GP Issue Gateway Fake

chanderjain — Sat, 27 Nov 2021 15:44:59 GMT

Hi,

I am facing the issue with Pan GP where I get an error Gateway Fake: Could not connect to the GlobalProtect gateway. Please contact your IT administrator.

I tried to remove the certificate and also reinstall it multiple times and delete the Palo alto network file also and re-install the Pan GP but no luck. Uninstall all applications but no solution I find. It was working fine before that but suddenly start the error.

I getting these logs from the files.

11/27/0021 20:17:50.979 [Info ]: GlobalProtect service started (client version: 5.1.1-12, OS version: Microsoft Windows 10 Pro , 64-bit).
11/27/0021 20:19:24.121 [Info ]: Portal login completed with address 203.122.6.28 and conect method of user-logon.
11/27/0021 20:19:24.199 [Info ]: Network discovery started.
11/27/0021 20:19:25.708 [Error]: Gateway Fake: Could not connect to the GlobalProtect gateway. Please contact your IT administrator.

11/27/21 20:17:46:733[Debug 743]: No oem .inf existing.
11/27/21 20:17:47:629[Debug 306]: Driver inf file is installed successfully.
11/27/21 20:17:49:667[Debug 359]: Driver gets installed successfully.
11/27/21 20:17:50:204[Debug 375]: Set debug level as 4
11/27/21 20:17:50:766[Debug 1196]: Driver status is: 4.
11/27/21 20:17:50:776[Debug 565]: Found pangpd device ROOT\PANGPD\0000, remove it now.
11/27/21 20:17:50:778[Debug 1196]: Driver status is: 4.
11/27/21 20:17:50:787[Debug 565]: Found pangpd device ROOT\PANGPD\0000, remove it now.
11/27/21 20:17:50:788[Debug 944]: Disable adapter be called.
11/27/21 20:17:50:868[Debug 824]: Disable Adapter success.

(T12520)Debug(2278): 11/27/21 20:17:58:741 No user, using SSO
(T12520)Debug(9709): 11/27/21 20:17:58:742 Saved password is empty.
(T12520)Debug(2338): 11/27/21 20:17:58:742 Portal 203.122.6.28, user , logonDomain DESKTOP-8H9MAI8, saved user , path C:\Users\Chander Jain\AppData\Local\Palo Alto Networks\GlobalProtect\
(T12520)Debug(2404): 11/27/21 20:17:58:742 use proxy is 1
(T12520)Debug(2462): 11/27/21 20:17:58:742 Pre-logon-then-on-demand value is no
(T12520)Debug(1469): 11/27/21 20:17:58:742 SSO starts.
(T12520)Info (1498): 11/27/21 20:17:58:743 SSO ----- PanCredGet failed with error Element not found.
(T12520)Debug(1509): 11/27/21 20:17:58:744 SSO GetSsoCredential starts.
(T12520)Info (1539): 11/27/21 20:17:58:744 SSO ----- PanCredGet failed with error Element not found.

