All of the sudden, in our global protect setup(Pre-Logon-Always-On, internal host detection, we were able to switch between internal and external networks and Global Protect would always reconnect. For about a month this has not been working. I got around to looking at the logs and see the following:
(T14316) Debug(4604): All external gateways are manual only.
This is not the case as we only have one external gateway configured and it is not set to manual.
The portal and gateway are configured on the same PAN 5250 device with PanOS8.1.9
Has anyone seen this lately or know why the client is saying this even though it's not configured that way on the PAN?
If you are looking at the GP Service logs and seeing these messages, then maybe it is something else.
There is a lot of logic programmed to test for all occurrences/scenarios, and sometimes I see logic tested and outputted, but does not hold true. Like your example... the startup logic tests for external gateways, comments that they are manual, but in reality, they are not.
I am not saying it is an anomoly or bug.. it is just my understanding that some of this realtime checks are red herrings in troubleshooting the real issue.
I think we would need to see more than a single log entry.. i need to see about 30 lines before and after to see exactly what the GP service is attempting to do.
I would perhaps test with a on-demand config, using your ldap credentials, so that you can manual turn on/off, and continue testing/committing, and troubleshooting one change at a time.
It may be easier to test, and then create a tech support file and open case with support through your support portal, and they can look at the logs in detail to assist you. You would of course, need to include the zipped logs from the user in question as well.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!