Monitoring authenticated users
This section describes how to view lists of currently logged-in firewall and VPN users. It also describes how to disconnect users.
The following topics are included in this section:
- Monitoring firewall users
- Monitoring SSL VPN users
- Monitoring IPsec VPN users
- Monitoring users Quarantine
Monitoring firewall users
To monitor firewall users, go to User & Device > Monitor > Firewall.
You can de-authenticate a user by selecting the Delete icon for that entry.
You can filter the list of displayed users by selecting the funnel icon for one of the column titles or selecting Filter Settings.
Optionally, you can de-authenticate multiple users by selecting them and then selecting De–authenticate.
Monitoring SSL VPN users
You can monitor web-mode and tunnel-mode SSL VPN users by username and IP address.
To monitor SSL VPN users, go to VPN > Monitor > SSL-VPN Monitor. To disconnect a user, select the user and then select the Delete icon.
The first line, listing the username and IP address, is present for a user with either a web-mode or tunnel-mode connection. The Subsession line is present only if the user has a tunnel mode connection. The Description column displays the virtual IP address assigned to the user’s tunnel-mode connection.
For more information about SSL VPN, see the FortiOS Handbook SSL VPN guide.
To monitor SSL VPN users – CLI:
To list all of the SSL VPN sessions and their index numbers:
execute vpn sslvpn list
The output looks like this:
| SSL-VPN | Login Users: | |||
| Index | User Auth Type | Timeout | From | HTTPS in/out |
| 0 | user1 1 | 256 | 172.20.120.51 | 0/0 |
SSL-VPN sessions:
Index User Source IP Tunnel/Dest IP
0 user2 172.20.120.51 10.0.0.1
You can use the Index value in the following commands to disconnect user sessions: