GlobalProtect v5.2.4 client disconnects with "Received a virtual interface packet with fragment"

[millerh1]

I am running GlobalProtect client 5.2.4-21, experiencing frequent disconnect events accompanied in PanGPS.log by the following:

(T10852)Debug(1564): 01/11/21 17:33:00:578 Received a virtual interface packet with fragment 0x2000
(T10852)Debug(1564): 01/11/21 17:33:00:578 Received a virtual interface packet with fragment 0xAC
(T10852)Debug(1564): 01/11/21 17:33:01:779 Received a virtual interface packet with fragment 0x2000
(T10852)Debug(1564): 01/11/21 17:33:01:779 Received a virtual interface packet with fragment 0xAC
(T10852)Debug(1564): 01/11/21 17:33:01:894 Received a virtual interface packet with fragment 0x2000

...

These lines keep repeating until the connection restores itself. During the disconnection event, the GlobalProtect client remains "connected" to the network, it's just that no traffic seems to make it back -- all connectivity appears to be lost from the user's perspective. It usually takes 30-90 seconds for the normal connectivity to resume. These events typically happen 2-3 times an hour during the work day. 

Does anyone have an idea what might be causing this? 

[SCantwell_IM]

We are experiencing the error message with 5.2.4.   We are going to try the latest 5.2.5 to see if this resolves, else, we are going to downgrade to a 5.1.x version.  Recommend you do the same, do some testing, and let us all know.

You can also try to Collect Logs and open a ticket with TAC.

Changes were made in 5.2.x to allow IP fragmentation, but I think this is breaking something.

[henrique.correia]

Hello @millerh1 

Is this problem happening on some specific endpoint? (Dell, Lenovo, Apple, etc.)
Do you checked the Ethernet/Wireless Driver version?

We are having similar problems and would like to look for common ground.

Thanks.

[millerh1]

Hi @SCantwell_IM thank you for the reply! We have no opened a ticket with support and I will be sure to let you know what they say. If nothing else, I'll try downgrading to 5.1.5 and see if that helps!

[millerh1]

Hi @henrique.correia -- The drivers are up to date on the client machine (Acer laptop). 

I switched to a different network that has a static IP address and no router (modem only). It seems to be performing fine on this new setup -- but it's not clear why that would make a difference. The original router is a 2017 model Arris Surfboard and I don't see any issues with normal internet connectivity -- the issue starts only when I am connected to GlobalProtect. 

[millerh1 · Accepted solution]

It appears that getting a different modem and router fixed the problem... Customer support still doesn't know what caused the issue and they are not interested in investigating further as far as I can tell... The equipment I had before (a 2017 Arris Surfboard Gateway) worked fine except when running GlobalProtect. If you are having this problem, please contact customer support and make sure they are aware that this issue wasn't isolated to one customer. "Buy a new modem/router" should not be considered a sufficient long-term solution.