PCNSE Secure Access and VPN Practice Question
A large organization uses GlobalProtect for remote access. Recently, users in the APAC region have been reporting frequent disconnections from the VPN. They can connect and authenticate, but after about 5 minutes the session drops and they must reconnect. The firewall logs show 'GlobalProtect gateway timeout' for these users. The gateway's tunnel timeout is set to 30 minutes. What is the most likely cause?
⚠ Common exam trap
The trap here is that candidates often focus on the tunnel timeout value (30 minutes) and assume it is the cause, but the real issue is the mismatch between the client's keepalive interval (60 minutes) and the gateway's idle timeout, which is typically much shorter than the tunnel timeout.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The GlobalProtect client's keepalive interval is set to 60 minutes
The GlobalProtect client uses keepalive messages to maintain the tunnel with the gateway. If the keepalive interval (default 60 minutes) exceeds the gateway's tunnel timeout (30 minutes), the gateway will tear down the idle tunnel before the client sends its next keepalive, causing a 'GlobalProtect gateway timeout' and disconnection after approximately 5 minutes (the gateway's idle timeout for the tunnel). The client must reconnect because the gateway considers the session expired.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The GlobalProtect client's keepalive interval is set to 60 minutes
Why this is correct
If the keepalive interval exceeds the gateway's idle timeout, the session is dropped.
- ✗
The portal's authentication timeout is set to 120 minutes
Why it's wrong here
A longer timeout would not cause disconnections.
- ✗
The IP pool for the gateway is exhausted
Why it's wrong here
Exhaustion would affect new connections, not existing ones.
- ✗
The internal gateway hostname cannot be resolved by the client
Why it's wrong here
DNS issues would prevent initial connection, not cause 5-minute drops.
Go deeper
Related to this question
About these practice questions
This PCNSE question is part of Courseiva's 504-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.