Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 9 replies
  • Subscribers 1 subscriber
  • Views 5124 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Missing up and down traffic values in remote access report

jetcopter
Hello,  

I have a L2TP over IPsec VPN setup and working perfectly except the remote access session report does not show the upload and download traffic.  The report always shows the values as zero as shown in the attached screenshot. 

Any ideas how to fix this?

Thanks!


This thread was automatically locked due to age.
  • 0
    Could be a bug.  Did you check the known issues list?  Index of /lists
    __________________
    ACE v8/SCA v9.3

    ...still have a v5 install disk in a box somewhere.

    http://xkcd.com
    http://www.tedgoff.com/mb
    http://www.projectcartoon.com/cartoon/1
  • 0 in reply to Scott_Klassen
    Could be a bug.  Did you check the known issues list?  Index of /lists


    Nothing listed.  This is the closest:

    ID23745 9.000 Remote Access: SSL VPN Graph no data
    ------------------------------------------------------------------------
    Description:  The 'SSL VPN Connections' graph at 'Logging & Reporting'
                  >> 'Remote Access' >> 'Activity' shows no data
    Workaround:   There is no workaround, the problem will be addressed in a
                  later release.
    Fixed in:
  • 0
    If you have a paid license, open up a support case with Sophos.  If Premium support, you can contact them directly.  If Standard support, contact your reseller to open up a case for you.

    What version UTM are you running?

    If you reboot and a new L2TP connection is made, is the data tracked properly?
    __________________
    ACE v8/SCA v9.3

    ...still have a v5 install disk in a box somewhere.

    http://xkcd.com
    http://www.tedgoff.com/mb
    http://www.projectcartoon.com/cartoon/1
  • 0
    Same for SSL VPN, I have just checked my home UTM reports from the last 3 months.

    UTM is currently on the last firmware version (9.306) and it still doesn't work. Values are present in the SSL VPN log file:

    2015:01:22-13:47:28 utm openvpn[6289]: id="2202" severity="info" sys="SecureNet" sub="vpn" event="Connection terminated" username="vilic" variant="ssl" srcip="x.y.z.w" virtual_ip="10.242.6.6" rx="2902524" tx="41446934"
  • 0 in reply to vilic
    I have the home license so no support. 

    Running the latest code version 9.306-6.  Reboot and new connection does not fix.
  • 0 in reply to vilic
    Same for SSL VPN, I have just checked my home UTM reports from the last 3 months.

    UTM is currently on the last firmware version (9.306) and it still doesn't work. Values are present in the SSL VPN log file:

    2015:01:22-13:47:28 utm openvpn[6289]: id="2202" severity="info" sys="SecureNet" sub="vpn" event="Connection terminated" username="vilic" variant="ssl" srcip="x.y.z.w" virtual_ip="10.242.6.6" rx="2902524" tx="41446934"


    I'm using L2TP over IPSEC so my data shows up in the ipsec vpn log instead, but I see the data is logged there as well:

    2015:01:23-10:00:27 MyRouter pppd-l2tp[718]: LCP terminated by peer (User request)
    2015:01:23-10:00:27 MyRouter pppd-l2tp[718]: Connect time 5.9 minutes.
    2015:01:23-10:00:27 MyRouter pppd-l2tp[718]: Sent 1654955 bytes, received 683565 bytes.

    Seems to be issue with report engine not parsing log correctly?
  • 0
    no you have to enable remote access accounting in the reports section.  If you are pushing your hardware this WILL place a high amount of load on the machine.  If you are using more than 50% of your ram you have a high likelihood of running into performance issues when the reporting system runs that.  Give it a whirl but i don't use it because it is a resource hog.

    Owner:  Emmanuel Technology Consulting

    http://etc-md.com

    Former Sophos SG(Astaro) advocate/researcher/Silver Partner

    PfSense w/Suricata, ntopng, 

    Other addons to follow

  • 0
    Good catch William.  I'd completely forgotten about that.
    __________________
    ACE v8/SCA v9.3

    ...still have a v5 install disk in a box somewhere.

    http://xkcd.com
    http://www.tedgoff.com/mb
    http://www.projectcartoon.com/cartoon/1
  • 0 in reply to William Warren
    no you have to enable remote access accounting in the reports section.  If you are pushing your hardware this WILL place a high amount of load on the machine.  If you are using more than 50% of your ram you have a high likelihood of running into performance issues when the reporting system runs that.  Give it a whirl but i don't use it because it is a resource hog.


    Yes, it works after that change (screenshot).

    Instead of doing live accounting (which degrades performance), simpler solution would be just to read TX and RX values from the log files after closing user VPN session.
Unfiltered HTML