topic Log out designated RA VPN users in SASE and Remote Access

Log out designated RA VPN users

Ave_Joe — Fri, 03 Apr 2020 00:21:49 GMT

Good day everyone.

I am looking for advise on the best way to force designated RA User VPN users off of VPN.

The requirement is to force the user offline in such a way that they would have to authenticate again to (or not to) gain VPN access again.

In this use case the backend authentication is completed via AD. In testing disabling the user AD account does not automatically disconnect their VPN session.

Thoughts?

Re: Log out designated RA VPN users

PhoneBoy — Sun, 05 Apr 2020 03:50:49 GMT

You can use RAsession_util (a CLI-based tool) for this.
However, it is OFF by default and requires a cprestart in order to activate it.

Re: Log out designated RA VPN users

JozkoMrkvicka — Sun, 05 Apr 2020 05:31:58 GMT

1. Find user's source IP of his/her workstation

2. Go to the gateway where the user is connected and needs to be disconnected

3. Issue command "vpn tu"

4. Delete all IPsec+IKE SAs for a given User (Client)

5. Repeat steps 2-4 for all relevant gateways

6. User is disconnected from all desired gateways