Problems accessing Google Play Store while connected to GlobalProtect

L2 Linker

Problems accessing Google Play Store while connected to GlobalProtect

Have just noticed that having connected to GlobalProtect on Android (client version 5.0.3-13), I can browse the Google Play Store but can no longer download any apps or app updates. The status will say "Downloading" but never starts. The security policy on the appliance is allow outbound and everything is being allowed as far as I can tell. Disconnecting the Android phone from GlobalProtect fixes the problem, and apps can be downloaded again.

 

Is anyone else experiencing this?

Community Manager

Re: Problems accessing Google Play Store while connected to GlobalProtect

Do you have decrypt enabled?

Is there security policy allowing/denying these downloads?

Are any threats being triggered?

Can you check the global counters to see if any interesting messages show up?


Help the community: Like helpful comments and mark solutions
Reaper out
L2 Linker

Re: Problems accessing Google Play Store while connected to GlobalProtect

Hi Reaper,

 

No decryption

 

Policy shows traffic being allowed, although I have not precisely been able to tie down the destination IP address used by Google Play Store. Anyway, I saw no logs in monitor for traffic being denied in an outbound direction.

No threats were found matching the source IP address of the client device.

I have had a look through global counters but there is so much in there, do you have any hints? I did a filter on severity drop and could not see anything incrementing. 

 

Thanks.

 

Community Manager

Re: Problems accessing Google Play Store while connected to GlobalProtect

you'll want to filter global counters :

 

> debug dataplane packet-diag set filter match source <src> destination <dst>
> debug dataplane packet-diag set filter match source <dst> destination <src>
> debug dataplane packet-diag set filter on
> show counter global filter delta yes packet-filter yes (establishes the delta start)
> show counter global filter delta yes packet-filter yes 

if you don't know the exact destination, leave that blank (play arount with the available filters to narrow down as much as possible)

 

is split tunnel enabled on the GP agent ?


Help the community: Like helpful comments and mark solutions
Reaper out
L2 Linker

Re: Problems accessing Google Play Store while connected to GlobalProtect

Ok have set up the filter and then tried downloading from Play Store. These lines keep appearing more often than anything else:

 

pkt_outstanding 6 0 info packet pktproc Outstanding packet to be transmitted
pkt_alloc 16 0 info packet resource Packets allocated
pkt_swbuf_fwd 14 0 info packet pktproc Packets transmitted using software buffer
flow_tcp_non_syn 1 0 info flow session Non-SYN TCP packets without session match
flow_tcp_non_syn_drop 1 0 drop flow session Packets dropped: non-SYN TCP without session match

 

There is no split tunneling configured.

 

Thanks,

 

Andy.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!