topic Re: Problems connecting to Globalprotect after users install latest windows Cumulative updates in GlobalProtect Discussions

Problems connecting to Globalprotect after users install latest windows Cumulative updates

jclements — Wed, 12 Oct 2022 17:42:22 GMT

There seems to be a bit of an issue connecting to Globalprotect after our windows machines have the latest microsoft cumulative updates, KB5018410 (windows 10) and KB5018418 (windows 11).

Looking in reddit it looks like other users are seeing the same problem as well, anyone got any ideas on how to fix this going forward? The only way we've been able to get users to connect is by uninstalling the latest update.

I've raised a call with our partner support but havent got anything back yet.

thanks

Re: Problems connecting to Globalprotect after users install latest windows Cumulative updates

spatel — Wed, 12 Oct 2022 18:30:22 GMT

Solution 1:

We have tried to remove the portal configuration from the global protect the app and re-add it and fixed the issue.

Solution 2:

Then we removed the below two files from the PAN folder in windows.

C:\Program Files\Palo Alto Networks\GlobalProtect

Delete the PANPPAC_xxxxxx

Solution 3:

Revert the Microsoft patch's last option.

Re: Problems connecting to Globalprotect after users install latest windows Cumulative updates

matt_pierce — Wed, 12 Oct 2022 19:36:59 GMT

I appreciate the heads up on this. I installed the Win10 October CU and am not having the issue. My GP version is 5.2.10-6. I'm running 10.0.11-h1. We use SAML as our Portal Auth and Gateway auth. I'm curious what are the factors leading to this issue.

Re: Problems connecting to Globalprotect after users install latest windows Cumulative updates

jclements — Wed, 12 Oct 2022 20:52:54 GMT

Cheers, I tried the first 2 solutions you proposed but they didn't work for us unfortunatly. Only thing that works at the moment is reverting the latest patch.

Re: Problems connecting to Globalprotect after users install latest windows Cumulative updates

TUH_IT — Wed, 12 Oct 2022 21:56:59 GMT

Problems here too. I will try the solutions suggested and come back.

https://www.reddit.com/r/sysadmin/comments/y0z1xa/comment/is098qs/?utm_source=share&utm_medium=web2x&context=3

Re: Problems connecting to Globalprotect after users install latest windows Cumulative updates

Carterj3 — Wed, 12 Oct 2022 22:14:03 GMT

Option 3 is the only solution that worked for us. Solutions 1 & 2 had no effect.

Re: Problems connecting to Globalprotect after users install latest windows Cumulative updates

