topic How to disconnect SNX Users in General Topics

How to disconnect SNX Users

Herschel_Liang — Thu, 17 Dec 2020 11:15:12 GMT

Some user's passwords may be forced to attack by blackhat. It was used to login in SNX VPN and want to attack the client LAN.

The client found that and is worried about it. They want to disconnect that connection first.

I gave him one command: RAsession_util terminate byuser xxx

After executing that command, he executed two below commands:

RAsession_util show users byname xxx

listusers

but the output is quite different. Did he disconnect SNX User successfully? Why? How should I help the client? Could someone kindly explain what is the difference between the two commands?

Re: How to disconnect SNX Users

G_W_Albrecht — Thu, 17 Dec 2020 12:25:32 GMT

I think you mix up RAsession_util show users all (only for MAB/SNX users) and the VPN tables listusers from sk152132: How to Monitor the Exact Number of Active VPN Tunnels ?

Re: How to disconnect SNX Users

Herschel_Liang — Fri, 18 Dec 2020 00:33:06 GMT

sk152132 explain is very useful, but I confuse mobile access VPN admin guide description:

Disconnecting Remote Access Users
To disconnect a user:
RAsession_util terminate {all|byuser <user>|bysession_id <id>|custom <sql
constraint>}

It seems like that "RAsession_util terminate XXX" can only disconnect remote access VPN users. I remember that remote access VPN is IPSec VPN while SNX is SSL VPN.

Re: How to disconnect SNX Users

G_W_Albrecht — Fri, 18 Dec 2020 09:03:18 GMT

EPS VPN, Mobile and SecuRemote are the three IPsec VPN flavours, while Mobile Access and SNX uses SSL VPN and can be influenced using RAsession_util.