PEP Session Viewer

[Vincent_Bacher]

PEP Sessions Viewer

Extension URL: https://vbacher.de/pep-sessions.json

Author: Vincent Bacher (vbacher.de) | Version: 1.0 | License: Free to use

Overview

SmartConsole extension for viewing active PEP (Policy Enforcement Point) sessions directly in the gateway Details Panel. Provides real-time session data with search, filter, and drill-down capabilities using the smxProxy API.

Key Features

• Session View: Up to 2000 active sessions per gateway
• Server-side Search: grep-based filtering on gateway before loading data
• Click-to-Detail: Interactive cells for Username/Machine/Client IP → detailed PEP query results in modal
• Sortable Columns: Username, Machine, Client IP, PDP IP, UID
• Detail View: 8 fields including Identity Roles, Log Username, Client Type
• Multi-Domain Support: Automatically inherits domain context

Requirements

Component	Requirement
SmartConsole	R80.40 or higher, Extension API 1.2+
Gateway	Identity Awareness blade enabled, PEP command support
Permissions	get-read-only-session, run-read-only-commands
Network	HTTPS access to extension URL

Installation

1. Open SmartConsole → Manage & Settings → Extensions
2. Click Install Extension
3. Enter URL: https://vbacher.de/pep-sessions.json
4. Accept permissions

Usage

1. Open any Gateway/Cluster object
2. Select PEP Sessions tab in Details Panel
3. Click Refresh Sessions

Verify Gateway Support

clish -c "pep help"

Technical Details

Architecture

• API: Uses SmartConsole smxProxy.sendRequest('request-commit')
• Commands: pep s u a (list), pep s u q usr/mchn/cid (detail)
• Execution: Base64-encoded commands via run-script
• Parsing: Custom PEP output parser for both list and detail formats
• Performance: 2000 session limit, 90s timeout

Search Modes

• Local: Type in search box → filters loaded sessions client-side
• Remote: Enter term + click Refresh → executes pep s u a | grep -i "term" on gateway

Data Flow

1. User clicks Refresh → Extension builds base64 command
2. SmartConsole sends command to Management Server
3. Management executes on gateway via run-script
4. Response base64-decoded and parsed
5. Displayed in table with interactive cells

Use Cases

• Terminal Server: View all sessions from single machine (click Machine column)
• User Tracking: Find all sessions for user across multiple IPs (click Username)
• Troubleshooting: Verify Identity Agent connectivity, check assigned roles
• Audit: Review active sessions, client types, authentication methods

Limitations

2000 Session Limit: Large environments may have more sessions. Use search+refresh to filter on gateway.
90s Timeout: Normal for 2000 sessions, may timeout on slow Management API.
PEP Only: Works with PEP sessions. PDP extension planned separately.

Troubleshooting

Error: "This service is not available"

• Restart SmartConsole (complete restart required)
• Verify URL accessible from workstation
• Check extension loaded in Manage & Settings → Extensions

Error: "No sessions found"

• Verify Identity Awareness blade enabled on gateway
• Test manually: clish -c "pep s u a"
• Check gateway has active sessions

Error: "Gateway command failed"

• Gateway may not support PEP commands
• Verify clish access: pep help
• Check Management API connectivity

Screenshots

Future Enhancements

• PDP session viewer (separate extension)
• CSV export
• Custom column configuration
• Session history tracking

Support

Author: Vincent Bacher | Website: vbacher.de
Post questions/feedback in this thread.

---

Installation URL: https://vbacher.de/pep-sessions.json

[the_rock]

Yes sir, happy to give it a go.

[Vincent_Bacher]

vbacher.de/pep-sessions.json

In Gateways&Servers Section when selecting a gateway, you see the pep session tab. Here you can click on refresh, then it sends the request and hopefully the session list will be displayed (currently limited to 2000 to reduce load) and you have a search box to search for anything linke username or machine name or client ip. 
Once the list is shown, you may click on username or machine name oder client id to show more details like access roles.

[the_rock]

Give me few mins, will test it and paste a screenshot of what it shows.

[the_rock]

Looks right to me!

 

[Vincent_Bacher]

Thanks. Happy to see. So in case anybody is interested and has ideas to improve or something to add, feel free 🙂

[the_rock]

Wanted to test it a bit more today, but got real busy. Will do it Friday.

[the_rock]

Hey Vince,

Tried it today on few more gateways, worked well.

Nice weekend!

[Vincent_Bacher]

Thanks for testing.

To be honest, it doesn't make sense for us to list all sessions, as we always have 5-digit session numbers, but I found it useful to search explicitly for sessions and identify the access roles, especially for our colleagues in day-to-day operations for troubleshooting.

[the_rock]

I set up brand new R82 cluster in the lab, so will do some testing on it tomorrow.

[the_rock]

Just did some more tests on R82 lab cluster, all good!