Traffic monitor incomplete

[danoman2]

I've got a new Global Protect portal/gateway.  When I get connected to the gateway, I can see the connection via the GP monitor.  Then if I go the to traffic monitor and search the source range 192.168.203.0/24 I only get traffic from previous testing that I've performed.  I'm not getting the currently connected device to show up for some reason.  It's connected as the remote user option in the network>gateway shows me connected and the ip of 192.168.203.2.  However its not in the monitor.  What do you all think?

GlobalProtect 

[Adrian_Jensen]

Do you have a "receive_time" or interface/source/zone filter in you log view? If this is a new gateway/portal, did you create a new Security Policy rule allowing the traffic from the new interface/zone/IPs but didn't check the log options in the policy action?

[danoman2]

My monitor is showing traffic from this IP.  It was from previous connections to the gateway.  It is a new portal/gateway.  Yes, it has a security policy, all settings are correct as far as I'm seeing.  

[Adrian_Jensen]

It's kind of hard to guess without details. I have seen a few errata in the release notes for various versions about edge cases where traffic wasn't being logged, but I don't recall anything specific about new gateways. Maybe open a support ticket with PA where you can share the details with them and they can see if it is something obvious.

[TomYoung]

Hi @danoman2 ,

You probably have "log at session end" configured for your security policy rules.  This is recommended.  Monitor > Logs > Traffic will only show sessions that have ended.  In order to see live sessions, go to Monitor > Session Browser.

Thanks,

Tom