View connections, blacklists, VPN SAs, users, routing, and SSL VPNs

There are several views in which you can monitor the status of the system.

The lists of connections, blacklisted entries, active VPN SAs, active users, routes, and SSL VPN sessions are automatically updated in the Current Events mode. The blacklist entries are added and removed according to their duration.

The Blacklist view does not show whether connections matching the entries are blocked by the Firewall, Layer 2 Firewall, or IPS engine. Nor does it show any history of entries that have already expired. Use the Logs view to see information about actual connections that are allowed and denied. Depending on the logging options selected in the policy, you can also use the Logs view to see past blacklist entry creation.

For more details about the product and how to configure features, click Help or press F1.

Steps

Right-click an NGFW Engine, then select Monitoring > <view type>.

Tip: If the Drill-downs pane is open, you can also select Monitoring > <view type> from there.
To browse the data, select an option from the toolbar.
You can adjust the view and the displayed data in a similar way as in the Logs view.
To filter data or open or compare snapshots, select the Filter tab or the Snapshots tab in the Query pane.
To combine entries having the same value for a given column type, right-click the heading of the corresponding column, then select Aggregate by <column name>.
Select one or more entries in the table, then right-click for a menu of actions you can take.
- To view more information about related log events, select Show Referenced Events.
- To blacklist connections manually, select New Blacklist Entry or New Entry.
- To close a connection in the Connections view, select Terminate.
- To remove a blacklist entry in the Blacklist view, select Remove Entry.
- To force an SA to renegotiate in the VPN SAs view, select Delete.
- To close the end user’s session in the Users view, select Delete.

Connections view

Use this view to monitor connections.

Option	Definition
Toolbar
Play	Shows current entries.
Pause	Creates a temporary snapshot of entries.
Stop	Aborts the running query.
Save	Saves a snapshot of entries.
Statistics menu	Shows the monitored data as charts. Select one of the predefined statistical items or select Select to create a custom statistical item.
Tools menu
Columns	Column Selection — Opens the Column selection dialog box. Save Your Local Settings — Saves the current column selection as your personal settings for the selected log data type. Reset to Default Settings — Discards changes to the column selection and reverts to the previously saved default settings.

Option	Definition
Connections table — Several menu options are available when you select a log entry and right-click.
Show Referenced Events	View more information about related log events.
New Blacklist Entry	Opens the Blacklist Entry Properties dialog box, where you can blacklist a connection manually.
Terminate	Terminates a connection in the Connections view.

Option	Definition
Query pane
Filter tab
New	Select — Opens the Select Filter dialog box. New — Select the type of new filter to create. The Filter Properties dialog box opens. Row — Adds an empty row to the Filters table.
Save	Opens the Filter Properties dialog box that allows you to save the current filtering criteria as a permanent Filter element.
Snapshots tab	Allows you to compare snapshots of entries. The names of the snapshots selected for comparison are shown in two separate fields. Current compares the current entries with a previously saved snapshot. Current is only available if the view is in the Current Events mode. If you click Pause in the toolbar a temporary snapshot of the current entries is selected as the first snapshot for comparison.
Select	Opens the Select Element dialog box, where you can select a previously saved snapshot as the first snapshot for comparison.
Compare with	Select to compare snapshots.
Second field	Shows the second snapshot selected for comparison.
Select	Opens the Select Element dialog box, where you can select a previously saved snapshot as the second snapshot for comparison.
Apply	Applies your changes.

Option	Definition
Fields pane
Category drop-down list	Watchlist — Allows you to create a customized list of fields to show in entries. All — Allows you to view all fields in entries.
Field	The name of the field.
Value	The value in the field.

Blacklist view

Use this view to monitor current blacklist entries.

Option	Definition
Toolbar
Play	Shows current entries.
Pause	Creates a temporary snapshot of entries.
Stop	Aborts the running query.
Save	Saves a snapshot of entries.
Tools menu
Columns	Column Selection — Opens the Column selection dialog box. Save Your Local Settings — Saves the current column selection as your personal settings for the selected log data type. Reset to Default Settings — Discards changes to the column selection and reverts to the previously saved default settings.

