topic Re: GlobalProtect Connection Issues in PAN-OS 10.2.7-h3 in GlobalProtect Discussions

GlobalProtect Connection Issues in PAN-OS 10.2.7-h3

fatihs20 — Wed, 03 Jan 2024 01:07:43 GMT

Hello Friends,
What troubleshooting steps can I take to address the GlobalProtect connectivity issues, including the "Your GlobalProtect session has been disconnected due to network connectivity issues or session timeouts" notification and the SSL VPN GlobalProtect connected status with 0 bytes traffic after upgrading PAN-OS to version 10.2.7-h3?
Notes : The installed GlobalProtect version on the Windows OS is 6.2.2-259.

Thank you.

Re: GlobalProtect Connection Issues in PAN-OS 10.2.7-h3

Clatronic — Wed, 03 Jan 2024 13:59:02 GMT

Hi, we have the same Problem since update to 10.2.7-h3. It happens with all Windows Versions (7 / 10 / 11) and only with windows.

With Mac OS there is no Problem.

We try different GlobalProtect Versions but always the same problem. Users need up to 20 attempts to get a working connection.

Our seller have two other customers with the same Problem since two weeks.

A solution would be nice!

Re: GlobalProtect Connection Issues in PAN-OS 10.2.7-h3

MTaylor22 — Wed, 03 Jan 2024 19:25:01 GMT

This may not be related but after upgrading to the same version my HIP objects and policy match but the security policy that uses that HIP policy won't match. Maybe see if you're seeing the same issue preventing your GP clients from connecting. I don't have a work around yet other than removing the HIP profile from the security policy for GP connections.

Re: GlobalProtect Connection Issues in PAN-OS 10.2.7-h3

Clatronic — Thu, 04 Jan 2024 09:06:33 GMT

Today we were able to narrow down the error.

It's definitely a problem with SSL and Windows only. On Mac OS everything work fine - no problems.

Now we made a security profile WAN to WAN with UDP 4501 and https, Then we enable IPSec in GlobelProtect (https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PPY1CAO).

Now, the connection is established with IP-Sec and the Problems are gone.

We hope, that Palo fix this Problem.

Re: GlobalProtect Connection Issues in PAN-OS 10.2.7-h3

RMikalauskas — Thu, 04 Jan 2024 09:47:31 GMT

Multiple complains from our customers about this. I hope PAN is aware of the issue.

Re: GlobalProtect Connection Issues in PAN-OS 10.2.7-h3

lestrada — Thu, 04 Jan 2024 15:12:28 GMT

I had the same issue when I upgraded from 9.1.14 to 9.1.17. The issue got solved today when I downgraded to 9.1.14-h7. H& has the 2024 certificate. This is definitely a bug.

Re: GlobalProtect Connection Issues in PAN-OS 10.2.7-h3

Glauber — Wed, 17 Jan 2024 23:55:41 GMT

I have the same issue. I'm considering a downgrade since it started after we installed 10.2.7-h3.

Re: GlobalProtect Connection Issues in PAN-OS 10.2.7-h3

Anderson_D — Fri, 26 Jan 2024 20:42:11 GMT

Had this exact same problem after 9.1.17 upgrade... SSL GP unstable (connecting/reconnecting) and when connected, some clients not being able to access resources, 0 bytes/packets in.

While going thru the GP logs, found this: "--Too many outstanding keepalive and no response from GP gateway, disconnect tunnel"

Opened a TAC case and waiting for the response.

By the way, in our case, the workaround was to enable IPSec under Global Protect Gateway for the locations that didn't have yet. The locations using IPSec already had not reported issues.

Re: GlobalProtect Connection Issues in PAN-OS 10.2.7-h3

Raido_Rattameister — Mon, 29 Jan 2024 05:32:11 GMT

I always enable IPSec under GlobalProtect gateway.

If IPSec checkbox is checked then GlobalProtect Agent will try 3 times to connect over udp/4501 and if it fails then will fall back to SSL protocol.

In latest PANOS releases (9.1.17, 10.2.7) SSL seems to have instability issues (in addition to regular tcp meltdown etc that SSL inside SSL can bring along).

I have noticed that if GlobalProtect gateway runs on natted IP then it is way higher probability that connection will fail back to SSL compared to running GlobalProtect gateway directly on wan interface.

It is convenient to run Gateway on DMZ interface if multiple ISPs are in use and DNAT tcp/443 and udp/4501 to DMZ IP but instability issues in latest PANOS forces to set up dedicated Gateway for every ISP interface to reduce risk of fallback to unstable SSL.

Re: GlobalProtect Connection Issues in PAN-OS 10.2.7-h3

AdamGoepel-Stillman — Tue, 30 Jan 2024 17:28:17 GMT

For me, the temp fix was in their upgrade notes: "Note: GlobalProtect tunnel might disconnect shortly after being established when SSL is used as a transport protocol. Workaround: Disable Internet Protocol Version 6 (TCP/IPv6) on the PANGP Virtual Network Adapter." It makes it sound like the connection might bounce once, but for us it bounced endlessly. We could try steps to get the connection to work: like rebooting 3 times, removing the portal and readding it or refreshing the connection. It would work if it got a working connection, but if the connection was stopped/started the issue would happen again. We have 200+ remote workers this affected, and we couldn't disable ipv6 for them all remotely. We had to roll back to 10.2.4-h4 from 10.2.7-h3. We talked to support, there is a private bug doc on it. The targeted fix versions include 11.0.5, 11.2.0, 10.2.8, 10.2.11, and 10.1.14., but 10.2.8 is not scheduled for around 2/8/24 and that's not a guaranteed date.

