CPanGPADlg::OnTimer - about refresh configruation

AxiomAsterisk — Tue, 17 Jan 2023 15:19:32 GMT

Anyone know what this log indicates in the GP client logs? We are investigating reports of unexpected GP disconnects, and in many cases the disconnect seems to start with this sequence:

15:32:38:033 --Set state to Disconnecting...

. . .

15:32:36:375 ----Portal refresh configuration starts----
15:32:36:375 msgtype = refresh-configuration
15:32:36:298 PanClient sent successful with 80 bytes
15:32:36:298 Command = <request><type>refresh-configuration</type></request>
15:32:36:298 Send command to Pan Service
15:32:36:173 CPanGPADlg::OnTimer - about refresh configruation.

Also, is there any documentation that defines the events in the GP client log? I have not been able to find anything.

Re: CPanGPADlg::OnTimer - about refresh configruation

aleksandar.astardzhiev — Thu, 19 Jan 2023 23:48:31 GMT

Hi @AxiomAsterisk ,

Those logs must be related to "GlobalProtect App Config Refresh Interval (hours)" option

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/globalprotect/network-globalprotect-portals/globalprotect-portals-agent-configuration-tab/globalprotect-portals-agent-app-tab

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000POMJCA4

Basically this option tell GP client at what interval to connect to GP portal and refresh it config (for example if you change agent upgrade method, or add new gateway or modify gateway priority or any other setting).

But portal config refresh shouldn't cause disconnect, so I personally would look backwards from this event. I would suggest to event look what happens before "Set state to Disconnecting", this event should indicate that client

I am living with the impression that portal config refresh timer is counting only while agent is connected to the gateway. So it will initiate config refresh at Nth hour of this active connection. So I am surprise to see config refresh few seconds after disconnect. For me it sound like client is reaching his "login lifetime" - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClqVCAS

- What connection method are you using? On-demand, always on?

- What is your login lifetime, inactivity and idle timers?

- Have you noticed any pattern in the disconnects, any of the above timers to match the frequency of the disconnects?

topic CPanGPADlg::OnTimer - about refresh configruation in GlobalProtect Discussions

CPanGPADlg::OnTimer - about refresh configruation

Re: CPanGPADlg::OnTimer - about refresh configruation