GlobalProtect user always returns authentication failed

Announcements

ATTENTION Customers, All Partners and Employees: The Customer Support Portal (CSP) will be undergoing maintenance and unavailable on Saturday, November 7, 2020, from 11 am to 11 pm PST. Please read our blog for more information.

Reply
Highlighted
L0 Member

GlobalProtect user always returns authentication failed

(T14508) 05/04/20 09:48:34:904 Info ( 474): msgtype = user_credential
(T14508) 05/04/20 09:48:34:904 Debug(2642): ServerThread: ProcessServerUserCredential. Redirect to processServerPortal.
(T14508) 05/04/20 09:48:34:904 Debug(1714): ----portal processing starts----
(T14508) 05/04/20 09:48:34:904 Debug(1736): User profile type is 0(not roaming)
(T14508) 05/04/20 09:48:34:904 Debug(1751): pg, source = 2, old source is 0
(T14508) 05/04/20 09:48:34:904 Debug(1773): pg, preferred gateway not set in message, old prefergateway=:)
(T14508) 05/04/20 09:48:34:904 Debug(1835): CheckUpdate is false.
)(T14508) 05/04/20 09:48:34:904 Debug(1850): portal-certificate-verification is yes
(T14508) 05/04/20 09:48:34:904 Debug(1890): No saml-load-cache tag.
(T14508) 05/04/20 09:48:34:904 Debug(1913): no saml-auth-error tag.
(T14508) 05/04/20 09:48:34:904 Debug(1924): allow-cached-portal is yes
(T14508) 05/04/20 09:48:34:905 Debug(1969): NewWinUser is minatorisato, WinUser is , PreviousSwitchOffMsg is false
(T14508) 05/04/20 09:48:34:905 Debug(1970): GetPrelogonStatus() 0, m_userName samuel.anthony, m_preUsername ___empty_username___
(T14508) 05/04/20 09:48:34:905 Debug(5479): StopThreads starts:
(T14508) 05/04/20 09:48:34:905 Debug(1267): Logging out gateway, reason is StopThreads
(T14508) 05/04/20 09:48:34:905 Debug(1298): Logging out gateway over
(T27880) 05/04/20 09:48:34:905 Debug(5250): NetworkConnectionMonitorThread: got exit event.
(T14996) 05/04/20 09:48:34:905 Debug(3938): NotificationTimerThread: got exit event.
(T2236) 05/04/20 09:48:34:905 Debug(4332): NetworkDiscoverThread: got exit event.
(T27880) 05/04/20 09:48:34:905 Debug(5265): NetworkConnectionMonitorThread: quits.
(T10936) 05/04/20 09:48:34:905 Debug(4133): CaptivePortalDetectionThread: got exit event.
(T2236) 05/04/20 09:48:34:905 Debug(4686): NetworkDiscoverThread: quits.
(T10936) 05/04/20 09:48:34:905 Debug(4287): CaptivePortalDetectionThread: captive portal detection thread exit status is (successful).
(T4352) 05/04/20 09:48:34:905 Debug(4812): HipReportThread: got exit event.
(T4352) 05/04/20 09:48:34:905 Debug(5111): HipReportThread: HipReportThread quits.
(T14508) 05/04/20 09:48:35:006 Debug(5494): threads are gracefully stopped.
(T29128) 05/04/20 09:48:35:006 Debug( 437): HipMissingPatchThread: got thread exit event.
(T24420) 05/04/20 09:48:35:006 Debug( 242): HipCheckThread: got thread exit event.
(T28508) 05/04/20 09:48:35:006 Debug( 414): HipMonitor gets quit event.
(T28508) 05/04/20 09:48:35:006 Debug( 431): Unregister -- WscUnRegisterChanges
(T28508) 05/04/20 09:48:35:008 Debug( 765): HipMonitorThread quits.
(T24420) 05/04/20 09:48:35:036 Debug( 287): HipCheckThread: Hip check thread quits.
