Globalprotect dissonnection issues

[jdprovine]

I have a couple of users who say that when on the GP VPN client it disconnects them multiple times and I have not been able to reproduce their issues.

The only thing I have found so far is this in the system logs "globalprotect gateway user login failed. error existing user session found"

collected logs on the client and nothing really stands out. any ideas would be appreciated

[jdprovine]

@Mick_Ball

Yes and when its only two users from home and I myself am not having these same issues from home, the likelihood of it being global protect are far less than it being the users.

[jdprovine]

@Mick_Ball

My user is bugging me again, he can't accept that its his home network and he didn't do have the things I asked him to test. 

So have you seen this in the logs before Failed to terminate process 2388. Error 5

[Mick_Ball]

@jdprovine, Hi.

of course it may not be anything to do with his home network but i like to eliminate this possibility.

I have never seen that error message, is there no indication prior to that error of what process it is going to terminate, or why it needs to.

Shame you cant post the entire log.

are these corp devices or user owned. is it worth offering a replacement or secondary device for him to test at home.

[jdprovine]

@Mick_Ball

Actually he did send me more of the logs and here is what he sent me. I still think it is his home network, I took the laptop,corp owned, he was having issues with, connected it to the same ISP (I have a port on my switch configured for a cable modem) and ran it for five hours and saw absolutely no issues. I repeated to him the other things I want him to do, link trying your suggestion to use the link to the portal and see if it is available. I told him to start a continuous ping and see what it does and last but not least to run wireshark.  

00000000: 01 80 c2 00 00 0e 02 50 41 00 00 01 88 cc 02 07
00000010: 04 02 50 41 00 00 01 04 07 03 02 50 41 00 00 01
00000020: 06 02 0e 11 fe 09 00 12 0f 01 03 00 01 00 00 fe
00000030: 07 00 12 bb 01 00 01 01 00 00 ........ ..
(T9160) 02/16/18 04:26:40:173 Error(3259): UnsetRoutesV6: No route installed before
(T6344) 02/26/18 17:27:42:044 Error(1002): Failed to terminate process 2388. Error 5
(T5596) 02/26/18 17:27:42:232 Error(1128): Failed to X509_LOOKUP_load_file
(T5596) 02/26/18 17:27:43:535 Error(2170): failed to retrieve client certificate passphrase. return false.
(T5596) 02/26/18 17:27:43:535 Error(5131): Failed to export client cert.
(T4432) 02/26/18 17:27:43:544 Error(9092): GetClientIpForGateway(): invalid remote host: .
(T4432) 02/26/18 17:27:43:544 Error( 178): CPanGatewayList::SelectInternalGateways() - failed to retrieve client source ipv6!
(T4432) 02/26/18 17:27:43:622 Error(1128): Failed to X509_LOOKUP_load_file
(T4432) 02/26/18 17:27:54:161 Error(1128): Failed to X509_LOOKUP_load_file
(T11088) 02/26/18 17:27:57:347 Error(1152): CheckDriverData() failed
00000000: 01 80 c2 00 00 0e 02 50 41 00 00 01 88 cc 02 07
00000010: 04 02 50 41 00 00 01 04 07 03 02 50 41 00 00 01
00000020: 06 02 0e 11 fe 09 00 12 0f 01 03 00 01 00 00 fe
00000030: 07 00 12 bb 01 00 01 01 00 00 ........ ..
(T11088) 02/26/18 17:27:58:346 Error(1152): CheckDriverData() failed
00000000: 01 80 c2 00 00 0e 02 50 41 00 00 01 88 cc 02 07
00000010: 04 02 50 41 00 00 01 04 07 03 02 50 41 00 00 01
00000020: 06 02 0e 11 fe 09 00 12 0f 01 03 00 01 00 00 fe
00000030: 07 00 12 bb 01 00 01 01 00 00 ........ ..
(T11088) 02/26/18 17:27:59:347 Error(1152): CheckDriverData() failed
00000000: 01 80 c2 00 00 0e 02 50 41 00 00 01 88 cc 02 07
00000010: 04 02 50 41 00 00 01 04 07 03 02 50 41 00 00 01
00000020: 06 02 0e 11 fe 09 00 12 0f 01 03 00 01 00 00 fe
00000030: 07 00 12 bb 01 00 01 01 00 00 ........ ..
(T11088) 02/26/18 17:28:00:347 Error(1152): CheckDriverData() failed
00000000: 01 80 c2 00 00 0e 02 50 41 00 00 01 88 cc 02 07
00000010: 04 02 50 41 00 00 01 04 07 03 02 50 41 00 00 01
00000020: 06 02 0e 11 fe 09 00 12 0f 01 03 00 01 00 00 fe
00000030: 07 00 12 bb 01 00 01 01 00 00 ........ ..
(T480) 02/26/18 17:29:28:059 Error(3259): UnsetRoutesV6: No route installed before

[Mick_Ball]

hmmmm... not much help with the logs... most of the failed messages displayed are the ones that I get, even on a succesful connection.

Albeit.... I have never seen the "Failed to terminate process" one...

lets go for the cunning approach, ask to borrow his laptop again to do some testing, then tell him you broke it. offer to lend him your lab test one for one week until you fix his one... see how he gets on...

Good Luck......

[Mick_Ball]

wireshark sounds good but could you pursuade him to drive it when needed....

[jdprovine]

@Mick_Ball

Yes the logs are pretty much the same as before, to me they are pointing to an ISP disconnection, like we said before as though you unplugged the ethernet cable. He is on wireless to, another failure point I told him to plug in a cable.

[jdprovine]

@Mick_Ball

When you say drive it when needed, do you mean to only have it running when an issue occurs

[Mick_Ball]

well yes, kind of....

not sure if you should have it running on boot/logon...

the user really needs to start (Drive) wireshark when a GP connection is made, only capture the wifi interface but I wouldn't filter for portal/gateway address as you may miss something obvious..

timing will be essential as pcap file could be humungous...

or perhaps restart wireshark after every 15 mins of connection...

[Mick_Ball]

having said that..... you could just start wireshark when the user fails to reconnect...   but it may fix itself before wireshark is fired up....

[Mick_Ball]

just adding another line to see if I get a badge...

[Mick_Ball]

Bummer!

[jdprovine]

@Mick_Ball

You crack me up 🙂

[z-anon]

In my experience, "immediately" is usually at least a 2 minute turn-around.  It routinely takes me over 10 minutes to login to my VPN every morning, because the network response is so slow and droppy.  There's so much already loading when I login that I receive "cannot connect" errors from other apps before GlobalProtect even prompts me.  I have gigabit Internet at home with speeds routinely registering at over 300mbps, but my work laptop peaks out at 90mbps after I've successfully connected via GlobalProtect.5.1.3-12 and authenticated on my iWatch.  Even then, it usually takes about 4 tries to get GlobalProtect to KEEP the connection.  My Internet access is dependent on the VPN connection, so this might be a cart-before-the-horse situation.  It often drops during meetings.or at inopportune moments while I'm working on a remote desktop, then it's a race to reverify before the four 30-second retries expire.  I've tried the "Reconnect" option, but that often leapfrogs validation requests on my device and appears to cancel itself.  There hasn't been a day in recent memory that I had less than a dozen interruptions due to GlobalProtect.  Is there anything I can tell our tech guys about setting up Internet and login options to remedy this?