IPSec tunnel to Azure - Strange issue

LukeRath — Tue, 18 Jan 2022 11:47:07 GMT

HI all,

I have an active ticket with PA but struggling to get through to anyone atm. We have recently made some routing changes and moved the Azure IPSec tunnel from an SRX to a PA. The tunnel came up fine but we are having a weird issue with RDP. It's like the tunnel is only allowing so many sessions across. Some users have to try about 10 times to get RDP to work. When RDP fails there is no sign of the traffic in PA logs so it's like its not leaving AZ. System/VPN logs look fine. Ping and traceroutes from both side are fine as well.

I have never come across anything like this with a tunnel before.. The only thing I am thinking of changing next is the SKU on the tunnel to see if it's a throughput issue.

Any input appreciated.

Luke | PCNSE

Re: IPSec tunnel to Azure - Strange issue

nikoolayy1 — Tue, 18 Jan 2022 15:04:34 GMT

You can check the link below if it helps:

%%%%%%%%%%%%%5

Specify whether remote desktop connections are permitted over existing VPN tunnels by specifying the
User Switch Tunnel Rename Timeout
. When a new user connects to a Windows machine using Remote Desktop Protocol (RDP), the gateway reassigns the VPN tunnel to the new user. The gateway can then enforce security policies on the new user.

Allowing remote desktop connections over VPN tunnels can be useful in situations where an IT administrator needs to access a remote end-user system using RDP.

By default, the
User Switch Tunnel Rename Timeout
value is set to 0, meaning the GlobalProtect gateway terminates the connection if a new user authenticates over the VPN tunnel. To modify this behavior, configure a timeout value from 1 to 600 seconds. If the new user does not log in to the gateway before the timeout value expires, the GlobalProtect gateway terminates the VPN tunnel assigned to the first user.

Changing the
User Switch Tunnel Rename Timeout
value only affects the RDP tunnel and does not rename a pre-logon tunnel when configured.

%%%%%%%%%%%%%%%%

Customize the GlobalProtect App (paloaltonetworks.com)

For clientless VPN you can see:

RDP, VNC, SSH Access through GlobalProtect Clientless VPN - Knowledge Base - Palo Alto Networks

Good thing to know about RDP and usernames:

What Login Credentials Does Palo Alto Networks User-ID Agent Se... - Knowledge Base - Palo Alto Networks

Also check for known rdp bugs with your version for example:

GlobalProtect App 5.2 Known Issues (paloaltonetworks.com)

Known Issues (paloaltonetworks.com)

topic IPSec tunnel to Azure - Strange issue in General Topics

IPSec tunnel to Azure - Strange issue

Re: IPSec tunnel to Azure - Strange issue