Re: GlobalProtect Connection Issues in PAN-OS 10.2.7-h3

Anderson_D — Fri, 02 Feb 2024 19:52:13 GMT

TAC replied that is confirmed to match PAN-234929 in 9.1.17, they are still working on a fix and the ETA is yet to be provided.

Re: GlobalProtect Connection Issues in PAN-OS 10.2.7-h3

Akhilb2728 — Tue, 20 Feb 2024 00:15:17 GMT

Is this a problem even if we have IPv6 disabled on the firewall?

Re: GlobalProtect Connection Issues in PAN-OS 10.2.7-h3

Orvain-l — Fri, 01 Mar 2024 09:55:38 GMT

Hello,

seems to be fixed on 10.2.8 RN :

ISSUE ID	DESCRIPTION
PAN-242561	Fixed an issue where GlobalProtect tunnels disconnected shortly after being established when SSL was used as the transfer protocol.

Anyone can confirm ?

Re: GlobalProtect Connection Issues in PAN-OS 10.2.7-h3

MannyCosta — Fri, 01 Mar 2024 21:33:49 GMT

I have the same issue with PANOS 10.2.6 and global protect 6.05 and using IPSEC not ssl and IPV4 only

I am getting ready to upgrade PAN OS and GP client, And now i am not sure which upgrade to do

has anyone been on PANOS 11.1x.or 11.2x for a wile and is it worth the upgrade and GPver 6.2

Any input is appreciated

Re: GlobalProtect Connection Issues in PAN-OS 10.2.7-h3

holbem — Mon, 04 Mar 2024 16:06:50 GMT

I am still having the issue on 10.2.8. I opened a TAC case and this is what they replied:

Thank you for providing me with the time to research.
Below are my findings:
PAN GP events
02/28/2024 10:54:07:618 [Info ]: Portal login completed with address go.sg.de.o2.com and conect method of on-demand.
02/28/2024 10:54:07:625 [Info ]: Network discovery started.
02/28/2024 10:54:23:708 [Info ]: Auto Gateway login finished with address go-disi2.sg.de.o2.com and user holbem.
02/28/2024 10:54:25:401 [Info ]: SSL tunnel creation finished with Gateway go-disi2.sg.de.o2.com.
02/28/2024 10:54:25:512 [Info ]: Completed HIP Report check with Gateway go-disi2.sg.de.o2.com.
02/28/2024 10:55:18:527 [Info ]: Tunnel is down due to keep-alive timeout.
02/28/2024 10:55:18:527 [Info ]: Gateway go-disi2.sg.de.o2.com: Checking network availability and restoring VPN connection when network is available.
PAN GPS
P 805-T31647 02/28/2024 10:55:18:527 Info (1335): --Too many outstanding keepalive and no response from GP gateway, disconnect tunnel
P 805-T31647 02/28/2024 10:55:18:527 Debug(1338): Tunnel downtime after keep-alive timeout is 54646 ms
P 805-T31647 02/28/2024 10:55:18:527 Info ( 631): VPN timeout due to keepalive, get out of ProcMonitor
P 805-T31647 02/28/2024 10:55:18:527 Debug( 646): In timeout handling, tunnel downtime is 54646 milliseconds
The logs match the known issue based on the fixed version and are 12.0.0, 11.0.5, 11.0.4, 11.2.0, 9.1.18, 11.1.2, 11.1.3, 10.2.11, 10.1.13, 10.1.14, 9.1.19, 10.1.12-h1, 10.2.7-h6, 11.0.3-h5
In 10.2.X, the fix version is 10.2.7 h6 (ETA not known yet)
Workaround:
> Remove IPV6 from the current setup or you can downgrade to 10.2.7(Working scenario)

removing IPv6 in the tunnel is not working for me so I need to stay on 10.2.7 (without h)

Re: GlobalProtect Connection Issues in PAN-OS 10.2.7-h3

PAFWNoob — Tue, 05 Mar 2024 23:54:01 GMT

We are plagued with this issue.

We are using IPSec but we have Portal and Gateway on the same firewall.

We initially upgraded to 10.2.7-h3 and were hit by the bug.

The workaround of disabling IPv6 did not work.

We then downgraded to 10.2.6 which again did not work.

We have now upgraded to 10.2.8 which again has not worked.

This is just frustrating for all our users and Tech Support still has no solution for this!!!

Re: GlobalProtect Connection Issues in PAN-OS 10.2.7-h3

holbem — Wed, 06 Mar 2024 08:03:52 GMT

For me the only option was to downgrade to 10.2.7 (without any Hotfix). Other option is to disable ipv6 on the GP virtual adapter or inside the Tunnel config. Disabling ipv6 on the LAN/WLAN Adapter did not work. 10.2.6-h1 might have the fix in it as well - but I did not tested that.

Re: GlobalProtect Connection Issues in PAN-OS 10.2.7-h3

holbem — Wed, 06 Mar 2024 08:04:32 GMT

Oh - an for me TAC replied that the issue will be fixed in 10.2.7-h6 - but no ETA yet

Re: GlobalProtect Connection Issues in PAN-OS 10.2.7-h3

WSadoff — Sat, 09 Mar 2024 17:58:43 GMT

I had this issue... If you go into the Portal App Settings and change the "IPv6 Preferred" setting to "No" this has resolved the issue, with no need to bother the users, push a GPO, or wait for an upgrade to fix.

Re: GlobalProtect Connection Issues in PAN-OS 10.2.7-h3

trevor_debeer — Tue, 12 Mar 2024 13:09:53 GMT

Absolutely agree. IPv6 "fix" does not work. We have also found that reverting the GP client all the way back to v 5.2.8 will work around the issue, but I would not recommend this approach, so we too will be downgrading, seems to be the best bet.