Will an On-Demand configuration keep GlobalProtect from notifying me that it did not connect?

Reply
MickBall
L7 Applicator

@BrianRa, yes noted... when i say we have no issues i of course mean not enough to cause any concern...

we do have the occasional rediscover issue but users are content and familiar with this... our calls have reduced 10 fold since always on was introduced. However... we really dont get many rediscover issues compared to the ammount of users involved and im talking about users who struggle to even open the laptop lid sometimes...

 

but of course.... if it all ran smoothly... i would be stacking shelves.....

 

not sure if it makes any difference but in sleep mode, users are logged off and after 15 mins of inactivity the laptop is shut down...

so.... by the time our users have moved site or arrived home the device powers up from scratch... 

 

Laters....

 

 

 

BrianRa
L3 Networker

Thanks @MickBall, I wasn't trying to argue I was confirming everything you had said. 

That is actually a very good differentiation.  We allow them to sleep then hibernate.  When they come back up the laptop thinks nothing has changed, checks its network and corrects.  GP does not always update when the interface updates.  This is where the rediscover network comes in.

I am not saying by any means this is a large problem, just one it is better to be aware of.  Initially we received quite a few calls because "it takes forever to come back up".  The GP VPN works much better than many others I have used.

 

Brian

MickBall
L7 Applicator

@BrianRa, no arguement perceived, it was a good post and i was confirming what you said as no matter what configuration you use, it will still have the occasional issue. Sorry for the confusion.

 

 

 

 

 

 

 

 

jdprovine
L4 Transporter

@MickBall

We allow internal accessa as well though I have been told that is not a good idea but I have never been given any reason why it is considered a bad idea

MickBall
L7 Applicator

@jdprovine.

 

I can see why this could be an issue...

if you remove the dns entry of your internal host, or, if the internal host changes its IP then always on devices will connect to the gateway via the internet and back again...  no big deal but it could max out your 128k isdn...

 

so, I use an internal host with a fixed IP, damage limitation reduced 50%. 

I still would prefer the option of being able to add at least another 1 internal host entry..

 

having said that,,, you can of course have internal host detection without access from the LAN to portal/gateway.

 

I have to say that the best point about internal host detection is that users will know if they have a GP issue prior to traveling half way round the world to discover thier auth cert has expired or that thier username has been changed on AD and not updated PKI. 

 

Mick

jdprovine
L4 Transporter

@MickBall

I have everyone configured for on demand so they don't automagically connect to the VPN.  I don't believe we have any internal host detection enabled either, I did not configure the box originally and there are still alot of pieces parts I don't understand or know yet

MickBall
L7 Applicator

@jdprovine.

 

"and there are still alot of pieces parts I don't understand or know yet"

 

ahhh... welcome to my world....

 

 

BrianRa
L3 Networker

@jdprovine, in many ways that is the positive and negative to Palo Alto.  There are many pieces that can be configured and often there is more than one way to put them together.  Thats great for this specific thing or that but at the same time it makes it very difficult to create that standard config that you can just pass off to the next guy.  He probably did something different.

 

@MickBall, the only suggestion I can make on using more than one internal device check is to configure both the IPV4 and IPV6 devices.  It let me configure both but we are not currently using V6 internally so I can not test the functionality for you.

 

Overall we have found the internal vs external configuration works very well (aside from the network swaps previously mentioned).  We have actually found the majority of our GP VPN client problems come from the actual client install itself having problems.  It will either not install properly the first time or something later (we can only assume) messes up the install when it is either installed or updated (new program, updated program, windows update, etc).

 

Brian

jdprovine
L4 Transporter

@BrianRa

 

Yes the configurations are probably not the same for everyone, but TAC assured me it was 99% unlikely that the configuration on the Zone protection broke my VPN

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!