topic Re: Report on Last Calendar Day IPSEC users in General Topics

Report on Last Calendar Day IPSEC users

ShannonTurner — Fri, 09 Jan 2015 14:59:18 GMT

Hello

I am new to the Palo Alto firewall and community. I really enjoy working with the PA-500's that I have. What I am trying to figure out though, is how, if even possible, I could create a report showing the previous day's IPSEC users. I am hoping that possibly someone who is more experienced will have some idea of how I could accomplish this.

Thank you in advance!

Re: Report on Last Calendar Day IPSEC users

Dz3015 — Fri, 09 Jan 2015 16:58:51 GMT

I'm sure you can get this by creating a custom report in the reporting section. I don't have Remote Access set up in my deployment but I'll take a quick look if I can give you an example for report settings.

You may just have to poke around to see what data is available to you. The reporting section is pretty easy to figure out if you know what you are trying to do.

Re: Report on Last Calendar Day IPSEC users

bat — Fri, 09 Jan 2015 20:53:47 GMT

shannonturner

In Monitor > Logs > Traffic you can give the timeframe as previous day using filter ( receive_time leq '2015/01/09 23:59:59' ) and ( receive_time geq '2015/01/09 00:00:00' ) and ( zone.src eq "GP-zone" )

Hope it helps !

Re: Report on Last Calendar Day IPSEC users

MSharma — Fri, 09 Jan 2015 21:25:27 GMT

HI Shannonturner,

Yes it is possible . We can generate a report for this .

If you are looking for Clients who got connected through Global protect. The only thing we want is a different zone for Global Protect users. If we have that , we can go to :

Monitor --> Manage Custom Reports-->Add

In query builder, just create a query by selecting source zone equal to the actual name of the zone as shown above. You can also specify the time frame like 24 hours and we have other options too.

Once all the fields are selected just click on Run Now.

Please try this and let us know if was helpful .

Re: Report on Last Calendar Day IPSEC users

mmmccorkle — Fri, 09 Jan 2015 21:49:41 GMT

Are you using HIP profiles for your GP clients?

Perhaps we could create a custom report to show you the HIP matches for the past 24 hours and group by source user.

Example:

We could also look through the system logs, under Monitor, for...

(subtype eq global protect)

Combine this with filtering the description for successful logins only, and you will get...

(subtype eq globalprotect) and ( description contains 'Login from' )

Example:

Re: Report on Last Calendar Day IPSEC users

oklier — Fri, 09 Jan 2015 21:51:21 GMT

Also be sure to add the Source User from the Available Column to the Selected Column and move it to the top, also group the report by 'Source User' and set the filter to 500.

Feel free to play with the options to tailor the report to your needs:

Also to schedule the report make user to check the box 'Scheduled', then create a email scheduler for the report.

Cheers!

Re: Report on Last Calendar Day IPSEC users

ShannonTurner — Fri, 09 Jan 2015 21:54:09 GMT

Thank you for assisting me with this. It worked out just how I wanted.

Re: Report on Last Calendar Day IPSEC users

ShannonTurner — Fri, 09 Jan 2015 21:54:53 GMT

Thank you for the response! This was helpful.

Re: Report on Last Calendar Day IPSEC users

ShannonTurner — Fri, 09 Jan 2015 21:57:09 GMT

Thank you for the reply!

Re: Report on Last Calendar Day IPSEC users

ShannonTurner — Fri, 09 Jan 2015 21:57:27 GMT

Thank you for your reply!