Firewall, Interface based Live Traffic Reports

    The Live Traffic provide a live visual representation of the traffic load across network links. Graphs are similar to that of MRTG, with the aim of providing a simple way to see exactly how much inbound and outbound traffic was generated for each device.

    Ensure you configure SNMP settings in firewall devices to get live reports.

    Note: SNMP base Live report graphs are not available for virtual Firewalls (vdom).

    Configure SNMP protocol settings for your Firewall device

    The procedure to configure the SNMP protocol settings of Firewall devices in the Firewall Analyzer is given below:

    • Click Interface/Zone Reports > Click Configure SNMP protocol for Live reports. "Try now." link. Add Live Settings page appears.
    • In that, the devices are listed in the Device Name drop down list. Select the device as required.
    • Below the Device Name, the IP Address of the selected device will appear.
    • Select the SNMP Version V1 or V2 or V3 using the respective radio button
    • Version 1 (V1):
      • Enter the SNMP Community of the device in the text box
      • Enter the SNMP Port of the device in the text box
    • Version 2 (V2):
      • Enter the SNMP Community of the device in the text box
      • Enter the SNMP Port of the device in the text box 
    • Version 3 (V3):
      • Enter the SNMP Community of the device in the text box
      • Enter the SNMP Port of the device in the text box
      • Enter the User Name of the device in the text box
      • Enter the Context Name of the device in the text box
      • Authentication:
        • Select the Protocol for authentication from the drop down list (MD5, SHA).
        • Enter the Password for authentication in the text box
      • Encryption:
        • Select the Protocol for encryption from the drop down list (DES, AES).
        • Enter the Password for encryption in the text box
    • Select the reports in the Select Reports section. In that section, the Report Name and Protocol are listed.
    • Select Interface Live Report using the check box. Select the Protocol for the report. On selecting the Interface Live Report, Interval field will appear with the drop down list. You can select 1 minute or 5 minutes or 10 minutes granularity in Live reports by choosing appropriate interval.
    • Select Live VPN Users report using the check box. Select the Protocol for the report. This report will be listed only if the device has the provision to get the Live VPN Users using SNMP protocol. Otherwise, this report option will not be there.
    • The Apply to other similar devices section, contains list of devices of the same vendor type as the selected device with the check boxes to select, along with Select All devices option. If you want to apply the same credentials (Community, Port, etc.,) to other similar firewalls, please select them.
    • Click Save button to save the configuration and Cancel button to cancel the operation. Upon saving the form, the details are stored in the database and a sample SNMP query is made to test connection. If the SNMP credentials are not valid, you can skip saving the Live Settings.
    Note: If SNMP query is not successful, error message will be displayed on top of the page. Upon error, ensure the credentials provided are correct. Also ensure you have provided Management access through the source interface for SNMP protocol.

    Once the 'Live Settings' is added successfully, the Edit | Disable | Delete SNMP options are displayed to respective devices in Interface Live Reports Dashboard. The Live Reports and Interface Live Reports are populated with SNMP data.

    Using the SNMP parameters configured, all the devices will be queried to get interface details. To configure/enable SNMP protocol in individual Firewall devices, refer the respective device configuration documents. Fortigate, Netscreen, Cisco PIX, Cisco ASA, Cisco Firewalls using ASDM tool

    Once the SNMP settings is done for Live Reports, we skip the syslog data and use SNMP data for Live Reports. To switch to syslog option either disabling or deleting the SNMP settings. You could find this option to the right of device name in Interface/Zone Live Reports dashboard.

    Live Reports of Each Firewall Device

    Select the name of the device from the dropdown of the device list, to see the live reports for that device alone, over all the time periods described above.

    The graphs for each device shows the minimum, maximum, and average amount of incoming and outgoing traffic through that device, over several time periods. Traffic is broken down into the last day, last week and last month, with an average granularity of 1 minute, 5 minutes, and 10 minutes respectively. Details of the Live traffic graph can be zoomed in by selecting the required portion of the graph.

    The incoming and outgoing bandwidth can be viewed in Kbps/Mbps/Gbps. 

    Note: Live Reports will not be available for devices whose logs do not contain the "duration" field.
    For example: WatchGuard, SonicWall, Astaro, IP Filter Linux Firewall, etc...

    Live Reports of Each Squid Proxy Device

    Click the Live Reports link present inside the list of reports for a device, to see the live reports for that device alone, over specific time periods.

    The graphs for each device shows the minimum, maximum, and average amount of outgoing traffic through that device, over several time periods. Traffic is broken down into the last day, last week, and last month, with an average granularity of 1 minute, 5 minutes, and 10 minutes respectively. Details of the Live traffic graph can be zoomed in by selecting the required portion of the graph.

    The outgoing bandwidth can be viewed in Kbps/Mbps/Gbps.

    Note: Live Reports will not be available for devices whose logs do not contain the "duration" field.