GP 5.2.5 disconnects in connected standby

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

GP 5.2.5 disconnects in connected standby

L2 Linker

We recently upgraded our clients to 5.2.5 and since then we have had numerous reports (and I have experienced it myself) of disconnects occurring as soon as the comouter goes into modern standby/connected standby.

 

We have the computers setup to Never drop internet (windows 10 setting) when the computer enters sleep.  Yet we see this occurring often.

 

On multiple types of network connection media too.  Meaning over wifi, usb dongle, hardwired etc.  

 

Another noticeable issue when this occurs is the PANGP VIRTUAL ETHERNET ADAPTER is disabled when the computer wakes and the pangpa.exe is throwing an error saying could not connect.  In these cases users give up and restart.  However i have noticed that simply waiting longer allows the pangp service to reconnect.

 

Basically, none of this should be happening because we have the computers setup to not drop network during modern standby... but sometimes it does anyway.

 

Looking for advice or tips.

5 REPLIES 5

L3 Networker

following as we see the same disconnect issue with several users

Glad I'm not the only one.

 

I'm troubleshooting this problem on weekends now because it's extremely widespread.

 

I had this issue occur on my own laptop last night.  My laptop is setup for screen sleep after 1 minute (testing this problem). 

 

My laptop, when entering connected standby, immediately drops GP connection and never re-connects.  It's the dropping that I'm most interested in.

Here's a snippet of events that occurred once the computer went to connected standby.

