Using client vpn with Okta, session re-authenticates multiple times throughout the day

0

We are using okta to authenticate when logging into AWS's client vpn. Multiple times throughout the day, while logged in to the vpn, a pop-up with okta login will show up, and require us the enter credentials again in order to continue using the VPN.

My ovpn file already has reneg-sec 0 & keepalive, and it still doesn't help. I tried creating a new vpn endpoint, without okta, and it seems I don't get prompt for re-authentication there. I contacted okta support and they say it is 100% on aws's side, I looked everywhere and cannot find a reason as to why this is happening.

1개 답변
1

Hello,

When you mention that the issue does not surface with Okta, it looks like compatibility between Okta & Client/OS. Questions:

  1. Which OS are you using ? Can you try on MAC/Windows and confirm if it is occurring on both ?
  2. Which client are you using ? Open VPN client or AWS Client ? Also is it on the latest version ?
  3. Can you also provide me with the logs when this happens of the entire period. Need to know what happens in the background when re-authentication is needed. Also need to check the timers since AWS Client support 24 hours session before it disconnects.
  4. Log collection as per the OS: https://docs.aws.amazon.com/vpn/latest/clientvpn-user/windows-troubleshooting.html

Use the following steps to view current maximum VPN session duration. -Open the Amazon VPC console at https://console.aws.amazon.com/vpc/. -In the navigation pane, choose Client VPN Endpoints. -Select the Client VPN endpoint that you want to view. -Verify that the Summary tab is selected. -View the current maximum VPN session duration next to Session timeout hours. You can also view other details displayed under the Summary tab. -View current maximum VPN session duration for a Client VPN endpoint (AWS CLI) -Use the describe-client-vpn-endpoints command.

To modify:

  • Select the Client VPN endpoint that you want to modify, choose Actions, and then choose Modify Client VPN Endpoint.
  • For Session timeout hours, choose the desired maximum VPN session duration time in hours. Hope this is helpful
profile pictureAWS
지원 엔지니어
답변함 2년 전

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