Couldn't access link "" from global protect VPN

Showing results for 
Search instead for 
Did you mean: 

Couldn't access link "" from global protect VPN

L1 Bithead

Hi Experts,


Users couldn't access the  link "" from global protect VPN, this is a normal bank related link so everyone can access though outside network, In our office structure Trust-VPN & Trust-Internal both sources zone are allowed to access "" with general policies. As per policy Trust-Internal user have access the link through "PAN-INT2EXT URL FILTER" rule but Trust-VPN couldn't access the error is below


hit policy "PAN-INT2EXT URL FILTER update" and application - incomplete and session end reason - aged out


Can anyone please help to fix the issue


L1 Bithead

It's a bit difficult to picture this, will you be able to upload a picture with your security policies? Also, what does the Detail Log View report?

Cyber Elite
Cyber Elite

I tested on my PC behind the PA i see same behaviour.

Did the PCAP no drops.


Did this ever worked?

Only way to know the exact reason is to enable debugging on the PA.

If i get time today i will do that and keep you posted.




Tested again today saw this Global counter incremented

tcp_drop_packet 2 1 warn tcp pktproc packets dropped because of failure in tcp reassembly


do you have uplink to more than one ISP?

In PCAP today i saw fw was dropping syn ack from the server i think might be  because it was receiving syn ack more than 5 secs due to this config


----->Session timeout
TCP default timeout: 3600 secs
TCP session timeout before SYN-ACK received: 5 secs


In my case i have single link to ISP and i did below changes to make it work only for testing purposes:

In Prod I do not recommend to make those changes


set deviceconfig setting tcp asymmetric-path bypass

set deviceconfig setting session tcp-reject-non-syn no


It was working fine then then i undo my change  via

going to config mode 

set deviceconfig setting tcp asymmetric-path drop

set deviceconfig setting session tcp-reject-non-syn yes


Since then i am able to access website fine






@MP18  sorry for the late!


Thanks for your update, Actually that was in data center firewall and it's in production so i am not sure can i make the changes, we are using 7 gateways on that firewall for global protect VPN, and that issue is only for VPN users


So please confirm whether can i make the changes or not, 




@Max.Segura sure , I have updated with internal and VPN users logs for your reference




As PA is dropping the syn ack from the server as it is taking too long.

See below link.


I had to make above change to make it work.

I will not recommend you above change as I do not know your environment.

For now their is no other way seems to access that website behind the PA firewall.




Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!