Option	Definition
Blacklist entries table — Several menu options are available when you select an entry and right-click.
Show Referenced Events	View more information about related log events.
Remove Entry	Remove a blacklist entry in the Blacklist view.

Option	Definition
Query pane
Filter tab
New	Select — Opens the Select Filter dialog box. New — Select the type of new filter to create. The Filter Properties dialog box opens. Row — Adds an empty row to the Filters table.
Save	Opens the Filter Properties dialog box that allows you to save the current filtering criteria as a permanent Filter element.
Snapshots tab	Allows you to compare snapshots of entries. The names of the snapshots selected for comparison are shown in two separate fields. Current compares the current entries with a previously saved snapshot. Current is only available if the view is in the Current Events mode. If you click Pause in the toolbar a temporary snapshot of the current entries is selected as the first snapshot for comparison.
Select	Opens the Select Element dialog box, where you can select a previously saved snapshot as the first snapshot for comparison.
Compare with	Select to compare snapshots.
Second field	Shows the second snapshot selected for comparison.
Select	Opens the Select Element dialog box, where you can select a previously saved snapshot as the second snapshot for comparison.
Apply	Applies your changes.

Option	Definition
Fields pane
Category drop-down list	Watchlist — Allows you to create a customized list of fields to show in entries. All — Allows you to view all fields in entries.
Field	The name of the field.
Value	The value in the field.

VPN SAs view

Use this view to monitor active VPN SAs.

Option	Definition
Toolbar
Play	Shows current entries.
Pause	Creates a temporary snapshot of entries.
Stop	Aborts the running query.
Save	Saves a snapshot of entries.
Tools menu
Columns	Column Selection — Opens the Column selection dialog box. Save Your Local Settings — Saves the current column selection as your personal settings for the selected log data type. Reset to Default Settings — Discards changes to the column selection and reverts to the previously saved default settings.

Option	Definition
VPN SAs table — A menu option is available when you select an entry and right-click.
Delete	Forces an SA to renegotiate.

Option	Definition
Query pane
Filter tab
New	Select — Opens the Select Filter dialog box. New — Select the type of new filter to create. The Filter Properties dialog box opens. Row — Adds an empty row to the Filters table.
Save	Opens the Filter Properties dialog box that allows you to save the current filtering criteria as a permanent Filter element.
Snapshots tab	Allows you to compare snapshots of entries. The names of the snapshots selected for comparison are shown in two separate fields. Current compares the current entries with a previously saved snapshot. Current is only available if the view is in the Current Events mode. If you click Pause in the toolbar a temporary snapshot of the current entries is selected as the first snapshot for comparison.
Select	Opens the Select Element dialog box, where you can select a previously saved snapshot as the first snapshot for comparison.
Compare with	Select to compare snapshots.
Second field	Shows the second snapshot selected for comparison.
Select	Opens the Select Element dialog box, where you can select a previously saved snapshot as the second snapshot for comparison.
Apply	Applies your changes.

Option	Definition
Fields pane
Category drop-down list	Watchlist — Allows you to create a customized list of fields to show in entries. All — Allows you to view all fields in entries.
Field	The name of the field.
Value	The value in the field.

SSL VPNs view

Use this view to monitor SSL VPNs.

Option	Definition
Toolbar
Play	Shows current entries.
Pause	Creates a temporary snapshot of entries.
Stop	Aborts the running query.
Save	Saves a snapshot of entries.
Tools menu
Columns	Column Selection — Opens the Column selection dialog box. Save Your Local Settings — Saves the current column selection as your personal settings for the selected log data type. Reset to Default Settings — Discards changes to the column selection and reverts to the previously saved default settings.

Option	Definition
SSL VPN table — There is a menu option available when you select an entry and right-click.
Terminate	Terminates the SSL VPN session.

Option	Definition
Query pane
Filter tab
New	Select — Opens the Select Filter dialog box. New — Select the type of new filter to create. The Filter Properties dialog box opens. Row — Adds an empty row to the Filters table.
Save	Opens the Filter Properties dialog box that allows you to save the current filtering criteria as a permanent Filter element.
Snapshots tab	Allows you to compare snapshots of entries. The names of the snapshots selected for comparison are shown in two separate fields. Current compares the current entries with a previously saved snapshot. Current is only available if the view is in the Current Events mode. If you click Pause in the toolbar a temporary snapshot of the current entries is selected as the first snapshot for comparison.
Select	Opens the Select Element dialog box, where you can select a previously saved snapshot as the first snapshot for comparison.
Compare with	Select to compare snapshots.
Second field	Shows the second snapshot selected for comparison.
Select	Opens the Select Element dialog box, where you can select a previously saved snapshot as the second snapshot for comparison.
Apply	Applies your changes.

