview tracker/monitor/update it is CLIENT side software for administration and monitoring. Your are not installing anything on the Nokias mentioned, only on the windows client you want to use these tools from.

[northlandboy]

If you're referring to SmartView monitor, at R55 it is a separate application on the firewall as well as the client. You will need to turn it on within Voyager, Apply/Save, then do a cpstop;cpstart. So yes, you will need to schedule downtime.

After that, update the general properties tab of the object, to select SmartView Monitor, and install policy.

Note that you need a specific license to be able to run SmartView Monitor, it's not included in the standard license.

As abusharif refers to, SmartView is the first part of the name for many of the Check Point client-side applications.

FWIW, this used to be called Real Time Monitor, so you may see the odd reference to that around. It's still there in the application paths - /opt/CPrtm-R55, or something like that.

[zn-me]

Hi northlandboy/abusharif,

Thank you so much for your information.

wow.. I was not aware of client side "smartview". Anyway what I wanted to do is on the smartview monitor. Sorry about that.

The main reason why I am doing all this is because... I need to find out why there is a constant network spike shown on the MRTG. Unfortunately, I am not able to run 'netflow' on the customer's router. So I decided that monitoring the network traffic on the checkpoint will be the next best option.

License.. that I don't have. But I have read previous post mentioning that we still can install smartview monitor w/o license and get basic features.. so I hoping the basic features can tell me someting about the network spike. Pls correct me if my expectation is wrong.....

Thanks again guys.
zn-me

[northlandboy]

You might be referring to SmartView Monitor at NGX, where they have combined the features of SmartView Status and Monitor.

You don't need to have a license to run the basic client, but it's not going to tell you about traffic - it's only going to give you things like CPU usage. You do need a license to run the traffic reports.

It's possible you've got some worm traffic on your network - have you tried looking at the logs for that?

[zn-me]

Hi northlandboy,

I suspect it is a scheduled job that is taking up the bandwidth. This is because it is constantly happening every Monday and Tuesday. In addition, I don't see any abnormal traffic when I view using smartview tracker.

If smartview monitor's basic setup does not give any traffic information, i think I will have to forgo the idea and think of something else.

Thanks
zn-me

[northlandboy]

Sounds like a good assumption. If you don't have a huge amount of traffic, then look at what logs you've got for just as the spike starts. See if you can work it out from that. You could capture traffic.

Another option might be to change the rules to accounting rules, and see if you can work it out from there.