topic Re: SSL VPN not allowing traffic after period of time in General Topics

SSL VPN not allowing traffic after period of time

cenders — Fri, 16 Sep 2011 03:29:19 GMT

This is my scenario: Establish an SSL VPN connection to my network. Start using RDP to remotely manage some of my servers. After a undetermined period of time, I'm no longer able to establish new sessions to other servers, yet my existing sessions are running just fine. Disconnect the VPN and Reconnect, then everything seems fine for a period of time. Seems to do the same with my mapped drives... if I've used them I can access them. If not, then new connections are blocked.

Checking the logs on the PAN, I see no blocked traffic.

Any thoughts? Known problem? I'm running PAN OS 4.0.5 and SSL VPN 1.3.2.

Re: SSL VPN not allowing traffic after period of time

bpappas — Fri, 16 Sep 2011 03:36:09 GMT

Is there any chance that your device has already filled the session table? This could lead to the symptoms you describe.

-Benjamin

Re: SSL VPN not allowing traffic after period of time

cenders — Fri, 16 Sep 2011 13:42:25 GMT

I didn't look at the session counter each time it happens, but this can happen to me late in the evening when we have next to no users in our environment. I will check the counters though to know for sure, but I don't think we are anywhere near maxing out the 125,000 session capabilities of the PA-2020. (failed to mention which device we have in my original posting).

Re: SSL VPN not allowing traffic after period of time

jleung — Sat, 17 Sep 2011 16:23:45 GMT

Hi,

Suggest you to check if there is any threat log covering the subnet of your SSLVPN clients. Also check if you have enabled any DoS policy.

Re: SSL VPN not allowing traffic after period of time

cenders — Mon, 19 Sep 2011 03:36:11 GMT

Session counter shows 302 active sessions, so that isn't the problem.

Threat log also shows nothing related to the VPN subnet.

Any other ideas?

Re: SSL VPN not allowing traffic after period of time

jleung — Mon, 19 Sep 2011 14:54:28 GMT

Hi,

If you have any DoS policy or threat prevention settings binding to the policy that SSL traffic will hit better try to disable it for troubleshooting purpose. If it sitll cannot help I will recommend you to open a support case so that we can look into it in more details, and review your config and logs.

Re: SSL VPN not allowing traffic after period of time

lumix1973 — Sat, 19 Nov 2011 15:02:46 GMT

hello,

i have exactly the same problem. Did you have solved the problem?

Can you describe how?

Thanks.

Re: SSL VPN not allowing traffic after period of time

paloalto_exn — Thu, 08 Dec 2011 15:13:14 GMT

my custoemr complains the same problem, as well.

Walter Doria

Re: SSL VPN not allowing traffic after period of time

cenders — Thu, 08 Dec 2011 16:15:59 GMT

The problem has gone away since moving to v4.1 on the firewall and using the new GlobalConnect VPN client (in this version, the SSL client no longer exists).

I suspect it is a bug in the old system but doubt it would be fixed as the old stuff is, well, old.