CPUG: The Check Point User Group

Resources for the Check Point Community, by the Check Point Community.


First, I hope you're all well and staying safe.
Second, I want to give a "heads up" that you should see more activity here shortly, and maybe a few cosmetic changes.
I'll post more details to the "Announcements" forum soon, so be on the lookout. -E

 

Results 1 to 2 of 2

Thread: Logs and Reporting - Views

  1. #1
    Join Date
    2007-10-02
    Posts
    1
    Rep Power
    0

    Default Logs and Reporting - Views

    Hi, I thought I would try here before logging a support call in the hope someone else has seen my problem.

    I am trying to create a view that will show me which internal hosts are having connections blocked at the firewall as they try to access the Internet or access another zone on the firewall,

    I have created a view with the following filter

    Action Equals Drop,Reject,Block
    Source Equals 172.22.34.62

    and table Widget showing Destination up to 11 values and Destination Port up to 11 values and everything default. My problem is that I am only seeing 3 destination all of which are in other zones on the firewall and no destinations on the Internet. When I look a the log messages I can seeing blocked traffic going to the Internet.

    Anyone have any ideas please?

  2. #2
    Join Date
    2014-09-02
    Posts
    367
    Rep Power
    10

    Default Re: Logs and Reporting - Views

    If I understand you correctly, I'd think a query string like this should do the trick. You'd just need to replace "Internal_Networks" with a group containing all destinations you want excluded, or you could replace it with an "OR" list in parentheses:

    source:172.22.34.62 AND (action:drop OR action:Reject OR action:Block) NOT destination:Internal_Networks

    or

    source:172.22.34.62 AND (action:drop OR action:Reject OR action:Block) NOT (destination:excluded1 OR destination:excluded2 OR destination:excluded3)

    Am I missing something?

    -E

Similar Threads

  1. Replies: 3
    Last Post: 2017-04-07, 01:07
  2. Where does SmartView Monitor store custom views
    By slowfood27 in forum SmartView Monitor
    Replies: 2
    Last Post: 2017-01-09, 09:13
  3. R80 Issues / Views
    By Peter-L in forum R80
    Replies: 7
    Last Post: 2016-04-20, 11:57
  4. Missing views in Smartview Monitor
    By velagapudy in forum SmartView Monitor
    Replies: 1
    Last Post: 2009-09-01, 07:59
  5. SmartView Monitor Customized Views
    By flexo in forum Mobile Access Blade (Formerly Connectra)
    Replies: 3
    Last Post: 2009-06-10, 20:29

Tags for this Thread

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •