topic Re: GlobalProtect - Client cert not present in GlobalProtect Discussions

GlobalProtect - Client cert not present

bernardo.hernandez — Sat, 29 Jan 2022 00:45:29 GMT

This past week we have experienced this issue where users are unable to connect to GlobalProtect. This is happening at random and on multiple firewalls with version 9.1.11-h3, GlobalProtect client version is: 5.2.3

Looking at the logs this is what it shows under Monitor -> GlobalProtect

Strangely enough, the certificate IS installed on the client. The client certificate is valid as well as the root CA's.

Any pointers will be greatly appreciated.

Re: GlobalProtect - Client cert not present

OtakarKlier — Mon, 31 Jan 2022 21:22:50 GMT

Hello,

This weekend I had issues with 9.1.12. For both Global protect and site to site tunnels. Once I went to 10.0.x, finally 10.0.8 everything was working as expected.

Regards,

Re: GlobalProtect - Client cert not present

BPry — Mon, 31 Jan 2022 21:30:27 GMT

I've ran into this on a few different occasions throughout various PAN-OS releases and restarting the sslvpn-web-server process fixed the issue. Just know that this will momentary disrupt GlobalProtect, so generally speaking a failover would be preferred under an Active/Passive scenario in some situations.

Also just as a reminder, 5.2.3 is kind of dated at this point. I would recommend validating a newer agent build and rolling it out. There's quite a few issues that have been addressed since 5.2.3 that you wouldn't have.

Re: GlobalProtect - Client cert not present

Maur73G — Wed, 16 Mar 2022 22:47:21 GMT

Hello

I'm pretty sure that you're having this problem because of bug PAN-163030. Let's check it out on the release notes of 9.1.x or 10.0.x. I've recreated this problem and the Workaround was restart the sslvpn-web-server process. This is fixed on 10.0.9 but I haven't upgraded to that version yet.