topic Re: GP connection issues while in Mexicvo and Dubai in GlobalProtect Discussions

GP connection issues while in Mexicvo and Dubai

PNevs — Mon, 21 Mar 2022 15:06:45 GMT

We have multipe clients in Mexico and Dubai that are having issues with the GP client (5.2.9-35) connecting. I have a ticket opened but figured I woudl post as well.

Re: GP connection issues while in Mexicvo and Dubai

PNevs — Mon, 21 Mar 2022 15:07:28 GMT

Apologies on the Typo.

Re: GP connection issues while in Mexicvo and Dubai

BPry — Mon, 21 Mar 2022 15:23:16 GMT

@PNevs,

What error message are they actually receiving on the agent? Have you looked at the PanGPS logs to verify what the service logs are actually saying? Do you have any restrictions on your portals/gateways that would limit the client from connecting from Mexico or Dubai?

Re: GP connection issues while in Mexicvo and Dubai

PNevs — Mon, 21 Mar 2022 15:32:53 GMT

Thanks for the reply BP. I am trying to get all that data you reference now. So far we only have that they cannot connect. I have not even thought about any restrictions. I will look into that.

Re: GP connection issues while in Mexicvo and Dubai

LliLliWong — Mon, 21 Mar 2022 15:55:12 GMT

Hi there, you may get pangps log according to this step

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClaLCAS

then you should be able to narrow down the issue if it's due to network issues , certificates, gateway issues

you can paste the error here so we can understand more detailed about the issue that you're experiencing

Re: GP connection issues while in Mexicvo and Dubai

PNevs — Mon, 21 Mar 2022 16:02:29 GMT

Thanks so much. Agreed. I need to pull the logs, just getting someone to do it now will be the challenge. Working on that now.

Re: GP connection issues while in Mexicvo and Dubai

PNevs — Thu, 07 Apr 2022 20:20:55 GMT

Thanks for the feedback. I was finally able to get some logging data from the GP client and a response from the Engineer. We are only seeing this in one region. We have a US region that is working but a Canadian region that is not. Logging data below.

(P5432-T4436)Debug(5850): 04/06/22 10:21:27:177 NetworkDiscoverThread: network type is external.
(P5432-T4436)Debug(5936): 04/06/22 10:21:27:177 NetworkDiscoverThread: Discover external network.
(P5432-T4436)Debug( 528): 04/06/22 10:21:27:177 Discover external gateway: gateway count is 3, cutoff time is 5, bJustResumed=0
(P5432-T4436)Debug( 679): 04/06/22 10:21:27:178 gateway 0 of canada-west-dentons.gpo5yo5sjo5j.gw.gpcloudservice.com is manual select only, will not be in rediscover list
(P5432-T4436)Debug( 679): 04/06/22 10:21:27:178 gateway 1 of canada-central-dentons.gpo5yo5sjo5j.gw.gpcloudservice.com is manual select only, will not be in rediscover list
(P5432-T4436)Debug( 679): 04/06/22 10:21:27:178 gateway 2 of canada-east-dentons.gpo5yo5sjo5j.gw.gpcloudservice.com is manual select only, will not be in rediscover list
(P5432-T4436)Debug( 714): 04/06/22 10:21:27:178 There is no gateway suitable to discovery
(P5432-T4436)Error(6044): 04/06/22 10:21:27:178 NetworkDiscoverThread: failed to discover external network.
(P5432-T4436)Debug(6068): 04/06/22 10:21:27:178 Network discovery failed, set error as The network connection is unreachable or the gateway is unresponsive. Check the network connection and reconnect.
(P5432-T4436)Debug(7064): 04/06/22 10:21:27:178 --Set state to Disconnected

Re: GP connection issues while in Mexicvo and Dubai

cmartin_60 — Thu, 07 Apr 2022 21:58:36 GMT

try GP 5.2.11 is a good version

Re: GP connection issues while in Mexicvo and Dubai

cmartin_60 — Thu, 07 Apr 2022 22:01:03 GMT

Also you need to add Mexico and Dubai into your GP gateway so they can connect.

Re: GP connection issues while in Mexicvo and Dubai

PNevs — Thu, 07 Apr 2022 22:28:05 GMT

I need to review the doc on fixes to that version. Maybe that's an issue. We were thinking that as well but waiting to hear back from PA on the log review. That has been a challenge at this point.

Re: GP connection issues while in Mexicvo and Dubai

PNevs — Thu, 07 Apr 2022 22:30:14 GMT

That's what we have been trying to identify from PA. Are we missing a GEO setting somewhere that may be blocking as we have US clients that have no issues so I don't think its the GP client config.

Re: GP connection issues while in Mexicvo and Dubai

cmartin_60 — Thu, 07 Apr 2022 22:33:02 GMT

Also I recommend to do Wireshark captures on the PANGP interface and the wire\wifi Interface too

Re: GP connection issues while in Mexicvo and Dubai

cmartin_60 — Thu, 07 Apr 2022 22:34:06 GMT

do Dumps from GP with Wiresharks

Re: GP connection issues while in Mexicvo and Dubai

PNevs — Thu, 07 Apr 2022 22:36:37 GMT

Our regions are set to any.

Re: GP connection issues while in Mexicvo and Dubai

PNevs — Thu, 07 Apr 2022 22:38:50 GMT

That is a challenge, Asking our clients to do that. I was hoping the GP logs would direct us towards a fix.

Re: GP connection issues while in Mexicvo and Dubai

BPry — Thu, 07 Apr 2022 22:40:42 GMT

@PNevs,

It's not the client config; if a matching client config wasn't found (IE: If you were only allowing US as a region or otherwise not allowing MX or whatever Dubai is), it would actually give that as an error message when you tried to connect and it was unable to find a matching client configuration. That can be ruled out at this point.

The logs indicate that the gateways are in manual select mode, while your configuration is set to Auto Discovery. Can you manually connect to the gateways in question without issue from these locations? If you modify the gateways in question on this config to actually prioritize them are the agents able to connect?

Re: GP connection issues while in Mexicvo and Dubai

PNevs — Fri, 08 Apr 2022 12:39:00 GMT

Awesome idea. I am reaching out now to see if we can connect with one of the clients.