3/6/2021 12:45:59 AMNetwtw0870267026 - Dump after return from D3 after cmdInformation
3/6/2021 12:45:55 AMMicrosoft-Windows-SMBClient30805The client lost its session to the server. Error: The transport connection is now disconnected. Server name: server Session ID: 0x344012C000C95 Guidance: If the server is a Windows Failover Cluster file server, then this message occurs when the file share moves between cluster nodes. There should also be an anti-event 30806 indicating the session to the server was re-established. If the server is not a failover cluster, it is likely that the server was previously online, but it is now inaccessible over the network.Warning
3/6/2021 12:45:55 AMMicrosoft-Windows-SMBClient30807The connection to the share was lost. Error: The transport connection is now disconnected. Share name:  ID: 0xBBA3000000141D89 Tree ID: 0x1 Guidance: If the server is a Windows Failover Cluster file server, then this message occurs when the file share moves between cluster nodes. There should also be an anti-event 30808 indicating the session to the server was re-established. If the server is not a failover cluster, it is likely that the server was previously online, but it is now inaccessible over the network.Warning
3/6/2021 12:45:55 AMMicrosoft-Windows-SMBClient30804A network connection was disconnected. Server name: \itconfigmgr Server address: 172.16.5.92:445 Connection type: Wsk Guidance: This indicates that the client's connection to the server was disconnected. Frequent, unexpected disconnects when using an RDMA over Converged Ethernet (RoCE) adapter may indicate a network misconfiguration. RoCE requires Priority Flow Control (PFC) to be configured for every host, switch and router on the RoCE network. Failure to properly configure PFC will cause packet loss, frequent disconnects and poor performance.Error
3/6/2021 12:45:55 AMMicrosoft-Windows-SMBClient30805The client lost its session to the server. Error: The transport connection is now disconnected. Server name:  Session ID: 0xA0214C00050D Guidance: If the server is a Windows Failover Cluster file server, then this message occurs when the file share moves between cluster nodes. There should also be an anti-event 30806 indicating the session to the server was re-established. If the server is not a failover cluster, it is likely that the server was previously online, but it is now inaccessible over the network.Warning
3/6/2021 12:45:55 AMMicrosoft-Windows-SMBClient30805The client lost its session to the server. Error: The transport connection is now disconnected. Server name:Session ID: 0xBBA3000000141D89 Guidance: If the server is a Windows Failover Cluster file server, then this message occurs when the file share moves between cluster nodes. There should also be an anti-event 30806 indicating the session to the server was re-established. If the server is not a failover cluster, it is likely that the server was previously online, but it is now inaccessible over the network.Warning
3/6/2021 12:45:55 AMMicrosoft-Windows-SMBClient30804A network connection was disconnected. Server name:  Server address: 172.16.5.170:445 Connection type: Wsk Guidance: This indicates that the client's connection to the server was disconnected. Frequent, unexpected disconnects when using an RDMA over Converged Ethernet (RoCE) adapter may indicate a network misconfiguration. RoCE requires Priority Flow Control (PFC) to be configured for every host, switch and router on the RoCE network. Failure to properly configure PFC will cause packet loss, frequent disconnects and poor performance.Error
3/6/2021 12:45:55 AMMicrosoft-Windows-SMBClient30807The connection to the share was lost. Error: The transport connection is now disconnected. Share name: xpprograms Session ID: 0xD33200000054CEF0 Tree ID: 0x4 Guidance: If the server is a Windows Failover Cluster file server, then this message occurs when the file share moves between cluster nodes. There should also be an anti-event 30808 indicating the session to the server was re-established. If the server is not a failover cluster, it is likely that the server was previously online, but it is now inaccessible over the network.Warning
3/6/2021 12:45:55 AMMicrosoft-Windows-SMBClient30805The client lost its session to the server. Error: The transport connection is now disconnected. Server name:  Session ID: 0xD33200000054CEF0 Guidance: If the server is a Windows Failover Cluster file server, then this message occurs when the file share moves between cluster nodes. There should also be an anti-event 30806 indicating the session to the server was re-established. If the server is not a failover cluster, it is likely that the server was previously online, but it is now inaccessible over the network.Warning
3/6/2021 12:45:55 AMMicrosoft-Windows-SMBClient30804A network connection was disconnected. Server name:  Server address: 172.25.7.102:445 Connection type: Wsk Guidance: This indicates that the client's connection to the server was disconnected. Frequent, unexpected disconnects when using an RDMA over Converged Ethernet (RoCE) adapter may indicate a network misconfiguration. RoCE requires Priority Flow Control (PFC) to be configured for every host, switch and router on the RoCE network. Failure to properly configure PFC will cause packet loss, frequent disconnects and poor performance.Error
