VPN Sessions Reports
To search for and generate a report on data about VPN sessions (including initiation and conclusion times) on selected log sources during a specified time interval, use the VPN Sessions Real-Time Report.
Menu path:
In addition to setting the common report options in Preparing a Real-time Report, you can select optional filter operators in the generated report.
Optional filter operators can be sorted in ascending or descending order. Choose sort order using the drop-down menu. The default is to display only the Source Device, User, Avg Duration, Avg Bytes, and Count.
For information on saving the generated report, see Formats for Saving a Generated Report.
| Option | Description |
|---|---|
| Source Device | Description of the device that sent these log messages |
| User | User ID |
| Target User | User ID on the device with which the source device attempted to connect |
| Source IP | IP address of the device that sent these log messages |
| Target IP | IP address of the device with which the source device attempted to connect |
| Avg Duration | Average duration of each connection |
| Avg Bytes | Average number of bytes |
| Count | Number of VPN sessions |
Appliances cannot receive disconnected messages. A VPN session is recorded permanently in the database table authentication after it is disconnected, prior to that the session is considered active. A Check Point VPN session is considered disconnected when a new connection attempt is made by the same user from the same IP address.