topic Re: Global protect and Outlook 2016 in General Topics

Global protect and Outlook 2016

KarthikRamalingam — Wed, 04 Sep 2019 13:07:29 GMT

Recently we observed an issue for users on GP and using outlook.

When the GP is etablished and if the user launches Outlook in less than 1 min the outlook throws the error

"we are unable to connect right now. please check your network and try again later"

The same user once connected to GP and tried to launch post 1 min the outlook works fine

I am unable to link to GP or generic Outlook behaviour, any pointed from the community is highly appreciated.

Re: Global protect and Outlook 2016

Mick_Ball — Wed, 04 Sep 2019 13:59:01 GMT

are you using user-ID mapping?

Re: Global protect and Outlook 2016

KarthikRamalingam — Wed, 04 Sep 2019 14:01:39 GMT

Yes, GP auth then user-id maping for the same.

Re: Global protect and Outlook 2016

Mick_Ball — Wed, 04 Sep 2019 14:03:29 GMT

is part of your outlook config cloud based... if so then it may be denying traffic as user ip mapping is not yet complete.

Re: Global protect and Outlook 2016

Mick_Ball — Wed, 04 Sep 2019 14:07:22 GMT

if a user disconnects and then reconnects immediately, does it still take 1 min ?

Re: Global protect and Outlook 2016

KarthikRamalingam — Wed, 04 Sep 2019 14:16:22 GMT

Yes, outlook is cloud based hybrid connections. logically the connection would take a min to be established post GP is connected and outbound access is user-id specific.

does user-id mapping takes close to a min to complete? i ran fw tests under a min trying to launch outlook and it does fail.

But the version on GP reminded with no recent upgrade, all i can pin is the latest office update the end user machine team did.

Re: Global protect and Outlook 2016

Mick_Ball — Wed, 04 Sep 2019 14:25:53 GMT

user ID is almost instant... but it will not take place until an event such as a drive mapping or domain authentication takes place.

this triggers an event to be written to the AD security log which includes the AD user ID and his/her/it's IP address. this is what the agent collects.

there are other options like device probing WMI stuff but i cannot help with this...

we allow access to all microsoft URL's without user ID required, that may be one option, or perhaps run a post VPN script that is included with GP such as GPUpdate... thats assuming mapping latency is the issue here...

also... set your mapping timeout higher... some suggest 8 to 12 hours but we use 24.

Re: Global protect and Outlook 2016

KarthikRamalingam — Wed, 04 Sep 2019 16:08:55 GMT

Well, i did test the connection to Microsoft URL's as a non user-id specific connection with a dedicated rule with source user group.

The status is remaining the same, post GP connection comes live, the outlook once launched works fine post 1 min of GP establishment, but fails to authenticate outlook and prompts password if attemted within 1 min of GP coming up.

p.s. taken off any SSL decryption that were currently in place assuming decryption was playing any part.

Re: Global protect and Outlook 2016

Mick_Ball — Wed, 04 Sep 2019 16:13:33 GMT

is this new..

"and prompts password if attemted within 1 min of GP coming up."

as this was not mentioned in your first post...

Re: Global protect and Outlook 2016

KarthikRamalingam — Wed, 04 Sep 2019 17:50:38 GMT

Yes, if outlook launched within 1 min of GP coming up the outlook says its offine and needs password (i.e., AD logon) to pass through

Re: Global protect and Outlook 2016

Mick_Ball — Wed, 04 Sep 2019 18:04:22 GMT

Are you still getting this message

"we are unable to connect right now. please check your network and try again later"

Re: Global protect and Outlook 2016

KarthikRamalingam — Wed, 04 Sep 2019 18:09:50 GMT

Yes, that's the error, tested it with ruleset permitting any generic users as suspected user-id mapping was causing anykind of slownes, but the status remains the same.

Re: Global protect and Outlook 2016

Mick_Ball — Wed, 04 Sep 2019 18:20:12 GMT

So do you still have a source user group in the policy. If so then set the source user to any and test again.

Re: Global protect and Outlook 2016

KarthikRamalingam — Mon, 09 Sep 2019 10:37:30 GMT

Yes, we did tried with a rule set having no source user/group attached, but no luck hence had escalated with MS Outlook if there are any latest bus on their office updates.

Re: Global protect and Outlook 2016

Retired Member — Thu, 31 Oct 2019 20:00:52 GMT

Any resolution to this issue? We are running into this same issue with Prisma.

Re: Global protect and Outlook 2016

mtijhoff — Wed, 18 Dec 2019 08:20:50 GMT

We have the same issue, but only if we use a full Globalprotect VPN and not if we use a split tunnel (default here).

I found out the reason is that the GlobalProtect network interface has no default gateway, but only routes are pushed.

Because of this, the Network Location Awareness service does not attempt to check if there is a connection to the internet.

Office programs rely on the NLA service and don't check themselves if they are online. Because of this, the apps assume they are offline when you are connected via GlobalProtect.

Other VPN service also have the same problem: https://superuser.com/questions/1447783/why-do-windows-10-apps-and-office-outlook-word-onedrive-etc-have-no-interne

Our clients are asking if they can use the full VPN more and more, but with this problem we can't provide them with it..

Re: Global protect and Outlook 2016

KarthikRamalingam — Mon, 13 Jan 2020 16:50:17 GMT

Thanks for those pointers, we have this pushing with MS again, lets see how it turns out with NIC level modifications for the apps to work as expected.

Re: Global protect and Outlook 2016

jambulo — Mon, 06 Apr 2020 20:42:21 GMT

Has anyone found a fix for this? I can confirm, with full tunnel VPN MS Office thinks there is no internet. With split tunnel VPN MS Office can see that there is an internet connection.

Re: Global protect and Outlook 2016

rajjair — Tue, 07 Apr 2020 05:33:23 GMT

Hi All

I had the similar issue and was able to to trace it down NCSI causing the problem, the probe HTTP was failing for me. You can check windows event logs to see if you are facing the same issue - Microsoft-Windows-NCSI/Operational

This is logged in the event it was failing:

Capability change on {57a83755-d89b-4a01-a72d-d4786875d856} (0x6008009000000 Family: V4 Capability: None ChangeReason: ActiveHttpProbeFailedButDnsSucceeded)

I need to allow "www.msftconnecttest.com" this site access in pre-logon policy.

For more info check this blog

https://support.microsoft.com/en-us/help/4494446/an-internet-explorer-or-edge-window-opens-when-your-computer-connects

https://www.ghacks.net/2014/02/07/disable-customize-windows-internet-connection-test-improve-privacy/

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-vista/cc766017(v=ws.10)?redirectedfrom=MSDN

I hope this helps fix your guys issue

Re: Global protect and Outlook 2016

KarthikRamalingam — Tue, 07 Apr 2020 07:57:02 GMT

Yes, we had similar tweak done under the Enforce GlobalProtect Connection for Network Access option under app in the GP agent profile by excluding the NLSA lookup DNS IP of Microsoft. We are still testing it though.

Split tunneling would eliminate this issue completely again, the above option we are testing with is very much in line with split tunneling 🙂