topic Re: GP 4.1.0 released and.... in General Topics

GP 4.1.0 released and....

hshawn — Wed, 07 Mar 2018 15:51:01 GMT

I have not seen any chatter or mention of this but I tried the 4.1.0 GP client in a lab environment yesterday.

The good:

* The app is redesigned and looks really nice

* You can now select from/add/remove multiple gateways!

The bad:

* It would not connect to the VPN even after a reboot and reinstall 😕

After going back to 4.0.7 everything worked again, then trying 4.1.0 again and same thing (no connection) then back to 4.0.7 and yay! working again. I see the traffic coming into the portal and being allowed, the client just never gets an established connection.

Anyone else brave enough to play with the new GP client? What did you find? Did it work? Same issue I am seeing?

Whats next:

I will try the new client on some other machines and OS versions to see if I can isolate the issue to a certain root cause. We won't be using this in production for a while or at least until I can validate this issue will not happen if we update all endpoints someday.

Re: GP 4.1.0 released and....

BPry — Wed, 07 Mar 2018 16:01:07 GMT

@hshawn,

Been running the 4.1 client on 8.1 for awhile without issues. Even if it's supposed to 'work' with 8.0 I wouldn't really recommend crossing like that at the moment.

Re: GP 4.1.0 released and....

hshawn — Wed, 07 Mar 2018 16:03:17 GMT

@BPry

Thanks, I was starting to wonder if it "required" PANOS 8.1 to function properly. I am not ready to take the 8.1 plunge yet, not even on my lab device after readin ghte known issues 😕

Re: GP 4.1.0 released and....

BPry — Wed, 07 Mar 2018 16:06:00 GMT

@hshawn,

I honestly haven't tried 4.1 on anything but 8.1, so I can't say if this is a known issue at all. According to documentation it should work perfectly fine on 8.0, and I think it even goes back to 7.1.*.

Re: GP 4.1.0 released and....

BPry — Wed, 07 Mar 2018 16:23:49 GMT

@hshawn,

I actually just updated the GP client on my 8.0.8 LAB device and it's working and connecting perfectly fine. You might want to play around with it a little bit more; potentially try uninstalling the agent and then installing it with 4.1.0 from scratch might work better than a direct upgrade?

Re: GP 4.1.0 released and....

hshawn — Wed, 07 Mar 2018 16:38:25 GMT

@BPry

That may tell me if it works better or not but when we eventually upgrade it will have to be through the good ol' activate the new version on the gateway and let it auto update when users connect. So I want to make sure I get a good woprking endstate following the same path we will use for everyone.

I will try a manual install later tonight just to see what results I get tho

Re: GP 4.1.0 released and....

BPry — Wed, 07 Mar 2018 16:40:53 GMT

@hshawn,

Just a heads up, 4.1.0 is a huge visual improvement over what was available previously. While it's very easy to interpret what they need to do, it might require a bit of re-training for more challenged end-users 🙂

Re: GP 4.1.0 released and....

hshawn — Wed, 07 Mar 2018 16:42:48 GMT

yep! I like the new look. most of our users are on pre-logon always on so they don't have much interaction but when the time comes we will have communication sent out to all

Re: GP 4.1.0 released and....

Mick_Ball — Thu, 08 Mar 2018 09:38:09 GMT

@hshawn, Hi.

Probably of no use to you but just to let you know that 4.1 seems to work OK with 7.1.15 and 8.0.8 aswell as 8.1.

this is using several auth options such as...

allways -on

on -demand

certificate auth only

radius only plus auth overide cookie

radius plus certificate

radius plus certificate plus auth overide cookie

ldap plus certificate.

unfortunately we do not use pre-logon. so cannot test....

group membership also works OK as login below (Admin Level) has the option to pick what gateway as well as portal.... I think you meant portal in your original post..

Re: GP 4.1.0 released and....

hshawn — Thu, 08 Mar 2018 10:47:10 GMT

Ok so this gets more confusing, I'm using 8.0.8 and the 4.1.0 client just refuses to connect at all in any of my tests.

Uninstall 4.0.7 and fresh manual install of 4.1 - no connection

Upgrade from firewall - no connection

Windows 10 - no connection

Windows 7 - no connection

Linux - no connection

OSX - testing soon

Going back to 4.0.7 - works perfectly

Since I am the only one seeing these issues here but I have tried a mixture of client environments the common denominator is the firewall itself. Maybe something in my config that 4.1 does not like but everything prior has no problem with..

Re: GP 4.1.0 released and....

