PC take few attempts to connect to GP

PaloAlto18 — Fri, 16 Jul 2021 05:27:26 GMT

Hi Community,

We have few users who complain that it takes few tries to connect to GP 5.2.5.

We are running PAN OS 9.1.8

Firewall does not show any logs for failed attempts.

why is that?

It only shows successfull connection attempt.

Below are the logs of from GP agent

we are using pre logon then on demand

P5188-T16948)Debug(3690): 07/15/21 08:44:05:492 REGION-PRIO, gateway region code is CA
(P5188-T16948)Debug(3722): 07/15/21 08:44:05:492 REGION-PRIO, portal and gateway have same region code!
(P5188-T16948)Debug(6513): 07/15/21 08:44:05:492 Auth message is Enter login credentials for gateway corp-vpn.xxx
(P5188-T16948)Debug(6541): 07/15/21 08:44:05:492 Gateway license yes, license-v6 yes
(P5188-T16948)Debug(6056): 07/15/21 08:44:05:492 OtpSaveCredential is save_credential
(P5188-T16948)Debug(6094): 07/15/21 08:44:05:492 External network gateway without OTP authentication
(P5188-T16948)Debug(6161): 07/15/21 08:44:05:492 Fallback portal user credential.
(P5188-T16948)Debug( 41): 07/15/21 08:44:05:505 Roaming profile is false
(P5188-T16948)Debug( 167): 07/15/21 08:44:05:529 profileInfo username mark10, profile path (null), server (null)
(P5188-T16948)Debug(2237): 07/15/21 08:44:05:552 Unserialized empty cookie for portal corp-vpn.xxx and user mark10%40corp.com
(P5188-T16948)Debug(10950): 07/15/21 08:44:05:552 send saml-pre-login to UI.
(P5188-T16948)Debug(3544): 07/15/21 08:44:05:552 Grace period is 0
(P5188-T16948)Debug(1421): 07/15/21 08:44:05:552 Added manual=no to response to PanGPA.
(P5188-T16948)Debug(1809): 07/15/21 08:44:05:554 Send response to client for request saml-pre-login
(P5188-T16948)Debug(3544): 07/15/21 08:44:05:554 Grace period is 0
(P5188-T16948)Debug(10982): 07/15/21 08:44:05:554 wait for m_hChallengeEvent.
(P5188-T1104)Debug(6500): 07/15/21 08:44:14:721 NetworkConnectionMonitorThread: route change detected. Wait for 3 seconds.
(P5188-T1104)Debug(5417): 07/15/21 08:44:14:721 No need to check gateway route since no tunnel.
(P5188-T1104)Debug(6561): 07/15/21 08:44:17:732 NetworkConnectionMonitorThread: m_state = 0, m_bOnDemand=1, m_bAgentEnabled=1, m_bJustResumed is 0,
m_bHibernate is 0, m_bAgentEnabled is 1, m_bDisconnect is 0, IsConnected() is 0, IsVPNInRetry() is 0.
(P5188-T1104)Debug(5417): 07/15/21 08:44:17:732 No need to check gateway route since no tunnel.
(P5188-T1104)Debug(6596): 07/15/21 08:44:17:732 NetworkConnectionMonitorThread: Detected route change, but skip network discovery.
(P5188-T1104)Debug(6500): 07/15/21 08:44:22:444 NetworkConnectionMonitorThread: route change detected. Wait for 3 seconds.
(P5188-T1104)Debug(5417): 07/15/21 08:44:22:444 No need to check gateway route since no tunnel.
(P5188-T1104)Debug(6561): 07/15/21 08:44:25:447 NetworkConnectionMonitorThread: m_state = 0, m_bOnDemand=1, m_bAgentEnabled=1, m_bJustResumed is 0,
