topic Re: GP gateway drops to SSL and client gets disconnected..? in General Topics

GP gateway drops to SSL and client gets disconnected..?

thatguy — Thu, 31 Jul 2014 00:48:17 GMT

Hi all -- I just noticed an odd behavior affecting all GP clients (running on PA200, PANOS 6.0.3, GP Client 2.0.3), but I haven't changed anything recently.

In looking at the System log, I see users connecting successfully ('portal user auth succ', 'portal client config gen', 'gateway user auth succ', 'gateway user login succ', 'gateway client config gen').. But then there's a 'gateway client switch to SSL tunnel mode', and 30secs later, there's a 'gateway client config release', and 'user logout succeeded'. All connections up until today have used IPSec, and for whatever reason, SSL sessions logout immediately (because we don't have a certificate?)..

Could this be a network issue? We've been having issues with out internet provider lately, and pings are averaging around 60ms from the public side, tho that doesn't seem slow. Is there anything I could check internally?

Any help is much appreciated. Thanks

Re: GP gateway drops to SSL and client gets disconnected..?

_slv_ — Thu, 31 Jul 2014 06:53:45 GMT

Hi Thatguy

Please read this topic How GP selects between SSL and IPSEC?

As mentioned You can forse IPSEC mode - try and let us know how its working.

Of course please try to connect from local networks - is it working?

Maybe Your ISP filtering IPSEC - ask them.

Regards

Slawek

Re: GP gateway drops to SSL and client gets disconnected..?

pulukas — Thu, 31 Jul 2014 10:04:30 GMT

Could you post the log message the Palo Alto generates on the firewall logs when the client disconnects?

Re: GP gateway drops to SSL and client gets disconnected..?

thatguy — Thu, 31 Jul 2014 13:26:41 GMT

Here is the same set of msgs that get logged for every user now. Prior to yesterday, we would get the same set of msgs, except for the switch to SSL. Since that started, users are immediately logged out.

Re: GP gateway drops to SSL and client gets disconnected..?

thatguy — Fri, 01 Aug 2014 03:38:08 GMT

Apparently, this was a non-issue. I had to do a hard reboot of the PA200 and suddenly the IPSec tunnel was fine. Just weird. Thanks for the replies anyway.

Re: GP gateway drops to SSL and client gets disconnected..?

pulukas — Fri, 01 Aug 2014 13:13:53 GMT

The universal solution to computer problems, reboot.

But a little disappointing that there is not a clearer logging on a problem. these look like normal sessions.

Re: GP gateway drops to SSL and client gets disconnected..?

PHFA — Wed, 29 Apr 2015 12:40:02 GMT

Hello,

I was facing the same issue and i was seeing the same logs on the PA device.

HA cluster PA500

PANOS 6.0.3

GP: 2.0.4

I have hard rebooted the devices but it did not solve the issue.

I had to install the new version of GP: 2.2 to solve this problem. And now i am able to connect in an instant way and without any issue.

Regards,

Phfa