Eliminate Blind Spots in Your VPN Network

VPN Reporter automatically collects GlobalProtect logs from Palo Alto Networks firewalls and turns them into meaningful reports. It shows in a single dashboard who connected, when, from which country and with which device, how long they stayed connected, and how much of that time went to business applications. You get shift tracking, security alerts and automated reports for managers without digging through raw logs.

Palo Alto Networks NGFW (PAN-OS) and Panorama are supported. Logs can be collected directly from the firewall or centrally from Panorama. In high-availability (HA) deployments, the primary and secondary devices are defined together.

No, nothing is installed on endpoints. VPN Reporter connects to the firewall's XML API and only pulls logs created since the last query, so the load on the device is low. Traffic logs are fetched only for closed VPN sessions and according to the filters you define.

Only two XML API permissions are needed: Log (to read and interpret traffic logs) and Operational Requests (to track active VPN sessions). Web UI, command line (CLI) and REST API access are not required. We recommend creating a dedicated admin role profile with just these permissions.

The setup wizard installs the service and the web console together on a Windows server. Once you enter the firewall address and API user, data collection starts immediately and reports are built from that moment on. Logs from before the installation are not imported.

Two shift types are available: fixed hours (e.g. weekdays 08:00–18:00) and flexible (e.g. 8 hours per weekday, any time of day). Each site has a default shift, and individual users can be assigned their own. Public holidays and special days are added as calendar exceptions. Every VPN session is split into in-shift and out-of-shift minutes, shown in the Shift Summary and Per-User Summary reports.

In that case the firewall closes the session when the timeout configured in GlobalProtect expires. VPN Reporter subtracts that timeout from the connection to calculate the net time the user was actually connected. Reports show the connection duration and the calculated net duration separately.

Every connection is listed as a separate record, so you can see which device was used, when and for how long. Connections from different devices are counted separately and added to the user's total connection time. You can get these totals per day, per week or for any date range you choose.

When a session closes, VPN Reporter pulls that session's traffic logs from the firewall and classifies them. You decide what counts as business traffic with include/exclude lists by application (e.g. SAP, CRM), security rule or destination IP. This shows how much of a user's connection time went to business applications and how much to video or social media.

Yes. The subject and body of every notification can be customized with variables containing connection details (user, public IP, country, device, etc.), and the language and time zone are chosen per notification. Repeated emails for the same event are limited by a throttle period. Emails are sent via Microsoft Graph API (Microsoft 365) or an SMTP server.

Yes. Scheduled reports run daily, weekly or monthly, and one report definition can include several periods. The Excel report is customizable: summary and connection-list sections, visible columns and the email text can all be adjusted. A report can cover one site, all sites, a user group or selected users.

Yes. With role-based reporting, report users only receive reports for the users assigned to them and only see which of those users are online. Access can be defined per user, by static group or by Active Directory (LDAP) group.

Yes. Each location is added as a "site" with its own firewall or Panorama connection, time zone, default shift and business-traffic rules. Data from all sites is collected centrally, and reports and notifications can target a single site or all sites. In multi-gateway deployments, transitions between gateways are merged correctly.

Each site is evaluated in its own time zone, and shift calculations use that site's local time. Notifications and reports can also have their own time zone and language, so managers in different countries see the same data in their local time.

All data stays on your own server in the database you choose (MSSQL, MySQL, PostgreSQL or SQLite); nothing is sent to Nascella or any third-party cloud. Raw traffic logs for each session are stored compressed and marked with a SHA-256 hash, so you can verify whether a file has been altered. IP geolocation (GeoIP) lookup is optional.

VPN connection history is not deleted automatically; your organization's policy decides the retention period. By default, 1-minute statistics are kept for 7 days, 15-minute statistics for 60 days, hourly statistics for 365 days, and job, alarm and email records for 30 days. All periods can be changed from the admin console.

Yes, we offer a 30-day trial. Request it with your corporate email address using the form on the product page; once approved, the download link is sent to your inbox.

VPN Reporter is licensed annually. The license is based on the firewall model running at the site or on the number of VPN users. Contact us through the contact page for a quote that fits your environment.