topic Re: GlobalProtect has DNS issues after waking from sleep mode in General Topics

GlobalProtect has DNS issues after waking from sleep mode

jrauman — Fri, 10 Apr 2020 01:10:29 GMT

GlobalProtect on Windows. User locks computer and computer goes to sleep. They return and unlock. If GlobalProtect has disconnected while in sleep mode, they user reconnects succsfully. User's drive mapping fail and apps fail. Pings name of server and that fails. PIngs IP address of server succeeds. Restarts PC and everything is fine again.

Whats going on?

Re: GlobalProtect has DNS issues after waking from sleep mode

Mick_Ball — Fri, 10 Apr 2020 07:31:50 GMT

What version of client do you have. When device wakes from sleep mode or switches from lan to wifi the client tries to reconnect to the previous gateway and some routing/domain issues seem to take place.

the same issue applies when using domain split tunnel exclusions.

have you tried a GP refresh before a reboot, are you above V5.1.

Re: GlobalProtect has DNS issues after waking from sleep mode

HoomanF — Tue, 15 Feb 2022 22:28:20 GMT

We have 5.2.9 , we have tried GP refresh connection, it sometimes fixes the issue but ideally we want the GP to restore connection after sleep without user having to refresh/reboot.

What is the fix for the issue you mentioned?

@Mick_Ball wrote:
When device wakes from sleep mode or switches from lan to wifi the client tries to reconnect to the previous gateway and some routing/domain issues seem to take place.

the same issue applies when using domain split tunnel exclusions.

Re: GlobalProtect has DNS issues after waking from sleep mode

BPry — Wed, 16 Feb 2022 00:39:08 GMT

@HoomanF,

You shouldn't be running into any issues with 5.2.9. I would recommend that you look at your client logs on an endpoint and see if they give you any clear errors in addition to checking your traffic logs and see if you have any traffic being received by the firewall.

Re: GlobalProtect has DNS issues after waking from sleep mode

mlinsemier — Wed, 09 Mar 2022 21:43:58 GMT

I am running into identical issues with GP client versions 5.2.8 - 5.2.10 and the latest 6.0. It seems to be DNS related as it also shows that we are running from a "cached profile" where before it would show portal gateways as "connected". We haven't changed our configurations in regards to pre-login and always-on for at least a year and a half and we have double and triple checked our configs (we have a ticket open with TAC on this now), we have split tunneled the portal/gateway IP addresses and domains), and just noticed the reconnect and portal cache issues recently (last 3-4 months).

If anyone found a fix for this please share.

Re: GlobalProtect has DNS issues after waking from sleep mode

EfrainMorales — Wed, 16 Mar 2022 15:53:52 GMT

We are having a ton of complaints about this same issue, but not sure if that's something related to the computer or the app itself. If someone has a fix on this, would be appreciated. I have the same issues as Minsemier explained.

Re: GlobalProtect has DNS issues after waking from sleep mode

mlinsemier — Wed, 16 Mar 2022 16:01:39 GMT

Is your Pre-Logon Tunnel Rename Timeout set to -1 or something different? We noticed that we can successfully reach the GlobalProtect portal perfectly when this is set to 0 which is not a graceful switch from pre-logon to user logon. Setting this back to -1 immediately re-introduces the "Cached Profile Config" issue. Additionally, we also have the issue where waking up from sleep the machine will not reconnect until a reboot.

I do have a TAC case open with Palo Alto but I am getting a bit of a runaround there trying to get to someone that truly understands GP.

Re: GlobalProtect has DNS issues after waking from sleep mode

EfrainMorales — Wed, 16 Mar 2022 17:38:02 GMT

Hi Mlinsemier,

Thanks for your response.

Yep, Pre-Logon Tunnel Rename Timeout is set as default with - 1 and the User Switch Tunnel Rename Timeout is set as 0, We have users under Windows and Mac, but the users with MAC computers mostly are facing this issue. They can reproduce the issue when they are just closing the lid at the end of the shift, but once they are turning it on again, GP is spinning only.

Re: GlobalProtect has DNS issues after waking from sleep mode

ChristerJohanss — Wed, 10 May 2023 11:27:51 GMT

Hi everyone,
Have someone experienced this problem with GP and laptops waking up from "sleep"?? I'm running 6.1.1 and I suspect that the problem is still there. It's supposed to have been fixed in 6.0.1 (GPC-13774).

Re: GlobalProtect has DNS issues after waking from sleep mode

ShajadAshraf — Thu, 25 May 2023 09:26:26 GMT

Hello, issue looks similar to described above by @ChristerJohanss . Happens with either GP 6.1.1 or 5.2.12 and found that the issue happens when the pc changes it's powersettings - see extract from GPS Log of one affected user (who tried to access VPN resource at 13:50). The DNS resolution doesn't work but IP does..

