Global Protect VPN frequently getting disconnected

cancel
Showing results for 
Search instead for 
Did you mean: 

Global Protect VPN frequently getting disconnected

L2 Linker

Hi,

 

We are facing issue with Global Protect VPN client connectivity for one of the user machine. Below are the details of the issue.

-> Global Protect VPN is very frequently getting disconnected

-> in Global Protect VPN connection stauts - can only see Packets Out , there are not Packets In.

 

In GP event logs can see "Tunnel is down due to keep-alive timeout" logs

 

Please let me know what can be the possible reason for GPVPN frequently disconnecting - but once connected there is no connectivity to corporate VPN over GPVPN.

 

Attaching the Global Protectlogs debug logs took from user n=machine during the time for issue.

 

Note: Issue is happening on for one user.For rest all users GPVPN is connecting fine.

 

 

 

20 REPLIES 20

L0 Member

We had this issue come up with a brand new 3410 running 10.2.1 and found a work-around. The issue is either caused by the keepalives not being sent correctly or not being detected correctly. This was causing every vpn user's connection to reset every 10min, you can imagine how happy they were. We found out is was because the gateway idle timer was set to 10min. Even though the connections were active and passing a lot of traffic the keepalives weren't being detected. We changed the idle timer to 24hrs and it fixed it as a work around. Palo support still hasn't provided any solution for this.

Hi,

We don't see any solution
Some private message ?
Is some one have the solution ?
For my case, the problems begun from globalprotect upgrade to 6.0.1

Thanks

Greetings

Franck

You have to modify the global protect gateway idle timeout to however long you want them to stay connected as a work around until Palo fixes the bug. Otherwise since it doesn't correctly detect the keepalives it will disconnect as soon as it hits the idle timeout.

L1 Bithead

We started having the same issue after upgrading to 10.1.6. No issue on 10.0.10.

We're running into the same issue. Just updated from 10.0.6 to 10.1.6 and users are being disconnected shortly after connecting to the gateway that was recently updated to 10.1.6

L1 Bithead

Agree on the issue occurring since upgrading our firewalls to 10.1.6.

   Issue was not present prior to upgrading 10.1.6.    Immediately after 10.1.6 upgrade, my users experienced this issue.  No change in GP client version as part of the upgrade.   Currently using 5.2.x GP branch, tested using multiple versions, included latest 5.2.12.

 

Issue occurs regardless of wireless/wired connection at offsite location, regardless of internet providers at offsite locations, or different internet providers connected to the firewalls themselves.

 

Hope to open a ticket this week with support on the issue.

Update: Opened a ticket with TAC - looks like this is a known issue, although there is no resolution and only a workaround. Workaround= completely shutdown the device and power back on (not a reboot) or to downgrade to 10.1.5-h2 or another previous version. Here's the kicker. We downgraded our PA-3250s in an HA pair one at a time to 10.1.5-h2, and after we tested our Active FW on 10.1.5-h2, GP users were NOT being disconnected (great!) then we downgraded our passive FW, and now the passive FW will not connect to Panorama. 

 

Looks like this is another bug and no work around yet. Still working with TAC....this is frustrating to say the least

L1 Bithead

Similar to @frankis ..  on my support ticket, full shutdown, don't reboot...

 so last night, shutdown one box, pulled power plugs for about 5 minutes.... plugged them back in and powered it back up...

currently, my laptop is connected via the VPN for over 5 hours without disconnecting.

@MattShuter Can you tell me the boxes you have? Are your boxes in HA pair? Are they 3200 series boxes?

5220s, not in HA pairs..  running at separate sites.   Will shutdown my second box this weekend I think.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!