topic Re: Never ending globalprotect VPN drops in General Topics

Never ending globalprotect VPN drops

jdprovine — Tue, 28 Aug 2018 14:08:01 GMT

Supporting VPN for people is a challenge no matter what VPN you are using but people never consider the reliabilty of their own ISP provider as part of that issue. So what is the best way to rule out the users ISP as the problem and not the globalprotect client/VPN access? But to be fair I do not want to rule that out either . This my users complaint :

We have been having an issue with the Global Protect client dropping us seemingly randomly when are connected. Sometimes we are remoted into local machines working in Clarion and/or Sybase. Other times we are remoted into our local machine and are dropped. The message we get sometimes is Global Protect is trying to reconnect and will do so in x amount of seconds. A user has been working from home this last hour and is having issues with this. We do need assistance as sometimes it is critical for us to remain connected to respond to an immediate issue. Could you please provide assistance?

Re: Never ending globalprotect VPN drops

OtakarKlier — Tue, 28 Aug 2018 16:49:05 GMT

Hello,

I feel your pain :(. What do the client GP logs state? I know its tought ot get them sometimes, but there could be an indicator. Also check the timeout settings, maybe they are too short? Also check the versions of GP and see if there are any known bugs, this has bitten me a few times in the past. I would probably even open a case with TAC and get their input on the issue.

Just some thoughts.

Re: Never ending globalprotect VPN drops

jdprovine — Tue, 28 Aug 2018 18:03:38 GMT

@OtakarKlier

I checked the timeout setting and they are set to 180 minutes or 3 hours. Yes tough to either get the users to collect them for you or to get them to sit down and collect the logs with you. I did some testing and I don't have any issue that they are having with any of the GP versions. The method they are using which is to VPN into their desktop at work and then work from it is not one that I would recommend to anyone. Not sure why we allow it

Re: Never ending globalprotect VPN drops

BPry — Wed, 29 Aug 2018 00:11:09 GMT

@jdprovine wrote:
The method they are using which is to VPN into their desktop at work and then work from it is not one that I would recommend to anyone. Not sure why we allow it

That's probably the most common way people use a VPN connection back to their organization, just FYI. The only people utilizing VPN to simply connect back to internal resources via their machine are auditors provided a laptop and everything they do is local to that one machine. The rest of my users will always remote back to their desktop sitting at the Agency building or in the Capital.

I'd say that out of all of my VPN connections active at any given time only 20-ish are actually using the VPN as you are expecting; everyone else does exactly this.

As you've already stated however really the only thing you can do is hammer home the fact that it's their connection causing the issue. If need be have them work from a laptop via the VPN when they are on-site with a stable 'guest' connection that doesn't have any access to internal resources; when the issue doesn't reappear with a known good connection that's usually enough for me to drive the point home.

Re: Never ending globalprotect VPN drops

jdprovine — Wed, 29 Aug 2018 12:20:57 GMT

@BPry

Yeah this has been brought to me repeatedly by the same people they want somehow to have it work exactly the same as if they were sitting at work at their desk and there are too many variables outside my control to provide that. It like wireless, its never going to be as reliable as being plugged in with a cable no matter how many people complain about it. Quite frankly I never have the issue that they do so all i can do is run some trouble shooting tell them the same thing and then wait for them to come back again later. They always blame the palo and the globalprotecte client but never their own ISP LOL. FYI I did expect these people to use this method because they are IT people in my own department LOL

Re: Never ending globalprotect VPN drops

jdprovine — Thu, 30 Aug 2018 12:08:38 GMT

@BPry @OtakarKlier @jdelio @reaper

How to I download or get the logs for support if my VPN client,version 4, does not have the collect log button?

Re: Never ending globalprotect VPN drops

reaper — Thu, 30 Aug 2018 12:52:47 GMT

there's nothing under settings > troubleshooting?

they can also be collected from your system

on my MAC they're in

/Library/Logs/PaloAltoNetworks/GlobalProtect/

on a windows machine they should be under

%HOMEPATH%\AppData\Local\Paloaltonetworks\GlobalProtect

Re: Never ending globalprotect VPN drops

jdprovine — Thu, 30 Aug 2018 13:21:50 GMT

@reaper

Well we are using version 4 of globalprotect and it does not have a settings tab but it does have a troubleshooting tab but no collect logs button. I want to make sure that I give the right logs to TAC and their instruction did not fit my situation and so far they have not responded to my question concerning that fact

Re: Never ending globalprotect VPN drops

reaper — Thu, 30 Aug 2018 13:24:58 GMT

did you click the 'start' button to start collecting logs? (just guessing here)

Re: Never ending globalprotect VPN drops

jdprovine — Thu, 30 Aug 2018 13:32:39 GMT

@reaper

Does this only collect when you have logging turned on and what is the best logging setting to use to determine the drops

%HOMEPATH%\AppData\Local\Paloaltonetworks\GlobalProtect

Re: Never ending globalprotect VPN drops

reaper — Thu, 30 Aug 2018 13:39:21 GMT

To troubleshoot i'd go with 'debug' level. After you're done set it back to 'info'

Re: Never ending globalprotect VPN drops

BPry — Thu, 30 Aug 2018 13:41:14 GMT

@jdprovine,

I'd look at upgrading to 4.1, as you get a few more options when it when it comes to troubleshooting and a real nice 'Collect Logs' button that will grab all the log files and zip them up for you; really easy to get people to get you log files at that time.

As @reaper mentioned the AppData folder will hold a few of the logs regardless of what you have for Troubleshooting settings that might be helpful.

Re: Never ending globalprotect VPN drops

jdprovine — Thu, 30 Aug 2018 13:51:09 GMT

@reaper

Yes and I have done the collecting of logs before, I just want to make sure I get the logs that TAC needs to help diagnose if there is an issue

Re: Never ending globalprotect VPN drops

jdprovine — Thu, 30 Aug 2018 13:52:02 GMT

@reaper

Set to panservice not panagent?

Re: Never ending globalprotect VPN drops

jdprovine — Thu, 30 Aug 2018 13:54:18 GMT

@BPry @reaper

I have been testing 4.1 on my PC but I have found it to be a bit glitchy, Some times there is no disconnect button and I have to disable the client to get it to disconnect and it starts logging in to the VPN when I restart my PC.

Re: Never ending globalprotect VPN drops

reaper — Thu, 30 Aug 2018 13:56:46 GMT

@jdprovine wrote:

@reaper

Set to panservice not panagent?

both 🙂

Re: Never ending globalprotect VPN drops

jdprovine — Thu, 30 Aug 2018 13:58:46 GMT

@reaper

So I have to run it twice? Because it seems to be an either or selection on the client

Re: Never ending globalprotect VPN drops

reaper — Thu, 30 Aug 2018 14:19:13 GMT

it's 2 processes you can separately run different log levels on, so you set log level for one and then the other 😉

Re: Never ending globalprotect VPN drops

jdprovine — Thu, 30 Aug 2018 14:34:51 GMT

@reaper

I had a TAC case open for this and they just called me back, they said to run pangpservice in debug mode and start. Then highlight the logs collected and paste into notepad and then upload to the case. The said I did not have to run as pangpclient but I trust your advice more reaper

Re: Never ending globalprotect VPN drops

reaper — Thu, 30 Aug 2018 14:43:51 GMT

no ones ever died from too many logs .... i think 😉