topic Re: Users are being disconnected from GlobalProtect VPN in GlobalProtect Discussions

Users are being disconnected from GlobalProtect VPN

vij — Mon, 19 Dec 2022 19:05:58 GMT

From PanGPS Logs following logs.

looking for network issues or DNS issues. kindly suggest further troubleshooting to resolve the issue.

(P5544-T4240)Debug(5173): 12/09/22 11:44:34:124 Found virtual IP route entry
(P5544-T4240)Debug(5936): 12/09/22 11:44:34:124 No change for gateway route
(P5544-T4240)Debug(6696): 12/09/22 11:44:34:124 NetworkConnectionMonitorThread: Detected route change, but skip network discovery.
(P5544-T4240)Debug(5048): 12/09/22 11:44:34:125 Wait for virtual interface IP route entry 10.11.160.66
(P5544-T4240)Debug(5062): 12/09/22 11:44:34:126 Found virtual interface IP route entry.
(P5544-T4240)Debug(4878): 12/09/22 11:44:34:126 des=10.1.0.0, mask=255.255.0.0, nextHop=10.11.160.66, ifidx=3, forwardType=3, forwardProto=3, age=0, nextHopAs=0, matrix=1,0,0,0,0
(P5544-T4240)Debug(2220): 12/09/22 11:44:34:126 number of route is 64
(P5544-T4240)Debug(2238): 12/09/22 11:44:34:134 Set route successfully. ForwardDest = 10.1.0.0, metric 1.
(P5544-T4240)Debug(2238): 12/09/22 11:44:34:248 Set route successfully. ForwardDest = 104.16.51.111, metric 1.
(P5544-T4240)Debug(2238): 12/09/22 11:44:34:344 Set route successfully. ForwardDest = 18.246.31.138, metric 1.
(P5544-T4240)Debug(2238): 12/09/22 11:44:34:440 Set route successfully. ForwardDest = 52.86.98.138, metric 1.
(P5544-T4240)Debug(6600): 12/09/22 11:44:40:093 NetworkConnectionMonitorThread: route change detected. Wait for 3 seconds.
(P5544-T4240)Debug(5173): 12/09/22 11:44:40:094 Found virtual IP route entry
(P5544-T4240)Debug(5936): 12/09/22 11:44:40:094 No change for gateway route
(P5544-T10840)Debug( 917): 12/09/22 11:44:40:231 HandleDnsCallback: failed to parse dns req packet.
(P5544-T10840)Debug( 917): 12/09/22 11:44:40:262 HandleDnsCallback: failed to parse dns req packet.
(P5544-T4240)Debug(6661): 12/09/22 11:44:43:114 NetworkConnectionMonitorThread: m_state = 0, m_bOnDemand=1, m_bAgentEnabled=1, m_bJustResumed is 0,
m_bHibernate is 0, m_bAgentEnabled is 1, m_bDisconnect is 0, IsConnected() is 1, IsVPNInRetry() is 0.
(P5544-T4240)Debug(5173): 12/09/22 11:44:43:116 Found virtual IP route entry
(P5544-T4240)Debug(5936): 12/09/22 11:44:43:116 No change for gateway route
(P5544-T4240)Debug(6696): 12/09/22 11:44:43:116 NetworkConnectionMonitorThread: Detected route change, but skip network discovery.
(P5544-T4240)Debug(5048): 12/09/22 11:44:43:117 Wait for virtual interface IP route entry 10.11.160.66
(P5544-T4240)Debug(5062): 12/09/22 11:44:43:117 Found virtual interface IP route entry.
(P5544-T4240)Debug(4878): 12/09/22 11:44:43:117 des=10.1.0.0, mask=255.255.0.0, nextHop=10.11.160.66, ifidx=3, forwardType=3, forwardProto=3, age=0, nextHopAs=0, matrix=1,0,0,0,0
(P5544-T4240)Debug(2220): 12/09/22 11:44:43:117 number of route is 64
(P5544-T4240)Debug(2238): 12/09/22 11:44:43:127 Set route successfully. ForwardDest = 10.1.0.0, metric 1.
(P5544-T4240)Debug(2238): 12/09/22 11:44:43:230 Set route successfully. ForwardDest = 104.16.51.111, metric 1.
(P5544-T4240)Debug(2238): 12/09/22 11:44:43:326 Set route successfully. ForwardDest = 18.246.31.138, metric 1.
(P5544-T4240)Debug(2238): 12/09/22 11:44:43:430 Set route successfully. ForwardDest = 52.86.98.138, metric 1.
(P5544-T10840)Debug( 917): 12/09/22 11:44:53:449 HandleDnsCallback: failed to parse dns req packet.
(P5544-T10840)Debug( 917): 12/09/22 11:44:53:777 HandleDnsCallback: failed to parse dns req packet.

