GP gateway drops to SSL and client gets disconnected..?

[thatguy]

Hi all -- I just noticed an odd behavior affecting all GP clients (running on PA200, PANOS 6.0.3, GP Client 2.0.3), but I haven't changed anything recently.

In looking at the System log, I see users connecting successfully ('portal user auth succ', 'portal client config gen', 'gateway user auth succ', 'gateway user login succ', 'gateway client config gen').. But then there's a 'gateway client switch to SSL tunnel mode', and 30secs later, there's a 'gateway client config release', and 'user logout succeeded'.  All connections up until today have used IPSec, and for whatever reason, SSL sessions logout immediately (because we don't have a certificate?)..

Could this be a network issue?  We've been having issues with out internet provider lately, and pings are averaging around 60ms from the public side, tho that doesn't seem slow.  Is there anything I could check internally? 

Any help is much appreciated. Thanks

[_slv_]

Hi Thatguy

Please read this topic How GP selects between SSL and IPSEC?

As mentioned You can forse IPSEC mode - try and let us know how its working.

Of course please try to connect from local networks - is it working?

Maybe Your ISP filtering IPSEC - ask them.

Regards

Slawek

[pulukas]

Could you post the log message the Palo Alto generates on the firewall logs when the client disconnects?

[thatguy]

Here is the same set of msgs that get logged for every user now.  Prior to yesterday, we would get the same set of msgs, except for the switch to SSL.  Since that started, users are immediately logged out. 

[thatguy]

Apparently, this was a non-issue.  I had to do a hard reboot of the PA200 and suddenly the IPSec tunnel was fine.  Just weird.  Thanks for the replies anyway.

[pulukas]

The universal solution to computer problems, reboot.

But a little disappointing that there is not a clearer logging on a problem.  these look like normal sessions.

[PHFA]

Hello,

I was facing the same issue and i was seeing the same logs on the PA device.

HA cluster PA500

PANOS 6.0.3

GP: 2.0.4

I have hard rebooted the devices but it did not solve the issue.

I had to install the new version of GP: 2.2 to solve this problem. And now i am able to connect in an instant way and without any issue.

Regards,

Phfa