topic Re: Is there a way to limit the number of logged in administrators? in General Topics

Is there a way to limit the number of logged in administrators?

gelgin — Wed, 02 Jul 2014 14:01:36 GMT

This came up as a question during a class and to my knowledge there is not a way to limit the number of logged in administrators, however the student asking presented a reasonable case; In a service provider or large enterprise environment during a network event multiple administrators log into the firewall and begin looking at filtered logs. Once more than about three get logged in the performance of the MP becomes significant enough to impede those administrators as they search for interesting log events.

My initial recommendation is to have the logs pointed at a log collection tool, and have the administrators use that tool for the filtered views. Is that the only way to manage this type of load?

Re: Is there a way to limit the number of logged in administrators?

kadak — Wed, 02 Jul 2014 16:28:18 GMT

Hello gelgin,

As far as the firewall is concerned, the management plane would definitely take heavy toll if there are multiple administrators filtering traffic logs at the same time. In order to cope up with Service providers and Enterprise level environments, we have a central managing system (virtualized or hardware based) called 'Panorama' where is specially dedicated for logging and reporting purposes. Its a central management system that manages several firewall together and can be ready in situations like yours.

Re: Is there a way to limit the number of logged in administrators?

gelgin — Wed, 02 Jul 2014 16:54:48 GMT

And thats what I thought... I pointed him in those directions as well... Maybe its worth a feature request for environments that may have operational constraints that demand the use of the firewall vs. an offline approach?

Re: Is there a way to limit the number of logged in administrators?

pulukas — Thu, 03 Jul 2014 22:27:16 GMT

A maximum number of logged in users would be a good feature. Let me know if you have a Feature Request number for this.