Remove specific user connection entry

[lamerz]

While trying to figrue out what caused my clients to time out using SNX application mode after one hour with the error "VPN failed to update Connectra", I found a way to remove a specific user connection. I thought it could be usefull if you don't want to reset everyone and clean some unused connections.

Here's how to kick out the user foobar:

1/ user_monitor start
2/ stattest gettable "1.3.6.1.4.1.2620.1.9004.1" 2 19 32 > userslist.txt
You will need to interrupt this when you get enough users.

3/ sort -u userslist.txt | grep foobar | cut -d',' -f3
We will need to find an id which corresponds to user foobar, let's call it foobar_id.
You can have more than one entry for a user, I don't konw what causes this but on my system it's usually badly closed portal sessions.

4/ fw tab -t cvpn_snx_session -u | grep foobar_id
Now we need to find the user in the table to remove it; we will get what I call idsnx and idsessionsnx

5/ fw tab -t cvpn_snx_session -x -e "idsnx;idsessionsnx"
With previous gathered parameters we can remove this user; his opened tunnels won't be disconnected but he'll need to reauthenticate if he launches a new tunnel.


using 4/ and 5/ clear cvpn_session too to remove portal entry.

example:
[Expert@connectra]# fw tab -t cvpn_snx_session -u | grep 47ea4de4
<47ea4de4; 7b9ad000; 3570/3600>

[Expert@connectra]# fw tab -t cvpn_snx_session -x -e "47ea4de4;7b9ad000"
Entry <47ea4de4>
deleted from table cvpn_snx_session

Back to my original problem, it seems that cvpn_snx_session has a 3600s timeout; if you launch an SNX application mode, open one ssl tunnel and you don't open other tunnels for one hour this timeout does not refresh itself. If you launch another tunnel after one hour, your currently opened tunnel will close and you'll get this error "VPN failed to update Connectra" (very annoying for my users). Checkpoint provided me a fix I need to test.

PS: used on Connectra R62HFA01

[RiverStone]

Lamerz,

Thanks. This will be useful. I have already added it to my notes.

RiverStone