topic Timeout/reauthentication VPN endpoint client in SASE and Remote Access

Timeout/reauthentication VPN endpoint client

the_rock — Tue, 01 Jun 2021 22:02:16 GMT

Im sorry if this was asked before, but customer asked me this and Im not sure if its possible. So, in global properties, you can set timeout for users to re-authenticate, but customer was wondering, if we set that timeout to 8 hours, can we set anywhere that vpn disconnects them if they are inactive for say 40 minutes? I see some settings there for it, but does not let you choose the time.

So essentially, timeout to 8 hours and inactivity timeout to 40 minutes?

Not sure if this can be done in trac_client_1.ttm file on the gateway?

Re: Timeout/reauthentication VPN endpoint client

Timothy_Hall — Wed, 02 Jun 2021 12:47:37 GMT

I don't believe this is possible, as the various timers follow the SA Lifetimes which are absolute values and not impacted by activity to ensure the keys are changed on a regular basis.

Re: Timeout/reauthentication VPN endpoint client

the_rock — Wed, 02 Jun 2021 12:50:40 GMT

Thanks Tim...I did not think so either, but I thought maybe its possible in fw .ttm file. I may open official TAC case for this, if customer asks me though.