(T12520)Debug(9726): 11/27/21 20:17:58:744 SSO password is empty
(T12520)Debug(2568): 11/27/21 20:17:58:744 Empty username
(T12520)Debug(2600): 11/27/21 20:17:58:744 m_preUsername
(T12520)Debug(9686): 11/27/21 20:17:58:744 Password is empty.
(T12520)Debug(7091): 11/27/21 20:17:58:744 Empty user for GetCachedPortalCfgOldNewFileName
(T12520)Debug(2621): 11/27/21 20:17:58:744 CheckCachedPortalForPrelogon 0, PrelogonNeedTimeout 0, RenameTimeout -1, userName ___empty_username___, preUsername
(T12520)Debug(2762): 11/27/21 20:17:58:744 Use ssl tunnel is no
(T12520)Debug(6140): 11/27/21 20:17:58:745 --Set state to Retrieving configuration...
(T8776)Debug( 413): 11/27/21 20:17:58:766 HipMonitorThread wait for exit event.
(T12520)Debug(7188): 11/27/21 20:17:58:768 SSO enable status is 1, user name is ___empty_username___, domain name is .
(T12520)Debug(2131): 11/27/21 20:17:58:768 open http session. agent is PAN GlobalProtect/5.1.1-12 (Microsoft Windows 10 Pro , 64-bit)
(T12520)Debug( 456): 11/27/21 20:17:58:771 winhttp SetSecureProtocol, hSession=2cafe1b0, bAllProtocol=0, gbFips=0
(T12520)Debug( 456): 11/27/21 20:17:58:771 winhttp SetSecureProtocol, hSession=2cb00b80, bAllProtocol=0, gbFips=0
(T12520)Debug(1604): 11/27/21 20:17:58:773 SetProxyForHost(https://203.122.6.28/😞 timeout:5 AutoDetect:1 url: proxy: bypass: proxystr:
(T12520)Debug(6185): 11/27/21 20:17:58:773 ----Portal Pre-login starts----
(T12756)Debug(4651): 11/27/21 20:17:58:773 CaptivePortalDetectionThread: IsDetectingCaptivePortal=1, PreLoginIsDone=0
(T12756)Debug(4628): 11/27/21 20:17:58:773 CaptivePortalDetectionThread: wait (2000 ms) for captive portal detection event.
(T12520)Debug( 550): 11/27/21 20:17:58:781 Network is reachable
(T12520)Debug(6211): 11/27/21 20:17:58:783 Pre-login...,verifyportalcert=yes
(T12520)Debug(10107): 11/27/21 20:17:58:783 Check cert of server 203.122.6.28
(T12520)Debug(10122): 11/27/21 20:17:58:783 File C:\Program Files\Palo Alto Networks\GlobalProtect\tca.cer does not exist.
(T12520)Debug( 777): 11/27/21 20:17:58:783 SSL connecting to 203.122.6.28
(T12520)Debug( 550): 11/27/21 20:17:58:790 Network is reachable
(T12520)Debug(1242): 11/27/21 20:17:59:027 Failed to X509_LOOKUP_load_file
(T12520)Debug( 363): 11/27/21 20:17:59:027 Open_SSL_connection: subject '/CN=203.122.6.28'
(T12520)Debug( 367): 11/27/21 20:17:59:027 Open_SSL_connection: issuer '/CN=203.122.6.28'
(T12520)Debug( 987): 11/27/21 20:17:59:027 Hostname 203.122.6.28 doesn't match sub alt name or no sub alt name, fallback to CN
(T12520)Debug(1023): 11/27/21 20:17:59:027 Hostname 203.122.6.28 match 203.122.6.28
(T12520)Debug(1318): 11/27/21 20:17:59:027 OpenSSL alert write⚠️close notify
(T12520)Debug(2574): 11/27/21 20:17:59:027 encpostdata, encpostdata=0000028D2C035280, encpostdatalen=160
(T12520)Debug(2744): 11/27/21 20:17:59:028 REQID=1,IPADDR=203.122.6.28,PORT=443,URL=/global-protect/prelogin.esp,POST=1,PROXY_AUTO=1,PROXY_CFGURL=NULL,PROXY=NULL,PROXY_BYPASS=NULL,PROXY_USER=NULL,PROXY_PASS=****,VERIFY_CERT=1,ADDITIONAL_CHECK=1,SCEP_CERT=,oid=
(T12520)Debug(1399): 11/27/21 20:17:59:028 Send response to client for request https_request
(T12520)Debug(2854): 11/27/21 20:17:59:182 receive pan_msg_ping, 3
(T12520)Debug(3006): 11/27/21 20:17:59:501 winhttpObj, cert error, 00000008.
(T12520)Debug(3011): 11/27/21 20:17:59:501 winhttpObj, cert erro is 00000008
(T12520)Debug(6322): 11/27/21 20:17:59:501 prelogin to portal result is
(null)
(T12520)Debug(6573): 11/27/21 20:17:59:501 Failed to pre-login to the portal 203.122.6.28 with return value 0(0).
(T12520)Debug(7416): 11/27/21 20:17:59:501 Try to restore last portal config from file.
(T12520)Debug(7463): 11/27/21 20:17:59:502 Skip retrieve cached portal configuration for empty user
(T12520)Debug(6645): 11/27/21 20:17:59:502 Need to send portal certificate verification message to PanGPA.
(T12520)Debug(6647): 11/27/21 20:17:59:502 Set state to Disconnected
(T12520)Debug(6140): 11/27/21 20:17:59:502 --Set state to Disconnected
(T12520)Debug(1006): 11/27/21 20:17:59:502 Display hip report V4 on the UI
(T12520)Debug(1399): 11/27/21 20:17:59:503 Send response to client for request portal-certificate-verification
(T12756)Debug(4539): 11/27/21 20:18:00:788 CPD, reset cp detection history
(T12756)Debug( 550): 11/27/21 20:18:00:897 Network is reachable

Re: GP Issue Gateway Fake

AnalysisMan — Mon, 29 Nov 2021 22:33:03 GMT

Hi Chanderjain,

If the GP configurations are okay, then the following steps should resolve the issue.

• Disable WMI services: run - services.msc - Windows Management Instrumentation(WMI) - stop the service.
• Delete the files under C:\Windows\System32\wbem\Repository
• Open Windows Registry (Regedit)
Go to HKEY_LOCAL_MACHINE > Software and HKEY_CURRENT_USER > Software. Delete the Palo Alto Networks folder.
• Delete the same if the same folder is present in any other user under HKEY_USERS.
• Un-install GlobalProtect from Windows 'Programs and Features.'
• Make sure that the virtual adapter is not present in the Network adapter settings.
• Reboot the machine.
• Reinstall GlobalProtect with admin privileges.
• Confirm that WMI service is running.

Hope this helps!

Re: GP Issue Gateway Fake

chanderjain — Thu, 02 Dec 2021 19:10:05 GMT

Hi AnalysisMan,

Thanks for sharing the solution but there I have one more concern. What I did there was I used my credential in another system's GPVPN and I see the same error and then I tried his credential in my machine's GPVPN what I see My GPVPN is connecting without any issue and error. Could you please help me here to understand where the issue is getting?

topic Re: GP Issue Gateway Fake in GlobalProtect Discussions

GP Issue Gateway Fake

Re: GP Issue Gateway Fake

Re: GP Issue Gateway Fake