GlobalProtect issue

[vesna.djukic]

Hi all,

We have problem connecting to a VPN using GlobalProtect. We opened a case but maybe someone has an idea what's going on..

The error message on GP client is

Error(4960): failed to get the tag gateways(T1404)

Error(5401): Failed to get gateway list for external network.

Erros on Palo Alto:

GlobalProtect portal user authentication succeeded. Login from: x.x.x.x, User name: YY, Auth type: profile.

GlobalProtect portal client configuration failed. Login from: x.x.x.x, User name: YY.

Device has been upgraded from 5.0.8 version to 6.0.6 month (or two) ago and GP was working fine until a week ago. The problem first appeared only to some people (weird?), but today almost all users have this problem.

All tips and ideas are welcome.

Regards,

Vesna.

[ssharma]

If issue occurred after upgrading to 6.0 then I would definitely check the common name of the certificate used for global protect (see if that is ip or fqdn) and the configuration under Portal's Client config. It must match what we have on certificate. If certificate has a common name abc.company.com then under external gateway setting we should configure abc.company.com (and not its public ip say 1.1.1.1). Hope this helps. Thank you.

[oklier]

Also upgrade the GP clients to the newer code release as well. There are bug fixes in them.

[vesna.djukic]

Thanks ssharma and oklier.

Problem did not start right away after upgrade. GP was working fine for a few weeks on 6.0.6 version.

Same problem with the newest GP client..

[oklier]

I would then say if Support has not called you back. Give them a call.