Allow a single user logon for each session via GUI/SSH

[Kevin_Ncs]

hi All,

I want to check when each admin account logs into its own session via GUI and SSH.
If either one login to a 2nd session then it will be denied.

Is it achievable? I can't find any article from Palo Alto regards to this.

[reaper]

No, admins are allowed to log in multiple times

you can limit their idle timeout in "device > setup > management > authentication settings" if you're worried they have too many 'sleeping' sessions open

[Kevin_Ncs · Accepted solution]

Does this article works?

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000kEhWCAU&lang=en_US%E2%80%A...

[BPry]

@Kevin_Ncs,

The option works perfectly fine, however I'd really caution thinking through setting this value to 1.

Admin sessions are tracked whenever they access the GUI/CLI/API; so say that you have an admin who is making a change in the GUI and loses access to the device due to the change, if restricted to a single session they've now effectively locked out of the device. You'll be waiting for the established session to be removed prior to it allowing access via another session.

[J.Kim530884]

We had max session count set to 3. FIPS standard is 4. 
We have 2 administrators and we constantly lock ourselves out of the PA when we are more actively engaged. 
Session Count default is 0(Unlimited) and Session Time default is 0 which translate to 30 days.