topic Re: last successful RA VPN login date/time in SASE and Remote Access

last successful RA VPN login date/time

Imzi — Thu, 24 Sep 2026 05:48:01 GMT

We have a Check Point 9200 Security Gateway with a VM-based Management Server, and Remote Access VPN is configured and operational.
We need to verify the last successful RA VPN connection date/time and the user's historical VPN session activity.
Please advise on the appropriate SmartConsole logs, CLI commands, or other recommended methods to validate the user's last active timeframe and connection history.

Re: last successful RA VPN login date/time

simonemantovani — Thu, 24 Sep 2026 07:10:09 GMT

Hello

as a first approach, you could start by creating report (under Logs and Events) for VPN logs that includes login action, etc.; by setting different timeframe for the report you'll be able to have historical information.

Re: last successful RA VPN login date/time

PhoneBoy — Thu, 24 Sep 2026 14:56:22 GMT

This will require SmartEvent and a report like: https://community.checkpoint.com/t5/Firewall-Security-Management/Custom-view-for-getting-Remote-Access-User-Stats/m-p/79666

Re: last successful RA VPN login date/time

Imzi — Mon, 28 Sep 2026 09:38:05 GMT

Could you please help us obtain the date and time of the user’s last connection to the RA VPN?

Re: last successful RA VPN login date/time

PhoneBoy — Mon, 28 Sep 2026 16:23:06 GMT

When a user logs in via Remote Access VPN, there will be one or more logs indicating this.
In the log view, the action should be "Log In" and the blade will indicate VPN or Mobile Access, depending on how the user connected.
To put that into a nice report, you will need SmartEvent or an external SIEM to correlate those logs.

Re: last successful RA VPN login date/time

Imzi — Tue, 29 Sep 2026 06:27:06 GMT

We have tried using SmartEvent to retrieve and analyze the user-related logs; however, the required user log details are not being displayed/available as expected.

Our requirement is to retrieve and review the logs for all disconnected Remote Access (RA) VPN users, including the relevant disconnect events/details, so that we can identify the reason for disconnection and take appropriate corrective action accordingly.

Could you please advise if there is an alternative method, CLI command, or Check Point utility that can be used to retrieve these logs? Additionally, please let us know if any specific debug commands or log files need to be collected for further analysis.

Re: last successful RA VPN login date/time

PhoneBoy — Tue, 29 Sep 2026 16:12:09 GMT

I don't recall disconnects being explicitly logged as a "disconnect" can occur, e.g. as a result of a loss of physical connectivity on the client end, thus no way for the client to log it (except maybe locally).
If you want to know why a client disconnects, the only place that might be logged is on the client side.

As for why SmartEvent isn't pulling the data, what specific fields are you attempting to build reports based on?
Not all of them may be indexed, which may be why you can't build the desired report.

Re: last successful RA VPN login date/time

Lesley — Tue, 29 Sep 2026 16:24:31 GMT

Import this one and try to add the columns you wish to see in this report. It is a good base to start from:

https://community.checkpoint.com/t5/SmartEvent/Enhanced-VPN-Dashboard/m-p/252358#M65