GP users are getting denied random times

[GeorgiosFakis]

I have global protect v5.0.5 deployed to all Corporate Windows and some users reported that when they work everything stop to work and suddenly after 5-10 minutes is back again without disconnecting them from the global protect .This happen random times and not always .I have a user though that he reports that every day for the last week .

Palo Alto version is 8.1.11 VM-300 and GP agent 5.0.5 on a Windows 10.

I can see from the logs user is working fine in one server , then traffic getting blocked and can see only traffic log but not threat etc. 

I am allowing based on the IP and the Zone and destination is any app any service .

HIP looks fine and agent is sending the report every hour .

Today this happened to a user connected 7 am and stopped working around 10am for 5 minutes .In the logs I can see HIP reports were send before and after the incident and user-id was reported that was learned from the AD .

I can see from the logs if that is helping that user is not written and after working is written . Is that related to USER-ID where I need to exclude the IP pools from the GP on the USER-ID ?

[MickBall]

I would extend that to 480 (8 Hours)

I have mine set to 24 hours but for some thats too long.

4 Hours may be OK.   but try  8 and reduce if needs be.

[MickBall]

also use....:-

show user ip-user-mapping  all

this will display all known users to IP address and when the expire

[GeorgiosFakis]

Hi

I have done this but again user reported that next day . 

I got debugging logs from user and I see it's an issue on HIP report that timed out . I have opened a case with Palo Alto and waiting their availability to check it .

[MP18]

Keep us posted on this.

Lets see what PA says?

Surprise Hip report can cause this issue

[GeorgiosFakis]

PA released version 5.0.6 that fix some HIP issues. Now for the case I have they are still reviewing the files I sent them .

From what I see is that :

 (T20032) 11/28/19 11:18:03:568 Debug(4477): Send hip report check failed

I have increased the timeout to 1 day for the HIP report from 3 hours that was set.I will keep you posted .