- Products
- Learn
- Local User Groups
- Partners
- More
Check Point Jump-Start Online Training
Now Available on CheckMates for Beginners!
Why do Hackers Love IoT Devices so Much?
Join our TechTalk on Aug 17, at 5PM CET | 11AM EST
Welcome to Maestro Masters!
Talk to Masters, Engage with Masters, Be a Maestro Master!
ZTNA Buyer’s Guide
Zero Trust essentials for your most valuable assets
The SMB Cyber Master
Boost your knowledge on Quantum Spark SMB gateways!
As YOU DESERVE THE BEST SECURITY
Upgrade to our latest GA Jumbo
CheckFlix!
All Videos In One Space
Hi CheckMates.
I have a request for scheduled report for VPN users usage.
The request if for log for which users were connected last 24hrs and what resources they were using.
Regular VPN client (not MOB).
Any ideas how to accomplish that? (I can't find any VPN related tables on the reporting).
Thanks
I do not know of reports for RA VPN users - but have a look into Remote Access Users license + count.
Thanks for the tip, unfortunately this is not the case (the requirement is to receive a report - which users were connected and which internal resources they have accessed).
This is not a canned report, you'd need to use smart event and build a custom report. I have tried (without success) to build this report. There were similar reports in smart whatever the previous version of event was called, that would show all the users logged in for the previous 24 hours. If you have that, it may go a long way toward helping you. Otherwise, the data is all in the logs, its just a matter of figuring out how to extract it. Who was logged in the last 24 hours is canned, but what they were accessing, not so much.
Option 1:
Use SmartLog and select only logs which has action "Log in". You will get all users connected to the gateway. You can search also specific time range (24 hours).
In addition, save IP addresses of connected users and search those IPs to see what they accessed.
SmartLog has very nice overview of resource usage.
Option 2:
Use "fw log" on log server or management. I dont know exact command from hand, but I can give it to you once I am at work.
Option 3:
Use connection table with relevant info about connected users. This can be done only from gateways. This method is "real-time", so you can search only for users which are currently connected to the gateway.
About CheckMates
Learn Check Point
Advanced Learning
YOU DESERVE THE BEST SECURITY