Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Christopher
New Contributor

SSL VPN reporting not working

Hello everyone,

 

1. IPSEC and SSL VPN data is being captured by the FortiGate and is transmitted to the FortiAnalyzer.

2. Reports pulling IPSEC information work correctly.

3. Reports pulling SSL information do not work correctly.

4. I can see the SSL VPN User data if I manually comb over the logs.

5. Only Failed SSL VPN User Login attempts show up in any logs.

6. Does anyone know of a dataset I can use to run reports showing the following information?

[ul]
  • user, time tunnel-up, time tunnel-down, total time of connection, bandwidth, source IP[/ul]

    Since the stock reports for SSLVPN users do not work I'm trying to see if I can create my own dataset that may work.

     

    Any help is appreciated.

  • 8 REPLIES 8
    AtiT
    Valued Contributor

    Hello,

    Try the following dataset - it is tested on v5.0.9 probably it will be the same on 5.2, maybe some column names will be different.

     

    SELECT `user`, TO_CHAR(TO_TIMESTAMP(`itime`-`duration`)::timestamp, 'YYYY-MM-DD HH24:MI:SS') AS tunnel_up, TO_CHAR(TO_TIMESTAMP(`itime`)::timestamp, 'YYYY-MM-DD HH24:MI:SS') AS tunnel_down, `duration` AS dur, SUM(COALESCE(`sentbyte`,0)+COALESCE(`rcvdbyte`,0)) AS bandwidth, `remip` AS sourceip FROM $log-event WHERE $filter AND `subtype`='vpn' AND `tunneltype`='ssl-tunnel' AND `action`='tunnel-down' GROUP BY `user`, tunnel_up, tunnel_down, dur, bandwidth, sourceip ORDER BY tunnel_up ASC

    AtiT

    AtiT
    Christopher

    Unfortunately it doesn't seem to work.  When I run the test it returns: No Data

     

    This is really frustrating.

    hzhao_FTNT

    Hi Christopher,

     

    Could you request a customer ticket and post your ticket number here? We may need a closer look into your FAZ/FGT.

     

    Regards,

    hz

    Chikosan
    New Contributor

    I have the same problem. if you have any solution please update.

     

    thanks shai 

    AtiT
    Valued Contributor

    Hi,

    I have a FAZ100C in our lab and upgraded it to 5.2.0 just now. The dataset I wrote earlier is working on my side.

     

    Try to run the dataset:

    SELECT * FROM $log-event WHERE $filter AND `subtype`='vpn' AND `tunneltype`='ssl-tunnel' AND `action`='tunnel-down'

     

    Do you see some logs?

    If not, try to run:

    SELECT * FROM $log

    Do you see something?

     

    If still not I would try to rebuild the sql database for sure.

    AtiT

    AtiT
    Chikosan
    New Contributor

    Hi

    i can see usersbut it very old data!

    run sql db rebuild ?

    how can i fix all the VPN report ?

     

     

    (add photo)

    hzhao_FTNT

    In order to get more accurate results, in new VPN report, we used action='tunnel-stats' instead of tunnel-up/tunnel-down to get vpn info. However FGTs do not send tunnel-stats info by default, we have to configure FGTs by:

    config system settings set vpn-stats-log ipsec ssl set vpn-stats-period 300 end

    Most of empty report issue should be fixed after above commands executed on fortigates.

     

    Regards,

    hz

    hzhao_FTNT

    Hi Chikosan,

     

    Please check if you can see recent logs in FortiView->LogView. If no recent logs, pls check FortiView->LogView->Log Browse and see if you can see recent logs there. If yes, then you will need rebuildDB by blow CLI command:

    exe sql-local rebuildDB

    If still not, you may have issues in log receiving, and it could be caused by either FAZ or FGT side.

     

    Regards,

    hz

    Announcements

    Select Forum Responses to become Knowledge Articles!

    Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

    Labels
    Top Kudoed Authors