topic Re: GlobalProtect Issue on PA-3020 9.1.17 in GlobalProtect Discussions

GlobalProtect Issue on PA-3020 9.1.17

Marlo_Perez — Thu, 11 Jan 2024 05:15:55 GMT

Hello everyone,

I'd want to seek your guidance on a matter that we're now dealing with. So, last year, around the third week of December, we upgraded the firmware of PA-3020 from 9.1.15 to 9.1.17 as per the advisory of Palo Alto. So far, no issues have been reported following the upgrade, but after a while we have discovered an issue regarding on GlobalProtect (currently on 6.1.0) where some of our users are having difficulties connecting.

The error displayed is 'Your GlobalProtect session has been disconnected due to network connectivity issues or session timeouts.' This problem occurs after the user has successfully connected; however, after a few seconds, the error appears. To establish a connection, we need to disconnect and reconnect multiple times—approximately 5-10 times—before successfully connecting and gaining access to our system. Please refer to the image below for a sample of the error.

After that, we looked for knowledge base articles about this issue and came across this one. It advises us to upgrade to a different GlobalProtect version other than 6.1.x, so we attempted updating to 6.2.0 and 6.2.2, but encountered more issues. As a result, we reverted back to 6.1.0.

We tried various methods, such as uploading the techsupport file to Palo Alto's AutoAssistant Tool, and discovered some information about firewall configuration that attracted my eye. It is about High Resource Utilization. Please see the image below.

As stated on the image, this may cause for the new connection requests to fail and the existing once to encounter slowness when accessing the web. So, in order to resolve this issue, we will be trying to use this KB to lower the usage from 94 to 90. We will be performing this later. So for the meantime, I have come across this LIVEcommunity post that is experiencing the same issue, the solution they have done is to rollback from their old version of PAN-OS. Our concern being, we cannot revert back to the old PAN-OS version because of PAN-OS Root Certificate Advisory provided above.

May I know if this is a known issue/bug for PAN-OS 9.1.17 on PA-3000 Series?

Thanks and Best Regards,

Marlo

Re: GlobalProtect Issue on PA-3020 9.1.17

lidewu — Fri, 12 Jan 2024 07:35:54 GMT

Hi Marlo,

I got same issue on PA-3000 Series. So can solved this issue revert back to 6.1.0? Thank you.

Regards,

Lide

Re: GlobalProtect Issue on PA-3020 9.1.17

Marlo_Perez — Fri, 12 Jan 2024 07:55:44 GMT

Hi Lide,

We have already reverted back to 6.1.0, but some users are still encountering the same issue There was another thread that suggested to revert/downgrade the OS version of the firewall. Kindly refer here: https://live.paloaltonetworks.com/t5/globalprotect-discussions/pan-os-9-1-17-global-protect-issues/td-p/571458

The thing about reverting of the firewall means we will be under the target version of the firewall to mitigate the issue about PAN-OS Root and Default Certificate and it might cause another problem.

Thank you and Regards,

Marlo

Re: GlobalProtect Issue on PA-3020 9.1.17

lidewu — Mon, 15 Jan 2024 08:03:36 GMT

Hi Marlo,

Last week, I did "enable ipsec"(It was must allow UDP: 4501 if you have other firewall in front of PA). The issue was reduced even not happen again.

Regards,

Lide

Re: GlobalProtect Issue on PA-3020 9.1.17

Raido_Rattameister — Mon, 15 Jan 2024 13:22:20 GMT

GlobalProtect instability is in all latest versions.

Downgrade to 9.1.16-hx

Enable IPSec reduces the issue and it is always best to have it enabled because then GlobalProtect encapsulates traffic into UDP instead of TCP.

IPSec offers better performance and don't have TCP meltdown problems.

IPSec requires UDP/4501 to be permitted.

Global Protect Client disconnect Issues after upgrading to Pan-OS 11.1.0
https://live.paloaltonetworks.com/t5/globalprotect-discussions/global-protect-client-disconnect-issues-after-upgrading-to-pan/td-p/568088

GlobalProtect Connection Issues in PAN-OS 10.2.7-h3
https://live.paloaltonetworks.com/t5/globalprotect-discussions/globalprotect-connection-issues-in-pan-os-10-2-7-h3/td-p/571507

PAN OS 9.1.17 Global Protect Issues
https://live.paloaltonetworks.com/t5/globalprotect-discussions/pan-os-9-1-17-global-protect-issues/td-p/571458

Re: GlobalProtect Issue on PA-3020 9.1.17

Marlo_Perez — Fri, 19 Jan 2024 01:19:06 GMT

Apologies for the delays; we need to go through approval for downgrading the firewall.

Hi @Raido_Rattameister,

It is confirmed that by downgrading from 9.1.17 to 9.1.16-h3 resolves the GlobalProtect issue.

Cheers,

Marlo

Re: GlobalProtect Issue on PA-3020 9.1.17

AlexanderWied — Tue, 06 Feb 2024 10:12:54 GMT

Hello @Raido_Rattameister

Is there an Pan-Issue-ID for this?
I could not find it searching through known and adresses issues for 9.1.17 or 10.1.11/12.
These stability issues hit us rather hard on some appliances (some not even affected), and while in some areas we have our reasons to keep IPSec shut off, we would like to keep Firmware up-to-date to mitigate other issues (SNMP / PAN-217208).

Regards, Alex