Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 6 replies
  • Answers 2 answers
  • Subscribers 3 subscribers
  • Views 10255 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Any way to get detailed inbound/outbound traffic logs?

Ryan Swin

I can find where to get session info on SSL VPN connections, but I can't find a log showing detailed SSL VPN traffic. Any ideas?



This thread was automatically locked due to age.
Parents
  • 0

    Hi Ryan,

    If Jaydeep's answer isn't what you were looking for, share with us the motivation for asking your question - what do you want to know?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Hi Bob/Jaydeep,

     

    Sorry, my question was posted on behalf of someone else and admittedly I rushed it. Basically I'd like to know whether SSL VPN-specific traffic is logged anywhere for an event such as:

     

    "Ryan sent traffic outbound to address 1.1.1.1 at 5:13PM on September 18th through the VPN tunnel."

  • 0 in reply to Ryan Swin

    Hi  

    No, it would not be possible for UTM to log the traffic to these details. It would consume the logs disk and the resource in only logging this traffic details which would be counterproductive to main purpose of a firewall.

    However, you can use TCPDUMP in SSH of UTM to check live traffic details. Please note that UTM can not store that for a later-viewing purpose. Please refer to this KBA Sophos UTM: How to capture packets and download the Packet Capture for more details on how to capture live traffic in UTM 9.

    Regards

    Jaydeep

Reply Children
  • 0 in reply to Jaydeep

    Thanks Jaydeep,

     

    Your reply makes a lot of sense, as what I was asking for does seem a little outside of the responsibilities of a router. I suppose there is dedicated hardware appliances that are meant gathering information like this that we could position between our router and the public internet. Perhaps something like a Unifi Security Gateway device? Does that make sense?

Unfiltered HTML