topic Re: Upgrade to 5.0.11 = High Amount of Global Protect Failed Auths in General Topics

Upgrade to 5.0.11 = High Amount of Global Protect Failed Auths

jambulo — Tue, 25 Feb 2014 14:43:49 GMT

We upgraded one of our 5020's from 4.1.13 to 5.0.11 about 2 weeks ago. Ever since then, we have been seeing an unusually high number of failed auths from Global Protect. Has anyone else experienced this?

The attached graph was made in Excel. I used this filter in PA ( eventid eq globalprotectgateway-auth-fail ) and ( receive_time geq '2014/02/01 00:00:00' ) to grab all of the GP failed auths from the System log, then graphed it out. You can clearly see when we performed the upgrade. I have verified that these extra failed auths are not coming from a single user(or even a few). It's spread out across all users. The weird thing is, we haven't had any complaints(yet) about Global Protect not working, it has also worked 100% of the time for myself.

Re: Upgrade to 5.0.11 = High Amount of Global Protect Failed Auths

ericgearhart — Tue, 25 Feb 2014 15:08:45 GMT

Just to kinda help clarify, the graph depicts the date as right to left. The far right is before the upgrade, the left is after the upgrade.

Re: Upgrade to 5.0.11 = High Amount of Global Protect Failed Auths

Phoenix — Tue, 25 Feb 2014 15:49:18 GMT

Hello jambulo

Yes I see that the system logs indicate GP Auth failures, to know more information about each failure we can look at

less mp-log authd.log ( Click Shift + G to go down to the latest )

Here for each failure it would give the logs and a reason. If you can share logs of one such may be we can find more.

Thanks

Re: Upgrade to 5.0.11 = High Amount of Global Protect Failed Auths

ericgearhart — Tue, 25 Feb 2014 18:06:48 GMT

jambulo maybe a pcap of a session with a failed auth and a successful auth combined with using the SSL private key and Wireshark can help unravel this too?