Palo Alto Globalptotect intermitant PanGPS error 'network type is unknown network' that causes the HIP report to not be send every hour

[nikoolayy1]

Has someone seen an issue where the PanGPS log is saying "network type is unknown network" before failing to send the HIP report every hour?

For info we don't use or have enabled Internal Host Detection as there no internal gateways and I see that there are no logs before that for DNS resolution, so the Globalprotect app does not try to trigger any fqdn resolution and this is ok but why the error :(. Also the Globalprotect App is the latest version 5.2.6 and the issue is still present on it.

[nikoolayy1]

@kiwi  and @aleksandar.astardzhiev  have you seen such issue before?

[kiwi]

Hi @nikoolayy1 ,

I have seen this before.  And as you've already pointed out the internal host detection was a valid workaround in our scenario:

(T4416)Debug(5897): 01/05/21 15:34:52:324 HipReportThread: network type is unknown network.

As a workaround we configured a dummy internal host detection that always resolves network type as external (IP address 1.2.3.4 and host fakehost.com). This config on the GP client helped to identify the network type as external.

In another scenario I saw this behaviour when Prisma Access came into play:

1. Users have user-logon as connect-method for the globalprotect agents which is an 'Always-on' method, meaning that you want the users to automatically establish a connection to the gateway.
2. Prisma Access is setting priority 0 (manual only) for users outside US which is contradicting the user-logon (always-on) behaviour.
3. HIP Is not submitted since the above configuration (User Logon connection Method + All External Gateways in Manual-Only mode) led to a failing to discover external network - (T4004)Debug(5897): 01/29/21 11:19:49:051 HipReportThread: network type is unknown network
4. As a fix/workaround for this: enable one of the gateways mentioned in the document below for redundancy if the users travel outside of US.  This is how Prisma Access is designed: https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-admin/prisma-access-fo...

Hope it helps,

-Kiwi.

[nikoolayy1]

Thanks Kiwi, I was also thinking the same but we had Palo Alto TAC case and we were still waiting for them but they are taking too long and now that you confirmed that this may help, I will move on with the testing it. I will write if this solved the issue.