topic Re: Monitoring applications and data volume related to remote access sessions in SASE and Remote Access

Monitoring applications and data volume related to remote access sessions

Peter_Elmer — Sat, 21 Mar 2020 20:21:36 GMT

Following up the great work of @Tomas_Vobruba mentioning the importance of SmartView Remote Access support, I created the attached View.

It shows the how long the user was connected, which application she/he has accessed and that data volume transmitted. Check the video to learn more how you can use this view.

(view in My Videos)

Re: Monitoring applications and data volume related to remote access sessions

Jacopo_Vigano — Sun, 22 Mar 2020 12:22:27 GMT

Hi Peter,

are there any method to have a timeline with concurrent active users?

From your template we are able to see the timeline with login peak, but customer asking a timeline with concurrent users.

Thanks in advance.

Jacopo

Re: Monitoring applications and data volume related to remote access sessions

Paul_Kellett — Tue, 24 Mar 2020 18:49:41 GMT

Have a look over on this page too for some more details in reporting for VPN : https://community.checkpoint.com/t5/Visibility-Analytics/SmartView-VPN-Client-enhanced-view/m-p/78873

Designed to provide

- total time spend on VPN

- transferred total bytes.

- number of logs

- blade used

- client used for connection (workspace, endpoint, snx, etc)

- login fails and realauth schemes

Re: Monitoring applications and data volume related to remote access sessions

Jacopo_Vigano — Tue, 24 Mar 2020 22:12:31 GMT

I already reviewed the link you posted, but there are no any references regarding concurrent users.

Talking with a TAC Engineer, he told me that it seems there are not any method to get concurrent users from SmartEvent. It seems that this information is only available on the Gateway.

Thanks.

Jacopo

Re: Monitoring applications and data volume related to remote access sessions

Maarten_Sjouw — Tue, 24 Mar 2020 22:31:22 GMT

That is indeed the information I also got from R&D when I was trying to get the user numbers on an MDS per domain.

Re: Monitoring applications and data volume related to remote access sessions

Juan_ — Thu, 13 Aug 2020 08:06:39 GMT

Hi Peter,

Have tried this in lab and worked well.

However, integrating it in production (200+ RA users), hence, more users and log data causes the cpu to max out and ultimately to SmartLog/SmartEvent to fail.

Only recovering it with a evstop ; evstart, or waiting many hours.

This might probably be the reason: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk112138&partition=Advanced&product=SmartEvent

Do you know of any successful use cases in production environments?

In which case i may raise a SR to tac to see if there is something else going on with my Management.

Re: Monitoring applications and data volume related to remote access sessions

nasa — Tue, 25 Aug 2020 17:16:37 GMT

There is a SmartEvent License needed to use this feature, right ?

Re: Monitoring applications and data volume related to remote access sessions

PhoneBoy — Wed, 26 Aug 2020 00:39:35 GMT

Yes, these reports require a SmartEvent license.

Re: Monitoring applications and data volume related to remote access sessions

marciojss_check — Thu, 12 Nov 2020 15:54:44 GMT

My dash is with transferred total bytes in O, Can you help me?

Re: Monitoring applications and data volume related to remote access sessions

pavan_kalal — Mon, 14 Jun 2021 11:16:20 GMT

How to create his custom report ? can anyone explain in details R80.30.

Re: Monitoring applications and data volume related to remote access sessions

PhoneBoy — Mon, 14 Jun 2021 14:57:42 GMT

The report was attached to Peter’s original post and can be imported into R80.30.

Re: Monitoring applications and data volume related to remote access sessions

mbckymber — Wed, 08 Dec 2021 12:34:40 GMT

Hi Peter , Can u tell me why if when implement this solution , i have the cpu 100%?

Re: Monitoring applications and data volume related to remote access sessions

Peter_Elmer — Wed, 08 Dec 2021 17:47:34 GMT

Hi,

you may want to work with Secure Knowledge and TAC here, as high CPU load can have many reasons. You may want to get started with sk167553 and sk165853.

-pelmer