Idle Timer

With a successful authentication, the authentication proxy sets up an inactivity (idle) timer for the created user profile. As long as any authorized user traffic goes through the firewall, the idle timer is continuously reset and the user’s host doesn’t trigger the authentication proxy. The ip auth-proxy auth-cache-time minutes command is used (covered in the section “Authentication Proxy Configuration on the Router”) to set the idle timer. The default is 60 minutes.

If the idle timer expires, the authentication proxy then removes the user’s profile information and any related dynamic ACEs in the access lists. Any subsequent traffic from the client host is blocked until they initiate another HTTP session to trigger the authentication proxy.