Feature req: list a user last login time to sslvpn/last time fortitoken was used

[Ralph1973]

What I have with a customer: they have 200+ vpn users with Fortitoken.

I want to see quickly when a user lately has logged in to sslvpn and/or when the fortitoken has been used for the last time.

The customer wants to manage their fortitokens and it is difficult (or not at all) to see whether a remote supplier did log on to their environment with a fortitoken for the last time. If it has been longer than 3 months, they want to remove the token/ disable user and supply the token to another user.

Kind regards,

Ralph

[emnoc]

For the 1st part Fortianalyer & Syslog should show the user logins

[ede_pfau]

There should be user events generated for each successful 2FA login, and thus you should be able to generate a custom report on a FAZ.

[Ralph1973]

Hello, I have looked through that already and unfortunately the token that is used is not logged during sslvpn login.

I am afraid we have to create a custom report that lists last login time of a user and from there derive the associated token, however that is more administrative effort.

Thanks,

Ralph