IPSec tunnel to Azure - Strange issue

Showing results for 
Show  only  | Search instead for 
Did you mean: 

IPSec tunnel to Azure - Strange issue

L1 Bithead

HI all,


I have an active ticket with PA but struggling to get through to anyone atm. We have recently made some routing changes and moved the Azure IPSec tunnel from an SRX to a PA. The tunnel came up fine but we are having a weird issue with RDP. It's like the tunnel is only allowing so many sessions across. Some users have to try about 10 times to get RDP to work. When RDP fails there is no sign of the traffic in PA logs so it's like its not leaving AZ. System/VPN logs look fine. Ping and traceroutes from both side are fine as well.


I have never come across anything like this with a tunnel before.. The only thing I am thinking of changing next is the SKU on the tunnel to see if it's a throughput issue. 


Any input appreciated.

Luke | PCNSE


L6 Presenter

You can check the link below if it helps:







  • Specify whether remote desktop connections are permitted over existing VPN tunnels by specifying the 
    User Switch Tunnel Rename Timeout
    . When a new user connects to a Windows machine using Remote Desktop Protocol (RDP), the gateway reassigns the VPN tunnel to the new user. The gateway can then enforce security policies on the new user.
    Allowing remote desktop connections over VPN tunnels can be useful in situations where an IT administrator needs to access a remote end-user system using RDP.
    By default, the 
    User Switch Tunnel Rename Timeout
     value is set to 0, meaning the GlobalProtect gateway terminates the connection if a new user authenticates over the VPN tunnel. To modify this behavior, configure a timeout value from 1 to 600 seconds. If the new user does not log in to the gateway before the timeout value expires, the GlobalProtect gateway terminates the VPN tunnel assigned to the first user.
    Changing the 
    User Switch Tunnel Rename Timeout
     value only affects the RDP tunnel and does not rename a pre-logon tunnel when configured.







Customize the GlobalProtect App (paloaltonetworks.com)




For clientless VPN you can see:



RDP, VNC, SSH Access through GlobalProtect Clientless VPN - Knowledge Base - Palo Alto Networks




Good thing to know about RDP and usernames:



What Login Credentials Does Palo Alto Networks User-ID Agent Se... - Knowledge Base - Palo Alto Netw...



Also check for known rdp bugs with your version for example:



GlobalProtect App 5.2 Known Issues (paloaltonetworks.com)



Known Issues (paloaltonetworks.com)





  • 1 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!