3/6/2021 12:45:55 AMMicrosoft-Windows-SMBClient30811Deleted a TCP/IP transport interface. Name: Ethernet InterfaceIndex: 0x12 Guidance: A TCP/IP binding was removed from the specified network adapter for the SMB client. You should expect this event when a computer shuts down or when a previously enabled network adaptor is disabled. No user action is required.Information
3/6/2021 12:45:55 AMMicrosoft-Windows-SMBClient30810Added a TCP/IP transport interface. Name: Ethernet 4 InterfaceIndex: 0x1E Guidance: A TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.Information
3/6/2021 12:45:55 AMMicrosoft-Windows-SMBClient30804A network connection was disconnected. Server name:Server address: 172.20.7.101:445 Connection type: Wsk Guidance: This indicates that the client's connection to the server was disconnected. Frequent, unexpected disconnects when using an RDMA over Converged Ethernet (RoCE) adapter may indicate a network misconfiguration. RoCE requires Priority Flow Control (PFC) to be configured for every host, switch and router on the RoCE network. Failure to properly configure PFC will cause packet loss, frequent disconnects and poor performance.Error
3/6/2021 12:45:55 AMMicrosoft-Windows-SMBClient30807The connection to the share was lost. Error: The transport connection is now disconnected. Share name: Session ID: 0x344012C000C95 Tree ID: 0x5 Guidance: If the server is a Windows Failover Cluster file server, then this message occurs when the file share moves between cluster nodes. There should also be an anti-event 30808 indicating the session to the server was re-established. If the server is not a failover cluster, it is likely that the server was previously online, but it is now inaccessible over the network.Warning
3/6/2021 12:45:54 AMe1dexpress27 Warning
3/6/2021 12:45:53 AMMicrosoft-Windows-SMBClient30810Added a TCP/IP transport interface. Name: Ethernet 4 InterfaceIndex: 0x1E Guidance: A TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.Information
3/6/2021 12:45:53 AMMicrosoft-Windows-SMBServer1011Endpoint removed. Name: Domain Name: Transport Name: \Device\NetBT_Tcpip_{58C6A8E8-34D8-4715-9D15-C54BE1BA6C77} Guidance: You should expect this event when the server stops listening on an interface, such as during shutdown or when disabling a network adaptor. No user action is required.Information
3/6/2021 12:45:53 AMNetwtw0870267026 - Dump after return from D3 after cmdInformation
3/6/2021 12:45:53 AMNetwtw0870257025 - Dump after return from D3 before cmd Information
3/6/2021 12:45:53 AMNetwtw0870267026 - Dump after return from D3 after cmdInformation
3/6/2021 12:45:53 AMMicrosoft-Windows-SMBClient30813Deleted a TDI transport interface. Name: \Device\NetBT_Tcpip_{58C6A8E8-34D8-4715-9D15-C54BE1BA6C77} Guidance: A TDI (NetBIOS) binding was removed from the specified network adapter for the SMB client. You should expect this event when a computer shuts down or when a previously enabled network adaptor is disabled. No user action is required.Information
3/6/2021 12:45:53 AMMicrosoft-Windows-SMBClient30811Deleted a TCP/IP transport interface. Name: Ethernet 4 InterfaceIndex: 0x1E Guidance: A TCP/IP binding was removed from the specified network adapter for the SMB client. You should expect this event when a computer shuts down or when a previously enabled network adaptor is disabled. No user action is required.Information
3/6/2021 12:45:52 AMMicrosoft-Windows-SMBClient30811Deleted a TCP/IP transport interface. Name: Ethernet 4 InterfaceIndex: 0x1E Guidance: A TCP/IP binding was removed from the specified network adapter for the SMB client. You should expect this event when a computer shuts down or when a previously enabled network adaptor is disabled. No user action is required.Information
3/6/2021 12:45:52 AMMicrosoft-Windows-SMBClient30813Deleted a TDI transport interface. Name: \Device\NetBT_Tcpip_{DDC88452-FFC6-4B38-8A79-713612547C5A} Guidance: A TDI (NetBIOS) binding was removed from the specified network adapter for the SMB client. You should expect this event when a computer shuts down or when a previously enabled network adaptor is disabled. No user action is required.Information
3/6/2021 12:45:52 AMMicrosoft-Windows-SMBServer1011Endpoint removed. Name: Domain Name: Transport Name: \Device\NetBT_Tcpip_{DDC88452-FFC6-4B38-8A79-713612547C5A} Guidance: You should expect this event when the server stops listening on an interface, such as during shutdown or when disabling a network adaptor. No user action is required.Information
3/6/2021 12:45:52 AMNetwtw0870257025 - Dump after return from D3 before cmd Information
3/6/2021 12:45:45 AMMicrosoft-Windows-TCPIP1302Network adapter Luid 0x600800D000000 received a wake packet matching pattern . Protocol: UDP. Destination MAC address: 0x3C18A013E34F. Source: 64.124.98.66 : 4501, Destination: 192.168.1.14 : 56409.Information
3/6/2021 12:45:42 AMMicrosoft-Windows-TCPIP1302Network adapter Luid 0x600800D000000 received a wake packet matching pattern . Protocol: TCP. Destination MAC address: 0x3C18A013E34F. Source: 50.18.194.39 : 443, Destination: 192.168.1.14 : 49734.Information
