GlobalProtect user always returns authentication failed

[anthony.limanto]

(T14508) 05/04/20 09:48:34:904 Info ( 474): msgtype = user_credential
(T14508) 05/04/20 09:48:34:904 Debug(2642): ServerThread: ProcessServerUserCredential. Redirect to processServerPortal.
(T14508) 05/04/20 09:48:34:904 Debug(1714): ----portal processing starts----
(T14508) 05/04/20 09:48:34:904 Debug(1736): User profile type is 0(not roaming)
(T14508) 05/04/20 09:48:34:904 Debug(1751): pg, source = 2, old source is 0
(T14508) 05/04/20 09:48:34:904 Debug(1773): pg, preferred gateway not set in message, old prefergateway=:)
(T14508) 05/04/20 09:48:34:904 Debug(1835): CheckUpdate is false.
)(T14508) 05/04/20 09:48:34:904 Debug(1850): portal-certificate-verification is yes
(T14508) 05/04/20 09:48:34:904 Debug(1890): No saml-load-cache tag.
(T14508) 05/04/20 09:48:34:904 Debug(1913): no saml-auth-error tag.
(T14508) 05/04/20 09:48:34:904 Debug(1924): allow-cached-portal is yes
(T14508) 05/04/20 09:48:34:905 Debug(1969): NewWinUser is minatorisato, WinUser is , PreviousSwitchOffMsg is false
(T14508) 05/04/20 09:48:34:905 Debug(1970): GetPrelogonStatus() 0, m_userName samuel.anthony, m_preUsername ___empty_username___
(T14508) 05/04/20 09:48:34:905 Debug(5479): StopThreads starts:
(T14508) 05/04/20 09:48:34:905 Debug(1267): Logging out gateway, reason is StopThreads
(T14508) 05/04/20 09:48:34:905 Debug(1298): Logging out gateway over
(T27880) 05/04/20 09:48:34:905 Debug(5250): NetworkConnectionMonitorThread: got exit event.
(T14996) 05/04/20 09:48:34:905 Debug(3938): NotificationTimerThread: got exit event.
(T2236) 05/04/20 09:48:34:905 Debug(4332): NetworkDiscoverThread: got exit event.
(T27880) 05/04/20 09:48:34:905 Debug(5265): NetworkConnectionMonitorThread: quits.
(T10936) 05/04/20 09:48:34:905 Debug(4133): CaptivePortalDetectionThread: got exit event.
(T2236) 05/04/20 09:48:34:905 Debug(4686): NetworkDiscoverThread: quits.
(T10936) 05/04/20 09:48:34:905 Debug(4287): CaptivePortalDetectionThread: captive portal detection thread exit status is (successful).
(T4352) 05/04/20 09:48:34:905 Debug(4812): HipReportThread: got exit event.
(T4352) 05/04/20 09:48:34:905 Debug(5111): HipReportThread: HipReportThread quits.
(T14508) 05/04/20 09:48:35:006 Debug(5494): threads are gracefully stopped.
(T29128) 05/04/20 09:48:35:006 Debug( 437): HipMissingPatchThread: got thread exit event.
(T24420) 05/04/20 09:48:35:006 Debug( 242): HipCheckThread: got thread exit event.
(T28508) 05/04/20 09:48:35:006 Debug( 414): HipMonitor gets quit event.
(T28508) 05/04/20 09:48:35:006 Debug( 431): Unregister -- WscUnRegisterChanges
(T28508) 05/04/20 09:48:35:008 Debug( 765): HipMonitorThread quits.
(T24420) 05/04/20 09:48:35:036 Debug( 287): HipCheckThread: Hip check thread quits.
(T29128) 05/04/20 09:48:35:046 Debug( 535): HipMissingPatchThread: Hip check missiing patch thread quits.
(T14508) 05/04/20 09:48:35:047 Debug( 132): All hip collect threads quit gracefully.