m_bHibernate is 0, m_bAgentEnabled is 1, m_bDisconnect is 0, IsConnected() is 0, IsVPNInRetry() is 0.
(P5188-T1104)Debug(5417): 07/15/21 08:44:25:447 No need to check gateway route since no tunnel.
(P5188-T1104)Debug(6596): 07/15/21 08:44:25:447 NetworkConnectionMonitorThread: Detected route change, but skip network discovery.
(P5188-T1104)Debug(6500): 07/15/21 08:44:25:705 NetworkConnectionMonitorThread: route change detected. Wait for 3 seconds.
(P5188-T1104)Debug(5417): 07/15/21 08:44:25:705 No need to check gateway route since no tunnel.
(P5188-T1104)Debug(6561): 07/15/21 08:44:28:727 NetworkConnectionMonitorThread: m_state = 0, m_bOnDemand=1, m_bAgentEnabled=1, m_bJustResumed is 0,
m_bHibernate is 0, m_bAgentEnabled is 1, m_bDisconnect is 0, IsConnected() is 0, IsVPNInRetry() is 0.
(P5188-T1104)Debug(5417): 07/15/21 08:44:28:727 No need to check gateway route since no tunnel.
(P5188-T1104)Debug(6596): 07/15/21 08:44:28:727 NetworkConnectionMonitorThread: Detected route change, but skip network discovery.
(P5188-T1104)Debug(6500): 07/15/21 08:44:30:877 NetworkConnectionMonitorThread: route change detected. Wait for 3 seconds.
(P5188-T1104)Debug(5417): 07/15/21 08:44:30:877 No need to check gateway route since no tunnel.
(P5188-T1104)Debug(6561): 07/15/21 08:44:33:889 NetworkConnectionMonitorThread: m_state = 0, m_bOnDemand=1, m_bAgentEnabled=1, m_bJustResumed is 0,
m_bHibernate is 0, m_bAgentEnabled is 1, m_bDisconnect is 0, IsConnected() is 0, IsVPNInRetry() is 0.
(P5188-T1104)Debug(5417): 07/15/21 08:44:33:889 No need to check gateway route since no tunnel.
(P5188-T1104)Debug(6596): 07/15/21 08:44:33:889 NetworkConnectionMonitorThread: Detected route change, but skip network discovery.
(P5188-T1432)Info ( 502): 07/15/21 08:44:53:307 msgtype = sleep
(P5188-T1432)Info (1983): 07/15/21 08:44:53:307 ProcessServerSleep called
(P5188-T1432)Debug(1990): 07/15/21 08:44:53:307 Received wakeup event already. ignore this one
(P5188-T1432)Debug(1809): 07/15/21 08:44:53:308 Send response to client for request sleep
(P5188-T5192)Info ( 428): 07/15/21 08:44:53:484 Received power event, type 0x0000000a
(P5188-T5192)Info ( 428): 07/15/21 08:45:23:292 Received power event, type 0x0000000a
(P5188-T1432)Info ( 502): 07/15/21 08:45:23:428 msgtype = sleep
(P5188-T1432)Info (1983): 07/15/21 08:45:23:428 ProcessServerSleep called
(P5188-T1432)Debug( 198): 07/15/21 08:45:23:428 Now is 294562. CheckHipTimeoutAfterSleep: 89000 ms
(P5188-T1432)Debug(2004): 07/15/21 08:45:23:428 Out-of-sleep during network discovery.
(P5188-T1432)Debug(2031): 07/15/21 08:45:23:428 Machine resumed from sleep/hibernation during network discovery.
(P5188-T1432)Debug(2033): 07/15/21 08:45:23:428 Skip re-do network discovery for on-demand mode.
(P5188-T1432)Debug(2051): 07/15/21 08:45:23:428 State is Discovering network...
(P5188-T1432)Debug(1809): 07/15/21 08:45:23:429 Send response to client for request sleep
(P5188-T6552)Debug( 553): 07/15/21 08:45:24:496 WscCallback
