Failed to get portal config from portal

[msingh]

What conditions allow the GP coffig to be downloaded?  I have the GP configured and am able to dowload the client. No cert error.  I am using a single cert.  Firewall is in 4.1.4 & GP is on 1.1.4.

Here is the error from the PANGP Service logs:

(T6460) 04/08/12 19:03:59:055 Info (2375): msgtype = user_credential
(T6460) 04/08/12 19:03:59:055 Debug(1924): ServerThread: ProcessServerUserCredential. Redirect to processServerPortal.
(T6460) 04/08/12 19:03:59:055 Debug(1668): ServerThread: ProcessServerPortal
(T6460) 04/08/12 19:03:59:055 Debug(1675): checkupdate tag exists with value no
(T6460) 04/08/12 19:03:59:055 Debug(1679): bCheckUpdate is false.
)(T6460) 04/08/12 19:03:59:055 Debug(1690): Reset network discover ready event.
(T6460) 04/08/12 19:03:59:055 Debug(1694): Logout gateways...
(T6460) 04/08/12 19:03:59:055 Debug(8725): StartThreads():
(T6460) 04/08/12 19:03:59:055 Debug(1724): pid of PanGPA is 5728, m_dwPanGpAgentPid is 5728
(T6460) 04/08/12 19:03:59:055 Debug(1737): gets user name domain1\user1.
(T6460) 04/08/12 19:03:59:055 Debug(9009): Set state to Retrieving configuration...
(T6460) 04/08/12 19:03:59:055 Debug(8613): ServerThread: ProcessServerPortal -- GetConfigFromPortal
(T6460) 04/08/12 19:03:59:055 Debug(5839): entering.
(T6460) 04/08/12 19:03:59:055 Debug(5897): SSO enable status is 0, user name is user1, domain name is domain1.
(T6460) 04/08/12 19:03:59:055 Debug(5900): reset user authentication status to true.
(T6460) 04/08/12 19:03:59:055 Debug(9529): open http session.
(T6460) 04/08/12 19:04:01:718 Debug(3401): CPanMSService::SetProxyForHost: fAutoDetect: 1 url: proxy: bypass:
url:https://https://vpn.pa.com/ returned proxystr:
(T6460) 04/08/12 19:04:01:719 Debug(9404): Pre-login...
(T6460) 04/08/12 19:04:01:719 Debug( 142): active session id is 1
(T6460) 04/08/12 19:04:01:731 Debug( 167): found process id 5728
(T6460) 04/08/12 19:04:01:732 Debug(4920): PrepareRequest...
(T6460) 04/08/12 19:04:01:732 Debug(4928): WinHttpOpenRequest...
(T6460) 04/08/12 19:04:01:732 Debug( 392): CPanHTTPSession::PostRequest: WinHttpSendRequest...
(T6460) 04/08/12 19:04:04:371 Error(4973): PostRequest failed with error code 12007.
(T6460) 04/08/12 19:04:04:371 Debug(9517): Failed to pre-login to the portal https://vpn.pa.com. Error 12007
(T6460) 04/08/12 19:04:04:371 Debug(9558): close WinHttp close handle.
(T6460) 04/08/12 19:04:04:372 Debug(5996): failed to get portal config from portal https://vpn.pa.com. Try to restore last portal config from file.
(T6460) 04/08/12 19:04:04:373 Debug(  49): CTranslate: dwSidLen is 24
(T6460) 04/08/12 19:04:04:373 Debug(  51): CTranslate: sid is S-1-5-21-3261640462-486741265-2394419994
(T6460) 04/08/12 19:04:04:373 Debug( 191): pan_read_text_from_file(): full path is C:\Users\user1\PanPortalCfg.dat
(T6460) 04/08/12 19:04:04:373 Debug( 198): pan_read_text_from_file(): full path in unicode is C:\Users\user1\PanPortalCfg.dat
(T6460) 04/08/12 19:04:04:373 Debug( 276): pan_read_text_from_file(): File does not exist. File: C:\Users\user1\PanPortalCfg.dat
(T6460) 04/08/12 19:04:04:373 Debug(6007): cannot restore last portal config from file C:\Users\user1\PanPortalCfg.dat.
(T6460) 04/08/12 19:04:04:373 Debug(6019): portal status is Invalid portal.
(T6460) 04/08/12 19:04:04:373 Debug(6020): returns 0.
(T6460) 04/08/12 19:04:04:373 Debug(8622): ServerThread: ProcessServerPortal -- return SendResponseToClient(socket, PAN_SERVER_PORTAL)

[akhan]

Hi,

If I understand correctly, you are unable to connect from the GP client to the GP portal.

(T6460) 04/08/12 19:04:04:371 Debug(9517): Failed to pre-login to the portal https://vpn.pa.com. Error 12007

The above error seems to indicate that connection to the portal https://vpn.pa.com is failing.  Can you check your system logs from under Monitor -> System for any related logs when you try to login?  Also, is this behavior seen for one or multiple users?

Thanks,

Ahsan

[msingh]

There are no corrosponding entries in the system logs and yes this is for all users.

[akhan]

Instead of using "vpn.pa.com" as the portal in your GP client, can you try using the IP address associated with "vpn.pa.com"?  Also, can you have a look at your traffic logs to make sure traffic to the portal is not being denied, possibly by a cleanup (deny any any) rule?

Thanks,

Ahsan

[msingh]

It turns out by default, the install uses https://vpn.pa.com as the portal connection.  Changing that to vpn.pa.com makes it to the gateway.  The connection still times out.

(T2704) 04/09/12 00:39:22:491 Debug(5929): this version of portal config is supported.
(T2704) 04/09/12 00:39:22:491 Debug(6019): portal status is Connected.
(T2704) 04/09/12 00:39:22:491 Debug(6020): returns 1.
(T2704) 04/09/12 00:39:22:491 Debug(8635): ServerThread: ProcessServerPortal -- GetHipPolicyCopy();
(T2704) 04/09/12 00:39:22:491 Debug(6466): enters GetAgentUiPolicyCopy().
(T2704) 04/09/12 00:39:22:491 Info (6517): On-Demand mode is on
(T2704) 04/09/12 00:39:22:491 Info (6533): Tag connect-method does not exist.
(T2704) 04/09/12 00:39:22:491 Info (6535): On-demand mode is true.
(T2704) 04/09/12 00:39:22:492 Debug(6643): returns true.
(T2704) 04/09/12 00:39:22:492 Debug(8664): ServerThread: ProcessServerPortal -- On-demand mode.
(T2704) 04/09/12 00:39:22:492 Debug(9009): Set state to OnDemand mode.
(T2704) 04/09/12 00:39:22:492 Debug(8672): ServerThread: ProcessServerPortal -- return SendResponseToClient(socket, PAN_SERVER_HIP);

That is the end of the log.  Not sure why HIP profile is being asked because the gateway is not configured to do so.  In any case, on to the next hurdle.

[akhan]

I do not see logs related to the GP gateway.  Can you try the "Rediscover Network" option and check if that helps?  Do you see any related logs in the system logs?  I would also recommend opening a case with Support for a speedy resolution.

Thanks,

Ahsan

[Tician]

Hi msingh,

please tell me what's happened with this? Is support resolve this issue, I'm interested in that because I have exactly the same...:smileyconfused:

[BMR]

Hi all,

i have exactly the same problem. Can you publish a solution. Thanks a lot...

Regards Patrick