(T14508) 05/04/20 09:48:35:047 Debug(5558): StopThreads ends.
(T14508) 05/04/20 09:48:35:047 Debug(5443): StartThreads starts:
(T14508) 05/04/20 09:48:35:047 Debug( 25): create thread 0x7e8 with thread ID 23140
(T14508) 05/04/20 09:48:35:047 Debug( 25): create thread 0x66c with thread ID 26372
(T14508) 05/04/20 09:48:35:047 Debug( 25): create thread 0x758 with thread ID 29552
(T23140) 05/04/20 09:48:35:047 Debug(3781): NotificationTimerThread: notification timer thread starts.
(T23140) 05/04/20 09:48:35:047 Debug(3931): NotificationTimerThread: wait (-1 ms) for notification timer event.
(T14508) 05/04/20 09:48:35:047 Debug( 25): create thread 0x50c with thread ID 24880
(T26372) 05/04/20 09:48:35:047 Debug(3977): CaptivePortalDetectionThread: captive portal detection thread starts.
(T26372) 05/04/20 09:48:35:047 Debug(4130): CaptivePortalDetectionThread: wait (-1 ms) for captive portal detection event.
(T14508) 05/04/20 09:48:35:047 Debug( 25): create thread 0x6c0 with thread ID 27976
(T29552) 05/04/20 09:48:35:047 Debug(4297): NetworkDiscoverThread: network discover thread starts.
(T29552) 05/04/20 09:48:35:047 Debug(4322): NetworkDiscoverThread: wait for network discover event.
(T14508) 05/04/20 09:48:35:047 Debug( 25): create thread 0x7fc with thread ID 22196
(T27976) 05/04/20 09:48:35:047 Debug(5119): NetworkConnectionMonitorThread: network connection monitor thread starts.
(T22196) 05/04/20 09:48:35:047 Debug( 167): Start HipCheckThread
(T14508) 05/04/20 09:48:35:047 Debug( 25): create thread 0x65c with thread ID 25432
(T22196) 05/04/20 09:48:35:047 Debug( 210): HipCheckThread started...
(T22196) 05/04/20 09:48:35:047 Debug( 216): HipCheckThread: wait for hip check event for 3600000 ms);
(T24880) 05/04/20 09:48:35:047 Debug(4771): HipReportThread: HipReportThread starts up.
(T14508) 05/04/20 09:48:35:047 Debug( 25): create thread 0x4f0 with thread ID 25340
(T24880) 05/04/20 09:48:35:047 Debug(4804): HipReportThread: wait for HIP report ready event.
(T25340) 05/04/20 09:48:35:047 Debug( 186): Start HipMonitorThread
(T25340) 05/04/20 09:48:35:047 Info ( 761): HipMonitorThread starts
(T25432) 05/04/20 09:48:35:047 Debug( 176): Start HipMissingPatchThread
(T25432) 05/04/20 09:48:35:047 Debug( 409): HipMissingPatchThread started...
(T25432) 05/04/20 09:48:35:047 Debug( 41): Roaming profile is false
(T14508) 05/04/20 09:48:35:047 Debug(2028): No user home path in portal message.
(T14508) 05/04/20 09:48:35:047 Debug(2132): Portal gp.eu.sec.wirecard.com, user samuel.anthony, logonDomain LAPTOP-FD9I9LHO, saved user samuel.anthony, path C:\Users\minatorisato\AppData\Local\Palo Alto Networks\GlobalProtect\
(T14508) 05/04/20 09:48:35:047 Debug(2256): Pre-logon-then-on-demand value is no
(T14508) 05/04/20 09:48:35:047 Debug(1554): SSO GetSsoCredential starts.
(T14508) 05/04/20 09:48:35:048 Info (1584): SSO ----- PanCredGet failed with error Element not found.

