Global Protect does not work

[NashTechIT]

Hello

I'm running the PAN OS 5.0.2.

I'm getting the following error with my GlobalProtect:

(T4364) Error(11792): failed to SetDoc. Message: errors getting GlobalProtect config

Where is my problem?

Here is my config:

<global-protect>

            <global-protect-gateway>

              <entry name="GPG_xxx">

                <roles>

                  <entry name="default">

                    <login-lifetime>

                      <days>30</days>

                    </login-lifetime>

                    <inactivity-logout>

                      <hours>3</hours>

                    </inactivity-logout>

                  </entry>

                </roles>

                <tunnel-mode>yes</tunnel-mode>

                <server-certificate>NashTech-Wildcard</server-certificate>

                <remote-user-tunnel>tunnel.5</remote-user-tunnel>

                <authentication-profile>AP_xxx-VPN</authentication-profile>

              </entry>

            </global-protect-gateway>

            <global-protect-portal>

              <entry name="GPP_xxx">

                <portal-config>

                  <local-address>

                    <ip>x.x.x.x/32</ip>

                    <interface>ethernet1/12</interface>

                  </local-address>

                  <authentication-profile>AP_xxx-VPN</authentication-profile>

                  <server-certificate>NashTech-Wildcard</server-certificate>

                  <custom-login-page>gpp.html</custom-login-page>

                  <custom-help-page>factory-default</custom-help-page>

                </portal-config>

                <client-config>

                  <configs>

                    <entry name="CC_xxx">

                      <hip-collection>

                        <max-wait-time>20</max-wait-time>

                      </hip-collection>

                      <gateways>

                        <external>

                          <list>

                            <entry name="x.x.x.x">

                              <priority>1</priority>

                              <description>FQDN</description>

                              <manual>no</manual>

                            </entry>

                          </list>

                        </external>

                        <cutoff-time>0</cutoff-time>

                      </gateways>

                      <source-user>

                        <member>UG_xxx-VPN</member>

                      </source-user>

                      <agent-ui>

                        <welcome-page>

                          <display>yes</display>

                        </welcome-page>

                        <agent-user-override-timeout>0</agent-user-override-timeout>

                        <agent-user-override>with-comment</agent-user-override>

                        <enable-advanced-view>no</enable-advanced-view>

                        <can-save-password>yes</can-save-password>

                        <max-agent-user-overrides>0</max-agent-user-overrides>

                      </agent-ui>

                      <agent-config>

                        <rediscover-network>yes</rediscover-network>

                        <resubmit-host-info>yes</resubmit-host-info>

                        <client-upgrade>prompt</client-upgrade>

                      </agent-config>

                      <refresh-config-interval>24</refresh-config-interval>

                      <use-sso>no</use-sso>

                      <connect-method>on-demand</connect-method>

                    </entry>

                  </configs>

                  <agent-user-override-key>-AQ==9EIXqBFzhp4IZxdTxSVTZG/12Vs=iH76LFLerpHJ1S680bBopQ==</agent-user-override-key>

                  <root-ca>

                    <member>NashTech-Wildcard</member>

                  </root-ca>

                </client-config>

                <satellite-config>

                  <certificate-life-time>7</certificate-life-time>

                  <certificate-renewal-period>3</certificate-renewal-period>

                </satellite-config>

              </entry>

            </global-protect-portal>

          </global-protect>

[shasnain · Accepted solution]

Try replacing your Server Cert with a one we know that has been signed by the CA or remove the "source user" from the portal.

Thanks,

Syed R Hasnain

[NashTechIT]

Thanks a lot for your help.

I changed the "source user" to "any" and could connect.

So my GlobalProtect Portal is working!

My Server Cert is signed.