Multiple VPN Connections in SmartView Monitor

[mfavinsk]

Hopefully this is the right forum to be asking SmartView Monitor questions.

I have several users that will VPN into my gateay with two or more concurrent sexsions using the same name and login credentials. SmartView Monitor only shows one VPN session for the user. If the user uses two different names, then SmartView monitor shows both.

Is there any way to get SmartView monitor to show both of the user's VPN sessions?

[BarryStiefel]

Originally Posted by mfavinsk

Hopefully this is the right forum to be asking SmartView Monitor questions.

I have several users that will VPN into my gateay with two or more concurrent sexsions using the same name and login credentials. SmartView Monitor only shows one VPN session for the user. If the user uses two different names, then SmartView monitor shows both.

Is there any way to get SmartView monitor to show both of the user's VPN sessions?

I just created this new forum for SmartView Monitor and moved this thread into it.

[RobertGraham]

Here's the problem, you're eliminating the concept of accountability. What this means is, if you see a VPN connection come in from an unknown location, you have no way of discerning whether it's an interloper or a legit user. Furthermore, if it's a legit user, you have no way of figuring out which one.

Most security products are finally moving in the direction of proper AAA, support for segregation of duties and least privilege. It's not wise for you to set up a model that counter-acts this.

To answer your question directly, five users with the same credentials are the same logical user. As such, there's generally not a need to separate them individually unless you want to see all the connections a single user has. Try SMART Tracker for the current connections, be aware though that this is very CPU intensive.

Please read up on some security best practices. Perhaps you want to get Shon Harris' book on the CISSP to familiarize yourself with these concepts. After that, it should be terribly clear that doing this is a very bad idea.

[melipla]

Originally Posted by RobertGraham

Most security products are finally moving in the direction of proper AAA, support for segregation of duties and least privilege. It's not wise for you to set up a model that counter-acts this.

AFAIK w/Check Point there's no way to limit how many simultaneous logins a user can have. Particularly if you use a third party authentication mechanism like radius. What's to prevent a user from logging in twice?