Global Protect disconnect issue

[rrau]

3000 series FW, software 6.0.1, GP 2.0.1 -- GP continually disconnects/reconnects.. tried reinstalling client, rebooting, etc.. happens with some users at random times..then the issue will magically go away.  Anyone else experience?

[HULK]

Hello Rrau,

Could you please confirm the internet connectivity from the affected machine during the issue. More more detail info, you may enable logging into the GP client:

---Advanced view > Troubleshooting tab: start

debug on PanGP Service

File > Collect Log

c:\Users: look for Pan… files

---Wireshark on client PC

Reference DOC: Troubleshooting GlobalProtect, PAN-OS 4.1

Thanks

[rrau]

Def has nothing to do with the local Internet service.  Happens at random intervals with random machines in random locations

I will run debug on a client machine next time I see the issue.  thanks!

[GlenRaven-Rick]

We are seeing the issue as well.  In the GP logs we are seeing:

(T15964) 12/22/15 10:17:52:802 Error( 306): read(zero byte) failed: 0 >>>>> !!!
(T15964) 12/22/15 10:17:52:802 Info ( 184): Error processing receive data from client>>>>> !!!
(T15964) 12/22/15 10:17:52:802 Info ( 190): close client socket
(T15992) 12/22/15 10:17:52:894 Debug( 142): CheckPanGpAgentThread: PanGPA process 15984 exits, ret is 00e88eb0.
(T15992) 12/22/15 10:17:52:894 Debug( 150): GlobalProtect agent terminates unexpectedly. Skip StopThreads().>>>>> !!!

Each time we get a disconnect.   Engineering is looking at it.   I will post when they figure it out

[rshetty]

What was the solution for this? I have couple of users complaining about the same. It disconnects randomly and restablishes the connection. 

I believe the internet connectivity is fine since we are all in the same network but for some reason only selected couple of users have this issue. I was looking at the logs and found this during the same time frame. 

(T14456) 05/17/18 14:46:18:838 Debug(3030): Enforcer,remember established connect, 192.168.100.22:62045, 172.16.60.231:49180, ESTABLISHED, 2464, port is 62045, panme is \Device\HarddiskVolume1\Windows\System32\spoolsv.exe
(T14456) 05/17/18 14:46:18:838 Debug(3065): Enforcer,block port 62045
(T14456) 05/17/18 14:46:18:838 Debug(3030): Enforcer,remember established connect, 192.168.100.22:62046, 172.16.60.231:49180, ESTABLISHED, 2464, port is 62046, panme is \Device\HarddiskVolume1\Windows\System32\spoolsv.exe
(T14456) 05/17/18 14:46:18:838 Debug(3065): Enforcer,block port 62046
(T14456) 05/17/18 14:46:18:945 Debug( 402): Enforcer,Successfully Committed BreakAllExistingConnections Transaction.
(T14456) 05/17/18 14:46:18:945 Debug(8965): PanMSService::UpdateGPEnforcer() - enforcer is blocking.
(T14456) 05/17/18 14:46:18:951 Debug( 452): Network is reachable

Does anyone have insight to these logs?