topic Re: Traffic on untrust interface - problem in General Topics

Traffic on untrust interface - problem

_slv_ — Fri, 12 Oct 2012 13:31:44 GMT

I have a problem. I have 8Mb internet connections some of my servers are directly connected to internet (I have a switch connected to servers and PA200).

Every day throught untrust interface are made backups of this servers. So the traffic on untrust interface dramatically rise from few Mb to about 100Mbit during the time where backups are made.

Im looking for ability to exclude traffic from policy thats allow traffic from backup servers to servers thats are on untrust interface.

I made diagrams of traffic using PRTG tools using SNMP protocol.

Any other idea to solve my problem are also welcome.

With regards

SLawek

Re: Traffic on untrust interface - problem

mikand — Tue, 16 Oct 2012 03:12:53 GMT

What do you mean by that you want to exclude traffic from policy?

What comes to mind is to setup QoS on your PA box to lower the priority of your backup traffic so production traffic will have it easier to function when the backups are being transmitted.

Re: Traffic on untrust interface - problem

_slv_ — Tue, 16 Oct 2012 11:04:33 GMT

My traffic (during the day) looks like this.

But at night because of backup traffic the scale of vertical changing to 100Mbit and my traffic looks:

and I cant see details of my real internet traffic.

I wouldn't count backup traffic on untrust interface- is it possible?

p.s. sorry for my bad english ...

Re: Traffic on untrust interface - problem

Phoenix — Tue, 16 Oct 2012 12:47:50 GMT

Hi,

Looking at the primary requirement that you would like to see the real internet traffic and not see the traffic when backup takes place as this is causing to consume a lot of bandwidth.

> One method is to have a security rule for backup traffic for servers but do not log them( Each security policy has log at session end which can be disabled). This makes sure that the PA 200 inline will have logs only for real internet traffic and you can monitor it. But the fact is backup server traffic is flowing through the same untrust interface. If the monitoring is done by external device other than PAN then we have to make changes on that device not to see back up traffic.

Hope this makes sense.

Re: Traffic on untrust interface - problem

_slv_ — Mon, 12 Nov 2012 10:12:54 GMT

As You sugested I unchecked Log on session start and log on session end - but it doesn't help.

Are you sure that traffic counting on interface is depended on logging by policy?