It looks like our server is expiring sessions at exactly 24 hours.
In the server's log report, there's repeated lines of "SESSION_ID not found (may have expired)" with a duration of "1d 00:00".
In the client log (Windows 7 if it matters), it has "SESSION: Your session has expired, please reauthenticate"
About the only thing I've found referencing 24 hour session expires is this link:
https://forums.openvpn.net/topic11684.html
Which says:
By default, Access Server implements a 24 hour timeout for the server-locked and user-locked profiles. These are the default profile types used. This means that when a user logs in with her or her credentials, the connection can stay online for a maximum of 24 hours. The autologin profile is an exception since this does not require credentials and can stay online indefinitely. The following configuration parameter allows you to alter this timeout setting to your specifications. You can even 'disable' it by setting a ridiculously high timeout value. You will need to run these commands on the console or through an SSH session on the Access Server:
/usr/local/openvpn_as/scripts/sacli --key vpn.server.session_expire --value 86400 ConfigPut
/usr/local/openvpn_as/scripts/sacli start
This will set the timeout to 86400 seconds (24 hours). Adjust this to your liking. If you set it to something like 1000000000 you can effectively disable it so the session doesn't time out.
If I google vpn.server.session_expire, there's only 3 links in the world. The one above and the release notes for openvpn v1.8.0 and v1.8.3, both of which say "* Added vpn.server.session_expire config key (integer, disabled by default) to force reauthentication of non-autologin profiles after a given number of seconds."
Questions:
1. Is there a way I can check if this setting is turned on and set to 86400? (If it's a unix command please be explicit. I haven't used it since college and I'm rusty)
2. While 1.8.0 and 1.8.3 say this setting is disabled by default, has it been enabled since?
3. Will the sacli lines fix this?
4. Anybody else having a 24 hour session expiry issue (and have a solution)???
Thanks,
Mark