(P5188-T6552)Debug( 555): 07/15/21 08:45:24:496 SetWscEvent
(P5188-T16512)Debug( 431): 07/15/21 08:45:27:497 before check wsc
(P5188-T16512)Debug( 385): 07/15/21 08:45:27:497 wsc-autodetect is enabled
(P5188-T16512)Debug( 434): 07/15/21 08:45:27:497 CheckWsc
(P5188-T16512)Debug( 460): 07/15/21 08:45:27:497 CheckWsc is called.
(P5188-T16512)Debug( 474): 07/15/21 08:45:27:497 WscCallback: health state change not detected. Ignore this one.
(P5188-T1432)Info ( 502): 07/15/21 08:45:28:436 msgtype = gateway-credential-cancel
(P5188-T1432)Debug(3853): 07/15/21 08:45:28:436 ServerThread: ProcessServerCancelGatewayLogin
(P5188-T1432)Debug(3867): 07/15/21 08:45:28:436 Set cancel gateway login event.
(P5188-T16948)Debug(11001): 07/15/21 08:45:28:436 Got cancel gateway login event while waiting for challenge event for gateway corp-vpn.xxx
(P5188-T16948)Debug(11019): 07/15/21 08:45:28:436 HandleGatewayChallenge returns 1
(P5188-T16948)Debug(3780): 07/15/21 08:45:28:436 HandleGatewayChallenge returns TRUE. Gateway saml login issue
(P5188-T16948)Debug(3791): 07/15/21 08:45:28:436 User canceled login to gateway corp-vpn.xxx.
(P5188-T16948)Info (2686): 07/15/21 08:45:28:437 Failed to retrieve info for gateway corp-vpn.xxx.
(P5188-T16948)Debug(2697): 07/15/21 08:45:28:438 tunnel to corp-vpn.xxx is not created.
(P5188-T16948)Error(5882): 07/15/21 08:45:28:438 NetworkDiscoverThread: failed to discover external network.
(P5188-T16948)Debug(5906): 07/15/21 08:45:28:438 Network discovery failed, set error as The network connection is unreachable or the gateway is unresponsive. Check the network connection and reconnect.
(P5188-T16948)Debug(6968): 07/15/21 08:45:28:439 --Set state to Disconnected
(P5188-T1580)Debug(2426): 07/15/21 08:45:28:439 Setting debug level to 5
(P5188-T16948)Debug(5946): 07/15/21 08:45:28:442 NetworkDiscoverThread: PortalStatus is 1, HasLoggedOnGateway is 0
(P5188-T16948)Debug(5969): 07/15/21 08:45:28:442 Network discovery is not ready, set GP VPN status as disconnected
(P5188-T16948)Debug(11295): 07/15/21 08:45:28:442 SetVpnStatus called with new status=0, Previous Status=0
(P5188-T16948)Debug(4214): 07/15/21 08:45:28:442 UpdatePrelogonStateForSSO() - tunnel state = Disconnected
(P5188-T16948)Debug(6047): 07/15/21 08:45:33:443 NetworkDiscoverThread: Network discover is not successful. Retry.
(P5188-T16948)Info (6065): 07/15/21 08:45:33:443 OnDemand mode, skip retry network discovery.
(P5188-T16948)Debug(5549): 07/15/21 08:45:33:443 NetworkDiscoverThread: wait for network discover event.
(P5188-T1104)Debug(6500): 07/15/21 08:45:43:141 NetworkConnectionMonitorThread: route change detected. Wait for 3 seconds.
(P5188-T1104)Debug(5417): 07/15/21 08:45:43:141 No need to check gateway route since no tunnel.
(P5188-T1104)Debug(6561): 07/15/21 08:45:46:143 NetworkConnectionMonitorThread: m_state = 0, m_bOnDemand=1, m_bAgentEnabled=1, m_bJustResumed is 1,
