PAM session disconnects during brief network interruptions or VPN changes

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

Users may experience PAM session disconnections during brief network interruptions, particularly when using VPN clients like Zscaler. This article clarifies why this occurs and provides recommendations to improve session resilience.

Environment

• Broadcom Privileged Access Manager (PAM) 4.x
• Supported Operating Systems (Windows/macOS)
• VPN/Zscaler configurations

Cause

When a network interruption occurs, the client's operating system often tears down the virtual network adapter to re-establish a secure tunnel (e.g., when switching from Wi-Fi to Wired or re-connecting a VPN). During this process, the operating system sends an explicit TCP Reset (RST) command to the PAM server. While PAM is designed to tolerate silent packet loss, an explicit RST packet is a security instruction that forces the server to close the socket immediately to prevent potential session hijacking. Because SSH and RDP applets are stateful connections, once the underlying socket is closed by the OS, the session cannot be transparently recovered.

Resolution

To improve resilience, consider the following configurations:

1. Zscaler Timeout Policy: Work with the Zscaler administrator to ensure the "Idle Connection Timeout" for the PAM application segment is set to a sufficiently high value. Navigate to Policies > Access Control > Private Applications > Timeout Policy in the Zscaler console.
2. Network Transition Stability: Investigate if the VPN/Zscaler can be configured to maintain the virtual adapter state during physical network handoffs to avoid triggering the OS-level TCP Reset.
3. Session Persistence: If a Session Broker is used behind PAM, ensure it is configured to recognize returning users, allowing them to be reconnected to existing target server sessions after a manual re-login to PAM.