topic Re: Global Protect lose internal resources access in General Topics

Global Protect lose internal resources access

TomasMedina — Wed, 30 Apr 2025 16:44:53 GMT

Hello everyone,

I hope you can help us. We have some users who are connected to global protect, but from time to time, they lose access to the internal resources. When this happens, they have to update the connection in the GP client to be able to access, and when they do this it works, they can access the internal resources.

Has this happened to anyone?

Re: Global Protect lose internal resources access

Brandon_Wertz — Wed, 30 Apr 2025 17:44:16 GMT

This sounds like their GP client goes into a disconnected state, and the users don't recognize the VPN is disconnected.

Re: Global Protect lose internal resources access

TomasMedina — Wed, 30 Apr 2025 19:27:20 GMT

The GP client does not disconnect at all. It just loses connectivity, perhaps it is lost through the service connection.

Re: Global Protect lose internal resources access

Brandon_Wertz — Wed, 30 Apr 2025 19:50:22 GMT

@TomasMedina maybe I'm not understanding what you're trying to say here:

But to me this means they're "refreshing" their VPN connection.

If their VPN is working, they can access internal resources then all of a sudden they can't access internal resources but they can access things not internal like things on the Internet. That probably means the VPN isn't connected, it got disconnected somehow. Especially if refreshing the VPN connection resolves their issue.

Have you looked at the GP client logs for the time period that internal resources aren't accessible?

Re: Global Protect lose internal resources access

Brandon_Wertz — Wed, 30 Apr 2025 19:52:52 GMT

@TomasMedina wrote:

The GP client does not disconnect at all. It just loses connectivity, perhaps it is lost through the service connection.

If it was the SC, I assume your clients are on Prisma Access, then refreshing the client connection wouldn't resolve the SC (IPSec) connection issue.

Re: Global Protect lose internal resources access

TomasMedina — Wed, 30 Apr 2025 20:12:13 GMT

@Brandon_Wertz wrote:

@TomasMedina maybe I'm not understanding what you're trying to say here:

But to me this means they're "refreshing" their VPN connection.

If their VPN is working, they can access internal resources then all of a sudden they can't access internal resources but they can access things not internal like things on the Internet. That probably means the VPN isn't connected, it got disconnected somehow. Especially if refreshing the VPN connection resolves their issue.

Have you looked at the GP client logs for the time period that internal resources aren't accessible?

Yes, we have, and yes, the source user is blank. So, I think you are right, the VPN is disconnecting somehow, but we don't know why this is happening.

TAC told us it could be because of the windows power settings, but it is not solved by increasing the idle time.

Re: Global Protect lose internal resources access

BPry — Wed, 30 Apr 2025 20:49:12 GMT

@TomasMedina,

So the actual issue then is that you're losing the source-user mapping for these users? If you have internal resources locked behind the user being identified (a common and good practice) and you're losing that it would explain the entirety of your behavior.

The question then moves into why that information is being lost. What agent are you actively pushing to your clients? What do the user-id logs say, and are you possible seeing it kick into pre-logon?

Re: Global Protect lose internal resources access

Brandon_Wertz — Thu, 01 May 2025 13:36:41 GMT

@TomasMedina wrote:

@Brandon_Wertz wrote:

@TomasMedina maybe I'm not understanding what you're trying to say here:

But to me this means they're "refreshing" their VPN connection.

If their VPN is working, they can access internal resources then all of a sudden they can't access internal resources but they can access things not internal like things on the Internet. That probably means the VPN isn't connected, it got disconnected somehow. Especially if refreshing the VPN connection resolves their issue.

Have you looked at the GP client logs for the time period that internal resources aren't accessible?

Yes, we have, and yes, the source user is blank. So, I think you are right, the VPN is disconnecting somehow, but we don't know why this is happening.

TAC told us it could be because of the windows power settings, but it is not solved by increasing the idle time.

@TomasMedina -- The source user being blank only matters if access to the internal resources have a security policy with a user requirement, is that a portion of the policy? Right now all of this is just conjecture because we need more details. You mentioned TAC, were the GP client logs collected when the users couldn't access the internal resources? Were they analyzed? Did anyone look at the GP logs from the firewall? Did it in-fact show there was a client disconnect? Or was it like @BPry mentioned it is simply because user attribution is being lost? What's the user attribution method? What's the timeout? Did anyone look at the User-ID logs on the firewall?

There are so many different possibilities for the issue and questions related to the actual thing that's going on. The first step I'd start with is GP client logs collected from the client at the time of the issue, which TAC should already be doing.

Re: Global Protect lose internal resources access

TomasMedina — Fri, 02 May 2025 16:14:20 GMT

Hi.

I think maybe losing the mapping of the origin user is the problem because, we have been doing some tests, looking at the log and when this happened, the connection is denied. After they update the connection, they can access the internal resources.

We are using the 6.3.2 client.

Re: Global Protect lose internal resources access

TomasMedina — Fri, 02 May 2025 16:57:07 GMT

The connection to internal resources is via VPN through a policy in GP. We have deployed GP on SCM, not on the firewall. We have reviewed the logs and TAC has reviewed the evidence we have sent them, but they only give us indications that it is a problem with the power process of the endpoints when they hibernate.

Here is the lastest TAC response.

Re: Global Protect lose internal resources access

Brandon_Wertz — Mon, 05 May 2025 13:10:23 GMT

@TomasMedina wrote:

The connection to internal resources is via VPN through a policy in GP. We have deployed GP on SCM, not on the firewall. We have reviewed the logs and TAC has reviewed the evidence we have sent them, but they only give us indications that it is a problem with the power process of the endpoints when they hibernate.

Here is the lastest TAC response.

When I mentioned "Look at the GP logs on the firewall" and when you say "We have deployed GP on SCM, not on the firewall." we're both saying the same thing. You might have "deployed" the Global Protect VPN service via Strata Cloud Manager (An orchestration tool) but all that is, is a view into a virtual cloud hosted Palo Alto managed FIREWALL...it's still a firewall.

The note you've shared from Palo TAC is something similar I've extensively troubleshot within my organization. Are you using Lenovo laptops by chance? We had a lot of issues with both the wireless network adapter on Lenovo laptops having stability issues that needed driver updates to solve our "VPN problems."

What looked like a "GP problem" for us was a hardware/driver issue on the wireless network adapters across tens/hundreds of laptops. Looking through our GP logs TAC was also able to identify power adapter/sleep issues of our laptops that was interfering with the GP software functionality.

You originally mentioned that users are online working then "all of a sudden they disconnect." TAC mentioned power changes in the clients. When your clients are having issues are they stationary & connected to a docking station? Maybe try updating both the laptop firmware (drivers) as well as drivers of the docking station itself?

Re: Global Protect lose internal resources access

JoergSchuetter — Thu, 08 May 2025 08:48:24 GMT

Do you have HIP enabled (Portal -> Agent -> HIP Data Collection)?

Even if you do not make use of that data, it will ensure that the client connects to the gateway every 60 minutes.

Re: Global Protect lose internal resources access

TomasMedina — Fri, 09 May 2025 17:35:33 GMT

Ok the it's a Firewall then hehe.

Yeah there are a lot of Lenovo laptops and it can be the issue. We only have dockings in the office, but this problem is happening when people are working at home.

I'm going to ask IT support for them to update lenovo's firmware.

I'll let you know.