Access Server: Unable to Establish Multiple VPN Sessions with the Same User

Overview

Access Server supports multiple simultaneous VPN connections for a single user.

If users are unable to establish multiple sessions, even after allowing this setting, you may see the following error message:

Disconnected because user-specific properties prevent concurrent VPN connections by this user.

Allow Multiple Sessions

Access Server 3.0.0 and newer:

1. Sign in to the Admin Web UI.

2. Click VPN Server.

   • The Network Settings tab displays.

3. Click the Advanced tab.

4. Under Enable multiple user connections, set it to On.

5. Click Save and Restart.

Older Access Server versions:

1. Sign in to the Admin Web UI.

2. Click Configuration > Advanced VPN.

3. Set Multiple Sessions per User to Yes.

4. Click Save Settings, and Update Running Server.

Why multiple sessions may still fail

Even when multiple sessions are allowed globally, user-specific settings can override this behavior.

Access Server assigns users one of two internal user types:

• user_connect: Allows multiple VPN connections.

• user_compile: Restricts users ot a single VPN connection.

A user's type is automatically determined based on their configuration. If a user has any of the following configured, they're assigned the user_compile type and can't connect multiple simultaneous sessions:

• Static IP assignment.

• VPN gateway settings.

• Port forwarding (DMZ).

• User-level access rules.

• Admin access.

A newly created user with no additional settings is assigned the user_connect type by default. Once you add one of the above user settings, the user type will change to user_compile.

How to check the user type

Important: This check must be performed using the CLI.

1. Connect to your console and get root privileges.

2. List all the users:

   sacli UserPropGet

3. To check a specific user:

   sacli --pfilt <USER> UserPropGet

   • Example output:

     { "kevinqa": { "type": "user_connect" } }

Resolution

If a user is assigned the user_compile type, review their configuration and remove any settings that require a single session (such as static IP or port forwarding), if multiple concurrent connections are needed.

If you have additional questions, please submit a ticket.