Conflict between Global Protect and RedSky MyE911 application

[azelenin]

Hello,
We have thousands computers with installed RedSky MyE911.
Installation of this app is mandatory on our computers (it is federal low).
We did not have a problem with this app when used Cisco Security Client VPN but now, after installation of Global Protect VPN we have a problem.
RedSky MyE911 is started automatically (when Windows started), before Global Protect establishes connection.
As result, RedSky MyE911 generates non-stop error (see the picture) which cannot stop even after Global Protect "Connected'.
For stopping this error our users should exit (close) RedSky MyE911, verify that Global Protect is "Connected" and restart RedSky MyE911 manually.
It is not a problem with RedSky MyE911 app - this app is working w/o any error on computers with Cisco Client VPN.
Any suggestion?
Sincerely,

[kiwi]

Hi @azelenin ,

The root cause is likely how GlobalProtect handles the network stack during the "Connecting" phase compared to Cisco.

I believe there are a couple of things you can try.

Add the RedSky executable to the Exclude Application list.  You can do this under Network > GlobalProtect > Gateways > Agent > Client Settings > Split Tunnel > Domain & Application

Alternatively you can tell your OS to enforce a wait time until GlobalProtect is ready before it even tries to start the RedSky service : On Windows, open services.msc, find the RedSky MyE911 service and set the Start Type to Automatic (Delayed Start).

Hope this helps,

[azelenin]

Hello,
Unfortunately, your  solutions are not applicable in our situation.
We have hundreds thousands computers and according our rules all our computers should have identical configuration.
We cannot modify settings of all our computers because Global Protect temporary blocks access to Internet.
I think, Global Protect team should fix this problem - Global Protect app should NOT block access to Internet during start.
Sincerely,

[kiwi]

Hi @azelenin ,

Just to clarify—adding the RedSky executable to the Exclude Application list is a single change made in the GlobalProtect Gateway configuration on the firewall (not on your clients). 

However, I completely understand the sensitivity of this at your scale.

I suggest opening a support case so they can verify if an App Exclusion or a Captive Portal Exception is the best global fix for your specific environment.

Kind regards,