Remote Access Traffic and Performance Monitoring and Analysis

It’s important to monitor connections and events related to remote access users to learn about who is accessing your network from remote locations. But to ensure your VPNs are configured to best utilize your VPN bandwidth, it is important to also monitor the traffic flowing along your VPNs. Although you can’t monitor the contents of traffic in encrypted VPN tunnels, you can monitor traffic statistics to understand how well your remote users are using VPN bandwidth. You can also detect unusual VPN activity that could indicate malicious activity or excessive use.

Because both endpoints are within domains in your IT infrastructure, you can monitor decrypted packets when they emerge from the end of the VPN tunnel. It is still important that you monitor WAN traffic to understand how your organization uses your WAN connections. VPN traffic monitoring provides additional information on how individual tunnels are behaving within your overall WAN usage. Excessive WAN usage might indicate a network usage problem. Further investigation using VPN monitoring could reveal that one remote user using a VPN is attempting to launch a denial of service (DoS) attack on your organization. In this case, WAN traffic monitoring will have revealed a high-level problem, and VPN traffic monitoring will have revealed the cause of the problem. You need to monitor at both levels to get the whole picture.

You can implement VPN traffic monitoring and analysis using the same methods as LAN and WAN traffic monitoring and analysis. You can install software or devices on the perimeter of the VPN where you establish the endpoint. You can also use any of a wide variety of network management software packages that support SNMP to monitor traffic directly from the network devices that transport VPN traffic. Regardless of the methods you employ, monitoring and analyzing VPN traffic is important to ensure your private data are secure and compliant.