m_bHibernate is 0, m_bAgentEnabled is 1, m_bDisconnect is 0, IsConnected() is 0, IsVPNInRetry() is 0.
(P5188-T1104)Debug(5417): 07/15/21 08:45:46:143 No need to check gateway route since no tunnel.
(P5188-T1104)Debug(6596): 07/15/21 08:45:46:143 NetworkConnectionMonitorThread: Detected route change, but skip network discovery.
(P5188-T1104)Debug(6500): 07/15/21 08:45:47:352 NetworkConnectionMonitorThread: route change detected. Wait for 3 seconds.
(P5188-T1104)Debug(5417): 07/15/21 08:45:47:352 No need to check gateway route since no tunnel.
(P5188-T1104)Debug(6561): 07/15/21 08:45:50:353 NetworkConnectionMonitorThread: m_state = 0, m_bOnDemand=1, m_bAgentEnabled=1, m_bJustResumed is 1,
m_bHibernate is 0, m_bAgentEnabled is 1, m_bDisconnect is 0, IsConnected() is 0, IsVPNInRetry() is 0.
(P5188-T1104)Debug(5417): 07/15/21 08:45:50:353 No need to check gateway route since no tunnel.
(P5188-T1104)Debug(6596): 07/15/21 08:45:50:353 NetworkConnectionMonitorThread: Detected route change, but skip network discovery.
(P5188-T5192)Info ( 428): 07/15/21 08:45:53:321 Received power event, type 0x0000000a
(P5188-T1432)Info ( 502): 07/15/21 08:45:53:507 msgtype = sleep
(P5188-T1432)Info (1983): 07/15/21 08:45:53:507 ProcessServerSleep called
(P5188-T1432)Debug(1990): 07/15/21 08:45:53:507 Received wakeup event already. ignore this one
(P5188-T1432)Debug(1809): 07/15/21 08:45:53:507 Send response to client for request sleep
(P5188-T1432)Info ( 502): 07/15/21 08:46:20:614 msgtype = portal
(P5188-T1432)Debug(2456): 07/15/21 08:46:20:614 ----portal processing starts----
(P5188-T1432)Debug(2486): 07/15/21 08:46:20:614 User profile type is 0(not roaming)
(P5188-T1432)Debug(2519): 07/15/21 08:46:20:614 pg, source = 0, old source is 0
(P5188-T1432)Debug(2541): 07/15/21 08:46:20:614 pg, preferred gateway not set in message, old prefergateway=:)
(P5188-T1432)Debug(2598): 07/15/21 08:46:20:614 CheckUpdate is false.
)(P5188-T1432)Debug(2613): 07/15/21 08:46:20:614 portal-certificate-verification is yes
(P5188-T1432)Debug(2653): 07/15/21 08:46:20:614 No saml-load-cache tag.
(P5188-T1432)Debug(2676): 07/15/21 08:46:20:614 no saml-auth-error tag.
(P5188-T1432)Debug(2689): 07/15/21 08:46:20:614 allow-cached-portal is yes
(P5188-T1432)Debug(2733): 07/15/21 08:46:20:614 NewWinUser is mark10, WinUser is , PreviousSwitchOffMsg is false
(P5188-T1432)Debug(2734): 07/15/21 08:46:20:614 GetPrelogonStatus() 2, m_userName mark10%40corp.com, m_preUsername ___empty_username___
(P5188-T1432)Debug(3544): 07/15/21 08:46:20:614 Grace period is 0
(P5188-T1432)Debug(6840): 07/15/21 08:46:20:614 StopThreads starts:
(P5188-T1432)Debug(6847): 07/15/21 08:46:20:614 There are 5 threads running...
(P5188-T1432)Debug(1395): 07/15/21 08:46:20:614 Logging out gateway, reason is StopThreads
(P5188-T1104)Debug(6611): 07/15/21 08:46:20:614 NetworkConnectionMonitorThread: got exit event.
(P5188-T16948)Debug(5559): 07/15/21 08:46:20:614 NetworkDiscoverThread: got exit event.
