I am noticing some potential weirdness with the data found in the ASA Insight data for Remote Access VPN Tunnels sessions. For example, I'm noticing some users who are showing as connected for months and months and months. That just isn't possible. Most of our users work in the office a few days (where they wouldn't connect to the VPN) and from home other days (where they would connect to the VPN). So how could they possibly be connected continuously for months. Even if these users were full time work from home users, there's no way they would be constantly connected day in and day out for months and months and months. The laptops get shut down and disconnected all the time. See screenshot below:
My other issue is that I picked out a random user and contacted him to see if he was currently connected to the VPN. He said he was, yet when I looked him up in the sessions table, it said he was currently disconnected and that he had last connected for less than 20 minutes that morning. Also, it seems to display time data in UTC time because, for example, it said the user I contacted was connected from 12:06pm to 12:25pm. It was 11:20am when I checked... He did say he logged in at around 7am EST that morning, which would be 12pm UTC time. Why is the data in the table not automatically mapped to the browsers local time like nearly every other widget in Orion? See screenshot below:
Is anyone else seeing inaccurate data like this for user sessions? The Firewall team is requesting some reports based on connection data in SolarWinds, but I don't want to spend a bunch of time creating this report if the data in it won't be accurate.
