NSX DFW - Traffic Dashboard

[matt_sweet]

In LogInsight 3.6 with the NSX content pack at the Distributed Firewall - Traffic Dashboard.

My query is on vmw_nsx_firewall_ruleid = 1010 this rule is a deny rule in NSX. The only widget that populates is "Application ports denied". IP sources or destination IP addresses do not populate.

When looking at the query that drives "Top Firewall Destinations" it is filtering on vmw_nsx_firewall_action  contains pass. How do I get rid of the "Pass" in the widget on the dashboard so I can see all the data on the Dashboard correctly?

[admin · Accepted solution]

Hi,

You will need to clone the widget to the My Dashboard section, then navigate to my dashboards ( to the dashboard you cloned it to) then on the widget gear menu select the option 'Edit in Interactive Analytics',

The widget query in Interactive Analytics is now editable and you can remove the filter for the field vmw_nsx_firewall_action ; click the Save button on the bottom right of your screen and select 'Return to Dashboard' menu.

This procedure will modify the widget query for you on your dashboard; the original widget that came in the content pack will not change. If you'd like the widget query in the content pack modified and think this is a bug, we can open a defect for it and it will get updated in the next update of the content pack.

Hope this helps!

[matt_sweet]

Hi,

Thanks for the reply!

I believe its a bug. I would think the title of the widget would clarify "Pass" or "Drop" in the title of it.

[admin]

Thanks for the feedback, I have filed a bug report and we will address this in the next update of the content pack. Please mark this post as answered if this solves your query. Thanks again.

[matt_sweet]

yogitap‌ would you happen to have the PR number? I've asked our TAM about it and he has requested the PR number for the bug report to be able to track it for us. Thanks!

[admin]

Can you ask the TAM to contact me directly, I'll keep him in the loop about the PR. Thanks!