(P5188-T16948)Debug(6022): 07/15/21 08:46:20:614 NetworkDiscoverThread: quits.
(P5188-T4880)Debug(5308): 07/15/21 08:46:20:614 CaptivePortalDetectionThread: got exit event.
(P5188-T1104)Debug(6626): 07/15/21 08:46:20:614 NetworkConnectionMonitorThread: quits.
(P5188-T4880)Debug(5476): 07/15/21 08:46:20:614 CaptivePortalDetectionThread: captive portal detection thread exit status is (failed).
(P5188-T16548)Debug(5106): 07/15/21 08:46:20:614 NotificationTimerThread: got exit event.
(P5188-T14652)Debug(6176): 07/15/21 08:46:20:614 HipReportThread: got exit event.
(P5188-T14652)Debug(6454): 07/15/21 08:46:20:614 HipReportThread: HipReportThread quits.
(P5188-T1432)Debug(1434): 07/15/21 08:46:20:614 Logging out gateway over
(P5188-T1432)Debug(6857): 07/15/21 08:46:20:614 Going to wait all threads exit...
(P5188-T1432)Debug(6861): 07/15/21 08:46:20:614 threads are gracefully stopped, counter=600.
(P5188-T1432)Debug(6874): 07/15/21 08:46:20:614 Double check all threads.
(P5188-T1432)Debug(6925): 07/15/21 08:46:20:614 To reset thread quit event.
(P5188-T472)Debug( 435): 07/15/21 08:46:20:614 HipMissingPatchThread: got thread exit event.
(P5188-T10104)Debug( 242): 07/15/21 08:46:20:614 HipCheckThread: got thread exit event.
(P5188-T16512)Debug( 423): 07/15/21 08:46:20:614 HipMonitor gets quit event.
(P5188-T16512)Debug( 440): 07/15/21 08:46:20:615 Unregister -- WscUnRegisterChanges
(P5188-T16512)Debug( 763): 07/15/21 08:46:20:617 HipMonitorThread quits.
(P5188-T10104)Debug( 287): 07/15/21 08:46:20:632 HipCheckThread: Hip check thread quits.
(P5188-T472)Debug( 533): 07/15/21 08:46:20:646 HipMissingPatchThread: Hip check missiing patch thread quits.
(P5188-T1432)Debug( 132): 07/15/21 08:46:20:646 All hip collect threads quit gracefully.
(P5188-T1432)Debug(6935): 07/15/21 08:46:20:646 StopThreads ends.
(P5188-T1432)Debug(6804): 07/15/21 08:46:20:647 StartThreads starts:
(P5188-T1580)Debug(2426): 07/15/21 08:46:20:647 Setting debug level to 5
(P5188-T1432)Debug( 25): 07/15/21 08:46:20:647 create thread 0x558 with thread ID 19564
(P5188-T19564)Debug(4949): 07/15/21 08:46:20:647 NotificationTimerThread: notification timer thread starts.
(P5188-T19564)Debug(5099): 07/15/21 08:46:20:647 NotificationTimerThread: wait (-1 ms) for notification timer event.
(P5188-T1432)Debug( 25): 07/15/21 08:46:20:647 create thread 0xa50 with thread ID 19568
(P5188-T19568)Debug(5145): 07/15/21 08:46:20:647 CaptivePortalDetectionThread: captive portal detection thread starts.
(P5188-T19568)Debug(5305): 07/15/21 08:46:20:647 CaptivePortalDetectionThread: wait (-1 ms) for captive portal detection event.
(P5188-T1432)Debug( 25): 07/15/21 08:46:20:647 create thread 0xa54 with thread ID 19572
(P5188-T19572)Debug(5486): 07/15/21 08:46:20:648 NetworkDiscoverThread: network discover thread starts.
(P5188-T19572)Debug(5549): 07/15/21 08:46:20:648 NetworkDiscoverThread: wait for network discover event.
(P5188-T1432)Debug( 25): 07/15/21 08:46:20:648 create thread 0xa58 with thread ID 19576