TUH_IT — Wed, 12 Oct 2022 22:28:12 GMT

(P5068-T7268)Debug(2133): 10/12/22 19:48:31:395 pan_get_gp_user_agent szGpUserAgent ua is PAN GlobalProtect/6.1.0-58 (Microsoft Windows 10 Pro , 64-bit).
(P5068-T7268)Debug(2370): 10/12/22 19:48:31:395 open http session. agent is PAN GlobalProtect/6.1.0-58 (Microsoft Windows 10 Pro , 64-bit)
(P5068-T7268)Debug(2133): 10/12/22 19:48:31:396 pan_get_gp_user_agent szGpUserAgent ua is PAN GlobalProtect/6.1.0-58 (Microsoft Windows 10 Pro , 64-bit).
(P5068-T7268)Debug( 469): 10/12/22 19:48:31:400 winhttp SetSecureProtocol, hSession=2fd17910, bAllProtocol=0, gbFips=0
(P5068-T7268)Debug(2133): 10/12/22 19:48:31:400 pan_get_gp_user_agent szGpUserAgent ua is PAN GlobalProtect/6.1.0-58 (Microsoft Windows 10 Pro , 64-bit).
(P5068-T7268)Debug( 469): 10/12/22 19:48:31:400 winhttp SetSecureProtocol, hSession=2fd1b170, bAllProtocol=0, gbFips=0
(P5068-T7268)Debug(1799): 10/12/22 19:48:31:402 SetProxyForHost(https://**portaladdressredacted**/): timeout:60 AutoDetect:1 url: proxy: bypass: proxystr:
(P5068-T7268)Debug(7335): 10/12/22 19:48:31:416 ----Portal Pre-login starts----
(P5068-T15688)Debug(5615): 10/12/22 19:48:31:416 CaptivePortalDetectionThread: IsDetectingCaptivePortal=1, PreLoginIsDone=0
(P5068-T15688)Debug(5592): 10/12/22 19:48:31:416 CaptivePortalDetectionThread: wait (2000 ms) for captive portal detection event.
(P5068-T7268)Debug( 564): 10/12/22 19:48:31:432 Network is reachable
(P5068-T7268)Debug(7375): 10/12/22 19:48:31:433 Pre-login...,verifyportalcert=yes
(P5068-T7268)Debug(11649): 10/12/22 19:48:31:433 Check cert of server 27.32.130.102
(P5068-T7268)Debug(11664): 10/12/22 19:48:31:434 File C:\Program Files\Palo Alto Networks\GlobalProtect\tca.cer does not exist.
(P5068-T7268)Debug( 859): 10/12/22 19:48:31:434 SSL connecting to 27.32.130.102
(P5068-T7268)Debug( 564): 10/12/22 19:48:31:451 Network is reachable
(P5068-T7268)Debug(1341): 10/12/22 19:48:31:489 Failed to X509_LOOKUP_load_file
(P5068-T7268)Debug(1178): 10/12/22 19:48:31:489 Name **portaladdressredacted** matches pattern **domainredacted**
(P5068-T7268)Debug(1026): 10/12/22 19:48:31:489 Hostname **portaladdressredacted** matches sub alt name **domainredacted**
(P5068-T7268)Debug(1417): 10/12/22 19:48:31:489 OpenSSL alert write⚠️close notify
(P5068-T7268)Debug(2829): 10/12/22 19:48:31:490 encpostdata, encpostdata=000001A230528610, encpostdatalen=192
(P5068-T7268)Debug(3036): 10/12/22 19:48:31:490 REQID=9,IPADDR=**portaladdressredacted**,PORT=443,URL=/global-protect/prelogin.esp,POST=1,PROXY_AUTO=1,PROXY_CFGURL=NULL,PROXY=NULL,PROXY_BYPASS=NULL,PROXY_USER=NULL,PROXY_PASS=****,VERIFY_CERT=1,ADDITIONAL_CHECK=1,SCEP_CERT=,oid=
(P5068-T7268)Debug(1978): 10/12/22 19:48:31:490 Send response to client for request https_request
(P5068-T7268)Debug(3146): 10/12/22 19:48:31:598 receive pan_msg_ping, 3
(P5068-T7268)Debug(3146): 10/12/22 19:48:31:708 receive pan_msg_ping, 3
(P5068-T7268)Debug(3197): 10/12/22 19:48:31:710 GetHttpsResponse error is WINHTTP_CALLBACK_STATUS_FLAG_SECURITY_CHANNEL_ERROR,winhttpObj, error! ipaddress **portaladdressredacted**
bRetryWithoutCert is 0, bClientCertNeeded=0
(P5068-T7268)Debug(7499): 10/12/22 19:48:31:710 prelogin to portal result is
(null)
(P5068-T7268)Debug(7811): 10/12/22 19:48:31:710 Failed to pre-login to the portal **portaladdressredacted** with return value 0(0).
(P5068-T7268)Info (10489): 10/12/22 19:48:31:710 Portal config does not exist, try registry/plist
(P5068-T7268)Info (8675): 10/12/22 19:48:31:710 failed to retrieve value of the tag version.
(P5068-T7268)Debug(8686): 10/12/22 19:48:31:710 Failed to get portal config from portal **portaladdressredacted**.
(P5068-T7268)Debug(8728): 10/12/22 19:48:31:710 Try to restore last portal config from file.

Re: Problems connecting to Globalprotect after users install latest windows Cumulative updates

marcelmikusik — Thu, 13 Oct 2022 13:06:12 GMT

It looks like, nobody cares about this Issue 😞

Re: Problems connecting to Globalprotect after users install latest windows Cumulative updates

TedMay — Thu, 13 Oct 2022 14:54:51 GMT

Hello!

I had no problem connecting via GP version 5.2.11-10 and Cumulative update KB5018418 (windows 11).

Can you confirm what GP version you were running and try 5.2.11-10 and see if that works?

Thanks

Re: Problems connecting to Globalprotect after users install latest windows Cumulative updates

LSUgEEk — Thu, 13 Oct 2022 17:11:20 GMT

I have GP 6.0.1 and it is failing for all of our users. I'll see if I can get an older version.

Thanks

Re: Problems connecting to Globalprotect after users install latest windows Cumulative updates

mlinsemier — Thu, 13 Oct 2022 17:34:37 GMT

This issues seems to specifically happen with SSO Authentication such SAML integration. We are running clients 5.2.12 and 6.1 and both have the issue that pop up the SSO page. In my lab clients that are using LDAP or Kerberos Authentication don't seem to be experiencing the issues. Reverting the patch fixes the issue for us.

