Hello LiveCommunity Team!
I created this post to share my experience regarding some Issues that recently seen on the Prisma Browser and Mobile User GlobalProtect pushed failing multiple times!
We had configured Prisma Browser alongside GlobalProtect—deployed via Strata Cloud Manager (SCM) to work seamlessly; however, a few days ago, we began seeing the following error in Prisma Browser when attempting to connect to remote resources "No Upstream Gateways Available":
PRISMA BROWSER REMOTE CONNECTION ERROR
We attempted to use GlobalProtect to access those resources; however, in SCM, push operations to the GlobalProtect Portals and Gateways consistently fail, take a long time, and always display the following messages:
PRISMA ACCESS MU-SPN GLOBALPROTECT ERROR MESSAGES
Troubleshooting Steps:
1- Check the current status of the Prisma SASE service worldwide on the following official webpage (But everything was fine!):
SASE Health
PALO ALTO SASE HEALTH STATUS
2- We created a support case and the TAC engineer create an internal ticket to Engineering team who says the next RCA:
Response And Findings Of The TAC engineer
"
Thank you for your patience.
Engineering identified the root cause of the issue as a failure in the certificate renewal API endpoint. This error prevented successful device certificate renewal.
As a result, the service responsible for processing commit jobs, which depends on successful device certificate renewal, became stuck while attempting to retrieve the device certificate. Consequently, commit jobs were not processed.
Engineering has completed the necessary remediation actions to restore normal operation, and the issue has now been resolved. Let me know if you have any additional questions.
Please do not hesitate to reach us
"
After a few hours, we re-sent the push tasks to the GlobalProtect nodes; the process completed without issues and more quickly, and Prisma Browser was able to resume connectivity with remote resources.
We also have another problem, but one related to push operations to Remote Network nodes, as shown below:
PRISMA ACCESS RN-SPN ERROR MESSAGES
We opened another support case, and the TAC engineer provided the root cause analysis (RCA):
Response And Findings Of The TAC engineer
"
You were experiencing persistent configuration push failures specifically for the Remote Networks scope in Strata Cloud Manager, while Service Connection and Mobile User pushes were successful. The pushes would remain in a "Pending" state for 30–60 minutes before eventually failing, blocking necessary network changes.
Investigation & Resolution:
> We joined the session and verified that two specific Remote Network nodes were out of sync and causing the global push timeout.
>Verified these nodes from the backend and identified that the process/daemon responsible for processing configuration pushes would have backed-up buffer. This was caused by multiple simultaneous pushes from different administrators, which would create a large queue that the process could no longer clear.
>Generated TSF from the backend nodes, and manually cleared the timed out jobs by restarted the process responsible for the commit on the two RN nodes.
> We initially performed a selective test push to the Remote Networks scope, which transitioned from "Pending" to Successful.
> You then performed a Full Push for all components, which also completed successfully.
> To avoid this in the future, we recommend performing pushes among administrators in a timely manner. If a push appears stuck, avoid triggering subsequent selective pushes to the same scope, as this increases the backend buffer load for the commit process.
"
After this, everything worked fine for Remote Network nodes!
Thank you for your time, and I hope this information is helpful in your daily cybersecurity work. I would greatly appreciate your support by liking or accepting this as a useful post; it would help me a lot in becoming a CyberElite!
Best Regards,
Daniel Romero
Senior Network/Security Engineer
PANW Partner
