topic Re: Globalprotect report generation on users in GlobalProtect Discussions

Globalprotect report generation on users

RemusDV — Tue, 17 Mar 2020 06:45:04 GMT

Is it possible to generate a report about the average logged in users in global protect

I can see who is currently logged in by going to Network>>gateway>remote user, but no reports on it. I also know the maximum number of users for that firewall PA3220 which is 1024 users

Re: Globalprotect report generation on users

kiwi — Tue, 17 Mar 2020 08:31:45 GMT

Hi @RemusDV ,

There's an existing feature request for this.

Please reach out to your local SE and have him add your vote:

FR ID 2460 (GlobalProtect Reporting).

Until then you should be able to use the following workaround:

How to Run a Report for Previous Logged in GlobalProtect Users

Cheers !

-Kiwi.

Re: Globalprotect report generation on users

SergGur — Tue, 17 Mar 2020 11:52:36 GMT

Seems like there will be many more people interested to graph GlobalProtect capacity due to COVID-9 and WFH

I checked past forum posts, seems like there is no simple option to do it onboard. Perhaps good old SNMP will be of help here. We are planning to try out panGPGWUtilizationActiveTunnels.0. Please share your progress in this post

MIB detials at https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClaSCAS

GlobalProtect gateway utilization	panGPGatewayUtilization	1.3.6.1.4.1.25461.2.1.2.5.1	PAN-COMMON-MIB
GlobalProtect gateway % utilization	panGPGWUtilizationPct.0	1.3.6.1.4.1.25461.2.1.2.5.1.1	PAN-COMMON-MIB
GlobalProtect gateway max tunnels	panGPGWUtilizationMaxTunnels.0	1.3.6.1.4.1.25461.2.1.2.5.1.2	PAN-COMMON-MIB
GlobalProtect gateway active tunnels	panGPGWUtilizationActiveTunnels.0	1.3.6.1.4.1.25461.2.1.2.5.1.3	PAN-COMMON-MIB

Re: Globalprotect report generation on users

SergGur — Wed, 18 Mar 2020 09:35:03 GMT

Just to confirm, we build report polling two parameters. Both are generating nice accurate graphs.

panGPGWUtilizationPct
panGPGWUtilizationActiveTunnels

Re: Globalprotect report generation on users

kiwi — Wed, 18 Mar 2020 09:55:12 GMT

Hi @RemusDV

Aside from what's already been said ... the ACC might provide the data you're looking for:

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-new-features/globalprotect-features/enhanced-logging-for-globalprotect.html#id13cfe4be-8017-410c-866b-c6d232fe0082

Cheers !

-Kiwi.

Re: Globalprotect report generation on users

RemusDV — Thu, 19 Mar 2020 01:10:52 GMT

This is actually a good solution. Even though it is available in 9.1(correct me if I'm wrong). I'll still advise the client. Thanks kiwi for the support

Re: Globalprotect report generation on users

yan — Wed, 18 Aug 2021 14:42:16 GMT

For those who are trying to get a list of GPA VPN users by the hour connecting via PRISMA or for those who have a Panorama that is connected to PRISMA, when you try to create a custom report that you can schedule to run every hour, you will notice in the fine print under the custom report creation that it does not support Cortex Data Lake logs. Thus your panorama cannot pull the data. it might pull it just 1x but never again. There is a feature request put up for that. In the meantime, the most you can do is generate the report manually , export to .csv and manually filter it by the time and manually remove the duplicate users. i use these filters:

Panorama/Monitor/mobileuserdevicegroup search by ( stage eq tunnel ) and ( status eq success )

apps.paloaltonetworks.com/ Explore search by stage = 'tunnel' AND status.value = 'success'

Export the results as .csv and filter it by date/hour and remove the duplicates, all manually and if needed by the hour, manually run the search again on the hour.

that's all you can do until they make it a feature on Panorama (Prisma).

Re: Globalprotect report generation on users

yan — Wed, 18 Aug 2021 14:43:31 GMT

in Explore, use Firewall/GlobalProtect. For Panorama, Monitor, Logs, GlobalProtect