Global Protect VPN disconnects on Windows while active

[jdoherty1103]

We are having an issue where Global Protect VPN on Windows 10 is disconnecting after 4 hours while it is still active.  We have the inactivity logout set to 4 hours.  Our Macs aren't having any issues.  The HIP log on both the mac and windows machines shows the check running successfully every hour.  We have ruled out sophos, windows defender, and crowdstrike as possibly blocking it. 

[Klaverblad]

Hi Jdoherty1103,

We are experiencing the same thing and it does appear that this setting is somehow involved in our situation.

What we're also seeing is succesful HIP Checks in PANGPS log.

We assume that the HIP check is performed properly (based on the events in the PanGPS log), but somehow with the 'wrong firewall/gateway'.

According to the description of the inactivity logout value, it is triggered by not receiving HIP checks within the given amount of time.

Next to that we also witnessed keepalive timeouts happening at the inactivity logout value.

We suspect this happens because of the inactivity logout threshold is triggered. The gateway thinks it did not receive HIP checks, starts sending keepalives.

Now this is a point where we don't fully understand what's happening. When the gateway does send a keepalive according to the capture, nothing comes back. Regardless of the suggestion that the HIPS check would indeed be sent to the other firewall. Why would any client not reply to a mere keepalive (once every 10secondes, for 50 seconds).

Are you using an active/active firewall setup?

If you'd change the inactivity logout value to 10-12 hours as a workaround for not having disconnects until the root cause/solution is found.

Currently we have a case open with TAC

[Fulicher]

I have several remote users that we have recently hired on to our company. We use the Palo Alto GlobalProtect VPN client for remote users. We do not have any SSO set up so everything is Windows Credential based krogerfeedback

[jdoherty1103]

@KlaverbladIf you could let me know what TAC comes up with, it would be greatly appreciated.

[Klaverblad]

Its confirmed to be a bug:

To be fixed in: PAN-151458 (A/A GP Gateway Inactivity Logout timer not Recognizing HIP and Disconnecting).

This fix is not yet implemented nor will it be in 9.1.5. So we'll have to wait for at least 9.1.6.

In the meantime the workaround is to set the inactivity logout long enough so nobody will get disconnected because of this.

Typical workday = 9hours including brakes. So 10-11hrs ?

[jdoherty1103]

@KlaverbladThank you for the information!

[Klaverblad]

Hi Sarah,

The fix has been implemented in 9.1.7