GlobalProtect Connection Issues after April 2021 Windows Updates

[bcatlett]

After installing the April 2021 windows updates our GlobalProtect clients started having issues connecting where it would take several attempts to get connected normally seeing 3-4 connect then disconnect cycles before finally staying connected.

We confirmed that after uninstalling the windows update GlobalProtect behavior returned to normal, however these windows updates have critical security patches so uninstalling them isn't a good option.  We are running GP 5.1.6 but have also tried 5.2.5 and 5.2.6 with the same results.  We are running Windows 10 2004 and Windows 10 20H2.

Our GP setup has prelogin using a machine certificate and then login using client certificate along with usernname/password then MFA.  We have tried fresh installs of GP and doing a reissue of the machine and client certs all give us the same behavior.

We have a Palo case open but so far they haven't found anything that has worked, I found the thread below so it looks like others are seeing the same problem and it might be related to DNS.  

Has anyone else seen this behavior and found a work around or fix?

https://answers.microsoft.com/en-us/windows/forum/all/vpn-issue-with-update-kb5001330-global-protect... 

[bcatlett · Accepted solution]

Hello,

Our system engineer applied the fix in the link below and this has resolved the issue for us.

https://hsione.force.com/dentrixguest/s/article/Unable-To-Access-Common-Folder-Due-to-Windows-Update... 

[fhu_omi]

Hi All,

i would provide you the secure solution, because LLMNR enabling is not a good idee-> https://attack.mitre.org/techniques/T1557/001/

We have been working with Microsoft and PAN for several months. Enabling LLMNR should not be enabled from a security perspective, so this is not the solution.

If LLMNR was disabled via GroupPolicy, mDNS was also disabled. This error was corrected with KB5001330 with two independent reg keys. However, if LLMNR was disabled before KB5001330, mDNS was implicitly disabled as well.

With the KB5001330 install, LLMNR remained disabled by GP policy, but mDNS was re-enabled and caused the GlobalProtect problem.

With this settings you are save from the LLMNR Security flaw and GP is connecting fast:

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\EnableMDNS                              REG_DWORD=0 (Off)

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\EnableMulticast                        REG_DWORD=0 (Off)

Have a nice day