Reason why the GlobalProtect session is disconnected

[olloczky]

Hi Guys,

Some of our users experience disconnects from our GP VPN. When it happens it always impacts a partial set of the clients not everyone. I would like to know a method in which I can determine the reason of the disconnection.

In the Monitor-Logs-GlobalProtect tab I can only see the fact if a user is logged-out or logged in and authentication steps.

Is there a way to know if somethings happening on the PA side or the users' home ISP is misbehaving?

PA version: 9.1.3-h1

GP version: 5.2.4

Cheers,

Daniel

[aleksandar.astardzhiev · Accepted solution]

Hi @olloczky ,

I would suggest to take one or two example users and check the GP client logs - How to Collect Logs from GlobalProtect Clients - Knowledge Base - Palo Alto Networks

Note that if in your portal config you have set "Enable Advance View" to no, the troubleshooting tab will not be visible for the user. So you will have to collect the files manually - Where is the GlobalProtect Log File Located? - Knowledge Base - Palo Alto Networks

I would suggest you to look at "pan_gp_event.log" and more importantly "PanGPS.log"

[olloczky]

Hi @aleksandar.astardzhiev,

Thanks for this info! Unfortunately our clients are thin clients with veeeery limited capabilities. This means they cannot create files on the computer, thus cannot save logs. Maybe the first option is feasible, will check that.

Besides from client side, is there no way to check similar debug infos on the FW side?

[BPry]

@olloczky,

No. Detailed logs are only kept on the client side, and the firewall won't be able to tell you why a client was disconnected unless it was disconnected by the firewall itself. 

[Brandon_Wertz]

---

@BPry wrote:

@olloczky,

No. Detailed logs are only kept on the client side, and the firewall won't be able to tell you why a client was disconnected unless it was disconnected by the firewall itself. 

---

While not wrong, the most detailed logs would come from the remote client, a firewall running PAN-OS 9.1.X does have greater logging than previous code versions.  There are "Global Protect" logs in the monitor tab which might help identify why a user is getting disconnected or not connecting.

[olloczky]

@Brandon_Wertz thanks for that! I've checked those logs as well. Either I'm not smart enough to interpret those logs or those are just really the events which are logged and not the detailed info and error codes. Because the latter is not enough for me now unfortunately. 

I really appreciate your inputs guys!

[Mick_Ball]

under the new logging regime Monitor/GlobalProtect add "( eventid eq gateway-config-release ) or ( eventid eq gateway-logout )"   to the filter.  this will be best information for disconnects but as @BPry mentioned, this will only be logged if planned. if the devices have comms or pangps service issues then this will not be logged on the firewall.

for all our disconnect issues I have never found much help on the firewall apart from the obvious that if it's not logged then it wasn't planned.

[olloczky]

Thank you guys. I was able to collect logs on client side but the security rules restrict me to gather them but that is a different topic 🙂 Thank you all for your inputs!