topic Re: How to generate GlobalProtect VPN Reports in General Topics

How to generate GlobalProtect VPN Reports

bhakti1213 — Fri, 29 Jun 2018 01:01:48 GMT

Is there any way to provide reporting for GlobalProtect remote access VPN. Like for example I want a report of users who have connected in the past week, etc. How do i generate those reports?

Re: How to generate GlobalProtect VPN Reports

kiwi — Fri, 29 Jun 2018 07:58:47 GMT

Hi @bhakti1213,

I found the following article about this :

https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Run-a-Report-for-Previous-Logged-in-GlobalProtect-Users/ta-p/52846

Cheers !

-Kiwi.

Re: How to generate GlobalProtect VPN Reports

bhakti1213 — Fri, 29 Jun 2018 13:09:52 GMT

Will this allow me to generate the reports? Like for example a report covering a week with concurrent users per hour?

Re: How to generate GlobalProtect VPN Reports

Mick_Ball — Fri, 29 Jun 2018 14:11:26 GMT

I never found any way of doing this on the PA itself.

I send to syslog and then run linux scripts to search files for succesful gateway auths and group them in date chunks.

no great detail is available but all of our departments pay for the VPN service and they like to know who is actually using it, when they used it and how often...

I also run scripts that use curl to call API's to monitor connections per gateway on a regular basis.

Re: How to generate GlobalProtect VPN Reports

bhakti1213 — Fri, 29 Jun 2018 14:16:32 GMT

Does anyone know if there is a way to schedule GlobalVPN reports, I found a way of generating them just like the artlice shows, but is there a way to shcedule them?

Re: How to generate GlobalProtect VPN Reports

bhakti1213 — Fri, 29 Jun 2018 14:27:01 GMT

Does anyone know if there is a way to schedule GlobalVPN reports, I found a way of generating them just like the artlice shows, but is there a way to shcedule them?

Re: How to generate GlobalProtect VPN Reports

BPry — Fri, 29 Jun 2018 16:14:29 GMT

Not sure how you would do it with the system logs, as they aren't an option within custom reports as you've likely already found out. You could likely script something with the API to run the query and actually export the results?

You could do the a kind of similar report simply by using the user-id logs since that is something you can actually build a Custom Report on, then you could schedule. The Query would simply be ( datasource eq vpn-client ) and you can then run a report to see which users logged in on which days. That might be enough for what you are looking for?

Re: How to generate GlobalProtect VPN Reports

bhakti1213 — Fri, 29 Jun 2018 17:06:21 GMT

Will that report telll me the pervious logged on users with ( datasource eq vpn-client )?

Re: How to generate GlobalProtect VPN Reports

BPry — Fri, 29 Jun 2018 17:46:16 GMT

@bhakti1213,

Yes; the user-id logs with the ( datasource eq vpn-client) will return all users who logged in during the time period you've specified.

Re: How to generate GlobalProtect VPN Reports

bhakti1213 — Fri, 29 Jun 2018 17:43:10 GMT

Is the the only query I am suppose to put because when I run the report it does not give me that much results. Or do I put

( database eq vpn-client) and (receive_time in last-calendar-month)

aslo the user log will be trhe device user logs right?

Re: How to generate GlobalProtect VPN Reports

BPry — Fri, 29 Jun 2018 17:55:18 GMT

@bhakti1213,

So this report will really only be helpful if you are aiming to get which user logged in when. I would likely set it up so that the Culumns has the User, IP, Source Name, Device Name, Day, Count, and Source Type present (Possible Hour). Then you would control the time in which you are searching via the 'Time Frame' field when you are building the custom report.

What the report should give you at the end of the day is essentially that user 'bpry' logged into globalprotect on Sun, Jun 24, 2018 a total of 3 times. Since you aren't looking at the actual GlobalProtect information that's all you'll be able to view.

Re: How to generate GlobalProtect VPN Reports

bhakti1213 — Fri, 29 Jun 2018 17:58:31 GMT

Ok that is the report that I am looking for. For the Query section I should only put the query you gave me correct? And thanks for your help, greatly appericate it!!!

Re: How to generate GlobalProtect VPN Reports

bhakti1213 — Fri, 29 Jun 2018 18:23:48 GMT

One last question do you know if this report can provide x number of users per hour (concurrent)

Re: How to generate GlobalProtect VPN Reports

BPry — Fri, 29 Jun 2018 18:25:36 GMT

@bhakti1213,

Correct, you just need the query in the earlier post (note that I modified it as I had specified the wrong thing). This report isn't able to view concurrent number of users as it isn't reading the actual GlobalProtect data.

Re: How to generate GlobalProtect VPN Reports

bhakti1213 — Fri, 29 Jun 2018 18:27:56 GMT

Then for that do you know any way if that is possible to get that in the report, any query? This report is 95% complete just need that small thing to complete this report. Is there any way?

Re: How to generate GlobalProtect VPN Reports

BPry — Fri, 29 Jun 2018 18:30:21 GMT

@bhakti1213,

To that best of my knowledge that information is not tracked historically in a format that you could easy include in a report. You could script something so that you have that information handy when needed, but that's about as good as you'll get with that one.

Re: How to generate GlobalProtect VPN Reports

bhakti1213 — Fri, 29 Jun 2018 18:32:28 GMT

ok but this report will show the users logged in at a specific hour so maybe I could filter that in excel. But thanks for the help greatly appericate it and your modified query is ( datasource eq vpn-client ) this one right?

Re: How to generate GlobalProtect VPN Reports

BPry — Sat, 30 Jun 2018 00:38:04 GMT

@bhakti1213,

Correct.

Re: How to generate GlobalProtect VPN Reports

Remo — Sun, 01 Jul 2018 10:46:59 GMT

@bhakti1213

If you are already using some sort of snmp monitoring software, then you may be able to gather the required information there. Paloalto has an snmp OID for concurrent global protect connections. Obviously not as simple as generate a report in the UI, but may be this is a doable alternative for you. (If needed there is a lot of good and also free software out there to do this)

As already mentionned by @BPry, you could script this ... a script that pulls the system logs and then analyzes these logs. Start with a concurrent session number of 0 and with every successful login log you increase the number and save it along with a timestamp to a file. The same of course also with logout logs where you decrease the number. In the end you have a file with a lot of timestamps and the number of concurrent global protect connections which you could nicely import to excel and greate a graph with that to visualize the concurrent connections.

Re: How to generate GlobalProtect VPN Reports

Remo — Sun, 01 Jul 2018 11:52:44 GMT

About that what I wrote about the script ... the dame is also possible in excel when you export sll the login and logout events.