Custom view for getting Remote Access User Stats

[Jacques_Spelier]

Hi Everyone,

Figured since in our current world state of COVID19,  a lot of our companies have enabled remote capabilities for our users. I have created a custom view that will list "mobile" users by gateway, then Client Name. I will display time user connected (nice to see if user having issue if multiple times), source, OS Name and OS version.  You can also add Machine Name which can be helpful if you want to know user's home PC if they have multiple hosts.

It is a view template built under R80.10. Import it and have fun. Feel free to tweak as you need.

Enjoy.

[PhoneBoy]

Thanks for providing this!
I've "featured" this thread to hopefully make it easier for people to find.

[Alex_Alborzfard]

This is great. How (what tool) can it be edited/tweaked? I'd like to add the machine names.

Thanks,

Alex

[Alex_Alborzfard]

Never mind. I was able to figure it out.

[PhoneBoy]

The same tool you use to view it: Logs and Reports.
You should be able to change the report after importing it to include this.

[ronitre]

Hi,

can you explain please how to import that 7Z file into the machine?

[PhoneBoy · Accepted solution]

First, decompress the file with 7-Zip.
Then, in SmartConsole > Logs and Monitor > Reports, click Actions and Import Template.

 

[ronitre]

Thank you for the explanations,

but I don't have the icons open/new/export/actions...

> show version all

Product version Check Point Gaia R80.10
OS build 462
OS kernel version 2.6.18-92cpx86_64
OS edition 64-bit

[PhoneBoy]

Reports (custom or otherwise) require SmartEvent.
You need to enable SmartEvent, as described in the screenshot.

[ronitre]

Thank you very much !!!

[Ajay_Kumar_Pate]

Where is the option , can you please share the steps and path so that i can check the same on my firewall.

i have office mode RA vpn,  is it work ot it is only for Mobile blade

[Jacques_Spelier]

Hi there,

The file I included is a view template. You can find the steps on how to import it into the Log and Monitor by referring to page 35 of the "R80.10 Logging and Monitoring Admin Guide"

The view will sort by Client type. In my case I can see my Endpoint Security VPN (IPSEC), Checkpoint Mobile (IPSEC) and Mobile Access Portal (SSLVPN) clients.  You can also edit and add another column for client machine name if that is required.

Enjoy.

[Niraj]

HI,

I am having  SmartConsole R80.30. can same template will be used in this version?

Regards,

Niraj Dave

[PhoneBoy]

You should be able to use it in any R80.x version.

[Niraj]

Thanks for update.  I need userwise details in this report.

Can we able to extract in this report?

Thanks and Regards,

Niraj Dave

[PhoneBoy]

There are two other reports that might be helpful:
https://community.checkpoint.com/t5/Remote-Access-Solutions/Monitoring-applications-and-data-volume-...
https://community.checkpoint.com/t5/Visibility-Analytics/SmartView-VPN-Client-enhanced-view/td-p/788...

[Wowos]

Hey, I'm trying to import this template to my R80.30. After selecting the template I recieve "Import completed successfully" prompt, but nothing else. There are no new templates in the Reports window. Anyone had that problem?

[Jacques_Spelier]

Hi there,

Did you look under the views?  This is a view template and not a report one. The view can be scheduled and sent via email in csv, pdf or xml format.

Hope this helps.

[marciojss_check]

My dash is with  transferred total bytes in O, Can you help me?

[Jacques_Spelier]

Hi there. I think the issue may be related with the log tracking option on the related rules for you mobile users.  Make sure that Logging has "accounting" checked on and both "per connection" and "per session" checked on as well.  This will provide the required data in the logs so that Smartevent can parse for the report.

[marciojss_check]

Hi,

These flags were already enabled.