Sophos XG Firewall | Monitor and Analyze | 18
Connections and Interfaces
The image of the device will be displayed in this panel on the right side. For a virtual device, stack of devices will be displayed.
Interface Table
This panel displays information of Interfaces describing their Name, Type and Status, Received and Transmitted
KBits/s.
Displays following details:
1. Interface - This displays the name of the Interface configured in the system. Example Port A, Guest AP. It displays
Physical, LAG and Bridge type of Interfaces.
2. Type - This displays the zone along with the type of Interface configured. Example LAN-Physical, WAN-VLAN etc.
3. Status - This displays the status and the Interface Speed for the configured Interface. Status can be connected, unplugged, disconnected, connecting, enabled or disabled (for RED interface only).
4. Received Kbits/s - This displays the received bits through the Interface.
5. Transmitted KBits/s - This displays the transmitted bits through the Interface.
Gateway Table
This panel displays information of Gateways which allows administrator to monitor Active and Backup Gateways describing their Name, Interface, Type, IPv4/IPv6, Activate on Failure of, Weight and Status.
Displays following details:
1. Gateway Name - This displays the name of the Gateway.
2. Interface - This displays the name and IP address of the Interface.
3. Type - This displays the type of the Gateway in terms of load balancing. Available options are Active and Backup.
4. IPv4/IPv6 - This displays the type of the Gateway in terms of IP addressing type used. Available options are IPv4 and IPv6.
5. Activate on Failure of - This displays the action for the Gateway failure situation, i.e. whether a backup Gateway will be activated or not.
6. Weight - This displays that how much traffic will pass through a particular link in relation to the other link(s).
7. Status - This displays the status of the Gateway. Status can be Active, Deactive.
Current Activities
The Current Activity section provides information about the live IPsec, SSL, IP and wireless connections to the device.
•
Live Users
: Displays a list of all the users currently connected to the device.
•
IPsec Connections
: Displays a list of all the live IPsec connections.
•
Remote Users
: Displays a list of all the live SSL VPN users.
•
Live Connections IPv4
: Displays a list of the live IPv4 connections on the device. You can forcefully disconnect the connections from the respective pages.
•
Live Connections IPv6
: Displays a list of the live IPv6 connections on the device. You can forcefully disconnect the connections from the respective pages.
Live Users
Live users in the device can be managed from a single page. All the active normal users, clientless users and single sign-on users are visible from the Live Users page. The administrator can disconnect these users from this page directly.
User Types:
Sophos XG Firewall | Monitor and Analyze | 19
• Normal
• Clientless
• Single Sign-On
• Thin Client
• WWAN user
A normal user has to logon to the device. It requires a client (client.exe) on the user machine or a HTTP client component can be used and all the policy-based restriction are applied.
A clientless user does not require a client component (client.exe) on the user machines.
If a user is configured for single sign-on, whenever the user logs on to Windows, he/she is automatically logged to the device.
If the user is a thin client user, whenever the user logs on, this is visible on the Live Users page.
If a wireless user is configured and connected, the user is shown on the Live Users page.
To disconnect a user:
1.
Click the Disconnect icon under the Manage column against a user.
2. Specify the message in a dialog box.
3. Click OK to disconnect the user. To disconnect multiple live users, select them and click Disconnect.
Note: Configured messages will not be sent to a clientless user.
Figure 1: Live Users
Related Topics
Users
on page 182
The Users page displays the list of all users added in the device.
Live Connections
Use Live Connections page to view a list of all currently active IPv4 connections.
The page displays the IPv4 live connections report and offers to get a quick real-time statistics of the network traffic.
You can use this report to check the share in network load of different protocols, computer systems (in your LAN or in the Internet), connections, or a combination of these (e.g. network connections with a certain protocol). Drill down quickly to get an in-depth view of your network.
Connections per Application
Use to determine the amount of traffic generated (bandwidth used) by application in real-time. It also displays which user is using which application currently and total data transferred using the application.
Use to view:
•
Connection Details per Application
•
Connections Details per Application and Username
For each connection the list shows:
Application
Applications running on network.
Sophos XG Firewall | Monitor and Analyze | 20
Click number in Total Connections column against application to view destination IP address-wise and destination port-wise connection details for the selected application.
Click the icon to view list of users using the respective application or click the icon to hide the list of users.
Upload Transfer
Data uploaded through the application.
Download Transfer
Data downloaded through the application.
Upstream Bandwidth
Upstream bandwidth.
Downstream Bandwidth
Downstream bandwidth.
Total Connections
Displays number of connections initiating/requesting the application.
Click the number in the Total Connections column to view the connection details for the selected application.
