GP App is getting a login lifetime lower than the configured Gateway's Login Lifetime

• GP App is getting a lower login lifetime value than the configured login lifetime on the Gateway
• Session Expiry Notification appears unexpectedly before the configured expected Login Lifetime
• Tunnel disconnects unexpectedly due to the login lifetime expiry

GP App

GP Portal and Gateway

PAN-OS 10.1+

Gateway sends the <lifetime> == configured Login Lifetime (e.g. 10800 seconds) ONLY when it authenticates the user using Authentication profile

Gateway dynamically adjusts and sends the <lifetime> == Remaining Login Lifetime based on the Cookie Generation when it authenticates the user using the Authentication Override Cookie 

NOTE: This dynamically adjusted lifetime is NOT equal to the Cookie Remaining Time. The rasmgr generates the lifetime config; rasmgr does not know about the cookie's remaining life. Instead, it knows about the Cookie generation time (it gets it from gpsvc).

The dynamic lifetime is calculated as Configured Lifetime - (Cookie Acceptance Time - Cookie Generated Time)

Example:

Cookie Generation configured on Portal
Configured Cookie Acceptance on Gateway: 2 hrs 
Configured Login Lifetime on Gateway: 3 hrs (10800 seconds) 

Let's say Portal generated the auth override cookie at (epoch 1772478124) Mar.02 11:02:04 
Gateway Accepts the Cookie at (epoch 1772478125) Mar.02 11:02:05 

This is how the gateway will process the cookie and generate the lifetime. 
- First check if the cookie is valid; It was generated 1 second ago, which is within 2 hours of acceptance time ==> Cookie is valid 
- Dynamically calculate Lifetime as Configured Lifetime - (Cookie Acceptance Time - Cookie Generated Time) (i.e. 10800 - (1772478125 - 1772478124) == 10800 - 1 ==> 10799) 

Therefore, the gateway will send the <lifetime>10799</lifetime> in the gateway configuration to the GP App

Login Time: Mar.02 11:02:05 
Logout/Expiration: Mar.02 14:02:04 <<<++++ This means tunnel is valid for 3 hours - 1 second 
TTL : 10799

Let's say the same user authenticates, using the same cookie (still valid), to the gateway later at (1772479032) Mar.02 11:17:12 (i.e., after 908 seconds)

The gateway will again process the cookie and dynamically generate the lifetime.
- First check if cookie is valid; It was generated 908 seconds ago which is within 2 hours of acceptance time ==> Cookie is valid 
- Calculate Lifetime as Configured Lifetime - (Cookie Acceptance Time - Cookie Generated Time) (i.e. 10800 - (1772479032 - 1772478124) == 10800 - 908 ==> 9892)

Therefore, the gateway will send the <lifetime>9892</lifetime> in the gateway configuration to the GP App

Login Time: Mar.02 11:17:12 
Logout/Expiration : Mar.02 14:02:04      <<<+++ Still logging out/expirying at the same time
TTL : 9892 

This is a security feature by design to logout the user based on cookie generation so that they authenticate again with the authentication profile and get a new cookie.

If the login expiry notification or tunnels are disconnecting frequently, please check the configuration and configure the cookie acceptance and login lifetime as per requirements.