topic Re: GlobalProtect connection problems in General Topics

GlobalProtect connection problems

cansurmeli — Mon, 21 Oct 2019 10:49:15 GMT

GlobalProtect version 3.1.6-19.

Windows Server 2012 R2 ver 6.3 (Build 9600)

Hi there,

We' ve a server in the remote network that we reach with GP, we regularly (mostly hourly) pull data from that server. There is a windows service that we wrote to do this pull data process. The GP is must be running and connected in order for the service to pull data from the database. We want to be able to the GP connection to last for a long time without any connection lost. But there are several problems about software:

Whenever a VPN connection is lost for any reason (network error or user interaction), the connection fails when I try to reconnect. I' ve to reinstall the app to reconnect successfully. Could this error be caused by the OS I'm using?

Also, when another user logout from the server (remote or local) again vpn connection is lost. Is there a process that will cause the vpn connection to break while users logout?

any suggestion to solve these problems?

thanks

Re: GlobalProtect connection problems

BatD — Mon, 21 Oct 2019 13:07:24 GMT

@cansurmeli I did not clarify which PanOS version you run, but Global Protect client 3.1.6 is quite old and no longer supported software (EOL May 2018), so it is unsurprising you are having issues.

Additioanlly, GPis designed for end users and not really for server use. Even though it may work, officially according to the below Windows Server 2012 does not support the GP app:

https://docs.paloaltonetworks.com/compatibility-matrix/globalprotect/where-can-i-install-the-globalprotect-app

Maybe a better option would be to use IPSec VPN, rather than global protect.

Re: GlobalProtect connection problems

BPry — Tue, 22 Oct 2019 02:51:42 GMT

@cansurmeli,

Going to agree with @BatD and say that what you are describing is not best supported by GlobalProtect. I would work with remote network to get a b2b site-to-site tunnel setup between networks. You would only need access to the one server and they can restrict your access through their firewall just as easily as they can with GlobalProtect. This would be a better solution for what you are doing.