topic Re: How to Monitor Concurrent VPN users connected to a Gateway (OID) in Firewall and Security Management

How to Monitor Concurrent VPN users connected to a Gateway (OID)

WillGonzalez — Fri, 27 Mar 2020 01:49:30 GMT

Dear Checkmates,

If a customer have asked to you how to monitor the concurrent VPN sessions per user with a specific SNMP tool you will have to follow the following procedure:

1. Login to the Gateway via SSH
2. From clish run the command "show configuration snmp" to check which is your community

The Output should be something like this:
CPSG> show configuration snmp
set snmp mode default
set snmp agent on
set snmp agent-version any
set snmp community labtest read-only
add snmp interface eth2.4
add snmp interface lo

Note: The community in this case is "labtest"

3. Go again to expert mode and create a directory:
CPSG# mkdir /var/log/snmpmon_script

4. Navigate to the directory you created in the previous step
CPSG# cd /var/log/snmpmon_script

5. Create a script in which you will put the following command:

CPSG# vi vpnconcurrentmon.sh

fw tab -t userc_users -s | awk '{print $4}' | grep -v -e "#VALS"

Notes: If you want to insert press "i" then paste the command and to save the changes and exit type
5.1. ":"
5.2. "wq!"
5.3. "Enter"

6. Then we have to make sure that the script that we have created works "sh vpnconcurrentmon.sh"
-It should give you the number of concurrent VPN users

7. Then you have to use snmpwalk to make sure your firewall is not using the OID you are about to configure:
CPSG# snmpwalk -v 2c -c labtest localhost .1.2.3.4.5.6.7.8.15

Note: The OID that we want to use in this case is: .1.2.3.4.5.6.7.8.15

8. Then we will create a copy of the original file, to have a copy and modify the original:
CPSG# cd /etc/snmp
CPSG# cp userDefinedSettings.conf userDefinedSettings.conf_original

9. Then to modify the original file we have to make a new "vi" to the file named: "userDefinedSettings.conf"
CPSG# vi userDefinedSettings.conf

9.1 In the editor add the line at the end of the comments "#":
extend .1.2.3.4.5.6.7.8.15 process_monitor /bin/sh /var/log/snmpmon_script/vpnconcurrentmon.sh

10. In clish mode restart snmp services:
CAT-EP> set snmp agent off
CAT-EP> set snmp agent on
CAT-EP> save config
CAT-EP> exit

11. In expert mode validate your OID:

CPSG# snmpwalk -v2c -c labtest localhost .1.2.3.4.5.6.7.8.15
iso.2.3.4.5.6.7.8.15.1.0 = INTEGER: 1
iso.2.3.4.5.6.7.8.15.2.1.2.15.112.114.111.99.101.115.115.95.109.111.110.105.116.111.114 = STRING: "/bin/sh"
iso.2.3.4.5.6.7.8.15.2.1.3.15.112.114.111.99.101.115.115.95.109.111.110.105.116.111.114 = STRING: "/var/log/snmpmon_script/concurrentvpn.sh"
iso.2.3.4.5.6.7.8.15.2.1.4.15.112.114.111.99.101.115.115.95.109.111.110.105.116.111.114 = ""
iso.2.3.4.5.6.7.8.15.2.1.5.15.112.114.111.99.101.115.115.95.109.111.110.105.116.111.114 = INTEGER: 5
iso.2.3.4.5.6.7.8.15.2.1.6.15.112.114.111.99.101.115.115.95.109.111.110.105.116.111.114 = INTEGER: 1
iso.2.3.4.5.6.7.8.15.2.1.7.15.112.114.111.99.101.115.115.95.109.111.110.105.116.111.114 = INTEGER: 1
iso.2.3.4.5.6.7.8.15.2.1.20.15.112.114.111.99.101.115.115.95.109.111.110.105.116.111.114 = INTEGER: 4
iso.2.3.4.5.6.7.8.15.2.1.21.15.112.114.111.99.101.115.115.95.109.111.110.105.116.111.114 = INTEGER: 1
iso.2.3.4.5.6.7.8.15.3.1.1.15.112.114.111.99.101.115.115.95.109.111.110.105.116.111.114 = STRING: "2"
iso.2.3.4.5.6.7.8.15.3.1.2.15.112.114.111.99.101.115.115.95.109.111.110.105.116.111.114 = STRING: "2"
iso.2.3.4.5.6.7.8.15.3.1.3.15.112.114.111.99.101.115.115.95.109.111.110.105.116.111.114 = INTEGER: 1
iso.2.3.4.5.6.7.8.15.3.1.4.15.112.114.111.99.101.115.115.95.109.111.110.105.116.111.114 = INTEGER: 0
iso.2.3.4.5.6.7.8.15.4.1.2.15.112.114.111.99.101.115.115.95.109.111.110.105.116.111.114.1 = STRING: "2"
CPSG#
CPSG# fw tab -t userc_users -s | awk '{print $4}' | grep -v -e "#VALS"
2