(T29128) 05/04/20 09:48:35:046 Debug( 535): HipMissingPatchThread: Hip check missiing patch thread quits.
(T14508) 05/04/20 09:48:35:047 Debug( 132): All hip collect threads quit gracefully.
(T14508) 05/04/20 09:48:35:047 Debug(5558): StopThreads ends.
(T14508) 05/04/20 09:48:35:047 Debug(5443): StartThreads starts:
(T14508) 05/04/20 09:48:35:047 Debug( 25): create thread 0x7e8 with thread ID 23140
(T14508) 05/04/20 09:48:35:047 Debug( 25): create thread 0x66c with thread ID 26372
(T14508) 05/04/20 09:48:35:047 Debug( 25): create thread 0x758 with thread ID 29552
(T23140) 05/04/20 09:48:35:047 Debug(3781): NotificationTimerThread: notification timer thread starts.
(T23140) 05/04/20 09:48:35:047 Debug(3931): NotificationTimerThread: wait (-1 ms) for notification timer event.
(T14508) 05/04/20 09:48:35:047 Debug( 25): create thread 0x50c with thread ID 24880
(T26372) 05/04/20 09:48:35:047 Debug(3977): CaptivePortalDetectionThread: captive portal detection thread starts.
(T26372) 05/04/20 09:48:35:047 Debug(4130): CaptivePortalDetectionThread: wait (-1 ms) for captive portal detection event.
(T14508) 05/04/20 09:48:35:047 Debug( 25): create thread 0x6c0 with thread ID 27976
(T29552) 05/04/20 09:48:35:047 Debug(4297): NetworkDiscoverThread: network discover thread starts.
(T29552) 05/04/20 09:48:35:047 Debug(4322): NetworkDiscoverThread: wait for network discover event.
(T14508) 05/04/20 09:48:35:047 Debug( 25): create thread 0x7fc with thread ID 22196
(T27976) 05/04/20 09:48:35:047 Debug(5119): NetworkConnectionMonitorThread: network connection monitor thread starts.
(T22196) 05/04/20 09:48:35:047 Debug( 167): Start HipCheckThread
(T14508) 05/04/20 09:48:35:047 Debug( 25): create thread 0x65c with thread ID 25432
(T22196) 05/04/20 09:48:35:047 Debug( 210): HipCheckThread started...
(T22196) 05/04/20 09:48:35:047 Debug( 216): HipCheckThread: wait for hip check event for 3600000 ms);
(T24880) 05/04/20 09:48:35:047 Debug(4771): HipReportThread: HipReportThread starts up.
(T14508) 05/04/20 09:48:35:047 Debug( 25): create thread 0x4f0 with thread ID 25340
(T24880) 05/04/20 09:48:35:047 Debug(4804): HipReportThread: wait for HIP report ready event.
(T25340) 05/04/20 09:48:35:047 Debug( 186): Start HipMonitorThread
(T25340) 05/04/20 09:48:35:047 Info ( 761): HipMonitorThread starts
(T25432) 05/04/20 09:48:35:047 Debug( 176): Start HipMissingPatchThread
(T25432) 05/04/20 09:48:35:047 Debug( 409): HipMissingPatchThread started...
(T25432) 05/04/20 09:48:35:047 Debug( 41): Roaming profile is false
(T14508) 05/04/20 09:48:35:047 Debug(2028): No user home path in portal message.
(T14508) 05/04/20 09:48:35:047 Debug(2132): Portal gp.eu.sec.wirecard.com, user samuel.anthony, logonDomain LAPTOP-FD9I9LHO, saved user samuel.anthony, path C:\Users\minatorisato\AppData\Local\Palo Alto Networks\GlobalProtect\
(T14508) 05/04/20 09:48:35:047 Debug(2256): Pre-logon-then-on-demand value is no
(T14508) 05/04/20 09:48:35:047 Debug(1554): SSO GetSsoCredential starts.
(T14508) 05/04/20 09:48:35:048 Info (1584): SSO ----- PanCredGet failed with error Element not found.

