topic GlobalProtect VPN usage reports? in General Topics

GlobalProtect VPN usage reports?

Maxstr — Tue, 20 Dec 2016 17:20:08 GMT

I'd like to generate a scheduled report of all the GlobalProtect VPN users connected in the last 24 hours. Is this possible to create in Pan OS 7.1?

Re: GlobalProtect VPN usage reports?

TranceforLife — Tue, 20 Dec 2016 18:10:45 GMT

Hi,

Thi sis how to do it manually:

https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Run-a-Report-for-Previous-Logged-in-GlobalProtect-Users/ta-p/52846

Not sure about scheduled but l guess 99% possible

Re: GlobalProtect VPN usage reports?

BPry — Wed, 21 Dec 2016 15:08:19 GMT

There isn't a way to generate a custom report with system logs; so you would need to likely rig something up with the API generating an output file of what you need and then create a job that pushes that output out via email. Wouldn't be a very elegent solution.

Re: GlobalProtect VPN usage reports?

pcaphunter — Wed, 21 Dec 2016 16:12:06 GMT

I currently have a custom report setup to review this for 7days on my palo alto. I made sure the database drop down was set to traffic summary. Then I simply created a custom report that had a query to include only the source subnet of the VPN users. Sorted by bytes, grouped by rule. I can see how much traffic each user has passed on the VPN specific to each rule allow traffic into the org. I'd imagine something like that could meet your needs as well.

Re: GlobalProtect VPN usage reports?

Maxstr — Wed, 21 Dec 2016 16:23:22 GMT

Thanks, that's what I ended up doing. I created a new custom report for my VPN zone, for Traffic Summary grouped by source user. I also threw in Application just to see what the users were doing, but that can be removed for a regular list