: Cloud NGFW for AWS CloudWatch Metrics
Focus
Focus

Cloud NGFW for AWS CloudWatch Metrics

Table of Contents

Cloud NGFW for AWS CloudWatch Metrics

Publish custom metrics in AWS CloudWatch for your Cloud NGFW for AWS resource.
Cloud NGFW for AWS publishes custom metrics in AWS CloudWatch to help you monitor your Cloud NGFW's health, performance and usage patterns. With these additional metrics you can assess the overall health of your Cloud NGFW resources, identify performance bottlenecks and detect anomalies. These metrics are numerical values describing aspects of a Cloud NGFW at a particular time. Collected every five minutes, metrics are useful for alerting due to their frequent sampling.
The CloudWatch log group, S3 bucket, CloudWatch namespace and the Kinesis stream should be pre-created in the Cloud Formation Template (CFT).
Metrics are collected every five minutes. All metrics are published to one namespace. CloudWatch stores your metrics, so that you can access historical information for added perspective on how your Cloud NGFW resources are performing. You can also set alarms that watch for certain thresholds, and send notifications or take actions when those thresholds are met. For more information, see the Amazon CloudWatch documentation.
The following CloudWatch metrics are supported by the Cloud NGFW resource:
Field Name
Description
Dataplane CPU Utilization (%)
Monitors dataplane CPU usage and measures the traffic load on the Cloud NGFW resource.
Dataplane Packet Buffer Utilization (%)
Monitors dataplane buffer usage and measures buffer utilization. If you have a sudden burst in traffic, monitoring your buffer utilization allows you to ensure that the firewall does not deplete the dataplane buffer, which results in dropped packets.
Connection per Second
Represents the total number of concurrent TCP connections.
Session Throughput Kbps
The session throughput, measured in Kbps.
Session Throughput Pps
The session throughput, measured in Pps.
Sessions Active
Monitors the total number of sessions that are active on the Cloud NGFW resource. An active session is a session that is in the flow lookup table for which packets will be inspected and forwarded, as required by policy.
Session Utilization (%)
Monitors the TCP, UDP, ICMP and SSL sessions that are currently active and the packet rate, new connection establish rate, and firewall throughput to determine session utilization.
BytesIn
Number of bytes in the server-to-client direction of the session.
BytesOut
Number of bytes in the client-to-server direction of the session.
PktsIn
Number of server-to-client packets for the session.
PktsOut
Number of client-to-server packets for the session.
To publish CloudWatch Metrics:
  1. Log into your Cloud NGFW resource.
  2. Select NG Firewalls.
  3. Select Log Settings.
  4. Under Metrics, specify the following:
    1. CloudWatch Namespace. This field represents the location on AWS where the metrics are collected.
    2. CloudWatch Metric. Select the metrics you want to monitor. See the table above for supported metrics.
  5. Click Save.
A sample output of metrics displayed in an account resemble: