topic Re: Global Protect w/ OTP RE: disconnect/recovery timer tolerance? in General Topics

Global Protect w/ OTP RE: disconnect/recovery timer tolerance?

pwebber — Mon, 14 Mar 2016 15:21:58 GMT

We have implimented Global Protect with radius authentication, username/password and a second prompt for OTP, this works great most of the time.

We have noticed that when our users connect from poor WiFi, or internet connections, there are times where connections drops out momentairly. This results in Global Protect disconnecting. The user then needs to re-authenticate. This is challeneging since our last remote access solution relied on certificates, which automatically re-authenticated without the users involvment. Is there a timer in Global Protect to buid some tolerance into the VPN connection before it disconnects? Any other workaround to solve this issue?

Thanks!

Re: Global Protect w/ OTP RE: disconnect/recovery timer tolerance?

pankaku — Mon, 14 Mar 2016 16:13:01 GMT

If the internet connect drops then the global protect will surely disconnect. It is like if we login into some bank website and if we disconnect and connect back the bank website will throw ssl error.

Re: Global Protect w/ OTP RE: disconnect/recovery timer tolerance?

pwebber — Mon, 14 Mar 2016 17:10:55 GMT

I see what you're saying, but from a usability standpoint, their must be some tolerance for poor connections. Imagine working, and every 10 mins or less you need to reconnect. It's one thing from home where you can work towards improving your connection, but when you are on the go and have no control of the hotel WiFi etc.

Re: Global Protect w/ OTP RE: disconnect/recovery timer tolerance?

Raido_Rattameister — Tue, 15 Mar 2016 12:58:46 GMT

Is OTP requirement?

Maybe you can go with password and client certificate (that you enroll with your AD certificate server).

In this case even if password gets loose then client side certificate will keep bad guys out.