MX250 - VPN clients showing as connected in the dashboard when they are not

[DavidSa]

When I look at client connections on an MX250, and filter by "online" and "client-vpn" to see who is connected by VPN using the Cisco Secure Client, I see entries that are not connected. For example there are at least two entries showing as connected for people who have left the company who's accounts have been disabled\deleted.  If I select the entry for one of them it actually says the user disconnected in June! It also does it for people still working here. So I just wondered if anyone has seen this behaviour? It has happened for a long time.  Not sure if the info is cached somewhere and not updating for some reason?

[GIdenJoe]

Do you actually see the username is being those old accounts or is it just the detected hostname?  Sometimes if the same IP is given to another client dashboard can conflate the two.

It is however extremely important to check the username field if that one is still the same or not.

You could try "forgetting" the client and see when they reconnect if the data is correct.

[DavidSa]

Yes, it shows the username they authenticate as (and it's not just old accounts that show as online when they also show as disconnected when you click on the individual connection).  I probably added the user column in the past at some point.  We use Cisco Duo for MFA.

I already tried a forget in the past and it does seem to make them disappear for a while, and then they come back again later - we are talking 10-20 mins later.   

It's all very odd...

[DavidSa]

I understand what you mean if the same IP is given to another client the dashboard can conflate the two, but you would have thought a forget would clear that permanently.  It also does it with the same still live host showing as connected when in the details it's not connected.  I think I might just have to live with it - it's not a huge problem, just a bit annoying.

Thanks for trying to help.