topic Cisco VPN Client Timeout in General Topics

Cisco VPN Client Timeout

JoergObermeier — Fri, 20 Apr 2012 14:01:06 GMT

Hello,

we are using Cisco VPN Clients to connect to our Palo Alto Network Device, it works like a charm, but the user are logged out after one hour.

The timeout for Login Lifetime is set to 30 day, and the Idle Timeout is set to 8 hours.

Any suggestion?

Jörg

Re: Cisco VPN Client Timeout

korosy — Fri, 20 Apr 2012 18:58:13 GMT

Do you mean that you connect thru the Palo Alto device. If so I have noticed that if DHCP lease provided by the PA expires, Cisco VPN disconnects.

Re: Cisco VPN Client Timeout

nicksampson — Mon, 21 May 2012 00:37:08 GMT

Hi,

I am also having this issue on 4.1.3 on a PA500. There are no DHCP lease timers on the Gateway DHCP pool. My timeout configuration is also set to 3 days for login lifetime and login inactivity.

Re: Cisco VPN Client Timeout

u14441 — Tue, 14 Aug 2012 15:42:31 GMT

Hello,

Did you ever manage to resolve the issue of disconnecting after an hour?

Many Thanks

Re: Cisco VPN Client Timeout

NGS_SOC — Wed, 05 Sep 2012 09:11:48 GMT

Hi, have you resolved this issue?

I found this behavior with 4.1.6 with almost all the devices (200-500 2000 series etc). Every 45 min I receive a disconnect from the gateway with or without traffic passing thru the vpn tunnel. Cisco Vpn is quite old and not longer supported right now (Anyconnect is the actual main client for Cisco) but is slightly better than GlobalProtect Client and connects like a flash, also is native in Ipad/Iphone and I don't want the 45m/1h limitation.

I also tried to expand session + tcp/dns timeout of ciscovpn application (how the ipsec remote access via cisco vpn is detected) without any luck.

Thanks

Re: Cisco VPN Client Timeout

licenselu — Thu, 06 Sep 2012 09:56:47 GMT

Hello,

Same problem on a PA 500 running 4.1.7. After one hour, disconnect...

Regards,

Re: Cisco VPN Client Timeout

manuelw — Tue, 13 Nov 2012 19:41:10 GMT

Same problem here on a PA-200 with the Cisco client. Disconnects seconds before 1:00hr, consistently.

The GlobalProtect client is trash so we are using Cisco clients.

Re: Cisco VPN Client Timeout

NGS_SOC — Tue, 13 Nov 2012 19:49:05 GMT

PANOS version 5.0 solves this problem, I've tried in lab just yesterday. in the next d days I'll try even version 4.1.9

Globalptotect is not so trashy 🙂 give it a chance

Re: Cisco VPN Client Timeout

itmanager — Mon, 19 Nov 2012 21:17:48 GMT

Any chance the fix made it into 4.8h3 or 4.9? I don't have a lab, and won't be able to go to 5.0 until at least 5.1 (rules), so I can't really test.

Thanks!

Re: Cisco VPN Client Timeout

NGS_SOC — Mon, 19 Nov 2012 22:08:15 GMT

4.1.8hf3 or 4.1.9 are useless for this problem, both tried in the last few days, always 60 min before automagic logoff, I hope in later versions.

5.0 is not so stable, I saw strange behavior in my 2050s so until 5.0.3 i don't think planning upgrading too.

Re: Cisco VPN Client Timeout

cparrish — Tue, 20 Nov 2012 02:58:42 GMT

I'm on 4.1.9 and this issue occurs for my clients also.

Re: Cisco VPN Client Timeout

cparrish — Tue, 22 Jan 2013 21:39:44 GMT

Does anyone know if the addressed issue in 4.1.10 listed as...

46059 – Session timeout settings were not in effect when set to the maximum value

...perhaps pertains to this? Im guessing no, but wanted to see if anyone knew.

Re: Cisco VPN Client Timeout

steve.chupack — Sun, 27 Jan 2013 01:18:32 GMT

I'm experiencing the same issue. "Cisco" IPSEC clients fail due to a rekey issue after about 3300 seconds. It's really a shame -- other than the timeout issue, they work perfectly and provide nearly universal cross-platform compatibility.

I may be upgrading to 5.x soon to address an unrelated user-id issue. I will post back to this thread if 5.x fixes it.

Re: Cisco VPN Client Timeout

OpsDev1 — Wed, 08 May 2013 07:15:31 GMT

PanOS 5.0.3 does NOT solve this problem for the built-in cisco client in OSX.

Whoever is responsible for the cursed pestilence that is ipsec needs to be staked out on a fire ant mound and drizzled with honey.

Re: Cisco VPN Client Timeout

NGS_SOC — Wed, 08 May 2013 07:54:17 GMT

I use cisco vpn client over win 7 with a vm-100 5.03 and the tunnel is up for 8 hours (and more if configured). Verify that GP Gateway has Inactivity Logout configured for at least 6/8 hours.

As you see form the command extracted for a newly GP ipsec phase 2 created has a lifetime of 8 hours 28778/3600, while with 4.1.X the lifetime was always below 3600

admin@VM-100> show vpn ipsec-sa tunnel Gateway1-N

GwID/client IP TnID Peer-Address Tunnel(Gateway) Algorithm SPI(in) SPI(out) life(Sec/KB)

192.168.Y.Y 1 X.X.X.X:49364 Gateway1-N(Gateway1-N) ESP/A256/SHA1 B5A1E116 4E33D6A4 28778/0

Sometimes 5.03 has problem in ipsec rekey (to be solved hopefully in 5.05 or 5.06) so maybe your problem is related to this issue, not to the lifetime of cisco vpn client.

Re: Cisco VPN Client Timeout

Steve1 — Mon, 14 Oct 2013 14:00:04 GMT

I am on Version 5.07 and I have the same issues. Global Protect clients receive the correct values. Cisco Clients will time out after 8 hours.

Is there a fix for this is or is this just another unsolved issue?

Re: Cisco VPN Client Timeout

bsimunko@recro-net.hr — Tue, 19 May 2015 13:34:08 GMT

same problem on 6.1.2!

also, the split-tunnel configuration DOES NOT WORK! the tunnel always ends up being full-tunnel

Re: Cisco VPN Client Timeout

jvalentine — Tue, 19 May 2015 13:43:33 GMT

I'm pretty sure that 3rd party IPSec clients only support full tunnel. If you require split tunneling, you should use the GlobalProtect client.

Re: Cisco VPN Client Timeout

bsimunko@recro-net.hr — Tue, 19 May 2015 13:46:51 GMT

really? why is there no mention about this in any documents?

shame on you paloalto

Re: Cisco VPN Client Timeout

NGS_SOC — Tue, 19 May 2015 13:52:25 GMT

Split tunnel on IPSEC is working but only if the networks are simpler enough. For examples if access routes are 192.168.0.0/24 and 172.16.0.0/24 this goes to full tunnel. Technical limitation probably will never fix.

Cisco IPSEC are stuck only to 8 hours and other IPSEC flavors (IPSEC on MacOSX) have even worst timeout.