11.1 Then use again the snmpwalk command to navigate to the correct OID:
CPSG# snmpwalk -v2c -c labtest localhost .1.2.3.4.5.6.7.8.15.4.1.2.15.112.114.111.99.101.115.115.95.109.111.110.105.116.111.114.1

Re: How to Monitor Concurrent VPN users connected to a Gateway (OID)

cdooer — Mon, 30 Mar 2020 16:09:50 GMT

Good morning everyone. We're doing this currently with SolarWinds NPM, and we went about it slightly different. We currently have our entire organization working from home, connected to two separate VPN gateway clusters. This is what we did;

1.) Enable SNMP in Gaia, and make sure your poller has SNMP access to it via the rulebase on the gateway.

2.) Make sure SolarWinds NPM has discovered the gateway, and is actively monitoring it.

3.) From the SolarWinds server, open the Universal Device Poller tool, and create a new Universal Device Poller;

4.) Setup the OID, give it a name, and set the polling interval;

5,) Assign it to the nodes you want to monitor;

That's pretty much it. Here's an example of what the graphs look like;

Re: How to Monitor Concurrent VPN users connected to a Gateway (OID)

Thomas_Eichelbu — Mon, 30 Mar 2020 16:53:06 GMT

Hello!

wow this is a cool thing, but can you explain, why i see too little users when i run the same stuff on a R80.20SP plattform?

[Expert@NWATSBGFWCL01-ch01-04(active)# g_fw tab -t userc_rules -s
1_01:
HOST NAME ID #VALS #PEAK #SLINKS
localhost userc_rules 164 98 877 0
1_02:
HOST NAME ID #VALS #PEAK #SLINKS
localhost userc_rules 164 98 876 0
1_03:
HOST NAME ID #VALS #PEAK #SLINKS
localhost userc_rules 164 98 877 0
1_04:
HOST NAME ID #VALS #PEAK #SLINKS
localhost userc_rules 164 98 877 0
[Expert@NWATSBGFWCL01-ch01-04(active)# ./vpnconcurrentmon.sh
94

i see 98 connected to the Maestro, but the script shows me 94?

is there a logical explanation?

best regards
Thomas.

Re: How to Monitor Concurrent VPN users connected to a Gateway (OID)

Egenity — Mon, 30 Mar 2020 22:52:26 GMT

This is exactly the information I was looking for.

However, I am getting really strange results:

[Expert@auc01-fw-ext01-a:0]# snmpget -c public -v 1 172.18.160.2 .1.3.6.1.4.1.2620.1.2.5.4.23.0
SNMPv2-SMI::enterprises.2620.1.2.5.4.23.0 = STRING: "163"
[Expert@auc01-fw-ext01-a:0]# fw tab -t userc_users -s
HOST NAME ID #VALS #PEAK #SLINKS
localhost userc_users 147 72 87 0

As you can see, 72 vs 163.

Did you encounter anything like this?

On another gateway, I am getting 6 vs 279.

Re: How to Monitor Concurrent VPN users connected to a Gateway (OID)

cdooer — Mon, 30 Mar 2020 22:57:46 GMT

Hi there. It took some trial and error on our part as well, but what I noticed is that is you drop the '0' (zero), you get the proper result. It seems as though adding that final zero gives you the high water mark for the most connected clients the gateway has seen at one time.

