Focus

Prisma Access

INC_PORTAL_CLIENTLESS_VPN_AUTH_ TIMEOUT_FAILURES_COUNT_EXCEEDED_ ABOVE_BASELINE_PER_PA_LOCATION

Table of Contents

Filter

Expand All | Collapse All

Learn about the INC_PORTAL_CLIENTLESS_VPN_AUTH_TIMEOUT_FAILURES_COUNT_EXCEEDED_ABOVE_BASELINE_ PER_PA_LOCATION incident.

Synopsis

Portal authentication timeout failures are higher than twice the baseline for location <location-name>.

Incident Code—INC_PORTAL_CLIENTLESS_VPN_AUTH_TIMEOUT_FAILURES_COUNT_EXCEEDED_ABOVE_BASELINE_ PER_PA_LOCATION

AI-Powered ADEM

	Description
Raise condition	The incident is raised at the tenant, when the average authentication timeouts are more than twice the baseline for 45 minutes.
Clear condition	The incident is cleared at the tenant, when the average authentication timeouts are less than twice the baseline for 45 minutes.

AL_PORTAL_CLIENTLESS_VPN_AUTH_TIMEOUT_FAILURES_COUNT_EXCEEDED_ABOVE_ BASELINE_PER_PA_LOCATION
AL_PORTAL_CLIENTLESS_VPN_AUTH_SUCCESS_COUNT_DROPPED_BELOW_BASELINE_PER_ PA_LOCATION

Check your authentication service availability on those services.

For on-premise authentication services (such as LDAP, Radius, or Kerberos), you can review audit logs for incoming user requests or login errors. If there is a lapse in incoming requests, take packet captures on the relevant network path.
For public authentication services (such as SAML or cloud LDAP or Radius services), review audit logs provided by your authentication service. If there is a lapse in incoming requests, check with your authentication provider for any ongoing outages.