topic Re: GlobalProtect IOS stuck in General Topics

GlobalProtect IOS stuck

Pantelis — Mon, 16 May 2022 09:56:19 GMT

Good day,

After updating to10.2.1 and 6.0.2 GlobalProtect client I could not connect to VPN.

The problem was occurred for one endpoint. So I used the second one to connect and update the client.

Also the DNS(for split tunnel) was not work. I had to make "virtual change", just to press the OK button and commit. After that DNS was working. Also the HA was not working and with the same work around it did.

With iPhone the problem s that although login successful the status is disconnected.

Any thoughts/suggestions?

Re: GlobalProtect IOS stuck

BPry — Mon, 16 May 2022 21:39:29 GMT

@Pantelis,

So it sounds like post upgrade the configuration migration to 10.2 wasn't handled 100% correctly during the upgrade process. That happens occasionally and the candidate-config kind of corrects itself into a usable format which is why those commits "fixed" the issue.

If I'm reading the remaining issue correctly, you're saying that when you connect via the iPhone you immediately get disconnected? Do you have a GlobalProtect subscription to allow you to use the mobile client? Is their anything on the firewall's GlobalProtect logs for the client pointing towards any issues with agent profiles or the like?

Re: GlobalProtect IOS stuck

Pantelis — Tue, 17 May 2022 05:04:24 GMT

I am not sure about the subscription... But users could login from their mobiles. After the upgrade this problem has occurred.

Logs for my login are the following (I have updated the GlobalProtect client on my iPhone)

Re: GlobalProtect IOS stuck

CirrusMDDevOps — Wed, 07 Sep 2022 22:18:18 GMT

did you ever find the solution to this? We have the exact same issue using SAML auth and the iOS app. Auth is successfull but the mobile app never connects.

Re: GlobalProtect IOS stuck

itfromgermany — Wed, 12 Oct 2022 10:42:28 GMT

Same issue here with PA-220, PAN OS 10.2.3 (GlobalProtect Client on PA is: 6.1.0). iOS Clients cannot connect anymore after upgrading PAN-OS on firewall device. Windows/MacOS clients can connect... logs seem fine.

We did some testing with new/blank IOS devices, where we didn't have any error. Several IOS devices are still not able to connect. Reset/Restarts didn't work. IOS 16 also affected. I guess there should be an app update for Global Protect app in appstore from palo alto or a PAN OS update on Firewall?

Re: GlobalProtect IOS stuck

pan219 — Wed, 12 Oct 2022 09:40:47 GMT

Having the same issue like @itfromgermany after upgrading PAN220 to 10.2.3 from 10.2.2-h2

Prior to the upgrade iOS 16.0.x clients were able to connect successful via GP App 6.0.2-0 to portal and then establishing an IPSec connection. Using local authentication on the fw, no SAML.

iOS Clients can connect to the portal and successfully authenticate on the pan but forwarding to the gateway results in an continuous loop (seen in the gp logs: successful auth, then followed by a gateway-register / gateway-logout loop in a 1sec inverall; in iOS app it's just stuck at "Connecting"

Tried to downgrade- unsuccessful
Fiddled with the configuration in any possible way - unsuccessful

Re: GlobalProtect IOS stuck

DavePalo — Mon, 17 Oct 2022 23:55:35 GMT

Having the same problem with iOS GlobalProtect 6.0.2 using SAML on PanOS 10.2.2.

Connections from Windows and MacOS work just fine.

iOS successfully authenticates and GP shows a "Login Successful!" message, but when I close the message GP is disconnected again.

During sanity testing I too found that switching from SAML to local auth does allow iOS devices to connect. Issue just seems to be iOS GP & SAML.

Re: GlobalProtect IOS stuck

Pantelis — Tue, 18 Oct 2022 05:01:07 GMT

Just upgrade the OS to 10.2.3. It will fix the issue.

