Global Protect 8.1 - HIP Profile doesn't work - No logs, No HIP profile found from CLI, No Matches

[mypasecure2017]

I have Global Protect VPN configured and everything is working, but the moment I apply a HIP-Profile to my security rule (for my VPN Users), they immediately do not match my VPN security rule. I get no HIP logs, I cannot find any hip profiles. I configured a HIP Profile, to match any Windows operating system, so I kept it simple. I can remove the HIP Profile from the security rule, then my VPN users will match the rule and everything is fine. But the moment I apply the HIP Profile to the security rule, the traffic will not match the rule. I am configuring the firewall via Panorama console. I feel like its a simple fix and I am overlooking a simple HIP configuration/requirement. 

I tried the following articles but they all failed to fix my issue or I cannot obtain any results from the show/debug commands. 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClshCAC

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000boP1CAI

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClbkCAC   

username@IFW-01> debug user-id dump hip-profile-database entry

Total number of hipmask in database: 0
Total number of logout records in database: 0
Total size of hip reports: 1024KB used / 34816KB
No record exists or matches!

username@IFW01> debug user-id dump hip-profile-database ipmapping

Total number of ipmappings in database: 0
No record exists or matches!

[BPry]

@mypasecure2017,

Do you actually have a GlobalProtect Gateway subscription for your firewall? 

[mypasecure2017]

Yes. I have a subscription license.

[mypasecure2017]

Anyone have any clue why HIP is not working for me? I get no show output, no HIP matches, nothing. I do have a valid GP Gateway subscription which is why I am building this HIP requirement. 

[Sec101]

do you have Collect HIP data - check mark box in your agent config on your portal?

[mypasecure2017]

yes.. I put the check for hip collection, yesterday but it didn't make a difference. It should be a simple setup but not sure why HIP is not working. Its almost as if the client/computer is not sending HIP information to PA. My HIP Profile is looking for any Windows OS, and I am running Windows 10 Enterprise so the HIP Profile should match. 

[BPry]

@mypasecure2017,

So as long as you have the license active, and you have the Collect HIP Data checked, you should at the very least be getting logs under 'HIP Match'. Short of posting the XML or CLI output so that we can actually verify that what you are seeing in the GUI and what the device is actually configured to do matches, I would contact TAC so they can actually look at your full log output. 

[mypasecure2017 · Accepted solution]

Not sure how I resolved my own problem, but i basically redownloaded GlobaPortect Data File from Dynamic Updates in Panorama (but it still failed) and then I went to the HIP profile, remove all specifications (e.g. windows 10..etc). That way my HIP profile will accept anything. I committed it and things started to work.. I was seeing HIP matches and etc.. I then went back to the HIP profile and put back some of my specifications and things continue to work. I am not really sure why is working now but it is.