Access Server: Configure the VPN Session Timeout for Users

Overview

By default, Access Server sets the VPN session timeout to 24 hours (86,100 seconds). After this time, users are disconnected and must re-authenticate.

You can adjust this timeout to determine how long a VPN session remains active before re-authentication is required.

⚠️ Important Notes:

• This only applies to server-locked and user-locked profiles.
• Auto-login profiles aren't affected, as they only use certificate-based authentication.

Prerequisites

• Use OpenVPN Connect v3.5.0 and higher
• If your Access Server uses PAM, local, RADIUS, LDAP, or PAS-only authentication, you must configure the auth-nocache directive.

Step 1: Check the current VPN session timeout

1. Connect to your Access Server via SSH.
2. Run the following commands:

   sudo su
   cd /usr/local/openvpn_as/scripts/
   ./sacli configquery | grep "vpn.server.session_expire"

3. If there isn't an output or result, the server is using the default value (24 hours).

Step 2: Add "auth-noache" directive (if required)

1. Sign in to the Admin Web UI.
2. Click Configuration > Advanced VPN.
3. Under Additional OpenVPN Config Directives (Advanced) > Server Config Directives, add this line:
   push "auth-nocache"
4. Click Save Settings and Update Running Server.

👉 If you’re using SAML authentication, you can skip this step.

Step 3: Configure the VPN session timeout

To set or change the session timeout:

1. Click this link to open the VPN session timeout tutorial.
2. Follow the steps in the tutorial to adjust the session token timeout.

If you have additional questions, please submit a ticket.