topic Re: GP users are getting denied random times in General Topics

GP users are getting denied random times

GeorgiosFakis — Wed, 27 Nov 2019 12:57:56 GMT

I have global protect v5.0.5 deployed to all Corporate Windows and some users reported that when they work everything stop to work and suddenly after 5-10 minutes is back again without disconnecting them from the global protect .This happen random times and not always .I have a user though that he reports that every day for the last week .

Palo Alto version is 8.1.11 VM-300 and GP agent 5.0.5 on a Windows 10.

I can see from the logs user is working fine in one server , then traffic getting blocked and can see only traffic log but not threat etc.

I am allowing based on the IP and the Zone and destination is any app any service .

HIP looks fine and agent is sending the report every hour .

Today this happened to a user connected 7 am and stopped working around 10am for 5 minutes .In the logs I can see HIP reports were send before and after the incident and user-id was reported that was learned from the AD .

I can see from the logs if that is helping that user is not written and after working is written . Is that related to USER-ID where I need to exclude the IP pools from the GP on the USER-ID ?

Re: GP users are getting denied random times

Mick_Ball — Wed, 27 Nov 2019 13:43:12 GMT

could you just confirm if your policy is based on source user-ID or user IP address.

Re: GP users are getting denied random times

reaper — Wed, 27 Nov 2019 13:44:21 GMT

GP does it's own UserID so if you have the IP pool included in the regular userID, this could cause a conflic. excluding the subnet would be a good step to see if it resoves your issue

you could also track global counters to help guide your search to the cause of users getting dropped during that timeframe

Re: GP users are getting denied random times

GeorgiosFakis — Wed, 27 Nov 2019 13:49:33 GMT

We had some issues 2 months ago with the Pilot where user let's say George had another account like adminGeorge and group was different so we removed the user/group access filtering in policy .

Now we have Source IP pool that we provide and the Zone of Global Protect only .

Destination is any any to internal resource for that user had issues today and with AV,VULN,ANTI-SPY profile . Nothing was blocked because of the profiles .

Re: GP users are getting denied random times

GeorgiosFakis — Wed, 27 Nov 2019 13:56:09 GMT

I can see that today but issue started before 10:13 . 10:13 was reported that was ok and user connected 7am which I don't have logs before that for user-id which is strange.

Re: GP users are getting denied random times

MP18 — Wed, 27 Nov 2019 21:55:00 GMT

Hi Remo,

When you say GP does it's own UserID ?

How does this work?

I am testing GP with assigning VPN pool a /24 subnet and it is based on the IP address.

Regards

Mike

Re: GP users are getting denied random times

Remo — Wed, 27 Nov 2019 22:55:24 GMT

@MP18 I think you meant @reaper and not me 😉

But what he was saying that as soon as a user logs in to GP, the firewall assings a local user-ip-mapping with globalprotect as source. So if you also have User-ID agents in place, a mapping there could lead to a conflict and if the mapping on the user-ID agent is newer the local global protect mapping will be overwritten.

@GeorgiosFakis do you have logs of that timeframe(s) where the users reported that they lost the connection? Does this problem exist for all your users at random times or "only" for a small group of users?

Re: GP users are getting denied random times

GeorgiosFakis — Thu, 28 Nov 2019 08:30:13 GMT

It's not sure how many experience the issue but right now i have reports from 20 users .

During the pilot phase was reported by 2 only but I had 20-22 pilots and most of them are not using the global protect all day , so it's not clear since the users are not connected the whole day on the global protect.

The reports I get about the issue is from users that are connected 8-10 hours constantly .

Re: GP users are getting denied random times

Mick_Ball — Thu, 28 Nov 2019 08:50:39 GMT

what is your user ID timeout currently set to.

Re: GP users are getting denied random times

GeorgiosFakis — Thu, 28 Nov 2019 10:32:45 GMT

Is set to 45 minutes :

Re: GP users are getting denied random times

Mick_Ball — Thu, 28 Nov 2019 11:34:36 GMT

I would extend that to 480 (8 Hours)

I have mine set to 24 hours but for some thats too long.

4 Hours may be OK. but try 8 and reduce if needs be.

Re: GP users are getting denied random times

Mick_Ball — Thu, 28 Nov 2019 11:41:13 GMT

also use....:-

show user ip-user-mapping all

this will display all known users to IP address and when the expire

Re: GP users are getting denied random times

GeorgiosFakis — Thu, 05 Dec 2019 09:06:37 GMT

I have done this but again user reported that next day .

I got debugging logs from user and I see it's an issue on HIP report that timed out . I have opened a case with Palo Alto and waiting their availability to check it .

Re: GP users are getting denied random times

MP18 — Thu, 05 Dec 2019 16:38:44 GMT

Keep us posted on this.

Lets see what PA says?

Surprise Hip report can cause this issue

Re: GP users are getting denied random times

GeorgiosFakis — Fri, 06 Dec 2019 08:33:23 GMT

PA released version 5.0.6 that fix some HIP issues. Now for the case I have they are still reviewing the files I sent them .

From what I see is that :

(T20032) 11/28/19 11:18:03:568 Debug(4477): Send hip report check failed

I have increased the timeout to 1 day for the HIP report from 3 hours that was set.I will keep you posted .

Re: GP users are getting denied random times

GeorgiosFakis — Sat, 07 Dec 2019 09:17:05 GMT

Palo Alto engineer and myself we were looking the logs .

User connected in the morning , opened a UDP session with significant amount of data transimtted and recevied .Was allowed by an ACL in line 35 let's say and after 3 hours Deny ALL acl was matching in line 50 .

We see that HIP report was sent and there flags 0x63 & 0x61 on the allowed and deny from the log .We suspect that is related to HIP report .We see that was sent every hour and HIP log is matching the HIP profile every hour .Question is why traffic that elapsed time was 3 hours is mathcing after that time DENY ALL ACL.

Re: GP users are getting denied random times

MP18 — Sat, 07 Dec 2019 17:14:41 GMT

Thanks for updating on this.

Re: GP users are getting denied random times

GeorgiosFakis — Wed, 26 Feb 2020 14:28:18 GMT

Forgot to update

We fixed that with disabling the timeout of the user-id but we also upgrade the agents to 5.0.8.

Re: GP users are getting denied random times

ksauer507 — Mon, 21 Feb 2022 17:12:19 GMT

I know this is an old thread but I'm experiencing the same issue, 3220 fw's with 10.0.8-h8 and GP 5.2.10-6 on Windows 11. First I thought it was an expiring cookie, but your right its right after the hip check. Strange I see exactly the same thing.

So when you say you disabled the timeout of user-id, do you mean you unchecked Enable User Identification Timeout in the cache section in Device > User Identification?

Re: GP users are getting denied random times

GeorgiosFakis — Tue, 22 Feb 2022 08:12:36 GMT

Hi ,

Yes that it is but keep in mind your logging will not be correct because the IP mapping will stay in the firewall for a long time.

This will might cause issues in your logs for other USER-ID for IP mapping for other zones like server zones where username will stay there.

For example , if you have a server let's say that is doing some service and has a service account and you RDP , the logs and the IP mapping will have for everything your username unless someone else RDP the server.