Figure 2: Live Connections based on Application
Connections per User
Used to determine the amount of traffic generated (bandwidth used) by users in real time i.e. traffic per user. It also displays which user is using a particular application currently and is consuming how much bandwidth.
Use to view:
•
Connection Details per User
•
Connections Details per User and Application
For each connection the list shows:
User
Network Users requesting various Applications.
Click to view list of applications or click icon to hide the list of applications.
Click number in Total Connections column against user to view
Click User to view Destination IP Addresses wise and Destination ports wise Connection details for selected User.
Upload Transfer
Data uploaded.
Download Transfer
Data downloaded.
Upstream Bandwidth
Upstream bandwidth.
Downstream Bandwidth
Downstream bandwidth.
Sophos XG Firewall | Monitor and Analyze | 21
Total Connections
Displays number of connections initiated by the User.
Click Total Connections to view the connection details for selected User.
Figure 3: Live Connections IPv4 based on Username
Connections per Source IP Address
Use to determine the amount of traffic generated (bandwidth used) by source IP addresses in real time i.e. traffic per source IP address. It also displays which user is using a particular application currently and is consuming how much bandwidth.
Use to view:
•
Connection Details
•
Connection per Source IP Address and Application
Source IP Address
Source IPv4 Addresses requesting various applications.
Click to view list of Source IPv4 Addresses or click to hide the list of IP Addresses.
Upload Transfer
Data uploaded.
Download Transfer
Data downloaded.
Upstream Bandwidth
Upstream bandwidth.
Downstream Bandwidth
Downstream bandwidth.
Total Connections
Displays number of connections initiated by the Source IP Address.
Click Total Connections to view the connection details for selected User.
Figure 4: Live Connections IPv6 based on Source IP
Live Connections IPv6
Use Live Connections IPv6 page to view a list of all currently active IPv6 connections.
The page displays the IPv6 live connections report and offers to get a quick real-time statistics of the network traffic.
You can use this report to check the share in network load of different protocols, computer systems (in your LAN or in the Internet), connections, or a combination of these (e.g. network connections with a certain protocol). Drill down quickly to get an in-depth view of your network.
Sophos XG Firewall | Monitor and Analyze | 22
Connections per User
Used to determine the amount of traffic generated (bandwidth used) by users in real time i.e. traffic per user. It also displays which user is using a particular application currently and is consuming how much bandwidth.
Use to view:
•
Connection Details per User
•
Connections Details per User and Application
For each connection the list shows:
User
Network users requesting various applications
Click the icon to view the list of applications used by the user or click the icon to hide the list of applications.
Click number in Total Connections column against user to view destination IP address-wise and destination port-wise connection details for the selected user.
Upload Transfer
Data uploaded.
Download Transfer
Data downloaded.
Upstream Bandwidth
Upstream bandwidth.
Downstream Bandwidth
Downstream bandwidth.
Total Connections
Displays the number of connections initiated by the user.
Click the number in the Total Connections column to view the connection details for the selected user.
Figure 5: Live Connections IPv6 based on User
Connections per Source IP Address
Use to determine the amount of traffic generated (bandwidth used) by source IP addresses in real time i.e. traffic per source IP address. It also displays which user is using a particular application currently and is consuming how much bandwidth.
Use to view:
•
Connection Details
•
Connection per Source IP Address and Application
Source IP Address
Source IPv6 Addresses requesting various applications.
Click to view list of Source IPv6 Addresses or click to hide the list of IP Addresses.
Upload Transfer
Sophos XG Firewall | Monitor and Analyze | 23
Data uploaded.
Download Transfer
Data downloaded.
Upstream Bandwidth
Upstream bandwidth.
Downstream Bandwidth
Downstream bandwidth.
Total Connections
Displays number of connections initiated by the Source IP Address.
Click Total Connections to view the connection details for selected User.
Figure 6: Live Connections IPv6 based on Source IP
View Live Connection Details
The page displays the connection details per application, user, and source IP address.
Connection Details for the Selected Application
Click on the Total Connections link against the application to view its connection details.
Start Time
Time when connection was established.
In Interface
Traffic incoming interface.
Out Interface
Traffic outgoing interface.
Source IP
IP address from which the connection for the application was established.
Destination IP
IP address to which the connection was established.
Protocol
Protocol used by the traffic.
Source Port
Port through which the connection was established for the application.
Destination Port
Port to which the connection was established for the application.
Rule ID
Firewall rule ID applied to the connection traffic.
Upload Transfer
Data uploaded.
Download Transfer
Sophos XG Firewall | Monitor and Analyze | 24
Data downloaded.
Upstream Bandwidth
Upstream bandwidth.
Downstream Bandwidth
Downstream bandwidth.
Connection Details for the Selected Application and User
Click on the Total Connections link against the user name to view the connection details of the connections established by the user for the selected application.
