topic End-Users connected in 1570 appliance in Spark Firewall (SMB)

End-Users connected in 1570 appliance

ebalmon — Mon, 14 Nov 2022 11:45:35 GMT

Hi mates,

Is there any way to see end-users connected via CLI in a 1570 appliance?

Thanks in advance

Re: End-Users connected in 1570 appliance

Chris_Atkinson — Mon, 14 Nov 2022 13:07:41 GMT

Just to confirm are you asking about VPN users or Admins connected via SSH or something else?

Re: End-Users connected in 1570 appliance

Lesley — Mon, 14 Nov 2022 14:09:39 GMT

Try this one (I assume you mean VPN clients):

vpn tu tlist

vpn tu -t tlist

To be honest I would recommend the web interface. GAIA embedded has less commands for on the CLI so it is a bit limited. For example you cannot run cpview.

Re: End-Users connected in 1570 appliance

PhoneBoy — Mon, 14 Nov 2022 14:16:31 GMT

cpview is available on SMB appliances with R81.10 firmware:

Not sure if information about connected VPN users is there.

Re: End-Users connected in 1570 appliance

ebalmon — Mon, 14 Nov 2022 14:18:53 GMT

Users connected to LAN or WIFI

Re: End-Users connected in 1570 appliance

ebalmon — Mon, 14 Nov 2022 14:23:04 GMT

Hi,

sorry, I mean users connected to LAN or WIFI. Thanks for the tip

Re: End-Users connected in 1570 appliance

Chris_Atkinson — Mon, 14 Nov 2022 14:24:52 GMT

Is Identity Awareness enabled?

Re: End-Users connected in 1570 appliance

ebalmon — Mon, 14 Nov 2022 16:54:19 GMT

No, could you tell me about that?

Re: End-Users connected in 1570 appliance

PhoneBoy — Mon, 14 Nov 2022 17:36:11 GMT

It's what allows you to associate IP addresses to usernames and requires a connection to your Active Directory server.
You configure it here:

Unfortunately, the only method supported on the SMB appliances currently is ADQuery, which may not work if your AD servers have recently been patched.
Refer to: https://community.checkpoint.com/t5/Security-Gateways/WMI-Permission-denied-From-this-months-Windows-Update/m-p/159491#M27921

Re: End-Users connected in 1570 appliance

G_W_Albrecht — Tue, 15 Nov 2022 09:37:32 GMT

Use WebGUI - not CLI...

Re: End-Users connected in 1570 appliance

ebalmon — Thu, 17 Nov 2022 14:12:21 GMT

Hi,

It is a specific need to do it through the CLI to run it with a troubleshooting script. Shouldn't it be possible to do it if it's also done via GUI?

Thanks for your help

Re: End-Users connected in 1570 appliance

G_W_Albrecht — Thu, 17 Nov 2022 15:22:54 GMT

I think the scripting used for GUI can read details that are not directly available as commands in clish / bash. This would be a RFE...

Re: End-Users connected in 1570 appliance

PhoneBoy — Thu, 17 Nov 2022 23:44:33 GMT

If you have Identity Awareness enabled, you can use the various CLI commands to query said database (for example adlog a query all).
These are for regular gateways but the commands here should also work on the SMB appliances in expert mode: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_IdentityAwareness_AdminGuide/Topics-IDAG/CLI/adlog-query.htm