topic Re: GlobalProtect - "Refresh Connection" API call via DLL/etc in GlobalProtect Discussions

GlobalProtect - "Refresh Connection" API call via DLL/etc

AAT — Wed, 24 Apr 2019 13:33:38 GMT

Is there an API or any documentation on how to call the GlobalProtect "Refresh Connection" function from external code? I want to be able to call this function from custom external code. The reason why is to fix a connection issue we are having through automation since we don't want to have to ask users to manually click that option.

If no external API call is possible, is there a command-line option to call "Refresh Connection"?

Why isn't Global Protect smart enough to call Refresh Connection on its own when an always on VPN connection breaks? There should be a way to monitor public IP addresses for reachability and automatically refresh the connection if can't access the public IPs... Our AOVPN breaks frequently when machines go to sleep and wake up, screen is unlocked, etc.

Re: GlobalProtect - "Refresh Connection" API call via DLL/etc

Remo — Wed, 24 Apr 2019 14:38:34 GMT

@AAT

No, GP does not provide an API to automate such things. But the problem you are talking about sounds like a bug of GP. Which version do you use right now?

Re: GlobalProtect - "Refresh Connection" API call via DLL/etc

AAT — Wed, 24 Apr 2019 15:11:55 GMT

Latest version. It has been an issue for us for years on every version and never found a resolution. Opened various tickets with PA, have one opened now.

The GP client needs to be smart enough to refresh the connection itself when it detects lack of network connectivty. I'm trying to write an app in C++ to get-netadapter -interfacedescription "PANGP*" | restart-netadapter via powershell create process call if a certain public IP address can't be reached, but I shouldn't be needing to go to this level. The client needs to have this bug fixed. GP needs to automatically repair itself when Windows wakes from sleep on AOVPN connections / etc.

Re: GlobalProtect - "Refresh Connection" API call via DLL/etc

Remo — Wed, 24 Apr 2019 15:26:10 GMT

I have 11 open cases about global protect right now 😛

One of them is about the issue you mentionned. Just wait a little longer...

Re: GlobalProtect - "Refresh Connection" API call via DLL/etc

AAT — Wed, 24 Apr 2019 15:36:05 GMT

I will post back here if we get a solution from Palo Alto, please do the same @Remo

This issue has been on going for years and not acceptable for the software to have such an obvious / easily fixable bug last so long. We shouldn't have to be writing our own code / hacks to fix Palo Alto's VPN client

Re: GlobalProtect - "Refresh Connection" API call via DLL/etc

Remo — Fri, 26 Apr 2019 15:34:57 GMT

--> Global Protect 5.0.2

Re: GlobalProtect - "Refresh Connection" API call via DLL/etc

Remo — Fri, 26 Apr 2019 17:21:52 GMT

@AAT wrote:
This issue has been on going for years and not acceptable for the software to have such an obvious / easily fixable bug last so long. We shouldn't have to be writing our own code / hacks to fix Palo Alto's VPN client

@AAT

Then 5.0.2 will be the first release that is acceptable 😉

Re: GlobalProtect - "Refresh Connection" API call via DLL/etc

mtx-admin — Fri, 18 Oct 2019 16:30:26 GMT

Hello,

Just want to report that we're also seeing this issue and we're running GP version 5.0.4-16

This is not mentioned in any of the "known issues" documentation.

-Gerson

Re: GlobalProtect - "Refresh Connection" API call via DLL/etc

Remo — Fri, 01 Nov 2019 21:48:04 GMT

Hi @mtx-admin

What exactly is the problem you're seeing? In which situations does it happen exactly? Do you have an always-on config?

Re: GlobalProtect - "Refresh Connection" API call via DLL/etc

mtx-admin — Fri, 08 Nov 2019 18:43:03 GMT

@Remo

That's correct. We have always-on VPN. Whenever I or other users work remotely, very randomly some of our services will stop working (Outlook, Internet, etc.)

It's like the connection goes "stale" even though we're active on the system. Things come back online after we "Refresh Connection" in the VPN client.

We are on GlobalProtect 5.0.5

Re: GlobalProtect - "Refresh Connection" API call via DLL/etc

JD-SECD — Wed, 26 May 2021 18:06:19 GMT

Did this ever get fixed - i have customer who has issues w/ the GP-client not transition the logged-in user from the Prelogon user to the logged-in-user by way of prelogon-always client settings.