Re: Users are being disconnected from GlobalProtect VPN

Metgatz — Wed, 21 Dec 2022 22:56:21 GMT

Hello @vij

How's it going. I recommend use and test with the Global protect Client version recommended by TAC

Check this link: https://live.paloaltonetworks.com/t5/customer-resources/support-pan-os-software-release-guidance/ta-p/258304#:~:text=2022%2D0030.-,GlobalProtect,-General%20Notes%3A

Cheers

Re: Users are being disconnected from GlobalProtect VPN

vij — Wed, 21 Dec 2022 23:26:37 GMT

Another errors also found

(P5500-T14648)Debug( 166): 11/29/22 09:53:19:599 Trying to do ipsec connection to 4.53.26.80[4501]
(P5500-T14648)Debug( 487): 11/29/22 09:53:19:599 socket send buffer old size is 65536
(P5500-T14648)Debug( 511): 11/29/22 09:53:19:599 socket send buffer new size is 3145728
(P5500-T14648)Debug( 564): 11/29/22 09:53:19:606 Network is reachable
(P5500-T14648)Info ( 178): 11/29/22 09:53:19:606 Connected to: 4.53.26.80[4501], Sending keep alive to ipsec socket...
(P5500-T14648)Info ( 221): 11/29/22 09:53:25:617 failed to receive keep alive
(P5500-T14648)Debug( 229): 11/29/22 09:53:25:617 IPSec anti-replay statistics: outside window count 0, replay count 0
(P5500-T14648)Debug( 231): 11/29/22 09:53:25:617 Disconnect udp socket
(P5500-T14648)Info ( 364): 11/29/22 09:53:25:617 Connecting to 4.53.26.80 failed
(P5500-T14648)Debug( 768): 11/29/22 09:53:25:617 Retry connect failed second time
(P5500-T14648)Debug( 921): 11/29/22 09:53:25:617 Tunnel retry done: failed retry
(P5500-T14648)Info ( 936): 11/29/22 09:53:25:617 Before ProcMonitor quit, disconnect vpn
(P5500-T14648)Debug(11009): 11/29/22 09:53:25:617 m_preUsername jweaver
(P5500-T14648)Debug(1441): 11/29/22 09:53:25:617 m_msp->IsVPNConnected() is 0, CControlManager::GetInstance()->IsInRetry() is 0
(P5500-T14648)Debug(7068): 11/29/22 09:53:25:617 --Set state to Disconnecting...
(P5500-T14648)Info (2681): 11/29/22 09:53:25:617 Disconnect(VPN timeout) called
(P5500-T8488)Debug(4533): 11/29/22 09:53:25:617 LifeTimeThread receives m_hExitLifeTimeThreadEvent
(P5500-T8488)Debug(4561): 11/29/22 09:53:25:617 LifeTimeThread quits
(P5500-T14648)Debug( 822): 11/29/22 09:53:25:617 vpn disconnect

Reference case in Jira

PAN-181116