Re: GlobalProtect IOS stuck

Pantelis — Tue, 18 Oct 2022 05:03:10 GMT

I upgraded the PanOS to 10.2.3 and the issue was solved.

My GP agent is 6.0.1 but the problem was not in the agent.

Re: GlobalProtect IOS stuck

Hyatlotsa — Tue, 18 Oct 2022 11:03:50 GMT

I'm especially stayed aware of the article and I will get many benefits from it. Subsequently, thank you for sharing it.That vitalizes the amazing bone! Here clearly accepting I endeavor an article I can pull off a couple of additional spaces!

Re: GlobalProtect IOS stuck

DavePalo — Tue, 18 Oct 2022 11:27:04 GMT

Thank you @Pantelis

I currently have an issue upgrading beyond 10.2.2 - the VM Series fails to come back up. Saved by a snapshot.

Good to know that the GP issue will be sorted once the update issue is resolved though. I'll raise a SR.

Re: GlobalProtect IOS stuck

itfromgermany — Wed, 19 Oct 2022 10:32:02 GMT

do you have any news in this case...?

Re: GlobalProtect IOS stuck

pan219 — Mon, 24 Oct 2022 06:50:42 GMT

nope, no news. I am waiting for the next update, as downgrading to a previous versions did not solve it. Someone at reddit mentioned that this bug is under ID 191216 from PAN.

Re: GlobalProtect IOS stuck

pan219 — Wed, 09 Nov 2022 16:40:06 GMT

have you seen any progress in resolving this issue? (im Sinne der der anderen Forenteilnehmer verzichte ich auf die deutsche Sprache)

Re: GlobalProtect IOS stuck

itfromgermany — Thu, 10 Nov 2022 07:39:07 GMT

Palo Alto Support is still clueless. I guess it's maybe related to mobile phone provider in relation to the setup (Telekom, LTE, Germany, IPV6, IOS 16). Because e.g. travelling through Italy with another mobile phone provider we hadn't seen the issue. I've sent you a DM. If anyone else is struggling with the issue, would be nice if you can post it here.

Re: GlobalProtect IOS stuck

lettes — Thu, 15 Dec 2022 20:22:12 GMT

Also tried it with 10.2.3 and the same issue with 10.2.3-h2 on my PA-220, my iOS 16 clients GP work while connected through WiFi but they have trouble reconnecting on cellular. Checked the logs with a lot of reconnects but no errors. Downgrade to 10.2.2-h2 (even with latest iOS 16) fixes it again, hopefully PAN can fix this.

Re: GlobalProtect IOS stuck

DavePalo — Thu, 15 Dec 2022 22:54:08 GMT

Hi all,

I had to rebuild my VM-100 from scratch to be able to run any PanOS higher than 10.2.2. Now running PanOS 11.0.0 and GP with SAML on iOS 16.2 working well - including over cellular.

Re: GlobalProtect IOS stuck

Zhiyang_Lv — Thu, 17 Aug 2023 08:29:45 GMT

I still encountered this problem in 10.2.4-h2😳

Re: GlobalProtect IOS stuck

travistech — Mon, 18 Sep 2023 01:59:28 GMT

I'm also experiencing this issue. Seems to be specific to IOS and SAML no issues on other devices.

Re: GlobalProtect IOS stuck

N.Akbari507080 — Mon, 30 Mar 2026 13:13:21 GMT

Also and Still IOS App Issue.
We are using GlobalProtect with RADIUS + 2FA. During testing on iOS (iPhone and iPad), we noticed the following behavior:

After entering the OTP (SecureID token), the OTP input screen does not close automatically.
The user remains stuck on that screen and can keep pressing "Sign In" repeatedly.
After cancelling and re-authenticating with username & password, the VPN connection is established successfully — without being prompted for OTP again.

has anyone faced or experienced such an issue? in case yeah, what is the solution? I don't think, if it is a FW or GP misconfiguration itself.