Cisco Security Cloud Control: Secure Firewall Device Management

PDF

Cisco Security Cloud Control: Secure Firewall Device Management

Remote access VPN session monitoring

Updated: August 31, 2026

Want to summarize with AI?

Log in

Explains how to monitor Remote Access VPN sessions in Security Cloud Control Firewall Management for ASA and FDM-managed devices, including live and historical AnyConnect session data, dashboards, search and filters, customized views, CSV exports, and session disconnection.

Remote access VPN session monitoring is a Security Cloud Control Firewall Management capability that

  • provides secure connection monitoring for remote users, such as mobile users or telecommuters

  • enables you to determine quickly whether remote access VPN problems exist and where they exist, and

  • allows you to disconnect remote access VPN sessions as needed.

Remote access VPN monitoring capabilities

The Remote Access Virtual Private Monitoring page provides this information:

  • A list of active and historical sessions for up to a year.

  • Shows intuitive graphical visuals to provide at-a-glance views from all active VPN headends managed by Security Cloud Control Firewall Management.

  • The live session screen shows the most used operating system and VPN connection profile in the Security Cloud Control Firewall Management tenant. It also shows the average session duration and data uploaded and downloaded.

  • Filtering capabilities to narrow your search based on criteria such as device type, device names, session length, and the amount of data transmitted and received.

Monitor live AnyConnect remote access VPN sessions

Monitor real-time data from active AnyConnect remote access VPN sessions to track current connectivity and session status.

You can monitor real-time data from active AnyConnect remote access VPN sessions on the devices. This data is automatically refreshed every 10 minutes. If you want to retrieve the latest list of sessions at any point, you click the reload iconReal-time monitoring interface for active AnyConnect remote access VPN sessions, displaying session status and connectivity information.appearing on the right corner of the screen.

Before you begin

  • Onboard the remote access VPN head-ends to Security Cloud Control.

  • Ensure that the connectivity status of the devices you want to monitor live data is "Online" on the Security Devices page.

Procedure

1.

From the Security Cloud Control Home page, click Firewall.
2.

In the left pane, click Insights & Reports > Reports & Analytics > Remote Access Monitoring.
3.

Click RA VPN.
4.

Click Live.

You can search and filter RA VPN sessions to narrow down your search based on criteria such as device type, session length, and upload and download data range.

Note

The Data TX and Data RX information are not available for FTD.

The live AnyConnect remote access VPN sessions are displayed with real-time data that refreshes automatically every 10 minutes.

View live remote access VPN data

The live data is presented both in the dashboard and tabular form.

Dashboard view

You have to click the Show Charts View icon appearing at the top right corner of the screen to see the dashboard.

The dashboard provides at-a-glance views from all active VPN headends managed by Security Cloud Control.

  • Breakdown (All Devices): Shows a total number of live sessions. It also shows a pie chart that is divided into four arc lengths. It illustrates the percentage of VPN sessions of the top three devices with the highest number of sessions. The remaining arc length represents the aggregate of other devices.

  • Shows most used operating system and connection profile in the Security Cloud Control tenant.

  • Shows average session duration and data uploaded and downloaded.

  • Active Sessions by Country: Shows an interactive heat map of the location of the users connected to your RA VPN headends.

    • Countries from which users have connected are shown in progressively darker shades of blue, depending on the relative proportion of the sessions established from that country — the darker the blue color means more sessions are established from that country.

    • The legend at the bottom of the map provides a scale that indicates the correlation between the number of sessions in a country and the shade of blue used to color the country.

    • Hover the mouse pointer on the map to see the country's name and the total number of active user sessions established from that country.

    • Hover the mouse pointer on the table to see the country's location and the total number of active user sessions on the map.

Tabular view

Click the Show Tabular View icon on the top right corner of the screen to view the data in tabular format.

The tabular form provides a complete list of VPN users connected presently.

  • The Location column shows the location of all the users connected to the VPN headends by geolocating their public IP addresses. Click a row to view the user details. On clicking the location link in the left pane, the location of the user is shown on the Google map.