(P5704-T17928)Debug( 917): 05/23/23 13:25:09:011 HandleDnsCallback: failed to parse dns req packet.
**(P5704-T5708)Info ( 397): 05/23/23 13:30:44:938 Received powersetting change event
*(P5704-T5708)Debug(15418): 05/23/23 13:30:44:938 Wakeup from modern standby
(P5704-T5708)Debug( 348): 05/23/23 13:30:49:102 Received session change, event type 8, session 1
(P5704-T5708)Info ( 428): 05/23/23 13:49:32:647 Received power event, type 0x0000000a
(P5704-T8648)Info ( 531): 05/23/23 13:49:32:855 msgtype = sleep
(P5704-T8648)Info (2079): 05/23/23 13:49:32:855 ProcessServerSleep called
(P5704-T8648)Debug( 198): 05/23/23 13:49:32:855 Now is 17280640. CheckHipTimeoutAfterSleep: 2615000 ms
(P5704-T8648)Debug(2103): 05/23/23 13:49:32:855 Out-of-sleep not during network discovery.
(P5704-T8648)Debug(2147): 05/23/23 13:49:32:855 State is Connected
(P5704-T8648)Debug(1898): 05/23/23 13:49:32:855 Send response to client for request sleep
(P5704-T8648)Info ( 531): 05/23/23 13:49:33:878 msgtype = sleep
(P5704-T8648)Info (2079): 05/23/23 13:49:33:878 ProcessServerSleep called
(P5704-T8648)Debug(2086): 05/23/23 13:49:33:878 Received wakeup event already. ignore this one

So issue from the original post continues...

Re: GlobalProtect has DNS issues after waking from sleep mode

YordanYordanov — Thu, 27 Jul 2023 13:43:53 GMT

has anyone found a solution?

Re: GlobalProtect has DNS issues after waking from sleep mode

ShajadAshraf — Thu, 27 Jul 2023 13:57:16 GMT

Hello Yordan,

We were advised to try this key which looks to be having a positive impact - please test in your environment first before deployment.

[HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\Settings]
"DNSBlockMethod"=dword:00000002

Regards,

Sarge

Re: GlobalProtect has DNS issues after waking from sleep mode

YordanYordanov — Tue, 01 Aug 2023 06:39:49 GMT

hi Sarge

thx for the Suggestion, i will try and let you know. Do you know when the software will be fixed?

Yordan

Re: GlobalProtect has DNS issues after waking from sleep mode

YordanYordanov — Tue, 01 Aug 2023 12:08:40 GMT

hi Sarge,

Unfortunately, this does not help, the problem is still there. we use GP 6.2.0 and the problem was not solved as anonced in PA :

GlobalProtect App 5.2.11 Addressed Issues

GPC-13774 Fixed an issue where the GlobalProtect tunnel could not send traffic after the system woke up from sleep mode.

Any suggestions?

regards

Yordan

Re: GlobalProtect has DNS issues after waking from sleep mode

MikeAkam — Mon, 21 Aug 2023 13:29:33 GMT

This also didn't work for us. Have we got a fix for this yet?

Re: GlobalProtect has DNS issues after waking from sleep mode

DL_CyberCX — Thu, 27 Jun 2024 04:35:08 GMT

Over 10 laptops woken up from sleep/hibernate mode & GP client showing a login error page attached screenshoot.

Any solution or root causes?

PanGPS log when issue happens.

