Globalprotect report generation on users

[RemusDV]

Is it possible to generate a report about the average logged in users in global protect

I can see who is currently logged in by going to Network>>gateway>remote user, but no reports on it. I also know the maximum number of users for that firewall PA3220 which is 1024 users

[kiwi]

Hi @RemusDV ,

There's an existing feature request for this.

Please reach out to your local SE and have him add your vote:

FR ID 2460 (GlobalProtect Reporting).

Until then you should be able to use the following workaround:

How to Run a Report for Previous Logged in GlobalProtect Users 

Cheers !

-Kiwi.

[SergGur · Accepted solution]

Seems like there will be many more people interested to graph GlobalProtect capacity due to COVID-9 and WFH

I checked past forum posts, seems like there is no simple option to do it onboard. Perhaps good old SNMP will be of help here. We are planning to try out panGPGWUtilizationActiveTunnels.0. Please share your progress in this post

MIB detials at https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClaSCAS

GlobalProtect gateway utilization	panGPGatewayUtilization	1.3.6.1.4.1.25461.2.1.2.5.1	PAN-COMMON-MIB
GlobalProtect gateway % utilization	panGPGWUtilizationPct.0	1.3.6.1.4.1.25461.2.1.2.5.1.1	PAN-COMMON-MIB
GlobalProtect gateway max tunnels	panGPGWUtilizationMaxTunnels.0	1.3.6.1.4.1.25461.2.1.2.5.1.2	PAN-COMMON-MIB
GlobalProtect gateway active tunnels	panGPGWUtilizationActiveTunnels.0	1.3.6.1.4.1.25461.2.1.2.5.1.3	PAN-COMMON-MIB

[SergGur]

Just to confirm, we build report polling two parameters. Both are generating nice accurate graphs.

• panGPGWUtilizationPct
• panGPGWUtilizationActiveTunnels

[kiwi]

Hi @RemusDV 

Aside from what's already been said ... the ACC might provide the data you're looking for:

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-new-features/globalprotect-features/enhanced-log...

Cheers !

-Kiwi.

[RemusDV]

This is actually a good solution. Even though it is available in 9.1(correct me if I'm wrong). I'll still advise the client. Thanks kiwi for the support

[yan]

For those who are trying to get a list of GPA VPN users by the hour connecting via PRISMA or for those who have a Panorama that is connected to PRISMA, when you try to create a custom report that you can schedule to run every hour, you will notice in the fine print under the custom report creation that it does not support Cortex Data Lake logs. Thus your panorama cannot pull the data. it might pull it just 1x but never again. There is a feature request put up for that. In the meantime, the most you can do is generate the report manually , export to .csv and manually filter it by the time and manually remove the duplicate users. i use these filters:

Panorama/Monitor/mobileuserdevicegroup search by ( stage eq tunnel ) and ( status eq success )

Or

apps.paloaltonetworks.com/ Explore search by stage = 'tunnel' AND status.value = 'success'

Export the results as .csv and filter it by date/hour and remove the duplicates, all manually and if needed by the hour, manually run the search again on the hour. 

that's all you can do until they make it a feature on Panorama (Prisma).

[yan]

in Explore, use Firewall/GlobalProtect. For Panorama, Monitor, Logs, GlobalProtect