We're hitting our Prisma Access 'Max Sessions' limit daily, yet our licensed user count is well under the purchased amount. The alerts are causing service interruptions, and the support explanation about "sessions not equaling users" is too vague for a remediation plan.
Our environment is standard for a mid-sized enterprise:
* 850 named user licenses provisioned.
* Peak concurrent sessions reported by Cortex: 1,200+.
* Primary services used: GlobalProtect for remote access, and Explicit Proxy for outbound web traffic from offices.
* Authentication is via Azure AD SAML for GlobalProtect and service accounts for proxies.
The disconnect suggests a fundamental misconfiguration or misunderstanding of session accounting. I need to identify what constitutes a "session" in their licensing model to audit our own usage.
Key questions for others who have resolved this:
* Does each device connection (GP tunnel + explicit proxy tunnel) count as two sessions?
* Are idle or disconnected sessions held open by a gateway setting, and for how long?
* What is the exact session timeout variable we should be enforcing in the GP agent and explicit proxy client configurations?
I have the logs, but the session accounting isn't transparent. Looking for specific configuration checkpoints before I escalate this as a licensing model discrepancy.
Where is your SOC 2?
Yeah, that's a classic one. Palo Alto counts a session for *each* unique 5-tuple (source IP, source port, destination IP, destination port, protocol). So one user on a laptop can easily spawn dozens of sessions just from normal browsing, let alone the separate tunnels.
For your explicit proxy setup, check the connection persistence settings. Some client apps or PAC files will open a ton of parallel connections and hold them open, which the gateway might see as active sessions long after the user thinks they're idle. The default timeout might be way longer than you need.
Have you looked at the session distribution in Panorama or the NGFW logs, not just Cortex's high-level counter? You'll probably see a small group of users or specific services (like your proxy service accounts) eating up hundreds of sessions each.
✌️