Monitoring authenticated users
This section describes how to view lists of currently logged-in firewall and VPN users. It also describes how to disconnect users.
The following topics are included in this section:
- Monitoring firewall users
- Monitoring SSL VPN users
- Monitoring IPsec VPN users
- Monitoring users Quarantine
Monitoring firewall users
To monitor firewall users, go to User & Device > Monitor > Firewall.
You can de-authenticate a user by selecting the Delete icon for that entry.
You can filter the list of displayed users by selecting the funnel icon for one of the column titles or selecting Filter Settings.
Optionally, you can de-authenticate multiple users by selecting them and then selecting De–authenticate.
Monitoring SSL VPN users
You can monitor web-mode and tunnel-mode SSL VPN users by username and IP address.
To monitor SSL VPN users, go to VPN > Monitor > SSL-VPN Monitor. To disconnect a user, select the user and then select the Delete icon.
The first line, listing the username and IP address, is present for a user with either a web-mode or tunnel-mode connection. The Subsession line is present only if the user has a tunnel mode connection. The Description column displays the virtual IP address assigned to the user’s tunnel-mode connection.
For more information about SSL VPN, see the FortiOS Handbook SSL VPN guide.
To monitor SSL VPN users – CLI:
To list all of the SSL VPN sessions and their index numbers:
execute vpn sslvpn list
The output looks like this:
|Index||User Auth Type||Timeout||From||HTTPS in/out|
Index User Source IP Tunnel/Dest IP
0 user2 172.20.120.51 10.0.0.1
You can use the Index value in the following commands to disconnect user sessions:
Having trouble configuring your Fortinet hardware or have some questions you need answered? Ask your questions in the comments below!!! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!