topic Re: Custom view for getting Remote Access User Stats in Firewall and Security Management

Custom view for getting Remote Access User Stats

Jacques_Spelier — Wed, 25 Mar 2020 12:59:36 GMT

Hi Everyone,

Figured since in our current world state of COVID19, a lot of our companies have enabled remote capabilities for our users. I have created a custom view that will list "mobile" users by gateway, then Client Name. I will display time user connected (nice to see if user having issue if multiple times), source, OS Name and OS version. You can also add Machine Name which can be helpful if you want to know user's home PC if they have multiple hosts.

It is a view template built under R80.10. Import it and have fun. Feel free to tweak as you need.

Enjoy.

Re: Custom view for getting Remote Access User Stats

PhoneBoy — Fri, 27 Mar 2020 19:07:16 GMT

Thanks for providing this!
I've "featured" this thread to hopefully make it easier for people to find.

Re: Custom view for getting Remote Access User Stats

Alex_Alborzfard — Mon, 30 Mar 2020 17:02:23 GMT

This is great. How (what tool) can it be edited/tweaked? I'd like to add the machine names.

Thanks,

Alex

Re: Custom view for getting Remote Access User Stats

Alex_Alborzfard — Mon, 30 Mar 2020 17:50:02 GMT

Never mind. I was able to figure it out.

Re: Custom view for getting Remote Access User Stats

PhoneBoy — Mon, 30 Mar 2020 17:50:34 GMT

The same tool you use to view it: Logs and Reports.
You should be able to change the report after importing it to include this.

Re: Custom view for getting Remote Access User Stats

ronitre — Tue, 31 Mar 2020 12:05:58 GMT

Hi,

can you explain please how to import that 7Z file into the machine?

Re: Custom view for getting Remote Access User Stats

Ajay_Kumar_Pate — Tue, 31 Mar 2020 12:14:26 GMT

Where is the option , can you please share the steps and path so that i can check the same on my firewall.

i have office mode RA vpn, is it work ot it is only for Mobile blade

Re: Custom view for getting Remote Access User Stats

Jacques_Spelier — Tue, 31 Mar 2020 12:28:22 GMT

Hi there,

The file I included is a view template. You can find the steps on how to import it into the Log and Monitor by referring to page 35 of the "R80.10 Logging and Monitoring Admin Guide"

The view will sort by Client type. In my case I can see my Endpoint Security VPN (IPSEC), Checkpoint Mobile (IPSEC) and Mobile Access Portal (SSLVPN) clients. You can also edit and add another column for client machine name if that is required.

Enjoy.

Re: Custom view for getting Remote Access User Stats

Niraj — Tue, 31 Mar 2020 13:20:47 GMT

HI,

I am having SmartConsole R80.30. can same template will be used in this version?

Regards,

Niraj Dave

Re: Custom view for getting Remote Access User Stats

PhoneBoy — Tue, 31 Mar 2020 15:43:30 GMT

You should be able to use it in any R80.x version.

Re: Custom view for getting Remote Access User Stats

PhoneBoy — Tue, 31 Mar 2020 15:46:54 GMT

First, decompress the file with 7-Zip.
Then, in SmartConsole > Logs and Monitor > Reports, click Actions and Import Template.

Re: Custom view for getting Remote Access User Stats

Niraj — Tue, 31 Mar 2020 15:49:48 GMT

Thanks for update. I need userwise details in this report.

Can we able to extract in this report?

Thanks and Regards,

Niraj Dave

Re: Custom view for getting Remote Access User Stats

PhoneBoy — Tue, 31 Mar 2020 16:41:19 GMT

There are two other reports that might be helpful:
https://community.checkpoint.com/t5/Remote-Access-Solutions/Monitoring-applications-and-data-volume-related-to-remote-access/m-p/79147#M2739
https://community.checkpoint.com/t5/Visibility-Analytics/SmartView-VPN-Client-enhanced-view/td-p/78873/jump-to/first-unread-message

Re: Custom view for getting Remote Access User Stats

ronitre — Wed, 01 Apr 2020 09:30:36 GMT

Thank you for the explanations,

but I don't have the icons open/new/export/actions...

> show version all

Product version Check Point Gaia R80.10
OS build 462
OS kernel version 2.6.18-92cpx86_64
OS edition 64-bit

Re: Custom view for getting Remote Access User Stats

PhoneBoy — Wed, 01 Apr 2020 13:14:47 GMT

Reports (custom or otherwise) require SmartEvent.
You need to enable SmartEvent, as described in the screenshot.

Re: Custom view for getting Remote Access User Stats

ronitre — Wed, 01 Apr 2020 14:30:17 GMT

Thank you very much !!!

Re: Custom view for getting Remote Access User Stats

Wowos — Fri, 10 Apr 2020 09:00:43 GMT

Hey, I'm trying to import this template to my R80.30. After selecting the template I recieve "Import completed successfully" prompt, but nothing else. There are no new templates in the Reports window. Anyone had that problem?

Re: Custom view for getting Remote Access User Stats

Jacques_Spelier — Mon, 20 Apr 2020 16:39:58 GMT

Hi there,

Did you look under the views? This is a view template and not a report one. The view can be scheduled and sent via email in csv, pdf or xml format.

Hope this helps.

Re: Custom view for getting Remote Access User Stats

marciojss_check — Thu, 12 Nov 2020 16:05:05 GMT

My dash is with transferred total bytes in O, Can you help me?

Re: Custom view for getting Remote Access User Stats

Jacques_Spelier — Fri, 13 Nov 2020 13:24:01 GMT

Hi there. I think the issue may be related with the log tracking option on the related rules for you mobile users. Make sure that Logging has "accounting" checked on and both "per connection" and "per session" checked on as well. This will provide the required data in the logs so that Smartevent can parse for the report.