(T14508) 05/04/20 09:48:35:048 Debug(9004): SSO password is empty
(T14508) 05/04/20 09:48:35:048 Debug(2356): m_preUsername samuel.anthony
(T14508) 05/04/20 09:48:35:048 Debug(2377): CheckCachedPortalForPrelogon 0, PrelogonNeedTimeout 0, RenameTimeout -1, userName samuel.anthony, preUsername samuel.anthony
(T14508) 05/04/20 09:48:35:048 Debug(5591): --Set state to Retrieving configuration...
(T14508) 05/04/20 09:48:35:048 Debug(1826): unknown network type.
(T14508) 05/04/20 09:48:35:048 Debug( 874): Display hip report V4 on the UI
(T25340) 05/04/20 09:48:35:049 Debug( 409): HipMonitorThread wait for exit event.
(T14508) 05/04/20 09:48:35:052 Debug(11371): Portal's ipv4 address 185.60.59.252
(T14508) 05/04/20 09:48:35:052 Debug(6618): SSO enable status is 0, user name is samuel.anthony, domain name is .
(T14508) 05/04/20 09:48:35:052 Debug(2176): open http session. agent is PAN GlobalProtect/5.0.4-16 (Microsoft Windows 10 Home Single Language , 64-bit)
(T14508) 05/04/20 09:48:35:053 Debug( 433): winhttp SetSecureProtocol, hSession=6387e6b0, bAllProtocol=0, gbFips=0
(T14508) 05/04/20 09:48:35:053 Debug( 433): winhttp SetSecureProtocol, hSession=6387eb30, bAllProtocol=0, gbFips=0
(T14508) 05/04/20 09:48:35:054 Debug(1649): SetProxyForHost(https://gp.eu.sec.wirecard.com/😞 timeout:5 AutoDetect:1 url: proxy: bypass: proxystr:
(T14508) 05/04/20 09:48:35:055 Debug(5636): ----Portal Pre-login starts----
(T14508) 05/04/20 09:48:35:055 Debug(4011): TriggerCaptivePortalDetection() return due to captive portal detection is in progress (0) or PreLogin is Done (1)
(T25432) 05/04/20 09:48:35:058 Debug( 167): profileInfo username minatorisato, profile path (null), server (null)
(T14508) 05/04/20 09:48:35:065 Debug( 527): Network is reachable
(T14508) 05/04/20 09:48:35:066 Debug(5662): Pre-login...,verifyportalcert=yes
(T14508) 05/04/20 09:48:35:066 Debug(9355): Check cert of server 185.60.59.252
(T14508) 05/04/20 09:48:35:066 Debug(9370): File E:\Program Files\Palo Alto Networks\GlobalProtect\tca.cer does not exist.
(T14508) 05/04/20 09:48:35:066 Debug( 769): SSL connecting to 185.60.59.252
(T14508) 05/04/20 09:48:35:073 Debug( 527): Network is reachable
(T14508) 05/04/20 09:48:35:962 Debug(1233): Failed to X509_LOOKUP_load_file
(T14508) 05/04/20 09:48:35:962 Debug( 356): Open_SSL_connection: subject '/C=DE/ST=Bayern/L=Aschheim/O=Wirecard AG/CN=gp.eu.sec.wirecard.com'
(T14508) 05/04/20 09:48:35:962 Debug( 360): Open_SSL_connection: issuer '/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=RapidSSL TLS RSA CA G1'
(T14508) 05/04/20 09:48:35:962 Debug( 923): Hostname gp.eu.sec.wirecard.com matches sub alt name gp.eu.sec.wirecard.com
(T14508) 05/04/20 09:48:35:962 Debug(1302): SSL3 alert write:warning:close notify
(T14508) 05/04/20 09:48:35:962 Debug(2619): encpostdata, encpostdata=000002A962D14CD0, encpostdatalen=176
(T14508) 05/04/20 09:48:35:962 Debug(2783): REQID=39,IPADDR=gp.eu.sec.wirecard.com,PORT=443,URL=/global-protect/prelogin.esp,POST=1,PROXY_AUTO=1,PROXY_CFGURL=NULL,PROXY=NULL,PROXY_BYPASS=NULL,PROXY_USER=NULL,PROXY_PASS=****,VERIFY_CERT=1,ADDITIONAL_CHECK=1,SCEP_CERT=,oid=
(T14508) 05/04/20 09:48:35:962 Debug(1262): Send response to client for request https_request
(T14508) 05/04/20 09:48:36:062 Debug(2893): receive pan_msg_ping, 3
(T14508) 05/04/20 09:48:37:292 Debug(5762): prelogin to portal result is
<?xml version="1.0" encoding="UTF-8" ?>
<prelogin-response>
<status>Success</status>
<ccusername></ccusername>
<autosubmit>false</autosubmit>
<msg></msg>
<newmsg></newmsg>
<authentication-message>Enter login credentials</authentication-message>
<username-label>Username</username-label>
<password-label>Password</password-label>
<panos-version>1</panos-version><krb-norm-username></krb-norm-username>
<krb-auth-status>0</krb-auth-status><region>ID</region>
</prelogin-response>
(T14508) 05/04/20 09:48:37:292 Debug(5778): krb-norm-username=
(T14508) 05/04/20 09:48:37:292 Debug(5797): REGION-PRIO, region code is ID
