topic GP Internal Gateway does not work after upgrading to 10.2.7-h3 in GlobalProtect Discussions

GP Internal Gateway does not work after upgrading to 10.2.7-h3

Jorge_Lopez — Thu, 21 Mar 2024 11:42:28 GMT

Our customer has configured internal gateways to retrieve mapping information for users from devices that are not joined to the domain.

This was working fine after Firewalls and Panorama were upgraded to 10.2.7-h3.

For example, one of the peer's firewalls (Active/Passive) was upgraded and this task was completed without issues around 7:30 PM.

Before 7:30 PM, the users were able to connect to the internal gateway without any problems, but from then onwards users were no longer able to connect to the Internal Gateway showing the error in the GP firewall logs "status: failure - error: Invalid tunnel end point IP address".

There can be no other explanation if just before the upgrade the connections to the internal gateway were successful and just after the upgrade they started to fail.

Checking known issues for version 10.2.7 or addressed issues for the next release 10.2.8 and I can't find anyone that matches this concrete issue.

Could it be an internal bug or not yet published?

Thanks in advance to the community

Re: GP Internal Gateway does not work after upgrading to 10.2.7-h3

Claw4609 — Fri, 22 Mar 2024 20:24:59 GMT

Hello,

Out of curiosity, does this issue apply?

If not are there any error on the GlobalProtect logs on the firewall itself? If you grab a clients GlobalProtect debug logs and look at the PanGPA and PanGPS files, is there anything in those around the time frame this provides additional information into the issue?

Re: GP Internal Gateway does not work after upgrading to 10.2.7-h3

Jorge_Lopez — Fri, 29 Mar 2024 09:20:12 GMT

Hi @Claw4609,

Thank you so much for updating this discussion.

Finally, the case was escalated to the TAC. I will share it with you once it is resolved.

Re: GP Internal Gateway does not work after upgrading to 10.2.7-h3

Jorge_Lopez — Sun, 14 Apr 2024 19:53:41 GMT

Finally, it was a certificate issue. The certificate of the internal gateways was expired...

Thanks @Claw4609, I will not hesitate to check the logs more thoroughly next time.