(T14508) 05/04/20 09:48:35:048 Debug(9004): SSO password is empty
(T14508) 05/04/20 09:48:35:048 Debug(2356): m_preUsername samuel.anthony
(T14508) 05/04/20 09:48:35:048 Debug(2377): CheckCachedPortalForPrelogon 0, PrelogonNeedTimeout 0, RenameTimeout -1, userName samuel.anthony, preUsername samuel.anthony
(T14508) 05/04/20 09:48:35:048 Debug(5591): --Set state to Retrieving configuration...
(T14508) 05/04/20 09:48:35:048 Debug(1826): unknown network type.
(T14508) 05/04/20 09:48:35:048 Debug( 874): Display hip report V4 on the UI
(T25340) 05/04/20 09:48:35:049 Debug( 409): HipMonitorThread wait for exit event.
(T14508) 05/04/20 09:48:35:052 Debug(11371): Portal's ipv4 address 185.60.59.252
(T14508) 05/04/20 09:48:35:052 Debug(6618): SSO enable status is 0, user name is samuel.anthony, domain name is .
(T14508) 05/04/20 09:48:35:052 Debug(2176): open http session. agent is PAN GlobalProtect/5.0.4-16 (Microsoft Windows 10 Home Single Language , 64-bit)
(T14508) 05/04/20 09:48:35:053 Debug( 433): winhttp SetSecureProtocol, hSession=6387e6b0, bAllProtocol=0, gbFips=0
(T14508) 05/04/20 09:48:35:053 Debug( 433): winhttp SetSecureProtocol, hSession=6387eb30, bAllProtocol=0, gbFips=0
(T14508) 05/04/20 09:48:35:054 Debug(1649): SetProxyForHost(https://gp.eu.sec.wirecard.com/ timeout:5 AutoDetect:1 url: proxy: bypass: proxystr:
(T14508) 05/04/20 09:48:35:055 Debug(5636): ----Portal Pre-login starts----
(T14508) 05/04/20 09:48:35:055 Debug(4011): TriggerCaptivePortalDetection() return due to captive portal detection is in progress (0) or PreLogin is Done (1)
(T25432) 05/04/20 09:48:35:058 Debug( 167): profileInfo username minatorisato, profile path (null), server (null)
(T14508) 05/04/20 09:48:35:065 Debug( 527): Network is reachable
(T14508) 05/04/20 09:48:35:066 Debug(5662): Pre-login...,verifyportalcert=yes
(T14508) 05/04/20 09:48:35:066 Debug(9355): Check cert of server 185.60.59.252
(T14508) 05/04/20 09:48:35:066 Debug(9370): File E:\Program Files\Palo Alto Networks\GlobalProtect\tca.cer does not exist.
(T14508) 05/04/20 09:48:35:066 Debug( 769): SSL connecting to 185.60.59.252
(T14508) 05/04/20 09:48:35:073 Debug( 527): Network is reachable
(T14508) 05/04/20 09:48:35:962 Debug(1233): Failed to X509_LOOKUP_load_file
(T14508) 05/04/20 09:48:35:962 Debug( 356): Open_SSL_connection: subject '/C=DE/ST=Bayern/L=Aschheim/O=Wirecard AG/CN=gp.eu.sec.wirecard.com'
(T14508) 05/04/20 09:48:35:962 Debug( 360): Open_SSL_connection: issuer '/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=RapidSSL TLS RSA CA G1'
(T14508) 05/04/20 09:48:35:962 Debug( 923): Hostname gp.eu.sec.wirecard.com matches sub alt name gp.eu.sec.wirecard.com
(T14508) 05/04/20 09:48:35:962 Debug(1302): SSL3 alert write:warning:close notify
(T14508) 05/04/20 09:48:35:962 Debug(2619): encpostdata, encpostdata=000002A962D14CD0, encpostdatalen=176
(T14508) 05/04/20 09:48:35:962 Debug(2783): REQID=39,IPADDR=gp.eu.sec.wirecard.com,PORT=443,URL=/global-protect/prelogin.esp,POST=1,PROXY_AUTO=1,PROXY_CFGURL=NULL,PROXY=NULL,PROXY_BYPASS=NULL,PROXY_USER=NULL,PROXY_PASS=****,VERIFY_CERT=1,ADDITIONAL_CHECK=1,SCEP_CERT=,oid=
(T14508) 05/04/20 09:48:35:962 Debug(1262): Send response to client for request https_request
(T14508) 05/04/20 09:48:36:062 Debug(2893): receive pan_msg_ping, 3
(T14508) 05/04/20 09:48:37:292 Debug(5762): prelogin to portal result is
<?xml version="1.0" encoding="UTF-8" ?>
<prelogin-response>
<status>Success</status>
<ccusername></ccusername>
<autosubmit>false</autosubmit>
<msg></msg>
<newmsg></newmsg>
<authentication-message>Enter login credentials</authentication-message>
<username-label>Username</username-label>
<password-label>Password</password-label>
<panos-version>1</panos-version><krb-norm-username></krb-norm-username>
<krb-auth-status>0</krb-auth-status><region>ID</region>
</prelogin-response>
(T14508) 05/04/20 09:48:37:292 Debug(5778): krb-norm-username=
(T14508) 05/04/20 09:48:37:292 Debug(5797): REGION-PRIO, region code is ID
(T14508) 05/04/20 09:48:37:293 Debug(11181): REGION-PRIO, save region code ID
(T14508) 05/04/20 09:48:37:293 Debug(5853): Portal authentication-message is Enter login credentials
