GlobalProtect never-ending "Finding the Best Available Gateway"

[janicex]

Hi. I'm using GlobalProtect App Version 6.1.1-5. It often to get into this never-ending cycle of "Finding the Best Available Gateway". I try to "Refresh Connection" which does nothing:

There doesn't seem to be a "Cancel" button to try to reinitiate the connection or restart the GlobalProtect client. I usually have to execute the following command in Windows 11 command prompt to restart the GlobalProtect client:

powershell -command "Restart-Service PanGPS -Force"

This usually does the trick. But it's a pain as I'm using a corporate laptop and I need to run the above in admin mode which requires entering an admin username/password.

Has anyone come across this? I really wish they would add a retry/cancel button to the client. Thanks.

[JayGolf]

Hi @janicex ,

Taking a look at the recommended release, 6.1.5 isn't considered preferred yet. Can you try degrading to the preferred 6.1.4 to see if that helps your situation at all? 

[JustinWoodman]

Normally when we see this, it is with mobile hotspots and other devices that use ppp/pppoe, which increases the tcp/ip overhead.  So you need to decrease the mtu size to fit inside a smaller packet size.  We created a special group, where we set the mtu size to 1300 for people who have these issues. You just set the special group's gp connection policy higher than the default users, so they pick up those special settings. This a new agent in the gp portal tab. Instead of user group "any" its using this special group. You could just set it as the default for all too. I think its 1280 is the smallest you can set this, and still support ipv6.  Somewhere around there.  Obviously you only want to the largest mtu size that still works.  This setting cause inefficiencies, which causes your connection to be slower.  We only had a small subset of users affected by this.  This is just something else to look at, could be caused by some other issue.  Good luck. 

[mlinsemier]

I'm seeing this exact same behavior on the latest GlobalProtect 6.3.1.  That being said, GlobalProtect 6.2.4 seems overall pretty stable for us.

[julian.benson]

Hey did you resolve this, i have this issue in any version higher than 6.3.0 , both 6.3.1 and the hotpatched version my users stick on finding best available gateway. The irony is we only have one gateway!

[JustinWoodman]

I know GP 6.2.6 has resolved issues about getting stuck on the connecting phase.  I think maybe 6.2.5 has one for finding gateway too. You can manually download the gp client from the support page, install it and run it against your current gateway, without changing the gateway client version. I would assume that any fixes the 6.2 has, would probably be relevant to 6.3 too.  Not sure why the 6.3 branch seem to get less frequent releases.