Global Protect External Gateway - saying only manual gateway exits

[dpeterson4]

All of the sudden, in our global protect setup(Pre-Logon-Always-On, internal host detection, we were able to switch between internal and external networks and Global Protect would always reconnect.  For about a month this has not been working.  I got around to looking at the logs and see the following:

(T14316) Debug(4604): All external gateways are manual only.

This is not the case as we only have one external gateway configured and it is not set to manual.

The portal and gateway are configured on the same PAN 5250 device with PanOS8.1.9

Has anyone seen this lately or know why the client is saying this even though it's not configured that way on the PAN?

Thank you.

[SCantwell_IM]

If you are looking at the GP Service logs and seeing these messages, then maybe it is something else.

There is a lot of logic programmed to test for all occurrences/scenarios, and sometimes I see logic tested and outputted, but does not hold true.  Like your example... the startup logic tests for external gateways, comments that they are manual, but in reality, they are not.

I am not saying it is an anomoly or bug.. it is just my understanding that some of this realtime checks are red herrings in troubleshooting the real issue.

I think we would need to see more than a single log entry.. i need to see about 30 lines before and after to see exactly what the GP service is attempting to do.

I would perhaps test with a on-demand config, using your ldap credentials, so that you can manual turn on/off, and continue testing/committing, and troubleshooting one change at a time.

It may be easier to test, and then create a tech support file and open case with support through your support portal, and they can look at the logs in detail to assist you.  You would of course, need to include the zipped logs from the user in question as well.