GlobalProtect Random disconnects

[KarolMajewski]

Hello,

Has anyone else have issues with random GP disconnections since recently (May/June/July 2021) on GP version 5.0.x and 5.2.x ? 

It started around one month ago throughout the whole company and we weren't able to figure out what's going on till now.

There is no preceding events logged in the GP debug or dump level trace that would point to an application crash or network failure. 

The same goes for the event viewer logs.

At a random point in time the agent sends a disconnect message to the GP service which start the disconnection process

GPA log:

(P11804-T8112)Debug( 611): 06/04/21 17:24:21:666 Send command to Pan Service
(P11804-T8112)Debug( 639): 06/04/21 17:24:21:666 Command = <request><type>disconnect</type></request>

GPS log:

(P9244-T9712)Info ( 502): 06/04/21 17:24:21:666 msgtype = disconnect
(P9244-T9712)Debug(2062): 06/04/21 17:24:21:666 ----Tunnel User Diconnecting starts----

debug_drv.log file:

(P9244-T10636)06/04/21 17:24:21:140[Info 450]: Set debug level as 4
(P9244-T9712)06/04/21 17:24:21:776[Debug 573]: Restore IPv4 strong host model for interface 18
(P9244-T9712)06/04/21 17:24:21:776[Info 291]: Unregister ends.
(P9244-T9712)06/04/21 17:24:21:777[Info 260]: ----Driver Control is being stopped
(P9244-T9712)06/04/21 17:24:21:778[Info 411]: Send thread stops.
(P9244-T9712)06/04/21 17:24:21:778[Debug 1368]: Disable adapter be called.
(P9244-T9712)06/04/21 17:24:21:783[Info 1147]: enum devevice ROOT\PANGPD\0000.
(P9244-T9712)06/04/21 17:24:21:783[Info 1166]: DevNode Status 0x180200b, Problem 0x0.
(P9244-T9712)06/04/21 17:24:21:877[Debug 557]: Set adapter ctrl code 0x2 success.
(P9244-T9712)06/04/21 17:24:21:877[Debug 1235]: Disable Adapter success.
(P9244-T9712)06/04/21 17:24:21:883[Info 1147]: enum devevice ROOT\PANGPD\0000.
(P9244-T9712)06/04/21 17:24:21:883[Info 1166]: DevNode Status 0x1802401, Problem 0x16.
(P9244-T9712)06/04/21 17:24:21:883[Debug 1376]: after disable adapter, get adapter status 0x1802401
(P9244-T9712)06/04/21 17:24:21:883[Debug 1400]: Disable adapter end.

I started seeing the "DevNode Status 0x1802401, Problem 0x16." log in the driver debug file around the same time the issues started happening, but I'm not sure (yet) if it's the cause or result of the disconnect.

As far as I'm concerned these messages are related to Platform Power Management , so I'm following up on disabling the Power Save and Green Energy Efficiency modes on the NICs.

The disconnects happen on both  wired and wireless connections.

We have a TAC case opened for this but haven't heard back from them.

If anyone had issues like this recently, I'd appreciate your time to share your findings.

Thanks!

[jdelio]

We see in the logs at 

06/04/21 17:24:21:666

The disconnect happens, but nothing else showing up in the logs prior. At least nothing is showing up here.

When this happens, does it disconnect ALL users or just random?

[KarolMajewski]

It's random

[jdelio]

@KarolMajewski 

I understand it being random.. 

Is this affecting everyone? both Mac and PC?

Also what hardware/version of PAN-OS?

[KarolMajewski]

Where are you going with these questions? Do you know of an issue that's affecting both MACs and PCs or a specific PAN-OS or hardware version? If so, please share them and I can decide if it's feasible for me.

I haven't asked for troubleshooting advice but for similar symptoms and how there were handled.

Obviously there was a ton of logs showing up prior to the disconnect messages but haven't shown any errors or failures.

Right now I'm following on the HIP report processing which is the most likely cause of the issues.

[RajeshKandukuri]

seeing similar issue in 5.2.10 version any findings on why is this happening ? 

[MannyCosta]

Does anyone have an answer to this   i am getting it on 3 different client versions 5.2.9 in Prod   test 6.0.1 upgraded today test to 6.0.3 still resets. may have been happening but got noticeable when the security update was installed 10.2.6.h6.

[JP-RMS]

Hi - Were you able to figure this out? I'm experiencing the same issue for about 20 users out of thousands that work fine (or at least aren't telling me).

[JBJohnson]

We are noticing the same issue but with GP v6.1.1-5

Any resolution on this issue for anyone?

[c_zellars]

I have also just run into this issue with a user. The VPN disconnects randomly throughout the day. Anyone find the root cause or fix? Thanks

(P5968-T16356)07/24/23 11:21:45:988[Debug 1387]: Disable adapter be called.
(P5968-T16356)07/24/23 11:21:45:988[Info 1166]: enum devevice ROOT\PANGPD\0000.
(P5968-T16356)07/24/23 11:21:45:988[Info 1185]: DevNode Status 0x1802401, Problem 0x16.
(P5968-T16356)07/24/23 11:21:45:988[Info 1166]: enum devevice ROOT\PANGPD\0000.
(P5968-T16356)07/24/23 11:21:45:988[Info 1185]: DevNode Status 0x1802401, Problem 0x16.
(P5968-T16356)07/24/23 11:21:45:988[Debug 1395]: after disable adapter, get adapter status 0x1802401
(P5968-T16356)07/24/23 11:21:45:988[Debug 1419]: Disable adapter end.
(P5968-T16356)07/24/23 11:21:45:999[Debug 1425]: Enable adapter be called.
(P5968-T16356)07/24/23 11:21:45:999[Info 1166]: enum devevice ROOT\PANGPD\0000.
(P5968-T16356)07/24/23 11:21:45:999[Info 1185]: DevNode Status 0x1802401, Problem 0x16.
(P5968-T16356)07/24/23 11:21:46:014[Debug 576]: Set adapter ctrl code 0x1 success.
(P5968-T16356)07/24/23 11:21:46:014[Debug 1268]: Enable Adapter success.