Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 7 replies
  • Subscribers 28 subscribers
  • Views 862 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

traffic counters live users

apijnappels

When I look in live users overview in XG, I can see increasing traffic on each SSL VPN-connection user, but counters for users in the internal network stay 0 while they do seem to be authenticated.

It's hardly imaginable that these users are not at all connecting to the internet, not in the first place for management traffic from AD.

Is there some setting that I need to enable for these internal LAN counters to increase?



This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to LuCar Toni

    Yes, 10.242.12.0/24 are SSL VPN users working from home. Their data is counted

    192.168.21.0/24 is local subnet and this data is not counted. XG is the only firewall and default gateway for every system. It is highly unlikely that no traffic is passing the XG. We have some agents on all our systems that are continuously connecting to online services, users are using mail, browsing the web etc.

  • 0 in reply to LuCar Toni

    Here's another example from this moment, showing that something doesn't look right, but I don't know why or what to change to make the counters start working or to make the connection between user and IP.

    IP 192.168.21.181 has a user authenticated through STAS.

    And here you can see the same IP definately generating traffic, but user is listed as NA

    It looks like the internal users (sitting in local LAN) always have very short STAS sessions, perhaps that is why the user doesn't show any traffic, but it's just guessing from my side.

  • 0 in reply to apijnappels

    I can see also many users with no traffic here. Even with connections for multiple days. All internal LAN connections.

    I found out, that those are networks, not directly connected to / routed by the XG firewall.

    as you have GUI counting issues and are using SSL VPN. Would you mind to have a look if you are facing a similar issue as we do described here?

    https://community.sophos.com/xg-firewall/f/discussions/122776/remote-users-connected-time-not-shown-in-table

    Today while in remote session with support we found out, if you filter for a specific username, missing information (connected since, but not where Connecting mode is empty) is shown for that user.

  • 0 in reply to LHerzog

    Hi ,

    I don't seem to have the issue with having to filter. Unfiltered I see all SSL clients and all information. In fact, my problem seems to be that the SSL-users are the only users where traffic is counted.