GlobalProtect, Windows 11 and laptop lids

[jasonbailey]

We've had issues running GlobalProtect (5.x and 6.0) on Windows 11, particularly when a person closes the lid of their laptop while they're still connected to the GP gateway. When they wake the laptop up, GP won't connect. They have to reboot the laptop and then it's fine again.

Manually disconnecting GP before shutting the laptop lid seems to mitigate the issue.

Anyone else have this issue?

[BPry]

@jasonbailey,

What type of connection method are you using with these devices? I have two Windows 11 devices that I use on a daily basis (well one daily, one regularly) that don't have any issue with this with an always-on pre-logon deployment using certificate authentication. We have a fair number of BYOD endpoints using Windows 11 on an on-demand basis and I'm not hearing any complaints of needing to restart between connections outside of normal instances where the user's computer is in a weird state in general because they haven't restarted in 60+ days. 

[jasonbailey]

@BPryI'm not entirely sure what you mean by 'connection method'. Our configuration is pretty close to stock -- we use the official GP client to connect to a GP gateway on a Palo Alto firewall over port 443. Connectivity to the gateway is manual -- nothing connects automatically. We had 5.2.8 originally, I believe. We upgraded to 6.0 and again to 6.0.1 to see if it would help address the issue. So far the problem persists.

[lchouteau]

I believe the default configuration when setting up GP is Always-On.

Have you checked if the computer is going to sleep upon the lid closing? There is a troubleshooting tabs to export some logs that would be helpful to pinpoint the issue.

[BPry]

@jasonbailey,

So your connection method in your app config would be on-demand then if you aren't connecting automatically. I would recommend looking at your PanGPS.log file on one of the affected endpoints when you know the time the issue presented itself and see if the log file is recording any issues. Do you see the service attempting to connect again when the user is experiencing the issue, or any other clear errors being recorded.

I'd also take a look at the service state itself upon running into this issue and seeing if you aren't running into a service issue when the machine tries to come online again. This is unfortunately an issue where you're really going to need to dig through client logs.

[PMCHelpdesk]

I am experiencing the exact same behavior, did you come to come to any final conclusion? Logs from waking below, didn't want to include any private info so this may not cover all of the generated log data....

(P6480-T3888)Info ( 397): 09/12/22 11:17:05:771 Received powersetting change event
(P6480-T3888)Debug(15351): 09/12/22 11:17:05:771 Modern standby
(P6480-T3888)Info ( 397): 09/12/22 11:21:30:692 Received powersetting change event
(P6480-T3888)Debug(15360): 09/12/22 11:21:30:692 Wakeup from modern standby
(P6480-T3888)Debug( 348): 09/12/22 11:21:32:473 Received session change, event type 8, session 1
(P6480-T10920)Info ( 531): 09/12/22 11:22:59:846 msgtype = disable
(P6480-T10920)Debug(3984): 09/12/22 11:22:59:846 ----Disable starts----
(P6480-T24464)Debug(6310): 09/12/22 11:22:59:846 HipReportThread: got exit event.
(P6480-T24464)Debug(6550): 09/12/22 11:22:59:846 HipReportThread: HipReportThread quits.
(P6480-T30924)Debug(6707): 09/12/22 11:22:59:846 NetworkConnectionMonitorThread: got exit event.
(P6480-T30924)Debug(6722): 09/12/22 11:22:59:846 NetworkConnectionMonitorThread: quits.
(P6480-T15716)Debug(5665): 09/12/22 11:22:59:846 NetworkDiscoverThread: got exit event.
(P6480-T15716)Debug(6184): 09/12/22 11:22:59:846 NetworkDiscoverThread: quits.
(P6480-T10916)Debug(2513): 09/12/22 11:22:59:846 Setting debug level to 5
(P6480-T1600)Debug(4532): 09/12/22 11:22:59:846 LifeTimeThread receives thread quit event
(P6480-T1600)Debug(4557): 09/12/22 11:22:59:846 LifeTimeThread quits
(P6480-T24076)Debug(5412): 09/12/22 11:22:59:846 CaptivePortalDetectionThread: got exit event.
(P6480-T24076)Debug(5580): 09/12/22 11:22:59:846 CaptivePortalDetectionThread: captive portal detection thread exit status is (successful).
(P6480-T7148)Debug(5210): 09/12/22 11:22:59:846 NotificationTimerThread: got exit event.
(P6480-T10916)Debug(2513): 09/12/22 11:22:59:846 Setting debug level to 5
(P6480-T10920)Debug(4014): 09/12/22 11:22:59:847 disable agent message is recorded in the file dalog.dat.
(P6480-T10920)Debug(1624): 09/12/22 11:22:59:848 external network.