GlobalProtect disconnects when Tunnel Login Lifetime is set to value 1 by the gateway

Why GlobalProtect App gets disconnected when authentication override cookie lifetime timer higher than tunnel login lifetime timer?

• Palo Alto Firewalls
• PAN-OS 11.1 or higher
• GlobalProtect (GP) app
• GlobalProtect Portal/Gateway with authentication override cookie enabled
• Authentication override cookie lifetime timer higher than tunnel login lifetime timer
• Prisma Access

• When the tunnel login lifetime timer expires, GP users need to re-authenticate by the authentication profile, NOT by the authentication override cookie. This means the GP app requires human interaction to physically enter credentials and finish authentication.
• The reason behind this behavior is that if the GP auth override cookie lifetime timer is higher than the tunnel login lifetime timer, the tunnel could be recreated based on cookie authentication. This negates the requirement for human interaction, making the tunnel login lifetime timer meaningless.
• Hence, this behavior was introduced in PAN-OS 11.0 or higher: if the authentication override cookie lifetime timer is higher than the tunnel login lifetime timer, the tunnel login lifetime will be set to a value 1 second after it expires to enforce that the user re-authenticates using the authentication profile.
• To fix this issue, make sure the authentication override cookie lifetime timer is less than the tunnel login lifetime timer.
• The same behaviour has also been introduced in Prisma Access with the recent upgrades in May 2026 (Even if the dataplane version is 10.2.10.x)

To resolve this behavior and avoid authentication cookie expiry related conneciton failures, ensure timers are configured correctly:

Configuration Rule: The Authentication Override Cookie Lifetime must be less than the Tunnel Login Lifetime.

1. Review your GlobalProtect Portal and Gateway timer settings.

2. Adjust the cookie lifetime to be shorter than the tunnel login lifetime.

3. Commit the changes.