topic Re: [SOLVED] Prisma Browser Issue "No upstream gateways available & GlobalProtect/Remote Networks Push Jobs Fails Continously" in General Topics

[SOLVED] Prisma Browser Issue "No upstream gateways available & GlobalProtect/Remote Networks Push Jobs Fails Continously"

DanielS.Romero — Wed, 08 Jul 2026 22:02:41 GMT

Hello LiveCommunity Team!

I created this post to share my experience regarding some Issues that recently seen on the Prisma Browser and Mobile User GlobalProtect pushed failing multiple times!

We had configured Prisma Browser alongside GlobalProtect—deployed via Strata Cloud Manager (SCM) to work seamlessly; however, a few days ago, we began seeing the following error in Prisma Browser when attempting to connect to remote resources "No Upstream Gateways Available":

PRISMA BROWSER REMOTE CONNECTION ERROR

We attempted to use GlobalProtect to access those resources; however, in SCM, push operations to the GlobalProtect Portals and Gateways consistently fail, take a long time, and always display the following messages:

PRISMA ACCESS MU-SPN GLOBALPROTECT ERROR MESSAGES

Troubleshooting Steps:

1- Check the current status of the Prisma SASE service worldwide on the following official webpage (But everything was fine!):
SASE Health

PALO ALTO SASE HEALTH STATUS

2- We created a support case and the TAC engineer create an internal ticket to Engineering team who says the next RCA:

Response And Findings Of The TAC engineer
"

Thank you for your patience.

Engineering identified the root cause of the issue as a failure in the certificate renewal API endpoint. This error prevented successful device certificate renewal.

As a result, the service responsible for processing commit jobs, which depends on successful device certificate renewal, became stuck while attempting to retrieve the device certificate. Consequently, commit jobs were not processed.

Engineering has completed the necessary remediation actions to restore normal operation, and the issue has now been resolved. Let me know if you have any additional questions.

Please do not hesitate to reach us
"

After a few hours, we re-sent the push tasks to the GlobalProtect nodes; the process completed without issues and more quickly, and Prisma Browser was able to resume connectivity with remote resources.

We also have another problem, but one related to push operations to Remote Network nodes, as shown below:

PRISMA ACCESS RN-SPN ERROR MESSAGES

We opened another support case, and the TAC engineer provided the root cause analysis (RCA):

Response And Findings Of The TAC engineer
"
You were experiencing persistent configuration push failures specifically for the Remote Networks scope in Strata Cloud Manager, while Service Connection and Mobile User pushes were successful. The pushes would remain in a "Pending" state for 30–60 minutes before eventually failing, blocking necessary network changes.

Investigation & Resolution:
> We joined the session and verified that two specific Remote Network nodes were out of sync and causing the global push timeout.
>Verified these nodes from the backend and identified that the process/daemon responsible for processing configuration pushes would have backed-up buffer. This was caused by multiple simultaneous pushes from different administrators, which would create a large queue that the process could no longer clear.
>Generated TSF from the backend nodes, and manually cleared the timed out jobs by restarted the process responsible for the commit on the two RN nodes.
> We initially performed a selective test push to the Remote Networks scope, which transitioned from "Pending" to Successful.
> You then performed a Full Push for all components, which also completed successfully.
> To avoid this in the future, we recommend performing pushes among administrators in a timely manner. If a push appears stuck, avoid triggering subsequent selective pushes to the same scope, as this increases the backend buffer load for the commit process.
"

After this, everything worked fine for Remote Network nodes!

Thank you for your time, and I hope this information is helpful in your daily cybersecurity work. I would greatly appreciate your support by liking or accepting this as a useful post; it would help me a lot in becoming a CyberElite!

Best Regards,

Daniel Romero
Senior Network/Security Engineer
PANW Partner

Re: [SOLVED] Prisma Browser Issue "No upstream gateways available & GlobalProtect/Remote Networks Push Jobs Fails Continously"

JayGolf — Thu, 09 Jul 2026 03:24:03 GMT

@DanielS.Romero Thanks for sharing!

Re: [SOLVED] Prisma Browser Issue "No upstream gateways available & GlobalProtect/Remote Networks Push Jobs Fails Continously"

DanielS.Romero — Sat, 11 Jul 2026 03:15:59 GMT

Today, we encountered a similar issue involving the same unexpected error message; however, in this case, the TAC engineer confirmed that the actual unexpected error on the Remote Network was caused by a duplicate eBGP peer address, after directly verifying the Remote Network node, as shown below:

PRISMA ACCESS REMOTE NETWORK GENERAL ERROR

REMOTE NETWORK REAL ERROR

We were informed that, to avoid opening a support case every time this unexpected error occurs, we can consult our Customer Success engineer, who has direct access to internal tools to verify the cause of jobs failures directly on every Remote Network, Service Connection, GlobalProtect and Explicit Proxy node.

After changing the peer's eBGP address, the push job status becomes successful.

Thank you for your time, and I hope this information is helpful in your daily cybersecurity work. I would greatly appreciate your support by liking or accepting this as a useful answer; it would help me a lot!

Daniel Romero
Senior Network/Security Engineer
PANW Partner

Re: [SOLVED] Prisma Browser Issue "No upstream gateways available & GlobalProtect/Remote Networks Push Jobs Fails Continously"

cartergray705 — Sat, 11 Jul 2026 05:21:18 GMT

Thanks for sharing this. The detailed RCA from TAC is especially helpful, and it's good to know the issues were caused by backend certificate renewal and commit queue problems rather than configuration errors. This will definitely help others facing similar Prisma Access or GlobalProtect push failures.

Re: [SOLVED] Prisma Browser Issue "No upstream gateways available & GlobalProtect/Remote Networks Push Jobs Fails Continously"

Brandon_Wertz — Mon, 13 Jul 2026 14:11:57 GMT

@DanielS.Romero -- IMO, TAC telling you (customer) to not open a case is wrong.

Customer's are paying for this SaaS product. If a customer doesn't open a support case there's nothing to trace back the customer impacted issue. Also, given the outage and it's duration the customer can/could be entitled to a product credit for paying for a service that was offline. Further opening tickets especially for repeated SaaS issues could show systemic problems with a service.

That said I do think informing your SE or CSE might get you a more immediate answer as to what might be happening, but IMO if a customer has an issue with a product we should be opening tickets to document the issue.

You can file SLA claims via this link (You need a TAC case to file a claim):

https://supportcases.paloaltonetworks.com/s/sla-claim

Re: [SOLVED] Prisma Browser Issue "No upstream gateways available & GlobalProtect/Remote Networks Push Jobs Fails Continously"

Brandon_Wertz — Mon, 13 Jul 2026 14:23:09 GMT

I think this was a great post. To go along with that customer should subscribe to the automated email reporting for Palo's "Prisma" infrastructure.

If you log into here:

https://sase.status.paloaltonetworks.com/incidents

You can manage your subscriptions. Getting very specific to the services that you have from prisma as well as the regions they're deployed in, which in theory should only given you email notifications for the very region you're operating in:

As a few examples