Option	Definition
Fields pane
Category drop-down list	Watchlist — Allows you to create a customized list of fields to show in entries. All — Allows you to view all fields in entries.
Field	The name of the field.
Value	The value in the field.

Users view

Use this view to monitor active users.

Option	Definition
Toolbar
Play	Shows current entries.
Pause	Creates a temporary snapshot of entries.
Stop	Aborts the running query.
Save	Saves a snapshot of entries.
Tools menu
Columns	Column Selection — Opens the Column selection dialog box. Save Your Local Settings — Saves the current column selection as your personal settings for the selected log data type. Reset to Default Settings — Discards changes to the column selection and reverts to the previously saved default settings.

Option	Definition
Users table — A menu option is available when you select an entry and right-click.
Delete	Closes the end user’s session.

Option	Definition
Query pane
Filter tab
New	Select — Opens the Select Filter dialog box. New — Select the type of new filter to create. The Filter Properties dialog box opens. Row — Adds an empty row to the Filters table.
Save	Opens the Filter Properties dialog box that allows you to save the current filtering criteria as a permanent Filter element.
Snapshots tab	Allows you to compare snapshots of entries. The names of the snapshots selected for comparison are shown in two separate fields. Current compares the current entries with a previously saved snapshot. Current is only available if the view is in the Current Events mode. If you click Pause in the toolbar a temporary snapshot of the current entries is selected as the first snapshot for comparison.
Select	Opens the Select Element dialog box, where you can select a previously saved snapshot as the first snapshot for comparison.
Compare with	Select to compare snapshots.
Second field	Shows the second snapshot selected for comparison.
Select	Opens the Select Element dialog box, where you can select a previously saved snapshot as the second snapshot for comparison.
Apply	Applies your changes.

Option	Definition
Fields pane
Category drop-down list	Watchlist — Allows you to create a customized list of fields to show in entries. All — Allows you to view all fields in entries.
Field	The name of the field.
Value	The value in the field.

Routing view

Use this view to monitor the routing of a selected engine.

Option	Definition
Toolbar
Play	Shows current entries.
Pause	Creates a temporary snapshot of entries.
Stop	Aborts the running query.
Save	Saves a snapshot of entries.
Tools menu
Visualization	Opens the Visualization tab.
Columns	Column Selection — Opens the Column selection dialog box. Save Your Local Settings — Saves the current column selection as your personal settings for the selected log data type. Reset to Default Settings — Discards changes to the column selection and reverts to the previously saved default settings.

Option	Definition
Routing table	Shows the routing entries for the selected engine.

Option	Definition
Query pane
Filter tab
New	Select — Opens the Select Filter dialog box. New — Select the type of new filter to create. The Filter Properties dialog box opens. Row — Adds an empty row to the Filters table.
Save	Opens the Filter Properties dialog box that allows you to save the current filtering criteria as a permanent Filter element.
Snapshots tab	Allows you to compare snapshots of entries. The names of the snapshots selected for comparison are shown in two separate fields. Current compares the current entries with a previously saved snapshot. Current is only available if the view is in the Current Events mode. If you click Pause in the toolbar a temporary snapshot of the current entries is selected as the first snapshot for comparison.
Select	Opens the Select Element dialog box, where you can select a previously saved snapshot as the first snapshot for comparison.
Compare with	Select to compare snapshots.
Second field	Shows the second snapshot selected for comparison.
Select	Opens the Select Element dialog box, where you can select a previously saved snapshot as the second snapshot for comparison.
Apply	Applies your changes.

Option	Definition
Fields pane
Category drop-down list	Watchlist — Allows you to create a customized list of fields to show in entries. All — Allows you to view all fields in entries.
Field	The name of the field.
Value	The value in the field.