topic Re: VPN dissconnect part II in General Topics

VPN dissconnect part II

jdprovine — Mon, 05 Mar 2018 15:51:45 GMT

So other than the time out settings for the GP client. Is there limit set somewhere that tells it to disconnect a client for dropped, insufficient or any other packet settings

Re: VPN dissconnect part II

BPry — Mon, 05 Mar 2018 17:11:05 GMT

So I'm assuming that this is a continuation of the last issue, and so have followed the same troubleshooting path. If that's not the case this could easily be wrong.

A few things I can think of.

1) Max User setting is enabled. (Gateways > Gateway > Agent > Tunnel Settings )

2) The user is dropping enough packets that the tunnel is collapsing. (On a GP Client this is less of an issue, with XAuth and built-in VPN clients I'm not so sure.)

3) The user really isn't testing much and just wants it fixed so he's telling you what you would want to here. If you can't duplicate the issue off his home network, I would be suspicious that he's actually testing much.

Re: VPN dissconnect part II

jdprovine — Mon, 05 Mar 2018 17:50:39 GMT

@BPry

More like a nightmare :P. I have two other users(co-workers) that are having issue getting booted out but they are also remoting to their desktops via VPN from home

1. max user is not set

2. We have x-auth enabled Gateway\agent\tunnel setting Enable X-auth support is selected

3. The user (co-worker) is not doing all the things I have requested, he won't try to connect to the portal via a web browser to make sure it is up, he has not done wireshark from home. I cannot replicate the issue with his laptop, on a cable modem here at work.

I think the wireshark is the only thing that would tell us about the packet drops, run from his home of course. I have also offered to run a packet capture on the PA when he is trying to connect from home, but that won't help if he never makes it to the AP

Re: VPN dissconnect part II

Mick_Ball — Mon, 05 Mar 2018 18:58:41 GMT

There was a co-worker from.... oh wrong post....

hi @jdprovine.

i cant see how this can be due to any tunnel or session timeouts, not sure what they are called....

because in your previous post you mentioned that on the PA you noticed an existing user session being disconnected.

this would not be the case if the PA disconnected the tunnel itself.

nor would you see this if the client disconnected gracefully..

wireshark will not deffo be the answer but may show what is going on.

you said that the users client was showing as disconnected when this happened so the reason for this disconnection must be in the pangps client logs somewhere...

you have posted log entries but not all, mostly for reconnection attempts,

could you not ask the user to tell you what time this occurred and look at the logs up to when this happened.

Happy to trawel through the logs myself but not sure how you can get them to me..

Mick.

Re: VPN dissconnect part II

jdprovine — Mon, 05 Mar 2018 19:02:11 GMT

@Mick_Ball

Now I can't get him to do the wireshark, he says it too much information and his issue is sporatic. Which logs are you referring too?

Re: VPN dissconnect part II

Mick_Ball — Mon, 05 Mar 2018 19:13:16 GMT

From the clint device...

pangps.log

Re: VPN dissconnect part II

OtakarKlier — Mon, 05 Mar 2018 19:30:07 GMT

Hello,

I would also peak at the time limit settings.

However the sporadic/intermittent ones are the worst to work with.

Re: VPN dissconnect part II

jdprovine — Mon, 05 Mar 2018 19:41:55 GMT

@OtakarKlier

This user doesn't hit the limits, his connection is intermittant right at the start

Re: VPN dissconnect part II

OtakarKlier — Mon, 05 Mar 2018 19:46:39 GMT

Yeah that bites...hard to test a solution like that :(.

Re: VPN dissconnect part II

jdprovine — Mon, 05 Mar 2018 19:51:13 GMT

@Mick_Ball

More than I gave you I presume and I downloaded the tech support file but I haven't found anything obvious yet and I have been looking through the sslvpn_ngx_error.log not sure it that is the one I should look at or not

Re: VPN dissconnect part II

Mick_Ball — Mon, 05 Mar 2018 19:57:13 GMT

Sorry @jdprovine, not sure what you are saying....

Re: VPN dissconnect part II

jdprovine — Mon, 05 Mar 2018 20:04:04 GMT

@Mick_Ball

In the previous threads I gave you a snippet of the pangp.log from the globalprotect client but I assume there wasn't enough information in it to make any determination, so I assume you want more of that log to look at. There is another log you can get if you download and open the tech support file which is sslvpn_ngx_error.log,

Re: VPN dissconnect part II

Mick_Ball — Mon, 05 Mar 2018 20:32:21 GMT

Yes the pangp log that you sent a snippet of... it would be great to see the whole file but not sure if you can send it....

Edit: or if your prepared to post it....

Re: VPN dissconnect part II

jdprovine — Tue, 06 Mar 2018 13:09:02 GMT

@Mick_Ball @OtakarKlier @BPry @reaper

My coworker is supposed to bring in some packet traces for me to review today so hopefully we can see something. But I am also seeing on the firewall that he is getting in and on the server he is accessing he is getting a tcp resever from server. To me again that point toward his ISP correct me if I am not correct.

Re: VPN dissconnect part II

Mick_Ball — Tue, 06 Mar 2018 14:19:49 GMT

well yes it's pointing that way... the TCP RST (Reset) will be sent if the conversation is idle for an extended period of time...

did your co-worker state that he/she was disconnected at that particular time? or did you just happen to see it...

Re: VPN dissconnect part II

jdprovine — Tue, 06 Mar 2018 19:46:02 GMT

@Mick_Ball @reaper

I found this in the traffic logs on the PA and looked up what the possible causes could be and found this

tcp-reset-from server - resources unavailable. The session dropped because of a system resour limitation. For example the session could have exceeded the number of out-order packets allowed per flow or the global out-of order packet

Re: VPN dissconnect part II

Mick_Ball — Fri, 16 Mar 2018 15:48:12 GMT

Hi @jdprovine

VPN dissconnect part III

is well overdue...

Re: VPN dissconnect part II

jdprovine — Fri, 16 Mar 2018 16:00:25 GMT

@Mick_Ball

LOL another squel I must check it out

Re: VPN dissconnect part II

jdprovine — Fri, 16 Mar 2018 16:07:46 GMT

@Mick_Ball

Oh you meant I should do an squel LOL