VPN timeout/key negotion after 8 hours

Question

Hello, 
 
 I have a remote user using SSL vpn connect to our main office Sophos XG virtual appliance. After almost exactly 8 hours it seems that the VPN is re-negotiating keys but fails and the VPN connection dies. This is probably because we are using 2 factor authentication? 
 
 Is there a way to adjust or disable the re-negotiation of the keys so that this will not happen? 
 
 Regards 
 Jacob

LuCar Toni · Accepted Answer

XG will actually reauth the user after rekey. That is the current design, which is currently under revisit to change. 
 IPsec will rekey after 4 hours. (Coded) 
 SSLVPN will rekey after 8 hours. (Adjustable) 
 
 That leads to 1-3 OTP Auths per Day in a common scenario, which is annoying but "maybe ok". 
 
 Assuming you will get the same numbers in Sophos Connect 2.0 ? Could you give this a try? 
 https://community.sophos.com/products/xg-firewall/sfos-eap/sophos-connect-eap/b/announcements/posts/sophos-connect-2-0-early-access

FloSupport · Answer

Hey Jacob Jensen1 
 I'll attach a screenshot below, but have you tried changing the key lifetime configured in your SSL VPN settings? 
 
 Best,

FloSupport · Answer

Hi marco_47d 
 See what I mentioned above regarding the risks of increasing the key lifetime. Generally, changing the settings on that SSL VPN configuration window will require users to re-download their SSL VPN configuration from the user portal. 
 Regards,

Derek Preston · Answer

I've verified that the Key lifetime value is a timeout option pushed to the client during client/server negotiations. Clients will not need to re-download their VPN profile if the Key lifetime value is change. However, applying this change does disconnect connected VPN clients and may require them to authenticate if OTP is enabled.

Jonnie · Answer

Ok, my guess with the global session timeout was correct. The VPN is still connected after 8 hours and I can reach all internal systems. 
 I assume that the setting only applies if you use the OTP Token for authentication and not just the normal username + password combination. 
 Maybe this info will help other customers and also the clueless sophos support. [:#]