topic Re: Remote VPN users report in Firewall and Security Management

Remote VPN users report

Moe_89 — Mon, 01 Apr 2019 18:19:33 GMT

Hello,

Is there a way to export a list of Remote VPN users in the local MGMT database which includes last login time etc. ?

Something similar to fwm dbexport.

Re: Remote VPN users report

PhoneBoy — Thu, 26 Aug 2021 16:25:05 GMT

You can get a list of the users easily enough using the following command:

mgmt_cli -r true --format json show generic-objects class-name com.checkpoint.objects.classes.dummy.CpmiUser | jq .objects[].name

Note: there is no official API support for locally defined users, so "generic objects" have to be used here.
If you have more than 500 users, you will have to execute variants of this command multiple times.
For example, to get the next 500 users:

mgmt_cli -r true --format json show generic-objects class-name com.checkpoint.objects.classes.dummy.CpmiUser limit 500 offset 500 | jq .objects[].name

Last login time is not something we store in the user database (generic objects or not), so you'll have to get it from the logs. Couple threads on this:

Re: Remote VPN users report

Scott_Perry1 — Mon, 24 Jun 2019 14:10:11 GMT

PhoneBoy,

Tried the command, it errored out (image attached). Am in expert mode. Here is the error. Thank you for your time.

Re: Remote VPN users report

Andres_Solari — Mon, 05 Aug 2019 14:59:54 GMT

Hello, how i can list 700 users, where i must put the offset command. Thanks in advance.

Re: Remote VPN users report

Andres_Solari — Mon, 05 Aug 2019 16:16:14 GMT

I resolved, with the next command "mgmt_cli -r true --format json show generic-objects class-name com.checkpoint.objects.classes.dummy.CpmiUser limit 500 offset 0 | jq .objects []. Name" but have 760 users, how can I fix it? thanks in advance

Re: Remote VPN users report

PhoneBoy — Sun, 15 Mar 2020 04:35:04 GMT

You have to ask for the next 500 results like so:
mgmt_cli -r true --format json show generic-objects class-name com.checkpoint.objects.classes.dummy.CpmiUser limit 500 offset 500 | jq .objects[].Name

Note: parent post was edited with this response.

Re: Remote VPN users report

Andres_Solari — Mon, 05 Aug 2019 20:02:53 GMT

Thanks for the solution!!

Re: Remote VPN users report

badz — Thu, 13 Feb 2020 08:04:27 GMT

For R80.30 CP. How to export VPN users indicating their corresponding groups or extracting the groups listing their members

Re: Remote VPN users report

Scott_Perry1 — Fri, 06 Mar 2020 19:27:11 GMT

Thank you all for providing updates methods to obtain the necessary information. Is there a way to relatively easily show the following:

1. List of concurrent connections

2. Time of the week which has more usage

3. Average concurrent users

4. Peak concurrent users

5. User average

6. Bandwidth usage

With the COVID-19 virus forcing companies to allow/accept more working from home, the information will become critical to me from a planning perspective.

Thank you,

Scott

Re: Remote VPN users report

PhoneBoy — Fri, 06 Mar 2020 19:48:57 GMT

I believe the only way to get most of this information is SmartView Monitor.

Open SmartConsole > Logs & Monitor.
Open the catalog (new tab).
Click Tunnel & User Monitoring.

Refer to the Logging and Reporting guide for your specific version.
Note this may require the Monitoring blade to be enabled on your gateway, which might have a performance impact.

Re: Remote VPN users report

Garrett_DirSec — Mon, 09 Mar 2020 19:46:43 GMT

Great question posed by @Scott_Perry1 monitoring remote access VPN usage metrics.

here's link to latest/greatest R80.40 Logging and Monitoring Admin Guide

check the "note" on page // views and reports / Reports

Note - For Security Gateways R77.30 and lower, the ability to generate reports on Firewall and VPN activity is integrated into SmartConsole. To enable this functionality, activate the Firewall session event on the SmartEvent Policy tab. Select and enable Consolidated Sessions > Firewall Session.

The R77.30 reference does remind me of pain experienced by numerous customers when they upgraded SmartEvent/SmartReporter to the new NGSE (and subsequently R80.xx SmartEvent). Incorporating R77.30 SmartReporter features directly into R80.xx SmartEvent (with one database back-end) was good decision but customers did lose functionality (the big taboo).

R77.30 SmartReport included a great per-user report template for remote VPN usage. This report -- and the associated access or similar relevant data -- disappeared with NGSE and the incorporated reporting in R80.xx SmartEvent.

One customer in particular spent lots of cycles talking with R&D. The idea was to understand the R77.30 report and try to replicate in R80.xx SmartEvent. There was not a comprehensive "YES" to everything -- AND -- the various data points were available in various different places and metrics (if I recall correctly).

I don't feel the customer's issues were ever resolved to satisfaction but I do understand some improvements were made with subsequent releases.

