If the secure gateway is enabled and sessions were not disconnected then something isn't right. It sounds like your security servers are not actually being used.

Do you have Unified Access Gateways or a load balancer that might be providing access instead?