I'm trying to find out the (historic) source public IP address of a user who has been connecting to the Sophos SSL VPN on a Sophos XTM firewall.
In the firewall logging I can find all the info for this user after he has connected, but the only way I can find the public IP address he connected from is if I can catch the login info in the live firewall log.
Is there any place this is tracked that I am not seeing, or does the firewall not log that info?
This thread was automatically locked due to age.
