topic Re: Monitoring Global Protect in General Topics

Monitoring Global Protect

Brandon_Wertz — Mon, 23 Jul 2018 18:00:09 GMT

I'm currently in the process of migrating my company from AnyConnect to Global Protect on our 5220s. I'm looking for your feedback on how you all "monitor" the VPN service?

When comparing the "dashboard" view of Cisco's ASDM I don't really see anything which can be loaded on the Palo "dashboard" tab. It seems like the only real way is to look at "remote users" under your gateway config, but this doesn't really seem to provide a good "at a glance" kinda view.

So I'm looking to get some "this is how it worked for us" tips from the community.

Things I'm looking for are trends on connected users, top talkers, lists of users which might be trying to connect but are failing... et al. (am I really going to have to try to sort through noisy system logs? anyone have any good filters???)

Look forward to hearing everyone's feedback.

Re: Monitoring Global Protect

gwesson — Mon, 23 Jul 2018 20:48:03 GMT

Nothing on the firewall GUI other than the Remote Users item you mention.

In CLI (and thus, using the API as well) you can grab the list:

show global-protect-gateway current-user

You can also restrict that command to a specific gateway, domain, or username.

System logs aren't great for what you want because you won't be able to easily tell which logs are no longer relevant. A user who logged in 5 minutes ago but logged out 3 minutes ago will still show up if you query all login events. If you query by both login and logout events, you'd have to sort those in a way that was unique to the user.

Re: Monitoring Global Protect

Brandon_Wertz — Mon, 23 Jul 2018 20:53:26 GMT

@gwesson Thanks for the reply. Unfrotunately wasn't what I was hoping to hear.

Hopefully others have some suggestions on what has worked for them. I have to say though I'm really surprised that there doesn't seem to be much in the way of a view into this service.

Re: Monitoring Global Protect

Mick_Ball — Tue, 24 Jul 2018 10:41:12 GMT

Yes the PA is missing some functionality here...

It can get messy so I have been relying on Syslog for my required information.

with simple scripts I can do the following...

report on department usage, individual use, group useage etc...

failed logins per day, week. month or year.

most connections, least connections and never connected.

I can also read through our list of 1500 IPad names (TAG) and report last connection, all connections or IPads that have not connected in the last 3 months. (these are returned to the pool).

and hundreds of other reports including source address, allocated IP.. and reason for failed connection.

probably of no use to anybody but my point is that this info is not easily available from the PA and saves hours connecting to each device, (each gateway is HA pair).

for instant updates on gateway connections I use as per @gwesson suggestion but via API.

this only shows current connections per gateway and updates every 10 seconds but clearly identifies busy periods..

Laters....

Re: Monitoring Global Protect

BPry — Tue, 24 Jul 2018 13:27:12 GMT

@Brandon_Wertz,

Personally I just created a script that pulls the gateways statistics and utilize the <CurrentUsers> value to keep track of how many users are connected to each gateway at any one time; and then have a weekly graph built out that can use the stored values to graph the average users per hour/day and such.

I also collect the Previous-User information on the gateways to indicate where each user logged in from (more important on the BYOD gateway) and how long the user was actually connected, along with the reason the session was disconnected. This is kept mainly for logging reasons so that we can provide them if a manager ever requests them for some reason, or if we need to see what the user logged in from.

Re: Monitoring Global Protect

Brandon_Wertz — Tue, 24 Jul 2018 15:41:18 GMT

So far it seems that custom reports are going to be the way to go.

Thanks for everyone's suggestions so far!

Re: Monitoring Global Protect

Brandon_Wertz — Wed, 25 Jul 2018 13:22:16 GMT

I was looking at the custom reports and just found you can't search system logs. Is everyone just using saved filters and searching the logs directly?

Re: Monitoring Global Protect

BPry — Wed, 25 Jul 2018 13:52:18 GMT

@Brandon_Wertz,

You could save the query and just do that; or you could do it with the API or something like Netmiko.

Re: Monitoring Global Protect

Brandon_Wertz — Wed, 25 Jul 2018 13:55:05 GMT

This gets worse the more I look into this. I can't believe there's this much effort that has to be done to monitor something which seems like it should be really easy to monitor.

Re: Monitoring Global Protect

BPry — Thu, 26 Jul 2018 01:15:19 GMT

@Brandon_Wertz,

Honestly short of the 4.1 updated clients that were recently pushed out with the redesigned interface it wasn't that big of an issue for us. The only people that I had using the GlobalProtect client were our IT staff members and everyone else simply used AnyConnect.

PA finally got the client right with the 4.1 update, but the reporting still leaves a lot to be desired. If you don't want to get busy with the API or scripting in some way or another, it frankly sucks. I'm hoping that PA addresses this going forward, but GP has never seemed like a priority so I'm not holding my breath.

Re: Monitoring Global Protect

Brandon_Wertz — Thu, 26 Jul 2018 13:34:07 GMT

And there you have it...

