Globalprotect for android ver 6.1.14 issue

[MRamadanAHafiez]

Hello Team,

                    I am recently having problem with GlobalProtect agent for Android phones.

previously everything was fine and no problems until version 6.1.11.x.

now upgraded to Globalprotect for android version 6.1.14.x.

since this version was installed o the mobiles, we are having problems connecting to the portal.

as soon as you click on the Connect you receive a message "Network connection is unreachable or the portal is unresponsive".

If I remove this version and back to the older 6.1.11.x it works back fine.

any other mobile phone with 6.1.11.x having no problems connecting to the portal.

any other globalprotect version 6.1.14.x can not connect.

Changes in my portal:

- applying policies based on a specific Host Information Profile only allowed to connect.

- according to security advisory we have stopped sending the firewall CA during the SSL VPN connection "supposed to affect on windows only".

- according to security advisory, we have a dedicated certificate for communication cookies between the mobile device and the portal.

- Globalprotect certificate is a self signed and used to accept it."also as in globalprotect for android ver 6.1.11.x.

We have PA-1410, Panos version 11.2.7-h4.

any ideas what's going on?

TIA

[MRamadanAHafiez]

Any ideas???

[BPry]

@MRamadanAHafiez,

Do the client logs show you anything? That's going to be the place where you're going to find the most useful information on whether it's simply a full communication issue. I will just caution using a self-signed certificate at all at this point; that causes a lot of issues that just aren't worth it considering you can get a valid certificate for free. 

[MRamadanAHafiez]

@BPry 

I am still checking in the logs because so far i found nothing.

but, how can I have a free signed certificate.

[BPry]

@MRamadanAHafiez,

Look into LetsEncrypt and CertBot, there's a lot of different options out there that have been documented to handle automatic certificate renewal or walk through manual generation and deployment. 

[MRamadanAHafiez]

@BPry 

thank you I will check,

regarding the issue, when the mobile tries to connect it receive the certificate warning "just like the working ver 6.1.11.x" and sure we then click continue, then it instantaneously, disconnect at the Portal Address with that error message "the network is unreachable or unresponsive..etc".

by check the logs, when my mobile source address connects to the portal address, and at the connect step after certificate warning acceptance right away the log session end reason is "Decrypt error" and no redirect to the login page where you enter your credentials then whenever I try again its normal tcp-fin.

we use the portal address and not fqdn for the portal address added in the clients devices.

any thoughts?

[MRamadanAHafiez]

I have tried many times both versions, obviously the 6.1.11.x and 6.1.14.x both have a major differences in the code, which still not clear to handle it in the deployment.

[E.Delil417682]

I am also experiencing this issue. After downgrading the version from 6.1.14 to 6.1.11, the issue was resolved.

I found the following log entries in the pan_gp_event log file:

[Info ]: Started the Portal pre-login
[Info ]: Portal pre-login result received
[Info ]: Failed to pre-login to the portal x.x.x.x
[Info ]: Portal status is "Invalid portal."
[Error]: No Network Connectivity. Please verify your network connection and try again.
[Error]: The network connection is unreachable or the portal is unresponsive. Check the network connection and reconnect.

I believe this is a software bug.

[MRamadanAHafiez]

After some diagnosis and test, logs review of the mobile globalprotect i have met the part:

CPanMSService::PreloginPortal CheckServerCert return 0x1001

And as @BPry highlighted its mostly certificate issue.

So، i will open a ticket and post the result here as soon as i get it.