For details on cookie usage on our site, read our Privacy Policy
GP users are getting denied random times
- LIVEcommunity
- Discussions
- General Topics
- GP users are getting denied random times
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Printer Friendly Page
GP users are getting denied random times
- Mark as New
- Subscribe to RSS Feed
- Permalink
11-27-2019 04:57 AM
I have global protect v5.0.5 deployed to all Corporate Windows and some users reported that when they work everything stop to work and suddenly after 5-10 minutes is back again without disconnecting them from the global protect .This happen random times and not always .I have a user though that he reports that every day for the last week .
Palo Alto version is 8.1.11 VM-300 and GP agent 5.0.5 on a Windows 10.
I can see from the logs user is working fine in one server , then traffic getting blocked and can see only traffic log but not threat etc.
I am allowing based on the IP and the Zone and destination is any app any service .
HIP looks fine and agent is sending the report every hour .
Today this happened to a user connected 7 am and stopped working around 10am for 5 minutes .In the logs I can see HIP reports were send before and after the incident and user-id was reported that was learned from the AD .
I can see from the logs if that is helping that user is not written and after working is written . Is that related to USER-ID where I need to exclude the IP pools from the GP on the USER-ID ?
- Mark as New
- Subscribe to RSS Feed
- Permalink
11-27-2019 01:55 PM
Hi Remo,
When you say GP does it's own UserID ?
How does this work?
I am testing GP with assigning VPN pool a /24 subnet and it is based on the IP address.
Regards
Mike
- Mark as New
- Subscribe to RSS Feed
- Permalink
11-27-2019 02:55 PM
@MP18 I think you meant @reaper and not me 😉
But what he was saying that as soon as a user logs in to GP, the firewall assings a local user-ip-mapping with globalprotect as source. So if you also have User-ID agents in place, a mapping there could lead to a conflict and if the mapping on the user-ID agent is newer the local global protect mapping will be overwritten.
@GeorgiosFakis do you have logs of that timeframe(s) where the users reported that they lost the connection? Does this problem exist for all your users at random times or "only" for a small group of users?
- Mark as New
- Subscribe to RSS Feed
- Permalink
11-28-2019 12:30 AM
It's not sure how many experience the issue but right now i have reports from 20 users .
During the pilot phase was reported by 2 only but I had 20-22 pilots and most of them are not using the global protect all day , so it's not clear since the users are not connected the whole day on the global protect.
The reports I get about the issue is from users that are connected 8-10 hours constantly .
- Mark as New
- Subscribe to RSS Feed
- Permalink
11-28-2019 12:50 AM
what is your user ID timeout currently set to.
- Mark as New
- Subscribe to RSS Feed
- Permalink
11-28-2019 02:32 AM
Is set to 45 minutes :
- Global Protect client connected an able to send traffic but not replying when traffic is initiated in the Datacenter side in GlobalProtect Discussions
- Allowed SSL traffic reporting as policy-deny in Next-Generation Firewall Discussions
- PAN-OS 10.1.9 -- CAUTION in General Topics
- Question about HIP, plist check wildcard in GlobalProtect Discussions
- Access denied for Cortex XSOAR Customer success Webinar: Case management. in Cortex XSOAR Discussions
Show your appreciation!
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