I'm testing changing what browser does authentication to system default (chrome) to see if this makes a difference. I'm not sure that I can get an updated config file from the portal as I'm not sure if this is downloaded before or after authentication.

Re: Problems connecting to Globalprotect after users install latest windows Cumulative updates

mdua — Thu, 13 Oct 2022 17:32:28 GMT

3rd option worked for my customer.

Re: Problems connecting to Globalprotect after users install latest windows Cumulative updates

TedMay — Thu, 13 Oct 2022 17:35:42 GMT

Interesting. This might be related to a change Microsoft made to the default browser and Edge. I found out the hard way awhile ago if you completely remove/disable Edge from a system it completely breaks GP. GP relies on Edge for portal/SAML/Auth. It is irrelevant to what the default browser is set to.

Re: Problems connecting to Globalprotect after users install latest windows Cumulative updates

BSwientoniowski — Thu, 13 Oct 2022 17:53:25 GMT

There's some discussion on Reddit about having TLS 1.2 as the minimum in the SSL/TLS profile for your gateway and portal. Can anyone who's having the problem confirm the min. TLS version in their setups?

Re: Problems connecting to Globalprotect after users install latest windows Cumulative updates

LFura — Thu, 13 Oct 2022 17:56:27 GMT

So our users are starting to experience this issue also. We were running a much older 4.1.6-12 GP Client on Windows x64. But even after upgrading the GP Client to 6.10.0 we still have the same connection issues. If we remove the KB5018410 from the client computer they can connect just fine. I do think it has to do with the Global Protect authentication. We use LDAP (active-directory) to authenticate our Global Protect users and are having issues. However, I can connect to some of my clients who are using Palo Alto with Global Protect and it will connect just fine even with the KB5018410 installed, however they just use local users configured on the firewall for Global Protect authentication.

Re: Problems connecting to Globalprotect after users install latest windows Cumulative updates

mlinsemier — Thu, 13 Oct 2022 18:05:34 GMT

My settings for the GlobalProtect portal are currently TLS 1.2/Max and we still are having issues. I can also confirm that I can browse to the FQDN of our portal address in Chrome (normal and incognito) and SSO authenticates correctly and shows TLS1.2. I'm thinking that this is a GlobalProtect client issue with the SSO implementation that could be using TLS1.0/1.1 still or its a Windows security change interop issue. Continuing to troubleshoot to see if I can find a workaround.

Re: Problems connecting to Globalprotect after users install latest windows Cumulative updates

TedMay — Thu, 13 Oct 2022 18:22:49 GMT

So there are two issues listed under this version:

1) Devices with Windows installations created from custom offline media or custom ISO image might have Microsoft Edge Legacy removed by this update, but not automatically replaced by the new Microsoft Edge. This issue is only encountered when custom offline media or ISO images are created by slipstreaming this update into the image without having first installed the standalone servicing stack update (SSU) released March 29, 2021 or later.

2) After installing this update, file copies using Group Policy Preferences might fail or might create empty shortcuts or files using 0 (zero) bytes. Known affected Group Policy Objects are related to files and shortcuts in User Configuration > Preferences > Windows Settings in Group Policy Editor.

Can anyone confirm that either of these are the causes for the issue they're experiencing?

https://support.microsoft.com/en-gb/topic/october-11-2022-kb5018410-os-builds-19042-2130-19043-2130-and-19044-2130-6390f057-28ca-43d3-92ce-f4b79a8378fd

Re: Problems connecting to Globalprotect after users install latest windows Cumulative updates

matt_pierce — Thu, 13 Oct 2022 18:34:55 GMT

I'm wondering why none of our test clients seem affected. The only major difference I see form known problem cases is we have FIPS enabled at the OS and in GB. Anyone affected feel like experimenting?

Re: Problems connecting to Globalprotect after users install latest windows Cumulative updates

jclements — Thu, 13 Oct 2022 19:21:52 GMT

yup, exactly the same with me. I've confirmed we're on min TLS 1.2/Max on our ssl/tls profile on gateway and portal and if I go ti the portal address I can authenticate and shows tls1.2. We're using kerberos auth but it doesn't even look like the global protect client can start authenticating. Can't think why some people are working fine and others, very strange.

Re: Problems connecting to Globalprotect after users install latest windows Cumulative updates

TedMay — Thu, 13 Oct 2022 19:27:24 GMT

I think it has to do with a potential update in edge on this KB.