IPSec tunnel to Azure - Strange issue

LukeRath · ‎01-18-2022

HI all,

I have an active ticket with PA but struggling to get through to anyone atm. We have recently made some routing changes and moved the Azure IPSec tunnel from an SRX to a PA. The tunnel came up fine but we are having a weird issue with RDP. It's like the tunnel is only allowing so many sessions across. Some users have to try about 10 times to get RDP to work. When RDP fails there is no sign of the traffic in PA logs so it's like its not leaving AZ. System/VPN logs look fine. Ping and traceroutes from both side are fine as well.

I have never come across anything like this with a tunnel before.. The only thing I am thinking of changing next is the SKU on the tunnel to see if it's a throughput issue.

Any input appreciated.

Luke | PCNSE

nikoolayy1 · ‎01-18-2022

You can check the link below if it helps:

%%%%%%%%%%%%%5

Specify whether remote desktop connections are permitted over existing VPN tunnels by specifying the
User Switch Tunnel Rename Timeout
. When a new user connects to a Windows machine using Remote Desktop Protocol (RDP), the gateway reassigns the VPN tunnel to the new user. The gateway can then enforce security policies on the new user.

Allowing remote desktop connections over VPN tunnels can be useful in situations where an IT administrator needs to access a remote end-user system using RDP.

By default, the
User Switch Tunnel Rename Timeout
value is set to 0, meaning the GlobalProtect gateway terminates the connection if a new user authenticates over the VPN tunnel. To modify this behavior, configure a timeout value from 1 to 600 seconds. If the new user does not log in to the gateway before the timeout value expires, the GlobalProtect gateway terminates the VPN tunnel assigned to the first user.

Changing the
User Switch Tunnel Rename Timeout
value only affects the RDP tunnel and does not rename a pre-logon tunnel when configured.