GlobalProtect Fails During Pre-Login with WinHttpReceiveResponse Error 12152

[R.Singh384240]

GlobalProtect is unable to connect during the pre-login phase.

• Verified all required certificates are installed on the endpoint.
• Confirmed certificates are located in the appropriate certificate stores.
• Collected and reviewed:
  • GlobalProtect logs
  • TSF
  • Firewall packet captures

We got the following error in PanGPS.log:2 3(P5136-T8916)Debug(544): CPanHTTPSession::PostRequest: WinHttpReceiveResponse...4(P5136-T8916)Error(549): CPanHTTPSession::PostRequest: WinHttpReceiveResponse failed with error code 12152.5(P5136-T8916)Debug(1439): PostRequest error code=12152 (The server returned an invalid or unrecognized response)6(P5136-T8916)Debug(8698): prelogin to portal result is (null)7(P5136-T8916)Debug(9106): Failed to pre-login to the portal x.x.x.x with return value 12152 (The server returned an invalid or unrecognized response)

I have not been able to identify a root cause from the available data. The failure occurs during communication between the GlobalProtect client and portal, and the connection does not progress beyond the pre-login stage.

Any guidance or similar experiences would be greatly appreciated.

Thank you.

[YEmreSeven]

Hi, looks like you have issue at the very first communications so it could be anything. At the first, you must create security policy that match the pre-logon user. Also I suggest to check counters with filters.

In the link below, also have good tips to pre-login authentication. 

https://docs.paloaltonetworks.com/globalprotect/administration/globalprotect-quick-configs/remote-ac...