VPN - INTERMITTENT/UNSTABLE VPN CONNECTION

[Amarparade]

Hi,

In my team multiple users upgraded windows 7 to windows 10 after that VPN intermittent issue happened. every 5 seconds VPN(GP Clint) is disconnected. i tried uninstalled GP in mobile and also laptop but still same happened. latency is normal and tracert is completed.. How can resolve this please update.

This morning, we had a walk in user that is having issue with SAP, upon checking, it is caused by VPN reconnecting after 4-5 mins. Here are the details:-

1. User was connected to mobile hotspot.
2. User has tested at in-law house on different network provider and no issue found.
3. User was previously using windows 7 and recently migrated to Windows 10. However, she was able to use VPN after the migration. It was last month, all of the sudden the issue occur

[aleksandar.astardzhiev]

@Amarparade ,

What GlobalProtect version are you using? What is your FW version? Have you check GP client logs - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClaLCAS 

[Amarparade]

1.  GP Version 5.0.10
2. FW Version GP agent 5.0.10
3. FW SW Version 9.0.9

Yes please check below logs

[BPry]

@Amarparade,

So according to your log file it's losing its connection to the GP gateway, which is what's causing your disconnect. If we take away GlobalProtect for a second, do these devices lose access to the actual gateway outside of the agent? 

When you say you upgraded Windows 7 clients to Windows 10, did you do an in-place upgrade? 

[Amarparade]

yes, upgraded 7 to 10 and issue occurred in home wifi  and hotspot in office wifi it works fine.

[BPry]

@Amarparade,

So the test that you would have to do is whether or not the actual computer loses connection to the gateway or if it's just an agent. So you'll need to setup a continual loop to the gateway itself and log it, so that you can compare that log when you run into the issue with the GlobalProtect VPN agent again. Essentially, what you're looking for is if you lose your IPSec connection AND access to the gateway address altogether or if you just lose the actual tunnel. 

The fact that it works on the office wireless doesn't really mean much without knowing how GlobalProtect is configured. When your internal to your office wireless network does the traffic actually get tunneled through GlobalProtect, do you connect to a dedicated internal gateway? There's a lot of variables on that one to rule out anything other than your actual agent isn't the issue.