topic Re: Unable to access Windows Store (Windows 10 + GP 3.0.2) in General Topics

Unable to access Windows Store (Windows 10 + GP 3.0.2)

Remo — Wed, 31 Aug 2016 17:51:04 GMT

Hello,

Does anyone else also have problems to access the windows store when connected with global protect vpn?

Actually the problem really only is the windows store app. Everything else works perfectly (internet access, accessing corporate ressources, internal websites, fileshares, ...). The store app only displays that I should check my internet connection and the error code 0x80072EFD.

The firewall has 7.0.6 installed and we have configured the vpn with the default route into the vpn tunnel.

Regards,

Remo

Re: Unable to access Windows Store (Windows 10 + GP 3.0.2)

TranceforLife — Wed, 31 Aug 2016 18:08:43 GMT

Hi,

So when you are not using GP windows store work fine?

Did you try "nslookup" from the client with Wireshark PCAP to get more details?

Thx,

Myky

Re: Unable to access Windows Store (Windows 10 + GP 3.0.2)

Remo — Wed, 31 Aug 2016 18:34:09 GMT

exactly, as soon as I disable GP --> the store app is able to connect

Re: Unable to access Windows Store (Windows 10 + GP 3.0.2)

Remo — Wed, 31 Aug 2016 18:46:19 GMT

and I did also capture the traffic with vpn enabled and disabled ... on both captures I can see the dns queries related to the windows store app, but with vpn enabled there are ONLY the dns requests but no store-related https connection attemps

Re: Unable to access Windows Store (Windows 10 + GP 3.0.2)

TranceforLife — Wed, 31 Aug 2016 19:12:08 GMT

How about Palo logs? Do you see the traffic from the client (GP Zone) going outside (untrust) to the Microsoft store IP as destination. Threat logs?

Re: Unable to access Windows Store (Windows 10 + GP 3.0.2)

Remo — Wed, 31 Aug 2016 19:21:26 GMT

one of the various fqdn's is storeedgefd.dsx.mp.microsoft.com (when I tried it resolved to 23.50.97.152).

on the firewall I have not one packet towards this ip and also nothing in the threatlog (actually if there was traffic I would be surprised because of the fact that I had no packets in the local packet capture)

Re: Unable to access Windows Store (Windows 10 + GP 3.0.2)

TranceforLife — Wed, 31 Aug 2016 19:31:18 GMT

Sure you said before no attempts from the client, my bad. This is strange. Did you try to do PCAP when connected through the GP on the local interface, not GP adapter? This is strange that you getting DNS but the client making desition not to initiate a connection after.

Re: Unable to access Windows Store (Windows 10 + GP 3.0.2)

Remo — Wed, 31 Aug 2016 19:33:58 GMT

Yes, I also captured on that interface. For whatever reason I also see the dns requests there going out directly, but still only the dns requests and no https traffic

Re: Unable to access Windows Store (Windows 10 + GP 3.0.2)

TranceforLife — Wed, 31 Aug 2016 20:41:49 GMT

When did you notice this first time, any os update GP? All Windows 10 clients or just you unable to access? l cannot think of anything else what could be an issue. Don't have much experience with GP

Re: Unable to access Windows Store (Windows 10 + GP 3.0.2)

Remo — Wed, 31 Aug 2016 20:33:41 GMT

this problem probably existst since we are testing with windows 10 ...

Re: Unable to access Windows Store (Windows 10 + GP 3.0.2)

TranceforLife — Wed, 31 Aug 2016 20:43:36 GMT

My answer would not help you but l have noticed that Windows 10 causing a lot of issues not just with your case.

Re: Unable to access Windows Store (Windows 10 + GP 3.0.2)

Remo — Mon, 12 Sep 2016 08:55:58 GMT

is really no one using global protect on windows 10? 😛

Re: Unable to access Windows Store (Windows 10 + GP 3.0.2)

BPry — Mon, 12 Sep 2016 15:09:17 GMT

Personally we don't run GP at all and have chosen to just continue to use ASAs for the VPN and have the PA do everything else. The issue with GP had more to do with it not being near as user friendly as AnyConnect has been and given the choice users didn't want to switch.

Re: Unable to access Windows Store (Windows 10 + GP 3.0.2)

jpapazian — Thu, 04 May 2017 16:08:57 GMT

Hello,

Did you solve this issue?

A customer of mine is having the same, and he pointed me to a checkpoint URL where it states that the microsoft Virtual Adaptor for the VPN tunnel is hiddent by default, and hence prevents the connection to the store.

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92881

Let me know...

Thanks,

Jérôme

Re: Unable to access Windows Store (Windows 10 + GP 3.0.2)

Remo — Thu, 04 May 2017 19:53:09 GMT

Hi Jérôme

Unfortunately, now we stil haven't solve this issue. We just lowered the priority of this/had to accept that it does not work (actually our users don't really need this store on their working computers, so the problem is not that important)

I tried to adapt the checkpoint solution to the PANGB network adapter. But there the initial "characteristics" value was 81 (129 in decimal). I changed this to "1" but so far I am still not able to access the store when connected with VPN.

Thanks,

Remo

Re: Unable to access Windows Store (Windows 10 + GP 3.0.2)

jpapazian — Wed, 31 May 2017 10:06:13 GMT

Remo,

My customer is really unhappy....can't we boost this issue?

Additionnlly customer has just migrated to GP 4.0.2...

We've opened a ticket to support, and are awaiting answer....

Thanks,

Jerome

Re: Unable to access Windows Store (Windows 10 + GP 3.0.2)

BPry — Wed, 31 May 2017 14:04:27 GMT

@jpapazian,

This is more of a Microsoft issue than it is strictly related to GlobalProtect.

Re: Unable to access Windows Store (Windows 10 + GP 3.0.2)

jmenon — Fri, 02 Jun 2017 17:47:26 GMT

So what is the issue ? We have customers successfully using the Windows 10 app. Are you referring to the app on Windows Store , https://www.microsoft.com/en-us/store/p/globalprotect/9nblggh6bzl3 or the regular GlobalProtect MSI app for Windows 10 that you download from our support portal or your GlobalProtect Portal. If you want to know the difference between store app and regular app refer to https://www.paloaltonetworks.com/documentation/71/pan-os/newfeaturesguide/globalprotect-features/globalprotect-app-for-windows-phone#_91590

The best way to resolve an issue if you are not able to find an answer in the community is to open a support case.

Re: Unable to access Windows Store (Windows 10 + GP 3.0.2)

Remo — Fri, 02 Jun 2017 19:10:21 GMT

@jmenon

The problem is NOT the Global Protect app/application. We also use the application and it works great. The only issue in this topic is: Accessing the windows store while connected to a global protect gateway with 0.0.0.0/0 routed into the tunnel.

Now how are you going to solve an issue (if its not mission critical like this one) when:

PaloAlto says that it is a problem of windows
Microsoft does not care because the store is accessible without GP or with their own VPN, so it can't be a problem of windows

Re: Unable to access Windows Store (Windows 10 + GP 3.0.2)

jmenon — Fri, 02 Jun 2017 19:36:59 GMT

Got it. Thanks for the clarification. Will invsetigate internally so as to what's happening and update the thread.

Another quick question, is this problem only when you are using the Wndows 10 UWP GlobalProtect app ? Meaning if you use the regualr windows GlobalProtect app on a windows 10 device and have the VPN established are you able to access the Windows Store ?