Orad

thank you Jason! Can this license be used in addition to our existing yearly license? will it just add extra month to current subscription?

thank you @jonatan but you just gave me more things to learn, and i mean it in a good way! :) now, from what i found, GRE would better maintain the connection, but VTI would be faster once connected? i know i'm oversimplifying it

@Zyxel_Emily also, we tested it today and it does work, but time it takes to reconnect VPN is a bit longer than we expected. Which settings should i play with to control it? it took about a 4-5 minutes before tunnel connected. In trunk i have it set to Least Load First/Outbound. Should i change it to Spillover?

thank you @Zyxel_Emily In handbook they create 2 VTIs, but if i understand correctly, i would need 4 VTIs on each side to get "full" redundancy?

Thank you @Zyxel_Cooldia for your reply. Do you know if its possible to pull that data from device logs and how would i do it?

thank you, testing it now, seems to be working. the only response i got is, that connection to that application (database based) got slower.

I We have 2 ADs at both location, ADs are in trust relationship and connected using that VPN tunnel. DO you think i should add second AD as authentication server as well?

Thank you Stanley, would it be better to configure Policy Control rule from LAN to WAN, instead of all any? Looks like it logs access to internal network resources as well.

Web Authentication will also show user name instead of unknown, correct?

Thank you Jeff for your answer, it explains what i needed! Now, if i understand it correctly - Base DN is used to channel restriction to a AD group or OU, is that correct? I can create a group in AD, and instead of "dc=domain,dc=local" for all users in the domain, set "dc=doman,dc=local,cn=AllowGroup" to allow only users…

Hello Stanley, thank you for the detailed response! Will it also log HTTPS sites? or do I have to configure SSL inspection? Also, Web Authentication is not required for logging of all the websites, is that correct?