WSM User Guide - WatchGuard Technologies

Seeing Basic Firebox and Network StatusUsing the Security Traffic displayFirebox System Manager initially has a group of indicator lights to show the direction and volume of thetraffic between the Firebox interfaces. The display can be a triangle (below left) or a star (below centerand right).Triangle displayIf a Firebox has only three configured interfaces, each corner of the triangle is one interface. If aFirebox has more than three interfaces, each corner of the triangle represents one type ofinterface. For example, if you have six configured interfaces with one external, one trusted, andfour optional interfaces, the “All-Optional” corner in the triangle represents all four of theoptional interfaces.Star displayThe star display shows all traffic in and out of the center interface. An arrow that moves from thecenter interface to a node interface shows that the Firebox is passing traffic. The traffic comes inthrough the center interface and goes out through the node interface. For example, if eth1 is atthe center and eth2 is at a node, a green arrow shows that traffic flows from eth1 to eth2. Thereare two star displays — one for a Firebox X Core with 6 interfaces and one for Firebox X Peakwith 10 interfaces.To change the display, right-click it and select Triangle Mode or Star Mode.Monitoring status informationThe points of the star and triangle show the traffic that flows through the interfaces. A green pointshows traffic is being allowed at that interface. A red point shows that traffic is being denied, or that theinterface is denying some traffic and allowing other traffic. Each point shows incoming connections andoutgoing connections with different arrows. When traffic flows between the two interfaces, the arrowslight up in the direction of the traffic.In the star figure, the location where the points come together can show one of two conditions:• Red (deny)—The Firebox denies a connection on that interface.• Green (allow)—There is traffic between this interface and a different interface (but not the center)of the star. When there is traffic between this interface and the center, the point between theseinterfaces shows as green arrows.In the triangle, the network traffic shows in the points of the triangle. The points show only the idle ordeny condition. One exception is when there is a large quantity of VPN ”tunnel switching” traffic. Tunnelswitching traffic refers to packets that are sent through a VPN to a Firebox configured as the defaultgateway for the VPN network. In this case, the Firebox System Manager traffic level indicator can showvery high traffic, but you do not see green lights as more tunnel switching traffic comes in and goes outof the same interface.User Guide 35