topic Re: how to check list of users of particular group who are connecting Global protect. in General Topics

how to check list of users of particular group who are connecting Global protect.

Deepak_K — Wed, 13 Jan 2021 11:55:11 GMT

We want list of users of particular group who are connecting Global protect.

Reason behind this requirement is to get number of users from particular group who are connecting GP. So accordingly we can purchase the licence for 2FA from third party vendor.

We have added multiple groups for GP authentication , if 100 users in HOD group and from them only 50 users connecting GP.
We want list of those 50 users.

Re: how to check list of users of particular group who are connecting Global protect.

Mick_Ball — Wed, 13 Jan 2021 12:30:56 GMT

I have not seen any direct link to display this but you could add a portal agent config for each group. just clone the default config (if you have one ) and add each group to the config selection criteria.

So your portal would have an agent config named "HOD" and the user/user group under selection criteria would also be "HOD".

you will then be able to run a custom report on GlobalProtect and use the filter builder "Description Contains HOD"

Or... If you are forwarding to syslog then you could import all group members into a file and using a "while do" loop grep the logs.

Re: how to check list of users of particular group who are connecting Global protect.

reaper — Wed, 13 Jan 2021 13:06:11 GMT

in the logs there's no direct correlation between the username and group membership, the group is used more like an access list to be allowed to authenticate

so if you add the HOD group to their own gateway (create a new gateway and only allow that group to use that gateway) you will be able to quickly generate a report or manually inspect the GlobalProtect logs for anyone using that gateway

Re: how to check list of users of particular group who are connecting Global protect.

Abdul-Fattah — Wed, 13 Jan 2021 14:12:51 GMT

you can check the list of users who are connecting or previously were connected to GP from: Network > Globalprotect > Gateway> Remote user > previuos user, you can search for the group you want or you can export the list and do the search and processing that meet your requirements.

Re: how to check list of users of particular group who are connecting Global protect.

Mick_Ball — Wed, 13 Jan 2021 14:40:32 GMT

@Abdul-Fattah

I cannot see the group listed in previous users, what version??

I only get these columns..

Re: how to check list of users of particular group who are connecting Global protect.

Abdul-Fattah — Thu, 14 Jan 2021 11:06:47 GMT

@Mick_Ball

<p> Primary Username field you should be able to seen the Domain and above in the search field you can enter the domain to filter only the wanted users</p>