Try 1.3.6.1.4.1.2620.1.2.5.4.23, and see if you get the desired results.

Re: How to Monitor Concurrent VPN users connected to a Gateway (OID)

Andreas_Schreib — Tue, 31 Mar 2020 07:33:36 GMT

I use on R80.20 the MIB iso.3.6.1.4.1.2620.500.9000.1.2 and get all current Users via SNMPv3.

Then we wrote a own check-plugin additional to the standard Checkpoint Plugins to have a overview on our "Check MK" monitoring server with counter and usernames.

The check is a little bit rudimentary (not much configurable now) but perhaps it´s useful for someone else here:

#!/usr/bin/python
# -*- encoding: utf-8; py-indent-offset: 4 -*-
# +------------------------------------------------------------------+
# | ____ _ _ __ __ _ __ |
# | / ___| |__ ___ ___| | __ | \/ | |/ / |
# | | | | '_ \ / _ \/ __| |/ / | |\/| | ' / |
# | | |___| | | | __/ (__| < | | | | . \ |
# | \____|_| |_|\___|\___|_|\_\___|_| |_|_|\_\ |
# | |
# | Copyright Mathias Kettner 2014 mk@mathias-kettner.de |
# +------------------------------------------------------------------+
#
# This file is part of Check_MK.
# The official homepage is at http://mathias-kettner.de/check_mk.
#
# check_mk is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
# the Free Software Foundation in version 2. check_mk is distributed
# in the hope that it will be useful, but WITHOUT ANY WARRANTY; with-
# out even the implied warranty of MERCHANTABILITY or FITNESS FOR A
# PARTICULAR PURPOSE. See the GNU General Public License for more de-
# tails. You should have received a copy of the GNU General Public
# License along with GNU Make; see the file COPYING. If not, write
# to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor,
# Boston, MA 02110-1301 USA.

# .1.3.6.1.2.1.1.1.0 Linux gateway1 2.6.18-92cp #1 SMP Tue Dec 4 21:44:22 IST 2012 i686
# .1.3.6.1.4.1.2620.1.1.25.3.0 19190

#checkpoint_connections_default_levels = (40000, 50000)

import datetime

vpn_states = {
    "3": "Active",
    "4": "Destroy",
    "129": "Idle",
    "130": "Phase1",
    "131": "Down",
    "132": "Init",
}

def inventory_checkpoint_vpnconnections(info):
# pprint.pprint(info)
return [(None, None)]

def check_checkpoint_vpnconnections(item, params, info):
    state = 0
    counter = 0
    infotext1 = ""

    for lauf in info:
#        print (lauf[2])
        user = lauf[0].split("@")
        starttime = saveint(lauf[2])
        timea = datetime.datetime.fromtimestamp(starttime)
        timeb = timea.strftime("%m/%d/%Y, %H:%M:%S")
#        print (timea)
        infotext1 += user[0] + " Status: " + vpn_states[lauf[1]] + " Since: " + timeb + "\n"
        counter =+ counter +1

#        + vpn_states[lauf[1]
#                + " since : " + datetime.fromtimestamp(lauf[2]) + "\n"
    infotext=("%d VPN Connections\n" % counter )
    return state, infotext + infotext1, [("vpnconnctions", counter)]

check_info["checkpoint_vpnconnections"] = {
    "check_function": check_checkpoint_vpnconnections,
    "inventory_function": inventory_checkpoint_vpnconnections,
    "service_description": "VPNConnections",
    "has_perfdata": True,
    "group": "checkpoint_connections",
    "snmp_scan_function": scan_checkpoint,
    "snmp_info": (".1.3.6.1.4.1.2620.500.9000.1" , [ "2", "4", "29" ]),
    "includes": ["checkpoint.include"],
}

Regards,

Andi

Re: How to Monitor Concurrent VPN users connected to a Gateway (OID)

MattG — Tue, 31 Mar 2020 08:50:54 GMT

Results from fw tab -t userc_users -s differ greatly from OID 1.3.6.1.4.1.2620.1.2.5.4.23.0, SmartConsole and SmartView Monitor in our environment (R80.30 Take 111). I raised a support call about it and a fix was provided in Take 155 (see PRJ-3404, PRJ-5954, VPNS2S-417 SmartView Monitor VPN tunnel status may show incorrect or missing tunnels status for a cluster object.) However, when I installed this in production it made the problem worse with the figures wildly different to fw tab. I have raised a new call now and been provided with another hotfix. I'm not going to be able to deploy that in production for a while as it involves a simultaneous reboot of both cluster members so have gone down the SNMP extend script route now for our monitoring.

