Inactivity timeout for NetExtender
03/26/2020 87 10806
NetExtender client connections should be terminated if a user session is idle for certain amount of time.
If a session has been idle for certain time, it should be terminated to be more complaint with PCI DSS Scans.
Inactivity timeout for NetExtender Windows Client connections is introduced in SMA firmware 126.96.36.199. If you are running on older firmware version, check upgrade guide and upgrade SMA appliance to firmware 188.8.131.52 or above.
Steps to configure Inactivity timeout for NetExtender:
1. Inactivity timeout can be configured based on Global, Group or User. By default, global inactivity timeout is set to 15 minutes. This can be overridden in Group / User settings.
Global Inactivity Timeout:
Navigate to Users - Local Groups - Edit Global Policies, under General tab, set Inactivity Timeout and click Accept. Setting the global inactivity timeout to 0 disables the Inactivity timeout for users that do not have a group / user timeout configured.
Group Inactivity Timeout:
Navigate to Users - Local Groups - Edit the required group, under General tab, set Inactivity Timeout and click Accept. Set to 0 to use the global timeout.
User Inactivity timeout:
Navigate to Users - Local Users- Edit the required user, under General tab, set Inactivity Timeout and click Accept.
The Inactivity timeout is applicable for Portal logins, HTML5 RDP/SSH/VNC/Telnet bookmarks, NetExtender connections.
2. To apply the inactivity timeout for NetExtender sessions, navigate to Clients - Settings, under Client Settings, set 'Disconnection on inactivity timeout' to Enabled. Click Accept.
Connect VPN to the SMA appliance using NetExtender . The inactivity timeout is monitored based on the user keyboard / mouse activity. If there is no keyboard / mouse activity, you will see Idle Time increasing for the user in appliance - Users - Status.
Once inactivity time reaches, connection will be terminated.
1.Inactivity timeout will not work when 'Always On VPN' feature is enabled for NetExtender Connections.
2.Inactivity timeout applies to NetExtender Windows Clients only.
3.User timeout setting takes precedence over the group timeout and the group timeout takes precedence over the global timeout.