    Security Cloud Control applies a standard filter to the live data and represents them on the dashboard. You can apply new filters only when tabular data is shown, since the custom filters are not supported in the visual dashboard view. Click Clear to remove all filters you have applied. You cannot remove the standard filter.

You can use Search and Filter RA VPN Sessions functionalities to narrow down your search based on criteria such as device type, session length, and upload and download data range. Note that a maximum of 10,000 results can be displayed at once.

A green dot with an Active label in the status column indicates an active VPN user's session.

Monitor historical AnyConnect remote access VPN sessions

Monitor historical data from AnyConnect Remote Access VPN sessions to analyze VPN usage patterns and session data recorded over the past 1 year.

You can monitor the historical data from AnyConnect Remote Access VPN sessions recorded over the past 1 year.

Before you begin

  • Onboard the RA VPN head-ends to Security Cloud Control.

Follow these steps to monitor Historical AnyConnect Remote Access VPN Sessions:

Procedure

1.

From the Security Cloud Control Home page, click Firewall.
2.

In the left pane, click Insights & Reports > Reports & Analytics > Remote Access Monitoring.

3.

Click RA VPN.
4.

Click Historical.

  • Remote Access VPN Session data is stored and available to query for 1 year.

  • You can use Search and Filter RA VPN Sessions functionalities to narrow down your search based on criteria such as device type, session length, and upload and download data range.

  • The Data TX and Data RX information are not available for Secure Firewall Threat Defense.

You can now view and monitor historical AnyConnect Remote Access VPN session data, with options to search and filter based on various criteria.

View historical remote access VPN data

The historical data is presented both in the dashboard and tabular form.

Dashboard view

You have to click the Show Charts View icon appearing at the top right corner of the screen to see the dashboard. You will see the dashboard view along with the tabular view.

The dashboard provides at-a-glance views from all active VPN headends managed by Security Cloud Control. It provides a bar graph showing the VPN sessions recorded for all devices in the last 24 hours, 7 days, and 30 days. You can select the duration from the drop-down. You can hover over on individual bars to see the date and the total number of sessions on that day.

Tabular view

You have to click the Show Tabular View icon appearing at the top right corner of the screen to see only the tabular view. The tabular form provides a complete list of VPN users connected over the last year.

The Location column shows the location of all the users connected to the VPN headends by geolocating their public IP addresses. Click a row to view the user details. On clicking the location link in the left pane, the location of the user is shown on the Google map.

Security Cloud Control applies a standard filter to the historical data and represents them on the dashboard. You can apply new filters only when tabular data is shown, since the dashboard is not supported for custom filters. Clearing the newly applied filters relaunches the dashboard (On the screen, click Clear to remove manually applied filters). You cannot remove the standard filter.

You can use Search and Filter RA VPN Sessions functionalities to narrow down your search based on criteria such as session date and time range, session length, and upload and download data range. Note that a maximum of 10,000 results can be displayed at once.

A green dot with an Active label in the status column indicates an active VPN user's session.

Search and filter remote access VPN sessions

This task enables you to locate specific remote access VPN sessions efficiently using search and filter capabilities to analyze session data and troubleshoot connectivity issues.

Use search and filter functionality to find remote access VPN sessions when you need to monitor or analyze specific session data. The filter functionality is available for both live and historical views, allowing you to examine sessions over the last three months.

Procedure

1.

Use the search bar to find remote access VPN sessions by device name, IP address, or serial number.

Start typing in the search bar, and remote access VPN sessions that fit the search criteria will be displayed. Search is not case-sensitive.
2.

Use the filter sidebar to find remote access VPN sessions based on specific criteria.

  • Filter by Devices: Select one or all devices from the All Types tab to view sessions from selected devices. The window also categorizes the devices based on their type and displays them under the corresponding tabs.

  • Sessions Time Range (Applicable only for historical data): View historical sessions from a specified date and time range. Note that you can view data recorded over the last three months.

  • Sessions Length: View sessions based on a specified session's duration length. Set the time unit (hours, minutes, or seconds) and specify the minimum and maximum duration length by moving the slider. You can also specify the length in the provided fields.

