topic Re: Global Protect Dropouts in General Topics

Global Protect Dropouts

PANgraves — Fri, 21 Dec 2018 01:24:18 GMT

Hi,

I keep getting dropouts, from global protect. It will say connected but I'm not able to remote to other machines that I know are on the network and then will disconnect and re-connect for some unknown reason like every minute or so. I looked through the logs but can't really figure out what is going on. Any nudge in the right direction would be greatly appreciated. Below is a summation of what i know :

Re: Global Protect Dropouts

mmeehan — Fri, 21 Dec 2018 15:15:26 GMT

We have seen the same issue, it appears the client maintains the connection and PING the VPN GW however users cannot access outside services for periods of time. The dropouts are not consistent as far as time and the drops/outages can last up to 5 min. We are using the 4.1.6 client after upgrading however this has not helped.

I worked with TAC and need to collect some log, I can report back once i get more information.

Re: Global Protect Dropouts

BPry — Mon, 24 Dec 2018 20:55:33 GMT

@PANgraves,

Look at you App configuration, specifically 'User Switch Tunnel Rename Timeout (sec)', and report back what this is set to. By default, if a tunnel detects that the user-id information has changed you'll only have that set timeout period to reauthenticate the tunnel. This kind of sounds like what you are running into.

Re: Global Protect Dropouts

mmeehan — Thu, 03 Jan 2019 17:04:21 GMT

The timeout was set to the default so to continue testing I increased the time to 100 seconds and according to the client that solved the issue. We still have a few more rounds of testing but this could be the cure.

Re: Global Protect Dropouts

PANgraves — Thu, 24 Jan 2019 06:35:20 GMT

@BPry Thanks for the suggestion, But I don't have any app configuration,

I'm still unable to connect to the sites I need due to these dropouts

When it connects it will connect to LAN2 and then Drop it for LAN1

Re: Global Protect Dropouts

BPry — Thu, 24 Jan 2019 21:11:24 GMT

@PANgraves,

The setting that I mentioned is available on the firewall and is not available on the agent settings. if you don't have access to the firewall you wouldn't be able to modify the User Switch Tunnel Rename Timeout value.