(T14508) 05/04/20 09:48:37:293 Debug(11181): REGION-PRIO, save region code ID
(T14508) 05/04/20 09:48:37:293 Debug(5853): Portal authentication-message is Enter login credentials
(T14508) 05/04/20 09:48:37:293 Debug(5869): autosubmit is false
(T14508) 05/04/20 09:48:37:293 Debug(5911): kerberos, auth failed, but previous flag is 1, which means to continue to fall back.
(T14508) 05/04/20 09:48:37:293 Debug(7328): ----Portal Login starts----
(T14508) 05/04/20 09:48:37:293 Debug( 530): pan_read_text_from_file(): File does not exist. File: C:\Users\minatorisato\AppData\Local\Palo Alto Networks\GlobalProtect\PanPCD_86ebac7651ae6a1c28ce559e07c4935.dat
(T14508) 05/04/20 09:48:37:293 Debug(1677): cannot restore portal config digest C:\Users\minatorisato\AppData\Local\Palo Alto Networks\GlobalProtect\PanPCD_86ebac7651ae6a1c28ce559e07c4935.dat.
(T14508) 05/04/20 09:48:37:293 Debug(1541): Failed to open file C:\Users\minatorisato\AppData\Local\Palo Alto Networks\GlobalProtect\PanPUAC_86ebac7651ae6a1c28ce559e07c4935.dat
(T14508) 05/04/20 09:48:37:294 Debug( 530): pan_read_text_from_file(): File does not exist. File: E:\Program Files\Palo Alto Networks\GlobalProtect\PanPPAC_dbddb5376646e0662119bd22dd3f2b44.dat
(T14508) 05/04/20 09:48:37:294 Debug(1518): Unserialized empty cookie for portal gp.eu.sec.wirecard.com and pre-logon user.
(T14508) 05/04/20 09:48:37:294 Debug(7396): IsInPrelogon() 0, GetPrelogonStatus() 0
(T14508) 05/04/20 09:48:37:294 Debug(6817): use cached deviceSN
(T14508) 05/04/20 09:48:37:294 Debug(6817): use cached deviceSN
(T14508) 05/04/20 09:48:37:294 Debug( 324): ClearHipCustomCheckInfo(): pHipCustomCheckInfo is NULL.
(T14508) 05/04/20 09:48:37:294 Debug( 86): ClearHipCustomCheckRegKeyInfo(): pHipCustomCheckRegKeyInfo is NULL.
(T14508) 05/04/20 09:48:37:294 Debug( 530): pan_read_text_from_file(): File does not exist. File: C:\Users\minatorisato\AppData\Local\Palo Alto Networks\GlobalProtect\PanPortalCfgCriteria_86ebac7651ae6a1c28ce559e07c4935.dat
(T14508) 05/04/20 09:48:37:294 Debug( 71): Portal config criteria is restored.
(T14508) 05/04/20 09:48:37:294 Debug( 530): pan_read_text_from_file(): File does not exist. File: C:\Users\minatorisato\AppData\Local\Palo Alto Networks\GlobalProtect\PanPortalCfgCriteria_86ebac7651ae6a1c28ce559e07c4935.dat
(T14508) 05/04/20 09:48:37:294 Debug(7466): m_szDomainAndUsername is samuel.anthony
(T14508) 05/04/20 09:48:37:294 Debug(2619): encpostdata, encpostdata=000002A9638A21D0, encpostdatalen=400
(T14508) 05/04/20 09:48:37:294 Debug(2783): REQID=40,IPADDR=gp.eu.sec.wirecard.com,PORT=443,URL=/global-protect/getconfig.esp,POST=1,PROXY_AUTO=1,PROXY_CFGURL=NULL,PROXY=NULL,PROXY_BYPASS=NULL,PROXY_USER=NULL,PROXY_PASS=****,VERIFY_CERT=0,ADDITIONAL_CHECK=1,SCEP_CERT=,oid=
(T14508) 05/04/20 09:48:37:295 Debug(1262): Send response to client for request https_request
(T14508) 05/04/20 09:48:37:399 Debug(2893): receive pan_msg_ping, 3
(T14508) 05/04/20 09:48:37:584 Debug(3007): Auth failed for portal
(T14508) 05/04/20 09:48:37:584 Debug(7689): Portal config is NULL.
(T14508) 05/04/20 09:48:37:584 Debug(6835): portal status is User authentication failed.
(T14508) 05/04/20 09:48:37:584 Debug(5591): --Set state to Disconnected
(T14508) 05/04/20 09:48:37:585 Debug(1826): unknown network type.
(T14508) 05/04/20 09:48:37:585 Debug( 874): Display hip report V4 on the UI
(T14508) 05/04/20 09:48:37:586 Debug(1262): Send response to client for request user_credential

I have tried to connect to several device, the others are okay yet this one particular device always return authentication failed to any connection i have tried to make... please help

[reaper]

@anthony.limanto  may want to edit out some details for privacy etc 😉

[reaper]

Try uninstalling and making sure you remove any registry artefacts, then reinstall as admin

[anthony.limanto]

what to edit sir?

anyway i have tried to uninstall and delete the registry then reinstall it again, the result is the same