Clientless VPN 404 error

[porq91]

Hello everyone,

i installed the clientless vpn and up to the login page everything is fine, but when i click on one of the apps i set it gives me the error "404 page not found", I don't have any kind of traffic log that I can analyze, the globalprotect vpn and clientless packages are correctly installed.

The security policies are correct, I also tried to downgrade the release, restart everything but nothing seems to work.

Any advice?

Release: 10.2.2-h2

Device: PA-220

Thanks in advice,

Angelo.

[kiwi]

Hi @porq91 ,

I believe you might be running into a known issue. 

Please reach out to support to have a confirmation of the bug and expected release fix.

Best,

-Kiwi.

[porq91]

After hitting my head for quite a while I finally solved it by removing the current clientless VPN package, uploading the same version of the package to the firewall and reinstalling it.

Currently I see all the icons and the port forwarding works correctly, it will be interesting to see what will happen to a possible restart or update of the device if it continues to work.

Angelo.

[taviss]

Ran into this issue as well, when we moved over to 10.2.2.   There is something wrong with 95-239 and 10.2.2.   We rolled the clientless application down to panup-all-gp-89-207, (no reason other than the date looked good.) once manually installing file from the GUI, we installed the older version and turned off the schedule updates. Once panup-all-gp-89-207 was marked as currently installed all our clientless apps came live again. 


When we have some more time, i'll check out what " latest version works" but we can confirm moving down to panup-all-gp-89-207 did restore our clientless apps

[jclarkevt]

Hello, I'm having this same issue where did you locate the older version: panup-all-gp-89-207 I don't see the last two version on my Dynamic updates window?

[Liviu_Bodeanu]

Hi @jclarkevt,
The panup-all-gp-89-207 can be downloaded from the PAN customer support portal section Updates - Dynamic Updates and search for Content Type - Clientless VPN.
After you downloaded the package, follow the below KB to manually install it. (CUSTOMER SUPPORT PORTAL (CSP) section)
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGRCA0

[SamKear]

Thanks, we had the same issue and installing 89-207 resolved the issue for us too.  Have you opened a support case for this?  Curious if they are already aware of the bug.

[jeremyw]

For my customer, on PAN-OS 10.2.5, manually uploading and installing the latest GlobalProtect Clientless VPN version 98-260 followed by disabling all GlobalProtect Clientless VPN configuration, committing configuration, then configuring GlobalProtect Clientless VPN again has resolved the issue!

I followed the manual installation steps on both active and passive members of the HA pair as I would expect the issue to have reoccurred during an HA failover event.

There is still an issue where local user groups can not be used to assign applications to users. I have a case open with Palo Alto to troubleshoot this further.

[rickyboone]

Confirmed that this is still an issue.  Upgraded 3200 series from a recent 10.1.x build to 10.2.6, with panup-all-gp-98-260 already installed and running without issues on 10.1.x.  Simply reverting to a previous version did not resolve it.  Reverting back to 98-260 did not resolve it either.  Uploading a third, older version from the CSP then installing, then uploading a fourth, older version and installing seemed to remove 98-260 fully from the firewall's software repository to the point that I had to re-download or upload it again, in which case that allowed it to work.

[SShnap]

I had the same issue with PANOS 10.2.7 GP clientless VPN 98-260 after upgrading.

I deleted 98-260 file and uploaded it manually and it works like a charm.

Thank you.

[Joseph.Johnson]

Had the same issue on HA pair of 3410 running PanOS 11.1

Like others above mentioned, deleting 98-260 from Device > Dynamic Updates > GlobalProtect Clientless VPN. Then downloading the 98-260 from CSP portal and manually uploading/installing from file solved the issue. (https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGRCA0 )

Thanks

[RuslanLevenets]

Hi all,

We have been using 89-207 with several PanOS 10.1.x versions for about a year or so with our Clientless VPN as a workaround solution found in this topic.

However, we just upgraded to 10.2.8 and it stopped working with 89-207, so we decided to activate 98-260 which previously never worked with any PanOS but now it worked well!

The previous test with 10.2.x branch was when we tested 10.2.5 last year which only worked with 89-207 and didn't work with 98-260.

Assuming, 10.2.8 has a fix to this issue.

Can you guys test and confirm?

[FrankRocks]

Upgraded 10.1.10-h2 -> 10.2.8 yesterday. While this was still an issue when the organization woke up... the same fix worked for me. Is uninstalling 98-260, then manually uploading it. Easy peasy lemon squeezy. 

[JohanSM]

This solved it for me, a manual install. Most clear explanation, thank you.

[A.BudiS]

PAN-OS 10.2.9-h1 got the same issue on clientless vpn portal.

the fixed is installing the clientless vpn version to 98-260.
Wonder wether PANW -TAC aware about this issue if this is a known issue/bug.

Thanks folks for heads up the solution.