=========================================

(P6068-T6072)Debug(17703): 06/24/24 12:20:15:508 Modern standby
(P6068-T6072)Info ( 397): 06/24/24 13:11:35:229 Received powersetting change event
(P6068-T6072)Debug(17712): 06/24/24 13:11:35:229 Wakeup from modern standby
(P6068-T6072)Info ( 428): 06/24/24 13:11:36:989 Received power event, type 0x0000000a
(P6068-T6072)Info ( 428): 06/24/24 13:11:42:068 Received power event, type 0x0000000a
(P6068-T6072)Debug( 348): 06/24/24 13:11:43:703 Received session change, event type 8, session 1
(P6068-T3484)Info ( 531): 06/24/24 13:12:13:592 msgtype = gateway-credential-cancel
(P6068-T3484)Debug(4656): 06/24/24 13:12:13:592 ServerThread: ProcessServerCancelGatewayLogin
(P6068-T3484)Debug(4672): 06/24/24 13:12:13:592 Set cancel gateway login event.
(P6068-T2996)Debug(13212): 06/24/24 13:12:13:592 Got cancel gateway login event while waiting for challenge event for gateway globalprotect.my************.com
(P6068-T2996)Debug(13230): 06/24/24 13:12:13:592 HandleGatewayChallenge returns 1
(P6068-T2996)Debug(3929): 06/24/24 13:12:13:592 HandleGatewayChallenge returns TRUE. Gateway saml login issue
(P6068-T2996)Debug(3940): 06/24/24 13:12:13:592 User canceled login to gateway globalprotect.my************.com.
(P6068-T2996)Debug(15044): 06/24/24 13:12:13:592 Enforcer is not enabled
(P6068-T2996)Debug(1986): 06/24/24 13:12:13:915 Enforcer,found 0 filter object belonging to us.
(P6068-T2996)Debug( 41): 06/24/24 13:12:13:915 Roaming profile is false
(P6068-T2996)Debug( 169): 06/24/24 13:12:13:922 profileInfo username Clastname, profile path (null), server (null)
(P6068-T2996)Debug(4178): 06/24/24 13:12:13:938 CPanMSServiceWin::IsGpDisabledForCurUser() - bGpIsDisabled=0.
(P6068-T2996)Info (2701): 06/24/24 13:12:13:938 Failed to retrieve info for gateway globalprotect.my************.com.
(P6068-T2996)Debug(2712): 06/24/24 13:12:13:938 tunnel to globalprotect.my************.com is not created.
(P6068-T2996)Error(6914): 06/24/24 13:12:13:938 NetworkDiscoverThread: failed to discover external network.
(P6068-T2996)Debug(6938): 06/24/24 13:12:13:938 Network discovery failed, set error as The network connection is unreachable or the gateway is unresponsive. Check the network connection and reconnect.
(P6068-T2996)Debug(7993): 06/24/24 13:12:13:938 --Set state to Disconnected
(P6068-T1060)Debug(2635): 06/24/24 13:12:13:938 Setting debug level to 5
(P6068-T2996)Debug(6978): 06/24/24 13:12:13:938 NetworkDiscoverThread: PortalStatus is 1, HasLoggedOnGateway is 0
(P6068-T2996)Debug(7001): 06/24/24 13:12:13:938 Network discovery is not ready, set GP VPN status as disconnected
(P6068-T2996)Debug(13525): 06/24/24 13:12:13:938 SetVpnStatus called with new status=0, Previous Status=0
(P6068-T2996)Debug(4513): 06/24/24 13:12:13:938 UpdatePrelogonStateForSSO() - tunnel state = Disconnected
(P6068-T2996)Debug(11265): 06/24/24 13:12:13:938 CPanMSService::OnVpnStatusProxyAgent: tunnel only, stop the proxy.
(P6068-T2996)Debug(7089): 06/24/24 13:12:18:946 NetworkDiscoverThread: Network discover is not successful. Retry.
(P6068-T2996)Debug(7103): 06/24/24 13:12:18:946 Retry network discovery for non-OnDemand mode.
(P6068-T2996)Debug(6452): 06/24/24 13:12:18:946 NetworkDiscoverThread: wait for network discover event.
(P6068-T2996)Debug( 596): 06/24/24 13:12:18:946 Set hip report quit event
(P6068-T2996)Debug(6468): 06/24/24 13:12:18:946 NetworkDiscoverThread: got network discover event.
(P6068-T2996)Debug(6475): 06/24/24 13:12:18:946 ----Network Discover starts----
(P6068-T2996)Debug( 752): 06/24/24 13:12:18:946 SetNextScheduledHipCheckTime to 0
(P6068-T2996)Debug( 774): 06/24/24 13:12:18:946 m_bScheduleFlag is set to 0
(P6068-T2996)Debug(6495): 06/24/24 13:12:18:946 UpdatePrelogonStateForSSO to GP_VPN_STATUS_DISCONNECTED
(P6068-T2996)Debug(4513): 06/24/24 13:12:18:946 UpdatePrelogonStateForSSO() - tunnel state = Disconnected
