03-16-2015 03:44 AM
Hi there,
we're having some clients which are not able to connect. The odd thing is: There are only a few clients and currently there is no obvoius reason for me why this is happenig. They're even not reaching a stage, where the PA does log anything in the System log.
The GP Client does require a certificate in the local computers certificate store, which is available.
I see in the pangpa.log this error:
"(T5664) 03/16/15 10:38:02:351 Debug(1064): HandlePortal - portal messsage with Invalid portal status received. m_nAuthTries = 1"
In the pangps.log I see the following errors; I can paste the rest of the logfile if needed.
When I try to attempt to visit the site on the webbrowser, it's showing up.
(T2960) 03/16/15 10:38:01:976 Debug( 109): GetProxyInfo, winhttpgetproxyforurl failed, lastError=12006
(T2756) 03/16/15 10:38:02:023 Error( 120): NetUserGetInfo is unknown error
(T2960) 03/16/15 10:38:02:054 Error( 857): PostRequest failed with error code 12007.
(T2960) 03/16/15 10:38:02:054 Debug(3281): Failed to pre-login to the portal sg.planethome.com. Error 12007
Any help would be appreciated.
Cheers,
Sven
03-18-2015 12:20 AM
Those two cases are going more in the direction of certificate issues.
In the meanwhile we got it resolved. That was a tricky one:
When logging on to Windows a script is running, which is importing the proxy settings from IE to winhttp (netsh winhttp show proxy). This is necessary, because the native Windows 8 apps have trouble with a proxy server. The winhttp settings were kind of corrupt or at least incorrect, because the exceptions were missing so they were not identical with the settings from IE. The GP client is running into trouble with this. So we either had to reset the settings (netsh winhttp reset proxy) or re-import the correct settings again. Once set correctly everything has worked as expected. Very odd...
03-17-2015 09:44 AM
same as this two case
https://live.paloaltonetworks.com/thread/12785
https://live.paloaltonetworks.com/thread/11366
do you open a support case?
03-18-2015 12:20 AM
Those two cases are going more in the direction of certificate issues.
In the meanwhile we got it resolved. That was a tricky one:
When logging on to Windows a script is running, which is importing the proxy settings from IE to winhttp (netsh winhttp show proxy). This is necessary, because the native Windows 8 apps have trouble with a proxy server. The winhttp settings were kind of corrupt or at least incorrect, because the exceptions were missing so they were not identical with the settings from IE. The GP client is running into trouble with this. So we either had to reset the settings (netsh winhttp reset proxy) or re-import the correct settings again. Once set correctly everything has worked as expected. Very odd...
06-10-2015 11:10 PM
Hello Sven,
I have similar problem that is related with a specific (so far) Windows 7 64bit machine and in the same time with certificate profle enabled on the GP portal.
There are no proxy settings defined anywhere, either there is any script importing any kind of proxy settings.
Moreover, with the same GP client I am able to login to other GlobalProtect Portal/Gateways without problems.
The workaround with the winhttp settings did not help me at all and the issue still persists...
Giving the command netsh winhttp show proxy returns me
Current WinHTTP proxy settings:
Direct access (no proxy server).
So this is not the path for the resolution, but something else more deep...
06-11-2015 05:51 AM
Hi ggoudr,
what does the pangpa.log say?
Most of the GP issues are looking similiar (it doesn't work) but having different root causes. Also, could you access the portal website?
Cheers,
Sven
06-17-2015 01:36 AM
Yes I was able to access the portal website without any problem.
Actually I detected that the problem was with the user not belonging to the proper user group.
So, adding the user to the group resolved the problem.
George
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
