NGFW Management and Monitoring
Domain 4 covers day-to-day operation through the SMC: finding and filtering logs, building views and reports, configuring alerts, administering roles and domains, and protecting management data. The exam tests whether you can locate evidence and distinguish audit from traffic records.
Logs, views and reports
- Log Servers store traffic, IPS, anti-malware and system events. The Management Server stores configuration and audit records.
- Log Explorer filters by engine, time, source, destination, service, action, rule and inspection. Filters can be saved as views for repeat use.
- NAT affects what appears in logs: you may see translated addresses rather than original client addresses, so search both.
- Reports can be scheduled and exported. Dashboards and situational awareness views summarize trends, but raw logs remain the evidence for a single connection.
- Alerts can send email, SNMP traps or syslog. An alert rule must match the event you care about; a dashboard alone does not notify anyone.
Administration and data protection
- Administrator roles and domains limit what an admin can see and change. A domain-scoped admin may not see global objects or logs.
- The audit log records configuration changes and admin actions. It does not record every allowed connection; use traffic logs for that.
- Back up the Management Server and Log Server before upgrades or major policy changes, and test restore procedures.
- Monitor engine status, node status, cluster state, policy version and license validity. A node can be up but running an old policy.
Worked example
Users report that a CRM site is blocked. In Log Explorer, filter by destination host, TCP 443 and the edge cluster. The matching entry shows a Discard from a rule above the intended allow rule. The log also shows the NAT-translated destination, which is why the original search missed it. Move the specific allow rule above the broad rule, attach the correct inspection policy, install to the cluster, then re-test and confirm a new Allow entry. Add an alert for repeated Discards on that rule. Reasoning: evidence first, then rule order and NAT interpretation, then verification.
Traps that cost marks
- Searching audit logs for blocked connections.
- Forgetting that NAT changes logged addresses.
- Assuming a domain-scoped admin sees all logs.
- Treating a green dashboard as proof that the current policy is installed.
- No backup before an upgrade or no tested restore.