topic Re: User on Checkpoint who have valid vpn accounts in SASE and Remote Access

User on Checkpoint who have valid vpn accounts

ShaunW — Mon, 05 Dec 2022 17:25:43 GMT

Hi All,

I have been asked how many users we have on our Chckpoint that have valid certificates that allow them to connect over the Endpoint client VPN. Unfortunately we are not informed when users leave so they are not removed from the Checkpoint. If I look at users on the SmartConsole I can see there are 465 however I have just randomly selected one user whose account has expired so this can be discounted.

Also, is there a way of checking when the users last logged in?

Thanks in advance

Shaun

Re: User on Checkpoint who have valid vpn accounts

PhoneBoy — Mon, 05 Dec 2022 18:26:15 GMT

Unfortunately, we do not track the last login as part of the user record.
This can only be done by looking through the logs, which would be a time-consuming process, but potentially something that could be automated (at least in currently supported versions of code).
I’m assuming all of these users are locally defined, correct?

Re: User on Checkpoint who have valid vpn accounts

ShaunW — Tue, 06 Dec 2022 09:12:47 GMT

Thanks for the prompt response, yes the users are locally defined.

Is there a way of checking users that have a vaild certificate that are within the expiration date? Our Audit team what to establish the number of users that are using the Checkpoint vpn.

Thanks

Re: User on Checkpoint who have valid vpn accounts

the_rock — Tue, 06 Dec 2022 11:27:47 GMT

I can check for you in my lab, but if you have monitoring blade enabled and once you open "logs and monitor" from smart console and click on new tab on the top, at the bottom left there is an option for vpn monitoring and once you open that, it would give you an option to check out all VPN users. Im fairly positive that shows when users last logged in.