https://community.checkpoint.com/t5/SASE-and-Remote-Access/Way-to-collect-Remote-Access-user-and-duration-information/m-p/50353#M12371 <P>We are using an MFA product layered on top of Windows NPS.&nbsp;&nbsp; In the RADIUS Account records we can see our Cisco VPN sessions but CheckPoint VPNs don't show.&nbsp;&nbsp; I asked CheckPoint support about this and was told that CP does not do RADIUS Accounting.&nbsp;&nbsp; (If so, why are there settings for it?)</P><P>From what I can tell, it seems that CP will do RADIUS Accounting when it is needed by the RADIUS server to manage the IP address pool.</P><P>I looked at NPS and it seems that it won't return a single IP.&nbsp;&nbsp; It will at best return a fixed subnet.</P><P>Who then picks the single IP from that subnet?</P><P>Can NPS be made to return a single address?</P><P>If not, and it returns a subnet, can CheckPoint pick one IP?</P><P>And if all that works, will CheckPoint then send RADIUS Accounting records?</P><P>My goal is to be able to get a list of all logins with user names, times and durations.</P><P>Barring RADIUS, does anyone else know how to get this information any other way?&nbsp;&nbsp; I have tried exporting the CheckPoint logs to CSV and discovered that SMB devices do not seem to log this information.&nbsp;&nbsp; Gaia and Splat systems do, not Gaia-embedded.</P><P>Anyone have any ideas?</P> Wed, 10 Apr 2019 01:09:42 GMT gaa 2019-04-10T01:09:42Z https://community.checkpoint.com/t5/SASE-and-Remote-Access/Way-to-collect-Remote-Access-user-and-duration-information/m-p/50353#M12371 <P>We are using an MFA product layered on top of Windows NPS.&nbsp;&nbsp; In the RADIUS Account records we can see our Cisco VPN sessions but CheckPoint VPNs don't show.&nbsp;&nbsp; I asked CheckPoint support about this and was told that CP does not do RADIUS Accounting.&nbsp;&nbsp; (If so, why are there settings for it?)</P><P>From what I can tell, it seems that CP will do RADIUS Accounting when it is needed by the RADIUS server to manage the IP address pool.</P><P>I looked at NPS and it seems that it won't return a single IP.&nbsp;&nbsp; It will at best return a fixed subnet.</P><P>Who then picks the single IP from that subnet?</P><P>Can NPS be made to return a single address?</P><P>If not, and it returns a subnet, can CheckPoint pick one IP?</P><P>And if all that works, will CheckPoint then send RADIUS Accounting records?</P><P>My goal is to be able to get a list of all logins with user names, times and durations.</P><P>Barring RADIUS, does anyone else know how to get this information any other way?&nbsp;&nbsp; I have tried exporting the CheckPoint logs to CSV and discovered that SMB devices do not seem to log this information.&nbsp;&nbsp; Gaia and Splat systems do, not Gaia-embedded.</P><P>Anyone have any ideas?</P> Wed, 10 Apr 2019 01:09:42 GMT https://community.checkpoint.com/t5/SASE-and-Remote-Access/Way-to-collect-Remote-Access-user-and-duration-information/m-p/50353#M12371 gaa 2019-04-10T01:09:42Z https://community.checkpoint.com/t5/SASE-and-Remote-Access/Way-to-collect-Remote-Access-user-and-duration-information/m-p/50503#M12372 The RADIUS Accounting settings are for importing information for Identity Awareness.<BR />Check Point does not export any information via RADIUS Accounting.<BR />While you can use RADIUS to authenticate users, IPS are assigned by the gateway using the Office Mode subnet configured for the gateway.<BR /><BR />Possible these threads may provide some insight:<BR /><A href="https://community.checkpoint.com/t5/Logging-and-Reporting/Timeline-report-for-concurrent-VPN-users/m-p/31443#M2560" target="_blank">https://community.checkpoint.com/t5/Logging-and-Reporting/Timeline-report-for-concurrent-VPN-users/m-p/31443#M2560</A><BR /><A href="https://community.checkpoint.com/t5/Logging-and-Reporting/Scheduled-report-for-VPN-users-usage/m-p/20693#M1833" target="_blank">https://community.checkpoint.com/t5/Logging-and-Reporting/Scheduled-report-for-VPN-users-usage/m-p/20693#M1833</A> Thu, 11 Apr 2019 01:41:35 GMT https://community.checkpoint.com/t5/SASE-and-Remote-Access/Way-to-collect-Remote-Access-user-and-duration-information/m-p/50503#M12372 PhoneBoy 2019-04-11T01:41:35Z