Tutorial: How to Change Access Server's Session Tokens⁠

Overview⁠

After a successful authentication, Access Server issues a session token to the VPN client. The client presents this token each time it needs to re-authenticate. — for example, during TLS key renegotiation or after a brief connection interruption — so the user doesn't need to re-enter their credentials mid-session.

This tutorial shows how to adjust session token settings from the command-line interface (CLI).

Prerequisites⁠

• An installed Access Server.

• Console access and the ability to get root access.

Step 1: Understand Access Server's session tokens⁠

Start by learning about how session tokens work by reading our detailed topic:

• Access Server's Session Tokens

Step 2: Adjust session token values⁠

1. Connect to the console and get root privileges.

2. Use the following commands to adjust the default session token values and define new behavior:

   • Set the session token timeout in seconds (default 86100 seconds or approximately 24 hours):

     sacli --key "vpn.server.session_expire" --value <SECONDS> ConfigPut
     sacli start

   • Restore this value to the default by removing it:

     sacli --key "vpn.server.session_expire" ConfigDel
     sacli start

   • Change the mid-session TLS renegotiation period:

     sacli --key "vpn.tls_refresh.interval" --value <MINUTES> ConfigPut
     sacli start

   • Restore this value to the default by removing it:

     sacli --key "vpn.tls_refresh.interval" ConfigDel
     sacli start