topic Re: GP Alert - Error code 44 - Invalid authentication cookie in GlobalProtect Discussions

GP Alert - Error code 44 - Invalid authentication cookie

GregorJus — Mon, 30 Jun 2025 07:34:21 GMT

Hi,

all of our users seem to be successfully connected to GP, however, I am receiving the alerts like below (I've only removed/amended some sensitive information).

Can anyone shed some light on this Error 44 and invalid authentication cookie? Anything I should be worried and anything I should/could do to rectify this?

Thanks,

receive_time: 2025/06/30 09:11:06
actionflags: 0x0
type: GLOBALPROTECT
subtype: 0
config_ver: 2817
time_generated: 2025/06/30 09:11:06
high_res_timestamp: 2025-06-30T09:11:06.815+02:00
dg_hier_level_1: 0
dg_hier_level_2: 0
dg_hier_level_3: 0
dg_hier_level_4: 0
vsys_id: 1
vsys: vsys1
eventid: gateway-hip-check
status: failure
stage: host-info
auth_method:
tunnel_type:
portal: GP gateway - Internal
srcuser: user@domain.com
private_ip: 10.0.2.25
private_ipv6: 0.0.0.0
hostid: 20d2155b-769e-4c0b-ba83-b9f1c55636e7
client_ver: 6.2.7
client_os: any
client_os_ver:
repeatcnt: 1
login_duration: 0
connect_method:
reason:
location:
error_code: 44
error: Invalid authentication cookie
opaque:
gateway:
selection_type:
response_time:
priority:
cluster_name:
attempted_gateways:

Re: GP Alert - Error code 44 - Invalid authentication cookie

BPry — Fri, 04 Jul 2025 07:47:40 GMT

@GregorJus,

This is normal to see in the logs and usually associated with gatewa-hip-check events like what you're seeing. I always see it on gateway-hip-check events and it's always between a gateway-logout event and a portal-auth/portal-gen-cookie event.

If I would have to guess what is going on, I think the user is likely suspending the machine and upon it resuming the agent sends spurious HIP check reports; since the HIP reports utilize a cookie with the gateway and the gateway session has already been cleared, the cookie is invalid and the reports aren't processed.

I've seen this on BYOD endpoints that aren't forced onto the VPN at random times well prior to them connecting to the VPN tens of minutes later, so that leads credence to it being an issue with the agent when exiting sleep. This is just a hypothesis, but it's the best I can offer.

Re: GP Alert - Error code 44 - Invalid authentication cookie

GregorJus — Mon, 07 Jul 2025 07:43:22 GMT

Hi @BPry,

This is bloomin' amazing explanation - I was thinking it could be related to users' devices going to sleep but couldn't come up with the actual explanation like you did!

Many thanks for this, mate!

Gregor