Start Time
Time when connection was established.
In Interface
Traffic incoming interface.
Out Interface
Traffic outgoing interface.
Source IP
IP address from which the connection for the application was established.
Destination IP
IP address to which the connection was established.
Protocol
Protocol used by the traffic.
Source Port
Port through which the connection was established for the application.
Destination Port
Port to which the connection was established for the application.
Rule ID
Firewall rule ID applied to the connection traffic.
Upload Transfer
Data uploaded.
Download Transfer
Data downloaded.
Upstream Bandwidth
Upstream bandwidth.
Downstream Bandwidth
Downstream bandwidth.
Connection Details for the Selected User and Application
Click on the Total Connections link against the application to view the connection details of the connections established by the applications for the selected user.
Start Time
Time when the connection was established.
In Interface
Traffic incoming interface.
Sophos XG Firewall | Monitor and Analyze | 25
Out Interface
Traffic outgoing interface.
Source IP
IP address from which the connection for the application was established.
Destination IP
IP address to which the connection was established.
Protocol
Protocol used by the traffic.
Source Port
Port through which the connection was established for the application.
Destination Port
Port to which the connection was established for the application.
Rule ID
Firewall rule ID applied to the connection traffic.
Upload Transfer
Data uploaded.
Download Transfer
Data downloaded.
Upstream Bandwidth
Upstream bandwidth.
Downstream Bandwidth
Downstream bandwidth.
Connection Details of the Selected User
Click on the Total Connections link against the user to view its connection details.
Start Time
Time when the connection was established.
In Interface
Traffic incoming interface.
Out Interface
Traffic outgoing interface.
Source IP
IP address from which the connection for the user was established.
Destination IP
IP address to which the connection was established.
Protocol
Protocol used by the traffic.
Source Port
Port through which the connection was established for the user.
Destination Port
Port to which the connection was established for the user.
Rule ID
Firewall rule ID applied to the connection traffic.
Sophos XG Firewall | Monitor and Analyze | 26
Upload Transfer
Data uploaded.
Download Transfer
Data downloaded.
Upstream Bandwidth
Upstream bandwidth.
Downstream Bandwidth
Downstream bandwidth.
Connection Details of the Selected Source IP Address
Click on the Total Connections link against the source IP address to view its connection details.
Start Time
Time when the connection was established.
In Interface
Traffic incoming interface.
Out Interface
Traffic outgoing interface.
Source IP
IP address from which the connection for the source IP address was established.
Destination IP
IP address to which the connection was established.
Protocol
Protocol used by the traffic.
Source Port
Port through which the connection was established for the source IP address.
Destination Port
Port to which the connection was established for the source IP address.
Rule ID
Firewall rule ID applied to the connection traffic.
Upload Transfer
Data uploaded.
Download Transfer
Data downloaded.
Upstream Bandwidth
Upstream bandwidth.
Downstream Bandwidth
Downstream bandwidth.
Connection Details of the Selected Application and Source IP Address
Click on the Total Connections link against the application to view the connection details of the connections established by the application from the selected source IP address.
Start Time
Time when the connection was established.
In Interface
Sophos XG Firewall | Monitor and Analyze | 27
Traffic incoming interface.
Out Interface
Traffic outgoing interface.
Source IP
IP address from which the connection for the application was established.
Destination IP
IP address to which connection was established.
Protocol
Protocol used by the traffic.
Source Port
Port through which the connection was established for the application.
Destination Port
Port to which the connection was established for the application.
Rule ID
Firewall rule ID applied to the connection traffic.
Upload Transfer
Data uploaded.
Download Transfer
Data downloaded.
Upstream Bandwidth
Upstream bandwidth.
Downstream Bandwidth
Downstream bandwidth.
IPsec Connections
The page displays list of all the connected IPsec tunnels and you can filter the list based on connection name, local server name, local subnet, user name, remote server/host or remote subnet.
To view the IPsec connection, go to Monitor & Analyze > Current Activities > IPsec Connections. The administrator can disconnect any of the IPsec connection if required by clicking Disconnect or update the list by clicking Refresh.
The table IPsec Connections contains the following information:
• Name: Name of the IPsec connection.
• Local Sever: Name of the local server.
• Local Subnet: Name of the local subnet.
• Username: Name of the IPsec connection user.
• Remote Sever/Host: Name of the Remote Server/Host.
• Remote Subnet: Name of the Subnet.
Related Topics
IPsec Connections
on page 212
The IPsec menu allows you to create and manage IPsec connections and failover groups.
Remote Users
Use Remote Users page to view a list of active remote users.
To view Remote Users page, go to Monitor & Analyze > Current Activities > Remote Users.
