Sessions and flow records
Sessions
Section titled “Sessions”VPN → Sessions lists sessions, newest first. You see your own; with the
vpn_session:read permission, you see everyone’s in the organization. Show picks
All sessions, Live, or Ended, and Site narrows the list to one site.
At the top, Sites you can connect to lists where your policies let you connect, and for how long.
Choose a session to see its details:
- the technician, their computer, and the version of the app
- the gateway it’s connected through, its routes, and its aliases
- when it was requested and connected, and when it ends, or when and why it ended
- the technician’s public address (Client endpoint), the last WireGuard handshake, and the bytes each way
With vpn_session:read, Connections lists the session’s
flow records.
If a session’s gateway couldn’t set it up, the session shows Refused by the gateway, and its details give the gateway’s reason.
A gateway’s live sessions are also on its page, on the VPN tab, with a link to every session it has carried.
End a session
Section titled “End a session”Choose End on a live session, and confirm. Its tunnel closes at once. You can end
your own sessions; ending someone else’s takes vpn:update.
Why a session ended
Section titled “Why a session ended”| Shown as | What happened |
|---|---|
| Ended by the user | The technician turned the site off, quit or disconnected the app, or started a newer session from the same computer at the same gateway |
| Ended by someone else | Someone else ended it, or turned the VPN off at its site |
| Expired | It reached its end time |
| Device revoked | Its computer was revoked |
| No policy allows it any more | The policy that allowed it was turned off, deleted, or changed, or the technician left its team |
| The gateway reset its VPN | The gateway cleared its VPN, which removes every session it holds |
Flow records
Section titled “Flow records”Every connection made through the VPN is kept as a flow record:
- Protocol, and the Destination address and port it went to
- As the site saw it: the gateway’s address and port, which is what the device at the other end logged
- From / to the client: the bytes each way
- when it Started and Ended
Your organization keeps flow records for 90 days unless you change it; see Flow records.
Who was it
Section titled “Who was it”A customer’s firewall or server logs VPN connections as coming from your gateway,
since the gateway carries each session onto the network. VPN → Who was it finds
the session behind a connection from what the site logged. It takes
vpn_session:read.
- Choose the Site.
- Enter When (your time) the site logged it. Connections within five minutes of that time match.
- Enter what else you know: the Device address it went to, and the Source address it logged and Source port it logged. The port narrows it down the most.
- Choose Look up.
Each match names the technician and their computer. Choose one to see the rest of that session’s connections.