Re: How to Monitor Concurrent VPN users connected to a Gateway (OID)

ascoyne — Tue, 31 Mar 2020 09:12:22 GMT

Are you sure 1.3.6.1.4.1.2620.1.2.5.4.23 is the right OID?

I have checked against our 5800 firewalls and that OID is for cpvIpsecUdpEspDecPkts ("IPsec UDP ESP decrypted packets"), not VPNConnectedUsers.

We are running R80.30.

Re: How to Monitor Concurrent VPN users connected to a Gateway (OID)

Egenity — Tue, 31 Mar 2020 14:25:06 GMT

I did try without the .0 on the end and got an SNMP error. The environment I tested on is R80.10, which is slated for upgrade soon anyway. Obviously from all the discussion here, the various releases produce different results, and there also appears to be bugs surrounding this. Looks like I will have to fallback on a script to get the data, like original solution at the top of this thread.

Re: How to Monitor Concurrent VPN users connected to a Gateway (OID)

WillGonzalez — Tue, 31 Mar 2020 17:41:53 GMT

Hello Adam,

Make sure you are using a specific OID that is not being used by something else, remember that you have to navigate to the specific number of OID that has the number of your current vpn sessions,

Regards,

Re: How to Monitor Concurrent VPN users connected to a Gateway (OID)

Jacopo_Vigano — Wed, 01 Apr 2020 08:59:15 GMT

Hi,

in this case I should see the RA Users by Endpoint Security client . Are there any method to see the Mobile Access Users via SNMP?

Thanks.

Jacopo

Re: How to Monitor Concurrent VPN users connected to a Gateway (OID)

PhoneBoy — Wed, 01 Apr 2020 13:16:47 GMT

May need a patch from TAC to resolve this on R80.10.

Re: How to Monitor Concurrent VPN users connected to a Gateway (OID)

Diego_Carreno — Fri, 03 Apr 2020 18:56:05 GMT

Thank you very much, it has been very useful to me!

Re: How to Monitor Concurrent VPN users connected to a Gateway (OID)

Egenity — Mon, 06 Apr 2020 17:33:16 GMT

Well, even after upgrade to R80.30 T155, same results. So, I gave up and did the original SNMP script solution described at the beginning of this thread. Works great, but a custom mod that must be tracked between major upgrades.

My client is happy with solution. I do wish there was a reliable OID that truly returned the same result as "fw tab -t userc_users -s"

Re: How to Monitor Concurrent VPN users connected to a Gateway (OID)

Troy_Yeske — Thu, 14 May 2020 15:54:30 GMT

Learning SNMP, bare with me: I was wondering why the OID .1.2.3.4.5.6.7.8.15 was used? Is that just an example? I’m trying to poll using What’s Up Gold but it defaults to 1.3.6.1 when setting up a poll due to the Checkpoint mib that is loaded. Any assistance would be appreciated.

Re: How to Monitor Concurrent VPN users connected to a Gateway (OID)

cowboyx2 — Thu, 14 May 2020 16:28:32 GMT

Thanks for the step by step. I am not finding the 1.3.6.1.4.1.2620.1.2.5.4.23 oid in the Universal Device Poller. I even did a MIB update. Any suggestions?

Re: How to Monitor Concurrent VPN users connected to a Gateway (OID)

Americo_two — Thu, 01 Apr 2021 15:08:33 GMT

I think it is one OID pre defined on GAIA OS to add your own commands.

Re: How to Monitor Concurrent VPN users connected to a Gateway (OID)

marcio_ota — Thu, 06 Feb 2025 19:18:16 GMT

Always return 0

Re: How to Monitor Concurrent VPN users connected to a Gateway (OID)

marcio_ota — Thu, 06 Feb 2025 19:22:21 GMT

How to set virtual system 1 ?