topic GlobalProtect failing after upgrading PanOS to 11.1.4 in GlobalProtect Discussions

GlobalProtect failing after upgrading PanOS to 11.1.4

idelconsulting — Wed, 17 Jul 2024 22:27:05 GMT

Dear all,

I have a very strange issue after I upgraded to 11.1.4

The mobile GlobalProtect client stopped working.

The network connection is unreachable or the portal is unresponsive.

I ran some packet captures and noticed that the firewall sees the SYN packets, but it never replies.

Nothing in the transmit stage pcap

Although I can see the connection attempts in the traffic logs.

They are aged out

out of curiosity I changed the settings for the sessions by entering:

set session tcp-reject-non-syn no

With this settings I can see also the SYN/ACK packets from the firewall back to the mobile device.

But it looks like these two streams are not recognized as being part of the same session?

Any idea how to further debug this issue?

Regards

Andreas

Re: GlobalProtect failing after upgrading PanOS to 11.1.4

kiwi — Fri, 19 Jul 2024 06:19:11 GMT

Hi @idelconsulting ,

I'd start by grabbing and checking the GP debug logs.

These generally give a pretty good indication why the portal isn't responding.

Are you able to just browse to the portal ?

Kind regards,

-Kim.

Re: GlobalProtect failing after upgrading PanOS to 11.1.4

idelconsulting — Sat, 20 Jul 2024 15:40:36 GMT

Long story short:

It works again

TL;DR

the fact that I saw SYN packets received by the server without a reply and SYN/ACK sent by the server without being seen by the client made me thing about some strange case of asymmetric routing.

I have two ISPs, one primary and a secondary.

Primary ISP has a metric of 10, secondary 200 for the default route out via the respective interfaces.

When I checked services like whatsmyip I saw the IP of the primary ISP, which is also the one GlobalProtect is listening on.

But, when checking the virtual router runtime stats and looking at the forwarding table, it showed the route via the secondary ISP as being active.

No idea how in such a case I saw the IP from the primary ISP on whatsmyip

Anyway, after deleting and re-adding the secondary ISP interface everything started working again.

I now see in the runtime forwarding table that the primary ISP is used.

How did this happen after the upgrade and why the internal routing was screwed up?

I have no idea.

Regards,

Andreas