How-to: Create a SSL VPN login report on a FortiAnalyzer

This quick how-to guide will go through creating a chart/report on a FortiAnalyzer to show successful SSL VPN logins, displaying the date/time, user, mode (tunnel or web) and the remote IP address the VPN was established from.

This config is done on a FortiAnalyzer running 5.0.6.

The steps required are as follows:

1. Create dataset

2. Create chart

3. Create report

1. Create dataset:

To create a dataset goto the 'Reports' tab on your FortiAnalyzer then browse to Advanced > Dataset. From here click on 'Create New' and enter a name, select 'Event' for the 'Log Type'. 

Enter the following in the 'Query' section:

select from_dtime(dtime) as date, `user`, tunneltype, action , remote_ip from $log where (tunneltype = 'ssl-tunnel' or tunneltype = 'ssl-web') and action = 'tunnel-up' order by date desc

Once this is done you can click on the 'Test' button to make sure it's working correctly then click 'Ok' to save. Your final dataset should look something like this:

2. Create chart:

Goto Reports > Chart Library and create a new chart (don't use the wizard to create the chart).

Enter a name, select 'Event' for the category, select the dataset you created in step 1 and change the 'Only Show First' to the amount of SSL VPN logins you want to show on the chart.

Next go through each column and change the header and the display values to the following:

Column 1:
Header: Date
Data Binding: date
Display: Text

Column 2:
Header: User
Data Binding: user
Display: Icon-User

Column 3:
Header: SSL Tunnel Type
Data Binding: tunneltype
Display: Text

Column 4:
Header: Remote IP
Data Binding: remote_ip
Display: Text

Click 'Ok' to save. Your end chart should look like this:

3. Create report:

Rightclick on the Report section and select 'Create New'

From here give your report a name, select the FortiGates you want to run the report for (or select 'All FortiGates to run it for all of them). Click Apply to save and you'll be taken to this screen:

Now click on 'Edit Template' to configure the chart to be run in the report.

Once here drag a textbox to the 'Header Text' section and type in your report name. Next drag a chart (circled in red) to the main body and select the chart we created in step 2. Your final report should look like this:

Click 'Save' then 'Return' to go back to the report. Once here click on 'Run Now' to run the report. Once the report is finished click it to open and view!