Why juniper:sslvpn log entries from users who claims working in office

[apollowhitehat]

Hello, salute to experts!

We have some users who claimed working in the offcie, are currently on vacation, how come we still see some juniper:sslvpn log entries like below:

VPN Tunneling: Session started ...
AUT24414: Agent login succeeded ...

Thanks

[apollowhitehat]

Sorry, correction ( I cannot edit my own post above?):
We have some users who claimed working in the office, how come we still see some juniper:sslvpn log entries

[apollowhitehat]

btw, the purpose is to find who goes to office, and who works remotely, as part of covid-19 tracking

[dongondon]

Users who are on vacation can still generate Juniper SSL VPN log entries like "Session started" or "Agent login succeeded" because VPN sessions may remain active even if the user is not physically in the office. Some devices or VPN clients might maintain persistent or automatic connections that trigger these logs without active user interaction. Additionally, background processes or network monitoring tools could cause log entries that do not necessarily reflect actual user presence.

Therefore, the presence of these log entries does not automatically mean users are working on-site during their vacation. It is important to check VPN session configurations, session timeouts, and correlate the logs with actual user activity or device status for a clearer understanding. This behavior is typical of Juniper SSL VPN systems and reflects how VPN sessions and logging operate in practice.


__________________________
**Links removed by Site Administrator so it doesn't look like you're spamming us. Please don't post them again.**