(P5188-T19576)Debug(6114): 07/15/21 08:46:20:648 HipReportThread: HipReportThread starts up.
(P5188-T19576)Debug(6147): 07/15/21 08:46:20:648 HipReportThread: wait for HIP report ready event.
(P5188-T1432)Debug( 25): 07/15/21 08:46:20:648 create thread 0xa5c with thread ID 19580
(P5188-T19580)Debug(6462): 07/15/21 08:46:20:648 NetworkConnectionMonitorThread: network connection monitor thread starts.
(P5188-T1432)Debug( 25): 07/15/21 08:46:20:648 create thread 0xa60 with thread ID 19584
(P5188-T19584)Debug( 167): 07/15/21 08:46:20:648 Start HipCheckThread
(P5188-T19584)Debug( 210): 07/15/21 08:46:20:648 HipCheckThread started...
(P5188-T19584)Debug( 216): 07/15/21 08:46:20:648 HipCheckThread: wait for hip check event for 3600000 ms);
(P5188-T1432)Debug( 25): 07/15/21 08:46:20:648 create thread 0xa64 with thread ID 19588
(P5188-T19588)Debug( 176): 07/15/21 08:46:20:648 Start HipMissingPatchThread
(P5188-T19588)Debug( 409): 07/15/21 08:46:20:648 HipMissingPatchThread started...
(P5188-T1432)Debug( 25): 07/15/21 08:46:20:649 create thread 0xa68 with thread ID 19592
(P5188-T19592)Debug( 186): 07/15/21 08:46:20:649 Start HipMonitorThread
(P5188-T19592)Info ( 759): 07/15/21 08:46:20:649 HipMonitorThread starts
(P5188-T1432)Debug(2854): 07/15/21 08:46:20:649 No user, using SSO
(P5188-T1432)Debug(10736): 07/15/21 08:46:20:649 Saved password is empty.
(P5188-T1432)Debug(2914): 07/15/21 08:46:20:649 Portal corp-vpn.xxx, user , logonDomain corp, saved user , path C:\Users\mark10\AppData\Local\Palo Alto Networks\GlobalProtect\
(P5188-T1432)Debug(2980): 07/15/21 08:46:20:649 use proxy is 1
(P5188-T1432)Debug(3038): 07/15/21 08:46:20:649 Pre-logon-then-on-demand value is yes
(P5188-T1432)Debug(1545): 07/15/21 08:46:20:649 SSO starts.
(P5188-T1432)Info (1574): 07/15/21 08:46:20:650 SSO ----- PanCredGet failed with error Element not found.
(P5188-T1432)Debug(1585): 07/15/21 08:46:20:650 SSO GetSsoCredential starts.
(P5188-T1432)Info (1615): 07/15/21 08:46:20:650 SSO ----- PanCredGet failed with error Element not found

Ticket has come to us to know the root cause for this?

Any help is appreciated..

Re: PC take few attempts to connect to GP

kiwi — Thu, 22 Jul 2021 18:24:29 GMT

Hi @PaloAlto18 ,

In order to get better traction for this, I have moved it to the GlobalProtect area.
I would recommend that you visit the GlobalProtect discussion area to see your discussion and others there and to create any other new discussions there.

Cheers,

-Kiwi

Re: PC take few attempts to connect to GP

RVizcarra — Sat, 28 Jan 2023 02:38:04 GMT

Hi @PaloAlto18 ,

I have the same issue. Every time I am switching gateways, GP requires user to input password twice.

Did you already find the root cause of this?

topic PC take few attempts to connect to GP in GlobalProtect Discussions

PC take few attempts to connect to GP

Re: PC take few attempts to connect to GP

Re: PC take few attempts to connect to GP