  • Upload (TX): View sessions based on a specified amount of data uploaded or transferred to the secured network. Set the unit (GB, MB, or KB) and select the range by moving the slider accordingly. You can also specify the values in the available fields.

  • Download (RX): View sessions based on a specified amount of data downloaded or received from the secured network. Set the unit (GB, MB, or KB) and select the range by moving the slider accordingly. You can also specify the values in the available fields.

Remote access VPN sessions matching your search criteria or filter parameters are displayed, allowing you to analyze specific session data based on your requirements.

Customize the remote access VPN monitoring view

Customize the remote access VPN monitoring view to display only relevant column headers for your specific monitoring needs.

You can modify the remote access VPN monitoring view in both live and historical modes. Security Cloud Control remembers your selection the next time you sign in to Security Cloud Control.

Procedure

1.

Click the column filter icon The remote access VPN monitoring view shows the selected column headers relevant to monitoring needs, highlighting customization options for both live and historical modes. located to the right of the columns.
2.

Select or deselect the columns you want to display in the view.

The remote access VPN monitoring view displays only the selected column headers. Your column selection preferences are saved for future sessions.

Export remote access VPN sessions to a CSV file

Export remote access VPN sessions to analyze session data in a spreadsheet application and to create sortable and filterable reports for monitoring purposes.

You can export the remote access VPN sessions of one or more devices to a comma-separated value (.CSV) file. You can open the .CSV file in a spreadsheet application such as Microsoft Excel to sort and filter the items on your list. This information helps you to analyze the remote access VPN sessions. Every time you export the sessions, Security Cloud Control creates a new .CSV file, where the file created has a date and time in its name.

Security Cloud Control can export a maximum of 100,000 active sessions to the CSV file. If the total number of sessions from all devices exceeds the maximum limit, you can use the View By Device filter and generate reports for individual devices.

Procedure

1.

From the Security Cloud Control Home page, click Firewall.
2.

In the left pane, click Insights & Reports > Reports & Analytics > Remote Access Monitoring.
3.

In the View By Devices area, select one of the following:

  • All Devices to export active sessions from all devices listed below it.

  • Click on a device that you want to export sessions of that device.
4.

Click theThe interface displays options to select devices for exporting active remote access VPN sessions to a CSV file, highlighting the export functionality for session analysis. icon on the top right corner. Security Cloud Control exports the rules you see on the screen to a .CSV file.
5.

Open the .CSV file in a spreadsheet application to sort and filter the results.

The remote access VPN sessions are exported to a .CSV file with a timestamp in the filename, ready for analysis in your spreadsheet application.

View the remote access VPN dashboard

This task allows you to access the Remote Access VPN Dashboard, which provides consolidated information about remote access VPN connections from multiple device types.

Security Cloud Control provides a consolidated information about remote access VPN connections from ASA, Cloud-Delivered Firewall Management Center-managed Firewall Threat Defense, and FDM-managed devices.

Procedure

1.

From the Security Cloud Control Home page, click Firewall.
2.

In the left pane, click Secure Connections > Remote Access VPN.

The Remote Access VPN Dashboard displays the following information:

  • VPN Tunnel Status: Displays a pie chart representing the active and idle VPN tunnels, each in appropriate colors. This chart shows the top ten number of remote access VPN sessions by headends.

  • Statistics: Shows the average session duration and data uploaded and downloaded.

Disconnect Remote Access VPN Sessions on FDM-Managed Device

This task allows you to terminate remote access VPN sessions for specific users on an FDM-managed device when the Security Cloud Control interface does not provide this capability.

Currently, it is not possible to terminate remote access VPN sessions on an FDM-managed device using the Security Cloud Control interface. Instead, you can connect to the Firewall Threat Defense CLI using SSH and disconnect the desired user. You can perform this task on an online FDM-managed device onboarded to Security Cloud Control.

Procedure

1.

Log on to Firewall Device Manager and use the device CLI as explained in the Logging Into the Command Line Interface (CLI) section of the "Getting Started" chapter of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager for the version your device is running.
2.

Execute the VPN-sessionsdb logoff {name} command and replace name with the user name. This command terminates all sessions for the username that you specify.

The remote access VPN sessions for the specified user are terminated.