Mick_Ball — Thu, 08 Mar 2018 11:50:43 GMT

could it be a pre-logon issue with 4.1.

have you tried other auth methods or just pre-logon.

Re: GP 4.1.0 released and....

hshawn — Thu, 08 Mar 2018 15:13:54 GMT

@Mick_Ball

Yes primarily I have been trying it in the lab with on demand mode

Re: GP 4.1.0 released and....

BPry — Thu, 08 Mar 2018 15:26:55 GMT

@Mick_Ball @hshawn,

I was actually playing around with this quite a bit last night, simply because I actually want to get 4.1 and the new UI rolled-out as soon as possible. I couldn't reproduce any connectivity issues in on-demand or pre-logon regardless of using 8.0.8 or 8.1.0. I'm guessing that it has to do something with your configuration, or for some reason the GP Package needs to be removed and re-downloaded/activated on your firewall. I've never seen one of those behavior poorly, but maybe something happened when you downloaded 4.1 that is causing your issues?

Re: GP 4.1.0 released and....

hshawn — Thu, 08 Mar 2018 16:28:37 GMT

This morning I manualy installed the 4.1 client on a device configured for the corp network portal/gateway using pre-logon always on and it worked like a champ.

This was an 8.0.8 connection same as the lab environment. so the client is working there and it must be something in the config that the 4.1 client does not like in the lab. the lab is also setup to allow native android clients using Xauth so maybe that is it? I might have to start trimming features away until I find an indicator. fun... so much fun

p.s. the successful testing was done on a 32 bit machine so the client was 32bit but that should not make a difference

Re: GP 4.1.0 released and....

Mick_Ball — Thu, 08 Mar 2018 16:45:10 GMT

have you looked at the PanGPS log from the client device, it may be helpful...

Re: GP 4.1.0 released and....

hshawn — Thu, 08 Mar 2018 17:03:48 GMT

I am not seeing anything helpful in the logs... but just to make it more confusing... it *works* on OSX!!

to summarize:

* OSX - working

* win7 - nope

* win10 - nope

* Linux - nope

I have created a support ticket, I can't help feel like we are always seeing crazy one-off nobody else has that issue type of things all the time.

Re: GP 4.1.0 released and....

ChrisSmith — Thu, 08 Mar 2018 23:17:55 GMT

How long is your password? I'm having an issue where the 4.1 client won't accept the last 3 characters of my password. I have a 25 character password. Frustrating.

Re: GP 4.1.0 released and....

ChrisSmith — Thu, 08 Mar 2018 23:29:04 GMT

Just rolled back to 4.0.7-5 and password works fine. Staying away until next release.

Re: GP 4.1.0 released and....

hshawn — Fri, 09 Mar 2018 04:31:07 GMT

@ChrisSmith

I think you just handed me the best clue! My password is 17 characters so I don't think its an issue of password length (for me anyway) I was looking at the logs (the PanGPS.log specifically) and noticed some odd broken XML in there then after reading your post I was looking at my password and noticed that part of my password was in the XML.

I think what is happening here is certain characters in the password are breaking it (notice line 3 below) The password character that appears before the broken XML tag is a < and after that is a > so I bet if i change my password to remove the < and/or the > it will be the magic fix for me. BUT Since prior versions don't break with that character and PA does not specify we cannot use that character, I think maybe they should fix the app and change their code to properly escape special characters.

(T5104) 03/08/18 18:47:04:975 Info ( 438): msgtype = hello
(T5104) 03/08/18 18:47:04:976 Debug(1120): Send response to client for request hello
(T5104) 03/08/18 18:47:05:479 Error(1455): end tag </7BsoX> not found
(T5104) 03/08/18 18:47:05:479 Error(1488): end tag </saved-passwd> not found
(T5104) 03/08/18 18:47:05:479 Error(1488): end tag </request> not found
(T5104) 03/08/18 18:47:05:479 Info ( 410): Message is not valid XML. Message is <request><ty
(T5104) 03/08/18 18:47:05:479 Info ( 194): Error processing receive data from client
(T5104) 03/08/18 18:47:05:479 Info ( 200): close client socket

This is just my theory and it really lines up with everything, I may test with a new password when I have time tomorrow and I will upadate my case with this new information. Thanks all for the dialog I feel pretty confident this is it.

Re: GP 4.1.0 released and....

BPry — Fri, 09 Mar 2018 14:06:19 GMT

@hshawn,

That's actually really interesting, and likely why you don't have many people running into it. I know that I have some users however that do actually utilize these characters in there password, so I'll have them give it a try.