I'll be talking to my SE hopefully getting some visibility on where these features are. Enterprise class hardware, shouldn't require advanced scripting or syslog parsing to view what even basic competitor platforms can do "on box."

Re: Monitoring Global Protect

jambulo — Fri, 27 Jul 2018 14:16:27 GMT

We use our SNMP monitoring tool to send HTTP request to the Portal/Gateway. If it does not get a response, we get alerted.

Re: Monitoring Global Protect

BPry — Fri, 27 Jul 2018 14:17:44 GMT

@jambulo,

I think this was less of a question on ensuring the Gateway is reachable, and more how one monitors the users and connection states of GP.

Re: Monitoring Global Protect

CarloSalvador — Thu, 18 Apr 2024 15:11:02 GMT

Hi @BPry , may I ask how did you do this? 🙂 Hope you can share your materials, documents, steps you use to build this. I am struggling with this monitoring at the moment.

Re: Monitoring Global Protect

Brandon_Wertz — Thu, 18 Apr 2024 17:39:51 GMT

I think since PAN-OS 10.0 Palo added the required visibility in the ACC tab with a specific section for Global Protect. There is also specific "Global Protect" logs in the monitor tab.

Re: Monitoring Global Protect

CarloSalvador — Fri, 19 Apr 2024 08:54:04 GMT

Hello @Brandon_Wertz , I mean, the script that @BPry created as stated below. Thank you!

"Personally I just created a script that pulls the gateways statistics and utilize the <CurrentUsers> value to keep track of how many users are connected to each gateway at any one time; and then have a weekly graph built out that can use the stored values to graph the average users per hour/day and such.

Re: Monitoring Global Protect

BPry — Fri, 19 Apr 2024 14:59:46 GMT

@CarloSalvador,

This is the basic substance for tracking user counts. You would then utilize whatever you want to store the information for utilization in reports or graphs as you desire.

gather_gateway_count = requests.post('https://' + str(firewall) + '/api/?type=op&cmd=<show><global-protect-gateway><statistics></statistics></global-protect-gateway></show>&key=' + str(key), verify=False) # Set firewall and key to whatever you need # gateway_count_dict = xmltodict.parse(gather_gateway_count.content) total_active_users = gateway_count_dict['response']['result']['TotalCurrentUsers'] # Gathers the current users across all configured gateways. You'll get each individual gateway as well via gateway_count_dict['response']['result']['Gateway'] if desired# total_previous_users = gateway_count_dict['response']['result']['TotalPreviousUsers'] # Gathers the previus users across all configured gateway. Again you can view this for specific gateways if desired #

If you want to log the rest of the information that I mentioned (disconnect reason, connection duration, login source, etc.) the same basic principal applies. Keep in mind if you are able to offload the GlobalProtect logs and store them for an extended duration, or have a sufficient storage allocation on your firewall or Panorama instance, all of this information is something the firewall already natively tracks. What I've done is simply build custom reports with the information that I want to record for easy automation purposes and utilize the API to collect and then record that report information.

As an example just:

run_report = requests.post('https://' + str(firewall) + '/api?type=report&async=yes&reporttype=custom&reportname=BYOD_GP_Logout',headers=headers,verify=False) # The report here includes what I actually want to record. So you might include just login_duration with srcuser, include public_ip, or whatever else you decide you want/need# report_dict = xmltodict.parse(run_report.content) job_id = report_dict['response']['result']['job'] time.sleep(60) #Allow enough time for report to run# request_report = requests.get('https://' + str(firewall) + '/api?type=op&cmd=<show><report><id>' + str(job_id) + '</id></report></show>',headers=headers,verify=False) report_dict = xmltodict.parse(request_report.content) OrdDict = report_dict['response']['result']['report']['entry'] root = OrdDict for element in root: recorded_session = [(element['srcuser']),(element['login_duration'])] src_user = recorded_session[0] login_duration = recorded_session[1] login_duration = int(login_duration) login_minutes = login_duration/60

This gives you an example of what/how I'm pulling information from that report. From here, what I end up doing is temporarily recording the duration in a REDIS database with the src_user being the key and the value being the login_duration. In the event the key already exists (indicating the user was previously connected) you can simply add the existing value to the current login_duration and update the key.

Once you have the desired information you simply work with it however you would want. So in the above REDIS example I'm writing that information into a SQL database for long-term retention and utilizing it in reports that get sent out. If you can get the information you want into a custom report, then you can fetch it through the API and do whatever you want with it from a reporting or retention aspect.

Re: Monitoring Global Protect

CarloSalvador — Mon, 22 Apr 2024 12:59:50 GMT

Hi @BPry , thank you for your response on my question. I saw another comment of you in another thread regarding Custom Reporting. I will try that one and will let you know 🙂

Thank you also for this scripts you gave! I will try to study it and understand it.