topic Re: Remote vpn login logs are rewrite after authentication timeout (R80.20) in Firewall & Security Management

Remote vpn login logs are rewrite after authentication timeout (R80.20)

andquesada — Tue, 22 Jun 2021 21:05:18 GMT

Hi,

I hope someone can help me with the next issue;

When remote vpn users connect to office, we can see the login log; however when authentication timeout is reached and they put back the credentials they can connect without problem; but the first login log doesn´t appers and just appers the new login connection; is like the log was rewrited.

This log was from 5/5/2020 (first login)

and then, after reauthentication the first login log doesn´t appear just the new login.

In firewall rule I´m using all the track options but still not working.

Is a distributed environment with a dedicated smartevent server all in R80.20.

Thanks in advance

Re: Remote vpn login logs are rewrite after authentication timeout (R80.20)

Timothy_Hall — Fri, 08 May 2020 14:06:36 GMT

Try unchecking "Per Session" in your Track options for that rule, I think that is what is consolidating/amending your logs.

Re: Remote vpn login logs are rewrite after authentication timeout (R80.20)

andquesada — Fri, 08 May 2020 16:07:11 GMT

Thanks Timonthy;
I´ve already tried the following combinations:
1) Log + per connection : Failed
2) Log + per connection + per session : Failed
3) and the last one was: Log + per connection + per ssesion :Failed
Now I´m gonna use your suggestion and wait for reauthentication time waiting a good new.

Re: Remote vpn login logs are rewrite after authentication timeout (R80.20)

andquesada — Tue, 12 May 2020 20:11:31 GMT

Hi @Timothy_Hall ;

I did what you suggested; but the log still is being overwritten.

First Login was yesterday at 7:49:39;

Then after user´s reauthentication the log is overwritten

Any other recommendation?

Thanks in advance for your help

Re: Remote vpn login logs are rewrite after authentication timeout (R80.20)

PhoneBoy — Wed, 13 May 2020 02:49:15 GMT

Sounds like expected behavior but it might be worth a TAC case.

Re: Remote vpn login logs are rewrite after authentication timeout (R80.20)

lucafabbri365 — Fri, 15 May 2020 10:14:00 GMT

Hello guys,
I'm experiencing (it seems) the same behavior posted here: Mobile Access Log In and Log Out.

I opened a support ticket because, even if "expected", it doesn't make sense to me: why re-writing a past log entry ?!? Logs, in general, shouldn't be touched once written, isn't it ?

Bye,
Luca

Re: Remote vpn login logs are rewrite after authentication timeout (R80.20)

andquesada — Sat, 16 May 2020 00:26:49 GMT

Hi @lucafabbri365

I apologize because I put the SmartEvent was in R80.20; the SmartEvent version is R80.10; the cluster and mgmt are in R80.20

Anyway, before open a TAC case I put the last Jumbo hotfix for R80.10 (take_272) and today I did a the same test and now it works as it should.

The first login log

And now I see the login action of the re-authentication. I´m not sure why it appers as correlated and not as simple log but now the log is not overwrite.

I suggest you to do the same; Jumbo HF Take_141 is the last jumbo HF for R80.20 and you said you has Take 80; so maybe It could help you.

Re: Remote vpn login logs are rewrite after authentication timeout (R80.20)

lucafabbri365 — Sat, 16 May 2020 12:09:23 GMT

Hello @andquesada,
thank you for your suggestion.

We planned to install last Hotfix in GA (141) next 20th of May; there are some bug fixed routing around "log" world, so maybe it will be solved too.

I'll update this post.

Thank you,
Luca

Re: Remote vpn login logs are rewrite after authentication timeout (R80.20)

lucafabbri365 — Wed, 20 May 2020 13:09:34 GMT

Hello All,
just an update regarding this post: I finished to install hotfix 141 (Check Point R80.20); I'll monitor the behavior for a couple of days: I'll let you know if it solved.
I'm still waiting for an answer by Check Point support.

Bye,
Luca

Re: Remote vpn login logs are rewrite after authentication timeout (R80.20)

lucafabbri365 — Thu, 21 May 2020 08:02:50 GMT

Hello Community,

this morning I didn't find log-in event (blade:"Mobile Access") occurred yesterday morning for a user; maybe substituted by log-in event occurred yesterday afternoon. This issue doesn't occur every day: looking at previous events, for the same user, log-ins events are there, untouched: I can find occurred both in the morning and in the afternoon.

However hotfix 141 didn't fix the issue. I updated support ticket with these information and waiting for an answer.

Bye,
Luca

Re: Remote vpn login logs are rewrite after authentication timeout (R80.20)

lucafabbri365 — Thu, 21 May 2020 14:01:03 GMT

Hello guys,

I have another question regarding logs in general (let me know if it would be better to open another CheckMates post): referring to Mobile Access logs (blade:"Mobile Access") I see "duplicated" log entries (same Time, same Source, same User, same Mobile Access Session UID) coming from both active and standby firewall nodes (Origin column); it happens for SOME users only, WHY ? I don't think it is a "normal" behavior because it happens for SOME users only (not ALL), not always.

Thank you,
Luca