Global protect and Outlook 2016

[KarthikRamalingam]

Recently we observed an issue for users on GP and using outlook.

When the GP is etablished and if the user launches Outlook in less than 1 min the outlook throws the error

"we are unable to connect right now. please check your network and try again later"

The same user once connected to GP and tried to launch post 1 min the outlook works fine

I am unable to link to GP or generic Outlook behaviour, any pointed from the community is highly appreciated.

[Mick_Ball]

are you using user-ID mapping?

[KarthikRamalingam]

Yes, GP auth then user-id maping for the same.

[Mick_Ball]

is part of your outlook config cloud based...   if so then it may be denying traffic as user ip mapping is not yet complete.

[Mick_Ball]

if a user disconnects and then reconnects immediately, does it still take 1 min ?

[KarthikRamalingam]

Yes, outlook is cloud based hybrid connections. logically the connection would take a min to be established post GP is connected and outbound access is user-id specific.

does user-id mapping takes close to a min to complete? i ran fw tests under a min trying to launch outlook and it does fail.

But the version on GP reminded with no recent upgrade, all i can pin is the latest office update the end user machine team did.

[Mick_Ball]

user ID is almost instant...  but it will not take place until an event such as a drive mapping or domain authentication takes place.

this triggers an event to be written to the AD security log which includes the AD user ID and his/her/it's IP address. this is what the agent collects.

there are other options like device probing WMI stuff but i cannot help with this...  

we allow access to all microsoft URL's without user ID required, that may be one option, or perhaps run a post VPN script that is included with GP such as GPUpdate...   thats assuming mapping latency is the issue here...

also...     set your mapping timeout higher... some suggest 8 to 12 hours but we use 24. 

[KarthikRamalingam]

Well, i did test the connection to Microsoft URL's as a non user-id specific connection with a dedicated rule with source user group.

 The status is remaining the same, post GP connection comes live, the outlook once launched works fine post 1 min of GP establishment, but fails to authenticate outlook and prompts password if attemted within 1 min of GP coming up.

p.s. taken off any SSL decryption that were currently in place assuming decryption was playing any part.

[Mick_Ball]

is this new..

"and prompts password if attemted within 1 min of GP coming up."

as this was not mentioned in your first post...

[KarthikRamalingam]

Yes, if outlook launched within 1 min of GP coming up the outlook says its offine and needs password (i.e., AD logon) to pass through

[Mick_Ball]

Are you still getting this message

"we are unable to connect right now. please check your network and try again later"

[KarthikRamalingam]

Yes, that's the error, tested it with ruleset permitting any generic users as suspected user-id mapping was causing anykind of slownes, but the status remains the same.

[Mick_Ball]

So do you still have a source user group in the policy. If so then set the source user to any and test again.

[KarthikRamalingam]

Yes, we did tried with a rule set having no source user/group attached, but no luck hence had escalated with MS Outlook if there are any latest bus on their office updates.

[JasonPeterson]

Any resolution to this issue?  We are running into this same issue with Prisma.