Need a way to track Mobile Access timeouts

[Joe_Kanaszka]

Good Morning - 

We are currently running:

R80.40 Take 173

Mobile access client version E87.50

I've been tasked with finding a way to track Check Point Mobile timeouts.  

For instance, a user is working from home and their WiFi disconnects - so the VPN is attempting to connect but cannot - and eventually times out.

If we look in the logs, we cannot find a query that tracks this.  We currently use this to track logins and logouts from the VPN:

blade:"Mobile Access" AND action:("Log In" OR "Log Out") AND user:"user's login name"

I found a setting in Smart Dashboard:

• Disconnect idle sessions after is the disconnection time-out if the connection remains idle. The default value is 60 minutes. When users connect via SSL Network Extender, this timeout does not apply.

What does this mean exactly?

This will not show timeouts though.  Any ideas?

Thanks guys

Joe

[the_rock]

Hey Joe,

I will look tomorrow into this on my lab smart event, Im sure there is something there that would help.

Andy

[Joe_Kanaszka]

Awesome Andy - thanks man!!

[the_rock]

For you...

****, never mind...EVERYONE is sick of that joke lol

No problem mate 🙂

Andy

[the_rock]

Btw, sorry mate, I was gonna do it tonite, but working on some Palo Alto stuff. I will test search filter in my lab tomorrow and see what happens. But either way, as I have fully working smart event on R81.20 jumbo 43, lets see if we can make it work there : - )

Best,

Andy

[Joe_Kanaszka]

Good Morning Andy and Happy Friday brother!

No worries at all - just trying to get an answer either way so I can let my boss know if it's possible.

[the_rock]

Happy Friday brother, or as our neighbours here in Quebec would say, joyeux vendredi ; - )

Anywho, will check all this shortly for you and see if I can "extract" anything from the smart event. I could give it a go in Azure lab, but makes more sense on a dedicated smart event in the lab.

Best,

Andy

[Joe_Kanaszka]

Thanks Andy - absolutely no rush!  

[the_rock]

For you...well, you know lol

[the_rock]

I have an idea. As my boss would say, Im not only good looking, I also have lots of ideas ; - )

Btw, no one ever said that 🤣🤣🤣

Anyway, my suggestion...we can do remote and I can show you what options are there and hopefully, if we put 2 brains together, Im sure we can come up with something.

Thoughts?

If that sounds good, just message me offline, I can give you my email and we can connect that way.

Best,

Andy

Below are options I found, just going through the values

 

[Joe_Kanaszka]

You're awesome Andy - thanks man!

I can't do any remotes today as I am unfortunately tied up with other calls.  However, I will gladly take you up on your offer next week if you are available - I totally will work around your schedule.  Between the two of us we can work it out.  😎

One other thing we noticed - perhaps this is an easy one.  

My boss and I both have two (2) laptops (in case one laptop dies we have a spare).  If I log into the Check Point Mobile VPN on both of my laptops with the same user name - I only see the first login in SmartView Monitor:  Users\All Users.

However, I see both sessions in the logs.

If I log in on my second laptop with a different user account, I of course see the 2 sessions in SmartView.  Does SmartView by default only show one session for a user - no matter how many VPN connections they have?

BTW - I realize I'm "taking" much more than I'm "giving" to this community.  I hope to one day be able to contribute more as I get gather more troubleshooting skills    😁

[the_rock]

Dont look at it like that mate...we ALL contribute, just remember that. Just message me offline, we can connect via email.

Best,

Andy

[the_rock]

Hey brother,

Since I will be working on Aruba SaaS lab Sunday, I will dig into this stuff more. Yesterday, sadly, I could not find the option for exactly what you were looking for, but then again, Im not a good liar, so its only fair to say Smart Event was never my stronger side haha. Anywho, if you are still good to do remote session next week, happy to do that. Its dedicated smart event in my lab, R81.20 jumbo 43, fully licenses, so Im sure we would be able to figure something out.

Looking at the default built-in reports, I could not locate one specifically for mobile access, but you can customize bunch of stuff when new report is set up.

Have an awesome weekend mate.

Best,

Andy

 

[Joe_Kanaszka]

Thank you so much brother!  I certainly did not expect you to work on this after hours!    Thank you again.  I'm doing some digging on my end as well.

[the_rock]

Got a bit furtger, but still not so clear to me. I see there are some options you can add when creating brand new report, but not overly user friendly, if you will, as far as what you are after.

Maybe someone else can confirm.

Best,

Andy

 

[Joe_Kanaszka]

Thank you again Andy - I agree as well that SmartEvent is too user-friendly!   

[the_rock]

Its not an issue my friend, no one forces me to do anything. As my late grandfather used to say, only 2 things have to happen in life, you are born and you will die one day, thats it lol

Anywho, if you wish to do remote, we can do so, I "slapped" another eval yesterday on SE server, so its good to go!

Best,

Andy

[Joe_Kanaszka]

HA!  Your late grandfather was a wise man for sure!    Thanks again Andy.

[the_rock]

Well, that is technically true lol

Anyway, if you still want to do remote, we can do that, just message me offline, not an issue.

Best,

Andy