Clients stuck in Connecting state

[jhwarren]

Hello All,

We have had a more or less stable GP environment during this pandemic.  About a week ago, we started receiving calls of clients not able to connect - the GP agent stuck in the connecting state.

We had recently enabled split tunneling for just a couple Microsoft networks to support teams and backed that out but at still receiving calls.  A call to TAC also resulted in some custom apps to reduce the load on our firewall.

With GP agent version 5.0.2-13 on Windows 10 clients, we have had a rough week with over 30 calls with issues.  It seems the fix for some clients is kill the agent, restart pangps service.  Others removing IPV6 from network adaptor did it.  Yet others a reinstall did it.

Is the connecting indication the client connecting to the portal, the gateway, or both?  I'm trying to determine where the issue is.  We have a large contingent of users working fine on it but a growing number having issues.

I suspected recent updates (sccm pushed some updates including .net 4.7.2, and windows update put a security patch on) - but we have clients with and without these updates working and not working.

The KB shows nothing that has helped with this, but just looking at other potential solutions while waiting.  

I'm trying to hold off rebooting the firewall but I'm tempted! 🙂

John

[OwenFuller]

Would it be possible to try a more recent version of the 5.0 client?  5.0.2 is over a year old now, and the preferred release at the moment is 5.0.9 (see https://live.paloaltonetworks.com/t5/customer-resources/support-pan-os-software-release-guidance/ta-...).  We previously had problems with users not being able to connect on versions earlier than 5.0.5.