agent VPN session expired mid-authorized-scan and the agent failed to reconnect

TL;DR

When the VPN session dies mid-scan, the agent's traffic either fails or, worse, routes outside the tunnel, so every result after the drop is untrustworthy. Detect the drop (tunnel interface down or route lost), stop the scan immediately, reconnect the VPN, verify with a probe to a scoped host, and resume from the checkpoint. Never let scan traffic flow untunneled.

agent VPN session expired mid-authorized-scan and the agent failed to reconnect

Use this when

• Scan results stop mid-run on an engagement that requires VPN access.
• The agent reports hosts as down that were reachable an hour earlier.
• You run long scans from a tester workstation through an engagement VPN.

Not for this skill when

• The VPN was never up. That is a setup problem; connect before launching.
• The target is internet-facing and needs no VPN. Then a drop is a network issue, not a tunnel issue.
• The range is outside your authorized engagement. Do not scan it at all.

Steps

1. Confirm the tunnel state: check that the VPN interface exists and that the route to the target range points through it. Verify: you can state whether the tunnel is up or down right now.
2. If the tunnel is down, stop the scan immediately. Do not let it continue "to see what happens"; post-drop results are false negatives at best. Verify: no scanner process is still sending packets.
3. Reconnect using the engagement's VPN procedure (not a personal VPN, not a different endpoint). Verify: the tunnel interface is back and the route is correct.
4. Probe one known-live scoped host through the tunnel before resuming. Verify: the probe succeeds, proving traffic flows through the tunnel again.
5. Resume the scan from the checkpoint, and mark the gap window in the engagement log. Verify: results from the gap window are excluded from findings.

Variant phrasings

vpn drops during pentest scan

Common phrasing.

scan traffic routing outside tunnel after vpn disconnect

The dangerous variant.

agent reconnect vpn mid scan

Agent-workflow phrasing.

Compatibility: any tunnel-based engagement access. The stop-on-drop rule is tool-agnostic.

Why it happens

VPN sessions expire on timers or idle timeouts, and agents have no tunnel awareness: they see "host down" and keep hammering. The scan tool retries through the default route, which either fails (false negatives) or exits the tunnel entirely (scope and safety problem).

Edge cases / pitfalls

• A kill switch (block all traffic when the tunnel drops) turns this whole failure into a safe stop. Use one if the engagement setup allows it.
• Reconnecting to a different VPN endpoint can change your source address and invalidate session-bound scan state. Reconnect to the same endpoint when possible.
• Log the drop and reconnect with timestamps. The gap window matters for report accuracy.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_YH3UN749wExOVWZCcF8Y7w