topic Re: Traffic monitor incomplete in General Topics

Traffic monitor incomplete

danoman2 — Wed, 09 Mar 2022 20:11:28 GMT

I've got a new Global Protect portal/gateway. When I get connected to the gateway, I can see the connection via the GP monitor. Then if I go the to traffic monitor and search the source range 192.168.203.0/24 I only get traffic from previous testing that I've performed. I'm not getting the currently connected device to show up for some reason. It's connected as the remote user option in the network>gateway shows me connected and the ip of 192.168.203.2. However its not in the monitor. What do you all think?

Re: Traffic monitor incomplete

Adrian_Jensen — Wed, 09 Mar 2022 22:47:53 GMT

Do you have a "receive_time" or interface/source/zone filter in you log view? If this is a new gateway/portal, did you create a new Security Policy rule allowing the traffic from the new interface/zone/IPs but didn't check the log options in the policy action?

Re: Traffic monitor incomplete

danoman2 — Thu, 10 Mar 2022 15:45:23 GMT

My monitor is showing traffic from this IP. It was from previous connections to the gateway. It is a new portal/gateway. Yes, it has a security policy, all settings are correct as far as I'm seeing.

Re: Traffic monitor incomplete

Adrian_Jensen — Thu, 10 Mar 2022 16:00:50 GMT

It's kind of hard to guess without details. I have seen a few errata in the release notes for various versions about edge cases where traffic wasn't being logged, but I don't recall anything specific about new gateways. Maybe open a support ticket with PA where you can share the details with them and they can see if it is something obvious.

Re: Traffic monitor incomplete

TomYoung — Fri, 11 Mar 2022 01:39:59 GMT

Hi @danoman2 ,

You probably have "log at session end" configured for your security policy rules. This is recommended. Monitor > Logs > Traffic will only show sessions that have ended. In order to see live sessions, go to Monitor > Session Browser.

Thanks,

Tom