(T14508) 05/04/20 09:48:37:293 Debug(5869): autosubmit is false
(T14508) 05/04/20 09:48:37:293 Debug(5911): kerberos, auth failed, but previous flag is 1, which means to continue to fall back.
(T14508) 05/04/20 09:48:37:293 Debug(7328): ----Portal Login starts----
(T14508) 05/04/20 09:48:37:293 Debug( 530): pan_read_text_from_file(): File does not exist. File: C:\Users\minatorisato\AppData\Local\Palo Alto Networks\GlobalProtect\PanPCD_86ebac7651ae6a1c28ce559e07c4935.dat
(T14508) 05/04/20 09:48:37:293 Debug(1677): cannot restore portal config digest C:\Users\minatorisato\AppData\Local\Palo Alto Networks\GlobalProtect\PanPCD_86ebac7651ae6a1c28ce559e07c4935.dat.
(T14508) 05/04/20 09:48:37:293 Debug(1541): Failed to open file C:\Users\minatorisato\AppData\Local\Palo Alto Networks\GlobalProtect\PanPUAC_86ebac7651ae6a1c28ce559e07c4935.dat
(T14508) 05/04/20 09:48:37:294 Debug( 530): pan_read_text_from_file(): File does not exist. File: E:\Program Files\Palo Alto Networks\GlobalProtect\PanPPAC_dbddb5376646e0662119bd22dd3f2b44.dat
(T14508) 05/04/20 09:48:37:294 Debug(1518): Unserialized empty cookie for portal gp.eu.sec.wirecard.com and pre-logon user.
(T14508) 05/04/20 09:48:37:294 Debug(7396): IsInPrelogon() 0, GetPrelogonStatus() 0
(T14508) 05/04/20 09:48:37:294 Debug(6817): use cached deviceSN
(T14508) 05/04/20 09:48:37:294 Debug(6817): use cached deviceSN
(T14508) 05/04/20 09:48:37:294 Debug( 324): ClearHipCustomCheckInfo(): pHipCustomCheckInfo is NULL.
(T14508) 05/04/20 09:48:37:294 Debug( 86): ClearHipCustomCheckRegKeyInfo(): pHipCustomCheckRegKeyInfo is NULL.
(T14508) 05/04/20 09:48:37:294 Debug( 530): pan_read_text_from_file(): File does not exist. File: C:\Users\minatorisato\AppData\Local\Palo Alto Networks\GlobalProtect\PanPortalCfgCriteria_86ebac7651ae6a1c28ce559e07c4935.dat
(T14508) 05/04/20 09:48:37:294 Debug( 71): Portal config criteria is restored.
(T14508) 05/04/20 09:48:37:294 Debug( 530): pan_read_text_from_file(): File does not exist. File: C:\Users\minatorisato\AppData\Local\Palo Alto Networks\GlobalProtect\PanPortalCfgCriteria_86ebac7651ae6a1c28ce559e07c4935.dat
(T14508) 05/04/20 09:48:37:294 Debug(7466): m_szDomainAndUsername is samuel.anthony
(T14508) 05/04/20 09:48:37:294 Debug(2619): encpostdata, encpostdata=000002A9638A21D0, encpostdatalen=400
(T14508) 05/04/20 09:48:37:294 Debug(2783): REQID=40,IPADDR=gp.eu.sec.wirecard.com,PORT=443,URL=/global-protect/getconfig.esp,POST=1,PROXY_AUTO=1,PROXY_CFGURL=NULL,PROXY=NULL,PROXY_BYPASS=NULL,PROXY_USER=NULL,PROXY_PASS=****,VERIFY_CERT=0,ADDITIONAL_CHECK=1,SCEP_CERT=,oid=
(T14508) 05/04/20 09:48:37:295 Debug(1262): Send response to client for request https_request
(T14508) 05/04/20 09:48:37:399 Debug(2893): receive pan_msg_ping, 3
(T14508) 05/04/20 09:48:37:584 Debug(3007): Auth failed for portal
(T14508) 05/04/20 09:48:37:584 Debug(7689): Portal config is NULL.
(T14508) 05/04/20 09:48:37:584 Debug(6835): portal status is User authentication failed.
(T14508) 05/04/20 09:48:37:584 Debug(5591): --Set state to Disconnected
(T14508) 05/04/20 09:48:37:585 Debug(1826): unknown network type.
(T14508) 05/04/20 09:48:37:585 Debug( 874): Display hip report V4 on the UI
(T14508) 05/04/20 09:48:37:586 Debug(1262): Send response to client for request user_credential

 

 

I have tried to connect to several device, the others are okay yet this one particular device always return authentication failed to any connection i have tried to make... please help

Highlighted
L7 Applicator

@anthony.limanto  may want to edit out some details for privacy etc

Tom Piens - PANgurus.com
New to PAN-OS or getting ready to take the PCNSE? check out amazon.com/dp/1789956374
Highlighted
L7 Applicator

Try uninstalling and making sure you remove any registry artefacts, then reinstall as admin

Tom Piens - PANgurus.com
New to PAN-OS or getting ready to take the PCNSE? check out amazon.com/dp/1789956374
L0 Member

what to edit sir?

anyway i have tried to uninstall and delete the registry then reinstall it again, the result is the same

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!