156-215.80 · Question #240
An internal router is sending UDP keep-alive packets that are being encapsulated with GRE and sent through your R77 Security Gateway to a partner site. A rule for GRE traffic is configured for…
The correct answer is C. The Log Server log unification process unifies all log entries from the Security Gateway on a. Check Point's log unification process consolidates repeated traffic matching the same connection tuple into a single log entry, so GRE-encapsulated keep-alive packets appear as one entry rather than one per minute.
Question
An internal router is sending UDP keep-alive packets that are being encapsulated with GRE and sent through your R77 Security Gateway to a partner site. A rule for GRE traffic is configured for ACCEPT/LOG. Although the keep-alive packets are being sent every minute, a search through the SmartView Tracker logs for GRE traffic only shows one entry for the whole day (early in the morning after a Policy install). Your partner site indicates they are successfully receiving the GRE encapsulated keep-alive packets on the 1-minute interval. If GRE encapsulation is turned off on the router, SmartView Tracker shows a log entry for the UDP keep- alive packet every minute. Which of the following is the BEST explanation for this behavior?
Options
- AThe setting Log does not capture this level of detail for GRE. Set the rule tracking action to Audit
- BThe log unification process is using a LUUID (Log Unification Unique Identification) that has
- CThe Log Server log unification process unifies all log entries from the Security Gateway on a
- DThe Log Server is failing to log GRE traffic properly because it is VPN traffic. Disable all VPN
How the community answered
(28 responses)- A18% (5)
- B4% (1)
- C68% (19)
- D11% (3)
Why each option
Check Point's log unification process consolidates repeated traffic matching the same connection tuple into a single log entry, so GRE-encapsulated keep-alive packets appear as one entry rather than one per minute.
The Log tracking action does capture GRE traffic correctly as evidenced by the single entry; there is no separate 'Audit' tracking action in R77 that would produce per-packet granularity for this scenario.
The LUUID is a component of the log unification mechanism itself, not the root cause of the behavior; the observed symptom is the expected result of session-based unification, not a LUUID malfunction.
The Log Server's unification process groups all packets sharing the same source, destination, service, and rule match into a single unified log entry, using the session established at policy install time as the anchor. GRE encapsulates the UDP keep-alive packets into one ongoing GRE session, so all subsequent packets are merged into that initial log entry rather than generating new ones. When GRE is removed, each UDP packet is treated as an independent short-lived connection with its own session, so each one produces a separate log entry.
The Log Server is not failing - it successfully logged the GRE session at establishment; the behavior is by design due to log unification, and disabling VPN settings would not change how GRE session logging works.
Concept tested: Check Point log unification for GRE encapsulated session traffic
Source: https://sc1.checkpoint.com/documents/R77/CP_R77_LoggingAndMonitoring_AdminGuide/html_frameset.htm
Topics
Community Discussion
No community discussion yet for this question.