GP users are getting denied random times

[GeorgiosFakis]

I have global protect v5.0.5 deployed to all Corporate Windows and some users reported that when they work everything stop to work and suddenly after 5-10 minutes is back again without disconnecting them from the global protect .This happen random times and not always .I have a user though that he reports that every day for the last week .

Palo Alto version is 8.1.11 VM-300 and GP agent 5.0.5 on a Windows 10.

I can see from the logs user is working fine in one server , then traffic getting blocked and can see only traffic log but not threat etc. 

I am allowing based on the IP and the Zone and destination is any app any service .

HIP looks fine and agent is sending the report every hour .

Today this happened to a user connected 7 am and stopped working around 10am for 5 minutes .In the logs I can see HIP reports were send before and after the incident and user-id was reported that was learned from the AD .

I can see from the logs if that is helping that user is not written and after working is written . Is that related to USER-ID where I need to exclude the IP pools from the GP on the USER-ID ?

[MickBall]

could you just confirm if your policy is based on source user-ID or user IP address.

[reaper]

GP does it's own UserID so if you have the IP pool included in the regular userID, this could cause a conflic. excluding the subnet would be a good step to see if it resoves your issue

you could also track global counters to help guide your search to the cause of users getting dropped during that timeframe

[GeorgiosFakis]

We had some issues 2 months ago with the Pilot where user let's say George had another account like adminGeorge and group was different so we removed the user/group access filtering in policy .

Now we have Source IP pool that we provide and the Zone of Global Protect only .

Destination is any any to internal resource for that user had issues today and with AV,VULN,ANTI-SPY profile . Nothing was blocked because of the profiles .

[GeorgiosFakis]

I can see that today but issue started before 10:13 . 10:13 was reported that was ok and user connected 7am which I don't have logs before that for user-id which is strange.