topic GlobalProtect and Microsoft NCSI in General Topics

GlobalProtect and Microsoft NCSI

Mick_Ball — Tue, 31 Oct 2017 14:44:25 GMT

When users are connected to GP they are unable to search online templates from both word and visio.

it works OK when connected to LAN and we have a test policy that allows all outgoing traffic for myself and I still cannot search the online templates via GP.

I think this has something to do with MS NCSI, as the VPN client has no default gateway.

perhaps someone else has experienced this or has a solution.

Re: GlobalProtect and Microsoft NCSI

OtakarKlier — Tue, 31 Oct 2017 18:50:19 GMT

Hello,

Have you checked the logs to see if/where the traffic is getting blocked? Sometimes SSL decryption has a funny way of breaking things.

Regards,

Re: GlobalProtect and Microsoft NCSI

Mick_Ball — Tue, 31 Oct 2017 19:00:32 GMT

Yes @OtakarKlier i have tried some diagnostics including the ssl decryption, we have a no decrypt policy for microsoft url’s.

i am running wireshark on the client and when we select “search online templates” we see no obvious packets being sent at that time.

It may be that something is being attempted or checked when visio/word is first opened, i will capture from start and look/monitor again.

thanks.

Re: GlobalProtect and Microsoft NCSI

Mick_Ball — Wed, 01 Nov 2017 16:28:21 GMT

OK as first suspected, this may have something to do with NCSI or microsoft network location awareness.

if GP connects via wifi to my isp router then the "search for online templates " is greyed out.

If GP connects via LAN connection to my isp router the option is available.

could anybody explain the above behaviour...

I am aware of this issue reported here.. https://blogs.technet.microsoft.com/the_microsoft_excel_support_team_blog/2014/03/24/office-2013-reports-no-internet-connectivity-with-vpn-connection/

to confirm...

no split tunnels.

DHCP is set on both wifi and LAN adapter.

to ensure consistency, i have made both of the connections via the same gateway.

even random or wild guesses would be welcome... I have probably tried most of them.....