topic Re: VPN disable reauthenticate in SASE and Remote Access

VPN disable reauthenticate

NorthernNetGuy — Thu, 19 Mar 2020 20:44:31 GMT

Is it possible to disable re-authentication for Mobile Access and other VPN clients? I see the option to set the re-authentication timer in the Global Properties, but not sure if setting this to 0 will disable re-authetnication, or if there is an actual method. Currently it's set to 720 minutes (12 hours)

Re: VPN disable reauthenticate

PhoneBoy — Sun, 22 Mar 2020 05:59:29 GMT

As far as I know, no.
You don't necessarily want to make the re-authenticate user option long, but you can cache the password on the client for longer.
Or use certificate-based authentication and have the certificate installed in the OS certificate store.
That should effectively keep the user connected for as long as they're logged in.

Re: VPN disable reauthenticate

NorthernNetGuy — Sun, 22 Mar 2020 12:33:22 GMT

That's unfortunate. The problem with the client re-authenticating for us is that we have two factor authentication.

If a user forgets to log out of VPN, they will receive a two factor authentication prompt when the VPN re-authentication occurs, which they mark as a fraudulent access attempt. A manual re-authentication would be preferred.

Re: VPN disable reauthenticate

PhoneBoy — Sun, 22 Mar 2020 20:31:56 GMT

I think, but I'm not sure, that this is also tied to the rekey of the underlying IPsec connection, which definitely cannot be unlimited (nor is it recommended to be).
In any case, it's generally recommended for security reasons to periodically reauthenticate.