As I have mentioned recently, Check Point has release so called 3D Analysis tool to help partner in showing added values of Check Point technologies by analyzing live production traffic.
Although this tool is a great thing, there are some tips and tricks to make it work even better:
1. Licensing. The downloadable tool from Check Point has an expired license. Use your quick eval license on it.
2. Tapping. The official guide mentions tapping on the external interface of the cusotmer's FW. In this case bandwidth utilization will not show internal hosts. Identity Awareness information will also be unavailable. You may want to mirror the internal interface of the customer FW, in case topology in place is simple.
3. DLP policy is not set to customer's case. Do not forget to configure email domain properly before deploying the tool.
4. identity Awareness is not activated. If you want to enable it, mind p.2. Also do not forget to arrange connectivity to AD from the physical machine hosting 3D VM tool.
5. Policy installation. VM does not have any policy installed when you start it, do not forget this tiny detail.
If you have some other tips, please kindly share them in the comments.