SSL VPN reporting not working

[Christopher]

Hello everyone,

1. IPSEC and SSL VPN data is being captured by the FortiGate and is transmitted to the FortiAnalyzer.

2. Reports pulling IPSEC information work correctly.

3. Reports pulling SSL information do not work correctly.

4. I can see the SSL VPN User data if I manually comb over the logs.

5. Only Failed SSL VPN User Login attempts show up in any logs.

6. Does anyone know of a dataset I can use to run reports showing the following information?

[ul]

user, time tunnel-up, time tunnel-down, total time of connection, bandwidth, source IP[/ul]

Since the stock reports for SSLVPN users do not work I'm trying to see if I can create my own dataset that may work.

Any help is appreciated.

[AtiT]

Hello,

Try the following dataset - it is tested on v5.0.9 probably it will be the same on 5.2, maybe some column names will be different.

SELECT `user`, TO_CHAR(TO_TIMESTAMP(`itime`-`duration`)::timestamp, 'YYYY-MM-DD HH24:MI:SS') AS tunnel_up, TO_CHAR(TO_TIMESTAMP(`itime`)::timestamp, 'YYYY-MM-DD HH24:MI:SS') AS tunnel_down, `duration` AS dur, SUM(COALESCE(`sentbyte`,0)+COALESCE(`rcvdbyte`,0)) AS bandwidth, `remip` AS sourceip FROM $log-event WHERE $filter AND `subtype`='vpn' AND `tunneltype`='ssl-tunnel' AND `action`='tunnel-down' GROUP BY `user`, tunnel_up, tunnel_down, dur, bandwidth, sourceip ORDER BY tunnel_up ASC

[Christopher]

Unfortunately it doesn't seem to work.  When I run the test it returns: No Data

This is really frustrating.

[hzhao_FTNT]

Hi Christopher,

Could you request a customer ticket and post your ticket number here? We may need a closer look into your FAZ/FGT.

Regards,

hz

[Chikosan]

I have the same problem. if you have any solution please update.

thanks shai 

[AtiT]

Hi,

I have a FAZ100C in our lab and upgraded it to 5.2.0 just now. The dataset I wrote earlier is working on my side.

Try to run the dataset:

SELECT * FROM $log-event WHERE $filter AND `subtype`='vpn' AND `tunneltype`='ssl-tunnel' AND `action`='tunnel-down'

Do you see some logs?

If not, try to run:

SELECT * FROM $log

Do you see something?

If still not I would try to rebuild the sql database for sure.

[Chikosan]

Hi

i can see usersbut it very old data!

run sql db rebuild ?

how can i fix all the VPN report ?

(add photo)

[hzhao_FTNT]

In order to get more accurate results, in new VPN report, we used action='tunnel-stats' instead of tunnel-up/tunnel-down to get vpn info. However FGTs do not send tunnel-stats info by default, we have to configure FGTs by:

config system settings set vpn-stats-log ipsec ssl set vpn-stats-period 300 end

Most of empty report issue should be fixed after above commands executed on fortigates.

Regards,

hz

[hzhao_FTNT]

Hi Chikosan,

Please check if you can see recent logs in FortiView->LogView. If no recent logs, pls check FortiView->LogView->Log Browse and see if you can see recent logs there. If yes, then you will need rebuildDB by blow CLI command:

exe sql-local rebuildDB

If still not, you may have issues in log receiving, and it could be caused by either FAZ or FGT side.

Regards,

hz