Outlook 2016 unable to open while on GlobalProtect

[jmurphy]

Anyone else experiencing issues with Outlook 2016 being unable to open while on GlobalProtect?  We have sporadic windows 10 pc's with this problem and all windows 7 pc's have this issue.  When we disable GlobalProtect and start Pulse Secure (our legacy VPN agent), Outlook opens right up and connects.  We have a ticket open, but I'm guessing TAC is slammed right now.

[OtakarKlier]

Hello,

Are you using split tunnel VPN or full tunnel? What do the traffic logs say with regards to the traffic, allow/deny? My guess is that it might be denied?

Regards,

[jmurphy]

We're currently running split-tunnel, but the split tunnel is only to exclude a few domains not related to O365.  I'm not finding ANY denied logs.  We even added FULL internet access based on any, any, any with no IPS, URL, etc.  Still failed.

[OscarFilipe]

 Is there any finding as to the issue?  We have the same problem with some clients whereby you need to disable global protect and start outlook first.  Thanks

[pshah1]

root cause:

we are running into this issue quite long.                                                                                                                                                    Root cause:The NLA/NCSI is confused and incorrectly assumes there is no active internet connection because the VPN adapter does not have an explicit default gateway IP defined.

Workaround we tried still testing though
1-Change the NLA under services to automatic delayed start ( so it takes some secs to start rather than automatic)
2->As Both of these rely on there being a default gateway specified for the current active Internet connection for them to successfully report the connection is up, I added default gateway “192.168.0.1" on my wifi network.( and added NLA and NLC ip are added to Allow traffic to specified hosts/networks when Enforce GlobalProtect Connection for Network Access is enabled and GlobalProtect Connection is not established )

3->if you hv pre-logon you would need to allow NLSA on pre-logon policy as well.

Type of Request that NCSI Sends

msftconnecttest.com
dns.msftncsi.com

[Brahim]

Hello,

Any news about this issue ? We have also this issue, we have a default route but we exclude private network from the tunnel. Outlook cannot connect (GP enforce network access is disabled).