VPN Sessions Reports
To search for and generate a report on data about VPN sessions (including initiation and conclusion times) on selected log sources during a specified time interval, use the VPN Sessions Real-Time Report.
Menu path:
In addition to setting the common report options in Preparing a Real-time Report, you can select optional filter operators in the generated report.
Optional filter operators can be sorted in ascending or descending order. Choose sort order using the list. The default is to display only the Source Device, User, Avg Duration, Avg Bytes, and Count.
For information on saving the generated report, see Formats for Saving a Generated Report.
| Option | Description |
|---|---|
| Source Device | Description of the device that sent these log messages |
| User | User ID |
| Target User | User ID on the device with which the source device attempted to connect |
| Source IP | IP address of the device that sent these log messages |
| Target IP | IP address of the device with which the source device attempted to connect |
| Avg Duration | Average duration of each connection |
| Avg Bytes | Average number of bytes |
| Count | Number of VPN sessions |
Appliances cannot receive disconnected messages. A VPN session is recorded permanently in the database table authentication after it is disconnected, prior to that the session is considered active. A Check Point VPN session is considered disconnected when a new connection attempt is made by the same user from the same IP address.