Cisco Firepower How to check who logged into VPN history?

[tripline]

show vpn-sessiondb index shows who logged in currently.

Is there a way to show users who logged in yesterday or last week?

[Marvin Rhoads]

Not easily - unless you send the syslog events to an external syslog server and use if to analyze the data.

If you are using FMC you will see some events under the Device Management (VPN) Troubleshooting menu.

[keithcclark71]

If your Username/ IP mapping is in place then one could simply filter events based on defined VPN subnet. I use certificate based yubikey smart cards with touch to establish the VPN and SBL and still can see user/IP mapping VPN history.

[tripline]

So sounds like there's nothing I can do from the CLI

[Marvin Rhoads]

@tripline - the only thing to show historical VPN usage from the cli would be to show log messages of the type related to VPN logon/logoff events. Assuming you are sending logs to the device buffer and that they haven't aged out due to limited local buffer storage space.