However, I would repeat this "should be easier".

Please bring back the R77.30 SmartReport template for remote access VPN usage.

reference:

1. List of concurrent connections

2. Time of the week which has more usage

3. Average concurrent users

4. Peak concurrent users

5. User average

6. Bandwidth usage

Re: Remote VPN users report

Jeff_Post — Wed, 11 Mar 2020 13:21:58 GMT

I agree, the information available is incomplete and difficult to access. So much so that I am starting to look at other solutions simply because I can not get metrics. The information that seems to be available is poor. While I can get a list of login in events, I have yet to see where I could get a list of concurrent vpn users over time. The issue, in my opinion, seems to be that user VPN is an add on feature to provide convenience for customers. The raw logs are available for you to do what you want with. Actual reports on VPN usage and statistics is lacking.

Jeff

Re: Remote VPN users report

Garrett_DirSec — Tue, 17 Mar 2020 22:34:11 GMT

Hello @PhoneBoy - we've been fielding various questions about remote VPN usage metrics and I've been referencing this checkmates thread.

I suggest CP R&D for SmartEvent reporting should take a queue on current global COVID status and provide quick JFA jumbo fix to SmartEvent to add the obvious VPN usage metrics discussed (in thread) in simple point/click report that can be scheduled and sent out via email.

My 0.02 -GA

Re: Remote VPN users report

PhoneBoy — Tue, 17 Mar 2020 23:41:26 GMT

Not sure how feasible this is, but it can't hurt to ask.
See also: https://community.checkpoint.com/t5/Logging-and-Reporting/A-Basic-Remote-Access-Report-for-R80-x/m-p/78322#M4536

Re: Remote VPN users report

Garrett_DirSec — Tue, 17 Mar 2020 23:52:18 GMT

@Jeff_Post. I sympathize. I get distinct feeling that CP really hasn't touched their core VPN functionality for years and effectively missed the mark with R80.xx SmartEvent VPN usage reporting. All the data points that were readily available in consolidated report with R77.xx SmartReport were not ported to new R80.xx SmartEvent reporting (sadly).

I will be creating a new Checkmates topic on this, but here's what I would recommend for current SASE alternatives (complete with Zero-Trust-Network-Access options). In addition, all following have good -- and mature -- multi-factor options that are well documented and mutually supported.

Netskope Private Access

Palo Alto Networks Prisma Access

Perimeter 81

side note: for whatever reason, the go-to-market Cloudguard Connect product doesn't include remote VPN option that I'm aware (ie. cloud-hosted VPN to cloud infrastructure). This is a huge head scratcher. Maybe CP doesn't want to cannibalize their existing MOB customer investments? Maybe the existing CP Cloudguard Connect global footprint is not ready for prime time (ie. points of presence across the globe)? we'll likely never know.

Re: Remote VPN users report

PhoneBoy — Tue, 17 Mar 2020 23:59:46 GMT

Believe we have started (or will soon) an EA program for CloudGuard Connect for Users.
@Tomer_Sole

Re: Remote VPN users report

Paul_Warnagiris — Wed, 18 Mar 2020 03:16:24 GMT

I need this SmartEvent output in any format other than GUI. XML/FlatFile/CSV, anything that I can use to inject the data into a customers' website in an automated fashion. Why do we need this? Because the customer needs this data for internal reasons that are beyond this thread. Particularly I need to know username and time of connect or duration of connection. Is there truly no way to do this other than to look at a GUI? Any guidance would be greatly appreciated.

Re: Remote VPN users report

Garrett_DirSec — Wed, 18 Mar 2020 03:28:51 GMT

hello @Paul_Warnagiris . this is a wonderful use-case. My apologies for ignorance, are you saying the various CLI recommendations provided in thread don't address your needs?

In my dream of dreams, the SmartEvent reports are generated via well documented API queries. Thus, the API is the most mature and documented environment available and everyone is tripping over each other to out-do each other on results.

Re: Remote VPN users report

Tomer_Sole — Wed, 18 Mar 2020 06:13:44 GMT

It is in the works.

Re: Remote VPN users report

Paul_Warnagiris — Wed, 18 Mar 2020 11:54:23 GMT

This is correct. It does not address my problem. I am capable of running Phoneboy's command and grabbing defined users, but not active users. And it doesn't show time connected. Most of the links are for historical reporting, even recently in the last 24 hours, but we are looking for something that is more real time.

This command below seems to have the most promise, but it doesn't show me duration of connection.

fw tab -t userc_rules -f

I get the user connected in the last 15 minutes, but I can't see the connected time.

What I'm trying to do specifically is to get a username and how long connected or when the user connected. And it needs to be something that is scripted. These are two of the data points shown in SmartViewMonitor>Users>All Users.

Unless I'm missing something I don't see it.

Thanks,
Paul