topic Re: Cyberark RDP sessions aging-out, disconnecting users in Next-Generation Firewall Discussions

Cyberark RDP sessions aging-out, disconnecting users

DrewNumberTwo — Thu, 20 Feb 2025 21:51:22 GMT

We are working on a deployment of CyberArk for identity management. At this point our problems are not with integrating it for authentication with the Palo. Our problem is that the connectors for CyberArk in our datacenter are dropping connections when our Admins are using the RDP sessions.

CyberArk gave us some docs re: creating an application override which did not solve the problem. The disconnects are not at specific time intervals that we can discern. Sometimes they drop at 10 minutes, sometimes at 35, sometimes longer than an hour. Peculiar notes from the logs show that more than 75% of the TCP sessions going to our CyberArk vault are "Aging-Out" instead of closing properly.

My next step I guess is to grab some pcaps and see if I can see what's going on at the TCP level.

Anyone ever seen something like this before? I cant possibly be the only one with CyberArc running through a Palo.

Re: Cyberark RDP sessions aging-out, disconnecting users

Raido_Rattameister — Fri, 21 Feb 2025 18:47:18 GMT

Check if those sessions that end with "aged-out" are actually TCP sessions.

RDP uses both TCP and UDP port 3389 and it is expected for UDP to end with session end reason aged-out.

CyberArk uses both protocols to connect to backend devices.

Re: Cyberark RDP sessions aging-out, disconnecting users

DrewNumberTwo — Tue, 04 Mar 2025 16:20:29 GMT

Yup TCP and still aging out. The RDP happens in side an encrypted tunnel that connectors on-prem maintain.

Re: Cyberark RDP sessions aging-out, disconnecting users

Raido_Rattameister — Wed, 05 Mar 2025 16:21:15 GMT

I would take packet capture as next step to see what happens during session drop.