topic Re: Scheduled report for VPN users usage in Firewall and Security Management

Scheduled report for VPN users usage

Alexander_Urits — Tue, 22 Jun 2021 21:18:59 GMT

Hi CheckMates.

I have a request for scheduled report for VPN users usage.

The request if for log for which users were connected last 24hrs and what resources they were using.

Regular VPN client (not MOB).

Any ideas how to accomplish that? (I can't find any VPN related tables on the reporting).

Thanks

Re: Scheduled report for VPN users usage

G_W_Albrecht — Tue, 21 Aug 2018 13:50:42 GMT

I do not know of reports for RA VPN users - but have a look into Remote Access Users license + count.

Re: Scheduled report for VPN users usage

Alexander_Urits — Tue, 21 Aug 2018 14:05:17 GMT

Thanks for the tip, unfortunately this is not the case (the requirement is to receive a report - which users were connected and which internal resources they have accessed).

Re: Scheduled report for VPN users usage

Steve_Moran1 — Tue, 21 Aug 2018 19:54:45 GMT

This is not a canned report, you'd need to use smart event and build a custom report. I have tried (without success) to build this report. There were similar reports in smart whatever the previous version of event was called, that would show all the users logged in for the previous 24 hours. If you have that, it may go a long way toward helping you. Otherwise, the data is all in the logs, its just a matter of figuring out how to extract it. Who was logged in the last 24 hours is canned, but what they were accessing, not so much.

Re: Scheduled report for VPN users usage

JozkoMrkvicka — Tue, 21 Aug 2018 20:53:36 GMT

Option 1:

Use SmartLog and select only logs which has action "Log in". You will get all users connected to the gateway. You can search also specific time range (24 hours).

In addition, save IP addresses of connected users and search those IPs to see what they accessed.

SmartLog has very nice overview of resource usage.

Option 2:

Use "fw log" on log server or management. I dont know exact command from hand, but I can give it to you once I am at work.

Option 3:

Use connection table with relevant info about connected users. This can be done only from gateways. This method is "real-time", so you can search only for users which are currently connected to the gateway.

Re: Scheduled report for VPN users usage

Di_Junior — Tue, 17 Mar 2020 09:43:17 GMT

Hi Jozko

Could you kindly share the command mentioned on OPTION 2.

Thanks in advance