Global Protect 5.2.6-87 Not able to see all folders on DFS file shares

[ibcarolek]

We have some users who cannot see and processes cannot access some of their folders on a DFS file share when they are on the GP VPN, but they can see them when they revert to our previous VPN (we are just rolling out GP now).  They do not have offline files enabled. Other users have no problem seeing folders on GP.  I searched Known Issues, but didn't find this symptom.  All are Windows 10 Enterprise, 1903.  64bit/8gb of RAM.  We like GP as TEAMS works better with it, but we need our files too.  Thoughts on what is going on and how to fix?

[BPry]

@ibcarolek,

GlobalProtect should have absolutely no bearing on what folders a user can see. I would enable logging on the interzone-default entry and verify that you aren't unknowingly dropping somw of the traffic by logging through your unified logs. 

[ibcarolek]

Yet it is...when we use our old VPN solution, all folders are visible. Consistently.  When we use GP only a few are.  I believe it is a conflict with DFS drives.  If we are dropping traffic, it would have to be due to GP.

[BPry]

@ibcarolek,

So to be clear, the GlobalProtect agent is simply passing the traffic back to your firewall. When I say that it isn't being caused by GlobalProtect, I'm speaking specifically about the fact that the agent itself isn't causing any issues with accessing a DFS share. 5.2.6 works perfectly fine when everything is properly configured in regards to DFS access.

If you are dropping traffic, which is what I asked you to look at in my prior comment, it's due to how you have your security rulebase configured on the firewall you are connecting to. That isn't a "GlobalProtect" issue, it's a security configuration issue. You need to look through your firewall's logs and ensure that you aren't dropping/denying traffic that you want your users to be able to access when connected to VPN.