Global protect and Outlook 2016

[KarthikRamalingam]

Recently we observed an issue for users on GP and using outlook.

When the GP is etablished and if the user launches Outlook in less than 1 min the outlook throws the error

"we are unable to connect right now. please check your network and try again later"

The same user once connected to GP and tried to launch post 1 min the outlook works fine

I am unable to link to GP or generic Outlook behaviour, any pointed from the community is highly appreciated.

[rajjair · Accepted solution]

Karthik,

Would be interested to see how that option goes when configured under the app agent... did you just put the domain url in there of you had to type in http://<website>

For me adding that domain to split tunnel did not resolve the issue, it only worked once i added to pre-logon policies.

RJ

[KarthikRamalingam]

Under the app option, we will be able to override addresses as IP based only (e.g. 1.2.3.4/32, 10.1.2.0/24).

Our initial tests suggested improved connectivity towards MS NLSA DNS resolutions www.msftconnecttest.com, we aren't convinced with the solution yet as extensive users on GP were impacted due to this it has to be tested widely to see as a workable solution.

p.s., TAC suggested a list of IP or IP's can be to a certain limit only 32 I reckon I do not have that in writing, unfortunately.

[crostron76]

Thank you @rajjair 

I've lost count of the number of hours I had sent researching this and trying to understand how I would resolve this issue.  The articles you linked explained the technology well.

I too had to create the pre-logon rule allowing access to just that website, after that all works perfectly.  Thanks again for sharing this solution.

[KarthikRamalingam]

Well we had to do the same on all our vsys, spinning a new pre rule to permit pre logon GP users to connect back to www.msftconencttest.com over 80 & 443 and it started to work

[DavidLukavsky]

I'm experiencing the same issue, but I'm not getting resolution on this. Its also a random issue, not everyone is experiencing the issue. Any one else have any success? When you said pre login rules, where is that located? Just the regular Policy section? I've checked and googled and I'm not seeing any pre login policy locations.