How To See Active Users

Login To Panorama

Follow the steps in this article to login to Panorama: How To Access Multi-Cloud Firewall

There are two ways to view the active users in GlobalProtect:

View Active Users by Portal

When a user navigates to the portal in a web browser they are authenticated and then given the option to download the GlobalProtect client. If you decide to set up Clientless Apps, they will appear in this area as well. Note that Clientless Apps are available to configure, but are not supported by Expedient.

1. Click the Panorama drop down in the top left corner.

2. Select your primary device (the device with the green icon).

3. Click the Network Tab.

4. Click on Portals under GlobalProtect

If Clientless Apps are set up, there will be a link here to view the current users who are using these apps.

Clicking on “Current Users” will display a popup window of active users with the following fields:

• Username
• Client IP
• Source Region
• Session ID
• Session Start Time
• Inactivity Timeout
• Inactivity Timeout Remains (Sec)
• Login Lifetime
• Login Lifetime Remains (Sec)
• Size of Cookie Cache
• Logout

Here there is no option to see previous users.

View Active Users By Gateway

After a user is authenticated on the Portal and is using the GlobalProtect local application, they have access to the Gateway. Depending on the Portal Authentication configuration they may need to authenticate again to complete the connection. When authentication completes the user will be assigned a client pool IP address.

1. Click the Panorama drop down in the top left corner.

2. Select your primary device (the device with the green icon).

3. Click the Network Tab.

4. Click on Gateways under GlobalProtect

5. To see currently logged in users, click Remote Users
   

You can also see users who have logged out under Previous User

User Count: At the top right you can see “43 items” which just means that 43 users are currently logged in to the Global Protect gateway.

Private IP: You can use the listed private IP to look up traffic logs and see what this user is accessing.

Tunnel Type: Typically (per default deployment) users connect with the IPSec type. However for poor network conditions (typically on the remote user’s home network), GlobalProtect may switch the user connection over to SSL. This is more reliable, but results in lower throughput.

Logout: This option allows the administrator to disconnect users who may have a stuck session.

Search Box: The search field at the top is plain-text, and matches any field in the table. For example, you can type “David” to see users with that name, or “11 Pro” to see users that are running Microsoft Windows 11 Professional on their machines.