(P6068-T2996)Debug( 571): 06/24/24 13:12:18:993 Network is reachable
(P6068-T2996)Debug(2124): 06/24/24 13:12:18:993 bNetworkAvailable is 1
(P6068-T2996)Debug(2132): 06/24/24 13:12:18:993 Network is available
(P6068-T2996)Debug(6525): 06/24/24 13:12:18:993 finish check host reachable
(P6068-T2996)Debug(7993): 06/24/24 13:12:18:993 --Set state to Discovering network...
(P6068-T10592)Debug(6231): 06/24/24 13:12:18:993 CaptivePortalDetectionThread: IsDetectingCaptivePortal=1, PreLoginIsDone=0
(P6068-T10592)Debug(6208): 06/24/24 13:12:18:993 CaptivePortalDetectionThread: wait (2000 ms) for captive portal detection event.
(P6068-T2996)Debug(6563): 06/24/24 13:12:18:993 Logout gateways before network discover..., bJustResumed=0
(P6068-T2996)Debug(1414): 06/24/24 13:12:18:993 Logging out gateway, reason is Network discover
(P6068-T2996)Debug(1453): 06/24/24 13:12:18:993 Logging out gateway over
(P6068-T2996)Debug( 338): 06/24/24 13:12:18:993 Parse gateway list for user firstname.lastname%40************.com
(P6068-T2996)Debug(15389): 06/24/24 13:12:18:993 RetrieveClientIpByRemoteHost() - invalid remote host: .
(P6068-T2996)Debug( 204): 06/24/24 13:12:18:993 SelectInternalGateways - failed to retrieve client source ipv6!
(P6068-T2996)Debug(5680): 06/24/24 13:12:18:993 getaddrinfo host.GetString() globalprotect.my************.com
(P6068-T2996)Debug(5804): 06/24/24 13:12:19:026 Gateway globalprotect.my************.com(Stanwell VPN): ipv4 *.*.*.* , ipv6 , FQDN yes
(P6068-T2996)Debug(6586): 06/24/24 13:12:19:026 Set network discover in progress
(P6068-T2996)Debug(4513): 06/24/24 13:12:19:026 UpdatePrelogonStateForSSO() - tunnel state = Connecting
(P6068-T2996)Debug(15595): 06/24/24 13:12:19:026 GetNetworkTypeDS
(P6068-T2996)Debug(15598): 06/24/24 13:12:19:026 No ipv6 internal host detection.
(P6068-T2996)Debug(2016): 06/24/24 13:12:19:026 IP *.*.*.*
(P6068-T2996)Debug(2035): 06/24/24 13:12:19:026 host dc2dc01.************.com
(P6068-T2996)Debug(2052): 06/24/24 13:12:19:040 DnsQuery returns 9003
(P6068-T2996)Debug(2067): 06/24/24 13:12:19:040 Resolved *.*.*.*.in-addr.arpa for internal host detection with return value 9003
(P6068-T2996)Debug(6656): 06/24/24 13:12:19:040 NetworkDiscoverThread: network type is external.
(P6068-T2996)Debug(6797): 06/24/24 13:12:19:040 NetworkDiscoverThread: Discover external network.
(P6068-T2996)Debug( 552): 06/24/24 13:12:19:040 Discover external gateway: gateway count is 1, cutoff time is 5, bJustResumed=0
(P6068-T2996)Debug( 572): 06/24/24 13:12:19:040 One external gateway globalprotect.my************.com, priority=1, manual is 0
(P6068-T2996)Debug(3106): 06/24/24 13:12:19:040 Gateway: globalprotect.my************.com, client IP: 10.1.0.108
(P6068-T2996)Debug(2645): 06/24/24 13:12:19:056 retrieve info of gateway globalprotect.my************.com
(P6068-T2996)Debug(2410): 06/24/24 13:12:19:056 pan_get_gp_user_agent szGpUserAgent ua is PAN GlobalProtect/6.2.2-259 (Microsoft Windows 11 Pro , 64-bit).
(P6068-T2996)Debug(2468): 06/24/24 13:12:19:056 open http session. agent is PAN GlobalProtect/6.2.2-259 (Microsoft Windows 11 Pro , 64-bit)
(P6068-T2996)Debug(2410): 06/24/24 13:12:19:056 pan_get_gp_user_agent szGpUserAgent ua is PAN GlobalProtect/6.2.2-259 (Microsoft Windows 11 Pro , 64-bit).
(P6068-T2996)Debug( 476): 06/24/24 13:12:19:056 winhttp SetSecureProtocol, hSession=6a204e70, bAllProtocol=0, gbFips=0
(P6068-T2996)Debug(2656): 06/24/24 13:12:19:056 Skip setting proxy for creating tunnel to gateway globalprotect.my************.com
(P6068-T2996)Debug(3599): 06/24/24 13:12:19:056 m_msp->IsInPreserveTunnel() 0, m_msp->IsPrelogonRenameAuthFail() 0
(P6068-T2996)Debug(16119): 06/24/24 13:12:19:056 Set m_bPrelogonRenameAuthFail to 0
(P6068-T2996)Debug(3629): 06/24/24 13:12:19:056 CPanGateway::RetrieveGatewayInfo portal default-browser value is 0, support yes
(P6068-T2996)Debug(3644): 06/24/24 13:12:19:056 ----Gateway Pre-login starts----