topic Re: Missing Log on Log server in SASE and Remote Access

Missing Log on Log server

HappyByte — Wed, 31 Mar 2021 10:35:37 GMT

Hello,

does anyone experience the following scenario:

TEST SCENARIO:

Logging on VPN server (Mobile Access Blade, 80.30) with Endpoint Security VPN.
t(0) time - Log In with timestamp in Logs
t(1) time - after VPN session timeout (10hours 30min) Re-Authenticated in less than 60 seconds
t(2) time - Log Out with timestamp in Logs

TEST SCENARIO RESULTS:

Checking logs on log server there is missing t(0) timestamp with Log In information
t(1) time - shows Log In with t(1) timestamp in Logs
t(2) time - shows Log Out with t(2) timestamp in Logs

EXPECTED:

t(0) time - Log In with t(0) timestamp
t(1) time - Log In Re-Authenticated with t(1) timestamp
t(2) time - Log Out with t(2) timestamp

In basic scenario, using VPN session for less than VPN Re-authenticate sesson timeout, both LogIn and LogOut are in log results.

GlobalProperties, Remote Access:
Re-authenticate user every: 630min (10h 30min)

thank you.

Re: Missing Log on Log server

PhoneBoy — Sat, 03 Apr 2021 22:51:05 GMT

Remote Access VPN can actually be served by either Mobile Access Blade or the VPN blade.
Are you looking for both types of logs when you check for this?
If you have Identity Awareness enabled with Remote Access as one of the identity sources, there should be a log for that association as well.

Re: Missing Log on Log server

the_rock — Sun, 04 Apr 2021 01:53:36 GMT

I think what you wrote makes sense, but I also do agree with phoneboy's response as well.

Re: Missing Log on Log server

HappyByte — Mon, 05 Apr 2021 07:07:50 GMT

Hello PhoneBoy,

yes, both are checked. Normally LogIn and LogOut are logged as part of Mobile Access Blade.

Interesting part is that LogIn in t(0) timestamp was visible in first hours (during 10hours30min period).

Although the LogIn t(0) timestamp is missing there are visible 'Key Install' logs on VPN Blade after t(0) timestamp.

Re: Missing Log on Log server

PhoneBoy — Mon, 05 Apr 2021 20:51:18 GMT

If you can consistently reproduce this, it might be worth a TAC case.

Re: Missing Log on Log server

HappyByte — Wed, 07 Apr 2021 16:30:54 GMT

Tested and successfully reproduced.

Logged In, t(0) timestamp visible in logs before Re-authentication.

After Re-authentication at t(1), t(0) timestamp disappeared, t(1) visible.

Screenshot: missing LogIn timestamp at 7:35:59

Re: Missing Log on Log server

PhoneBoy — Wed, 07 Apr 2021 21:10:25 GMT

I think what's actually happening here is that we are updating the original log entry with the new Log In time.
Believe you can confirm this by opening the log card and reviewing it.

Re: Missing Log on Log server

HappyByte — Thu, 08 Apr 2021 06:10:05 GMT

Possible. But as stated, expected is to keep original LogIn at t(0) as valuable information.

Solved, using external log server infrastructure.

Re: Missing Log on Log server

PhoneBoy — Thu, 08 Apr 2021 15:07:31 GMT

Can you open the log card and confirm what I'm saying?
Whether it should do that or not is a separate question, but I believe this is the intended behavior.

Re: Missing Log on Log server

HappyByte — Thu, 08 Apr 2021 15:47:21 GMT

I can confirm both log cards (missing one from t(0) and Re-Authenticated at t(1)) have the same Mobile Access Session UID.