topic Re: GlobalProtect issue in General Topics

GlobalProtect issue

vesna.djukic — Tue, 24 Feb 2015 16:12:33 GMT

Hi all,

We have problem connecting to a VPN using GlobalProtect. We opened a case but maybe someone has an idea what's going on..

The error message on GP client is

Error(4960): failed to get the tag gateways(T1404)

Error(5401): Failed to get gateway list for external network.

Erros on Palo Alto:

GlobalProtect portal user authentication succeeded. Login from: x.x.x.x, User name: YY, Auth type: profile.

GlobalProtect portal client configuration failed. Login from: x.x.x.x, User name: YY.

Device has been upgraded from 5.0.8 version to 6.0.6 month (or two) ago and GP was working fine until a week ago. The problem first appeared only to some people (weird?), but today almost all users have this problem.

All tips and ideas are welcome.

Regards,

Vesna.

Re: GlobalProtect issue

ssharma — Tue, 24 Feb 2015 16:17:07 GMT

If issue occurred after upgrading to 6.0 then I would definitely check the common name of the certificate used for global protect (see if that is ip or fqdn) and the configuration under Portal's Client config. It must match what we have on certificate. If certificate has a common name abc.company.com then under external gateway setting we should configure abc.company.com (and not its public ip say 1.1.1.1). Hope this helps. Thank you.

Re: GlobalProtect issue

oklier — Tue, 24 Feb 2015 23:10:30 GMT

Also upgrade the GP clients to the newer code release as well. There are bug fixes in them.

Re: GlobalProtect issue

vesna.djukic — Wed, 25 Feb 2015 08:31:43 GMT

Thanks ssharma and oklier.

Problem did not start right away after upgrade. GP was working fine for a few weeks on 6.0.6 version.

Same problem with the newest GP client..

Re: GlobalProtect issue

oklier — Wed, 25 Feb 2015 16:08:37 GMT

I would then say if Support has not called you back. Give them a call.