topic Re: NetConnect to Global Protect migration issue in General Topics

NetConnect to Global Protect migration issue

Tician — Mon, 07 Nov 2011 10:10:27 GMT

Hello to everyone,

I migrate my PAN 500 from 4.0.7 to 4.1.0, with previously configured SSL-VPN which was operational. After migrating to new FW, SSL-VPN migrated to Global Protect portal with all configured settings and with new GP client to end nodes, but new GP client can't connect to gateway.

I troubleshoot a while and from client side (protocol error picture) have error, can't connect to ssl, check server certificate and protocol error message.

When I'm trying https to my gateway address from browser, I'm permitted to connect to portal and gain client download page. Only during this process PAN system logging this, but attempts from GP client was not logged neither.

Is there someone with same issue and solution?

Re: NetConnect to Global Protect migration issue

friento — Mon, 07 Nov 2011 16:25:21 GMT

You think you need to create new SSL cert? I will have to do this sometime in the near future and will follow your thread.

Re: NetConnect to Global Protect migration issue

dwalter — Mon, 07 Nov 2011 17:00:52 GMT

Same issue here. I can't for the life of me get this Global Protect client to connect since migrating to 4.1 yesterday. Already have a support ticket in.

Re: NetConnect to Global Protect migration issue

Tician — Tue, 08 Nov 2011 08:45:50 GMT

Dwalter, please keep us informed about support response...

Re: NetConnect to Global Protect migration issue

cmet — Tue, 08 Nov 2011 09:09:37 GMT

Looks like I have the same problem.

Portal https webside is not comming up. In Monitor traffic to port 443 dosn't show up at all.

On a second firewall everything is working like expected, but there wasn't a ssl vpn client installed before the upgrade.

since configurating globalprotect i have this messages in the system log.

2011/11/07 09:47:38info     general        general 0 File zeroization error: No such file or directory
2011/11/07 09:47:38info     general        general 0 File zeroization error: No such file or directory
2011/11/07 09:47:38info     general        general 0 File zeroization error: No such file or directory
2011/11/07 09:47:38info     general        general 0 File zeroization error: No such file or directory
2011/11/07 09:47:39info     general        general 0 File zeroization error: No such file or directory
2011/11/07 09:47:39info     general        general 0 File zeroization error: No such file or directory
2011/11/07 09:47:39info     general        general 0 File zeroization error: No such file or directory
2011/11/07 09:47:39info     general        general 0 File zeroization error: No such file or directory
2011/11/07 09:48:07info     routing        routed- 0 Route daemon configuration load phase-2 succeeded.

Re: NetConnect to Global Protect migration issue

dwalter — Tue, 08 Nov 2011 14:28:11 GMT

Well it seems we may have had two separate issues. I was getting the SSL issues, but rekeyed my cert from Digicert and it seemed that issue went away. However, I think I found an issue where if Windows 7 network discovery is disabled, the client won't connect. When I used my home pc (non-domain) to test the vpn it connected just fine, yet my domain machines (all Win 7) tried to connect they'd fail. I had a GPO that disabled network discovery on non-domain networks. Once I enabled it again, it seemed to allow the clients to connect again.

Re: NetConnect to Global Protect migration issue

Tician — Fri, 11 Nov 2011 08:46:17 GMT

Nothing new! I straggling with this GlobalProtect almost a week, but nothing. Always the same from the client side (can’t connect to ssl, protocol error, check server certificate). I reissue new server certificate, configuring from zero GP portal and gateway, trying various configuration regarding documentation, but still the same. Is there mandatory configuring HIP clients and profiles, prior to configure GP portal and gateway?

Anyone have PAN 500 platform and operational GP clients and gateway?

Re: NetConnect to Global Protect migration issue

Rahn — Mon, 21 Nov 2011 14:21:37 GMT

I had the same issue, Netconnect worked fine but after the upgrade to 4.1 I was only able to get a single machine to make the VPN connection using Globalprotect. I spent about 2+ hours with tech support Friday trying to get it working. I showed them how I was able to connect with one machine but no others and they apparently couldn't discover anything from the logs. The last suggestion they made was to make sure I installed the Globalprotect client using an admin account, that didn't help. I finally decided to come in over the weekend and roll everything back to 4.07. Now things are working again, except for the cleanup of clients on user machines that tried the switch to Globalprotect. With the holiday coming and people leaving town, I couldn't leave our system setting with a VPN connection that didn't work.

I really liked the 4.1 GUI changes but I'm not sure it's ready for "prime time". I also noticed that sometimes the GUI would stall when I changed screens and the help link wasn't working.