Re: GlobalProtect - "Refresh Connection" API call via DLL/etc

Remo — Wed, 26 May 2021 19:11:41 GMT

Hi @JD-SECD

The requested solution in this topic probably isn't the solution for your situation. In the past I already hat some issues like yours and in most of the cases (not all) the issue was a configuration problem or then related to an issue with authentication profiles. Why don't you start a new topic where you describe your issue in detail and the used configuration and then maybe the community is able to help you.

Re: GlobalProtect - "Refresh Connection" API call via DLL/etc

beng — Sat, 17 Jul 2021 05:19:18 GMT

Hi @Remo , hope you are well. I didn't note a resolution from this thread. Are you able to advise on the bug ID and version of GlobalProtect this issue is fixed?

Re: GlobalProtect - "Refresh Connection" API call via DLL/etc

Remo — Sat, 17 Jul 2021 20:20:44 GMT

Hi @beng

Which issue are you now talking about exactly? The transition from the pre-logon user to the actual user? If yes, then as I wrote 2 months ago, in most cases this is a configuration issue. I assume you use an always on configuration and then what authentication method you you use?

Re: GlobalProtect - "Refresh Connection" API call via DLL/etc

beng — Tue, 20 Jul 2021 06:12:42 GMT

Hi @Remo , connect method is Pre-logon (Always On) and authentication method is Azure SAML, using GlobalProtect v5.2.7.

The issue I'm seeing is when a user loses internet, and then regains internet e.g. manually disconnect WiFi, and then connect WiFi.. The Global Protect auto attempt to reconnect continually, however fails with "Gateway <GW_NAME>: The network connection is unreachable or the gateway is unresponsive. Check the network connection and reconnect." The workaround is to manually hit the "Refresh Connection" button.

I've verified via Wireshark on my corporate laptop that there is no DNS resolution for vpn.<domain> upon those auto reconnects/failures, but there is DNS resolution for vpn.<domain> upon a manual "Refresh Connection".

I've logged a TAC case for this issue and will see how that goes... Out of curiosity, would you class this as expected behavior?

Re: GlobalProtect - "Refresh Connection" API call via DLL/etc

Remo — Tue, 20 Jul 2021 10:08:11 GMT

I don't expect such a poor user experience to be expected behavior ... but I don't know how this is seen by TAC (in the past I also had some very "special" situations where it absolutely did not make sense what the gp agent was doing - but it still was "expected behavior" by paloalto)

May I ask, if you have a global protect subscription on that firewall?

Re: GlobalProtect - "Refresh Connection" API call via DLL/etc

beng — Fri, 30 Jul 2021 06:32:51 GMT

There's been some progress on the TAC case, however not sure why those changes would effect reconnections in a good way when disconnecting and reconnecting on the same WAN IP. Anyway the changes made were:

1) Under the Gateway Connection Settings, ticked "Restrict Authentication Cookie Usage(for Automatic Restoration of VPN tunnel or Authentication Override)" and chose "The original Source IP for which the authentication cookie was issued".

2) Exempted "https://vpn.<domain>" from the corporate proxy .pac file.

@Remo yes, totally agree that poor user experience can be what a vendor deems expected behavior. Do you think user experience has improved from v5.0.2 to v5.2.7?

Can I find out why whether we have a GP subscription or not is useful information to you?

Re: GlobalProtect - "Refresh Connection" API call via DLL/etc

Remo — Fri, 30 Jul 2021 16:34:55 GMT

The user experiance definately has improved between 5.0.2 and 5.2.7. Actually there were huge steps between these versions. The problem here is - as everywhere - with new features there are new issues/special situations/edge cases ...

The question for the GP subscription was because then you could try to add the hostnames for the SAML login to split tunneling fqdn exclusions. Currently I am experimenting with that as I had not only a few situations where the connection to login.microsoftonline.com was blocked because it was sent through the vpn tunnel and there I have a policy that allowed internet access only for real users. So when my user-id agents were not able to provide the username early enough to the firewall, the gp login was not possibile. In your reconnect situations I imagine it could be a similar situation.