3/6/2021 12:45:18 AMMicrosoft-Windows-TCPIP1303Network adapter Luid 0x600800D000000 received a wake packet matching pattern . Protocol: ICMPV6. Destination MAC address: 0x3C18A013E34F. Source: fe80::baf8:53ff:fe91:e981 : 135, Destination fe80::bdbe:343e:801f:2992 : 0.Information
3/6/2021 12:45:15 AMMicrosoft-Windows-TCPIP1302Network adapter Luid 0x600800D000000 received a wake packet matching pattern . Protocol: UDP. Destination MAC address: 0x3C18A013E34F. Source: 64.124.98.66 : 4501, Destination: 192.168.1.14 : 56409.Information
3/6/2021 12:45:02 AMMicrosoft-Windows-TCPIP1302Network adapter Luid 0x600800D000000 received a wake packet matching pattern . Protocol: UDP. Destination MAC address: 0x3C18A013E34F. Source: 64.124.98.66 : 4501, Destination: 192.168.1.14 : 56409.Information
3/6/2021 12:44:41 AMMicrosoft-Windows-TCPIP1302Network adapter Luid 0x600800D000000 received a wake packet matching pattern . Protocol: TCP. Destination MAC address: 0x3C18A013E34F. Source: 50.18.194.39 : 443, Destination: 192.168.1.14 : 49734.Information
3/6/2021 12:44:24 AMMicrosoft-Windows-TCPIP1302Network adapter Luid 0x600800D000000 received a wake packet matching pattern . Protocol: TCP. Destination MAC address: 0x3C18A013E34F. Source: 50.18.194.39 : 443, Destination: 192.168.1.14 : 49734.Information
3/6/2021 12:44:19 AMMicrosoft-Windows-TCPIP1302Network adapter Luid 0x600800D000000 received a wake packet matching pattern . Protocol: UDP. Destination MAC address: 0x3C18A013E34F. Source: 64.124.98.66 : 4501, Destination: 192.168.1.14 : 56409.Information
3/6/2021 12:44:05 AMMicrosoft-Windows-TCPIP1302Network adapter Luid 0x600800D000000 received a wake packet matching pattern . Protocol: TCP. Destination MAC address: 0x3C18A013E34F. Source: 50.18.194.39 : 443, Destination: 192.168.1.14 : 49734.Information
3/6/2021 12:43:57 AMMicrosoft-Windows-TCPIP1302Network adapter Luid 0x600800D000000 received a wake packet matching pattern . Protocol: UDP. Destination MAC address: 0x3C18A013E34F. Source: 64.124.98.66 : 4501, Destination: 192.168.1.14 : 56409.Information
3/6/2021 12:43:44 AMMicrosoft-Windows-TCPIP1302Network adapter Luid 0x600800D000000 received a wake packet matching pattern . Protocol: UDP. Destination MAC address: 0x3C18A013E34F. Source: 64.124.98.66 : 4501, Destination: 192.168.1.14 : 56409.Information
3/6/2021 12:43:31 AMMicrosoft-Windows-TCPIP1302Network adapter Luid 0x600800D000000 received a wake packet matching pattern . Protocol: UDP. Destination MAC address: 0x3C18A013E34F. Source: 64.124.98.66 : 4501, Destination: 192.168.1.14 : 56409.Information
3/6/2021 12:43:13 AMPanGPA.log669 balltip, m_hipMsg=0000000000000000Debug
3/6/2021 12:43:13 AMPanGPA.log2482 Window session changed with state 7Info
3/6/2021 12:43:13 AMPanGPA.log2532 user session locked.Debug
3/6/2021 12:43:12 AMMicrosoft-Windows-Kernel-Power506The system is entering connected standby Reason: Idle Timeout.Information
3/6/2021 12:40:27 AMPanGPA.log2539 user session changed with state=8Debug
3/6/2021 12:40:27 AMPanGPA.log669 balltip, m_hipMsg=0000000000000000Debug
3/6/2021 12:40:27 AMPanGPA.log2482 Window session changed with state 8Info
3/6/2021 12:40:11 AMLenovo-Sif-Core104<?xml version="1.0" encoding="utf-16"?> <event xmlns:i="http://www.w3.org/2001/XMLSchema-instance"> <classification>Device</classification> <collectedDate>2021-03-06T00:40:06</collectedDate> <name>Imc-Lifecycle-Action</name> <occuredDate>2021-03-06T00:40:06</occuredDate> <productName>imc</productName> <productVersion>1.1.19.8</productVersion> <sid>S-1-5-21-2143771791-1300785627-1788637320-70592</sid> <variables> <var> <name>LifcycleActivity</name> <value>Suspend</value> </var> <var> <name>ImcVersion</name> <value>1.1.19.8</value> </var> <var> <name>DriverVersion</name> <value>2.0.0.0</value> </var> <var> <name>MinutesSinceServiceStart</name> <value>157</value> </var> <var> <name>MinutesSinceSessionStart</name> <value>0</value> </var> <var> <name>WindowsSessionID</name> <value>f2778404-789d-4745-b415-f32f09e578e3</value> </var> </variables> </event>Information
3/6/2021 12:40:11 AMLenovo-Sif-Core104<?xml version="1.0" encoding="utf-16"?> <event xmlns:i="http://www.w3.org/2001/XMLSchema-instance"> <classification>Device</classification> <collectedDate>2021-03-06T00:40:11</collectedDate> <name>Imc-Lifecycle-Action</name> <occuredDate>2021-03-06T00:40:11</occuredDate> <productName>imc</productName> <productVersion>1.1.19.8</productVersion> <sid>S-1-5-21-2143771791-1300785627-1788637320-70592</sid> <variables> <var> <name>LifcycleActivity</name> <value>Resume</value> </var> <var> <name>ImcVersion</name> <value>1.1.19.8</value> </var> <var> <name>DriverVersion</name> <value>2.0.0.0</value> </var> <var> <name>MinutesSinceServiceStart</name> <value>157</value> </var> <var> <name>MinutesSinceSessionStart</name> <value>0</value> </var> <var> <name>WindowsSessionID</name> <value>f2778404-789d-4745-b415-f32f09e578e3</value> </var> </variables> </event>Information
3/6/2021 12:40:10 AMPanGPA.log703 CAC, type is 8004, data=0000000C6C4FFCC0Debug
3/6/2021 12:40:10 AMPanGPA.log747 CAC, DBT_DEVICEREMOVECOMPLETE, device type=00000005, cacUnplugLogout=0Debug
3/6/2021 12:40:10 AMMicrosoft-Windows-Kernel-Power507The system is exiting connected standby Reason: Input Keyboard.Information
3/6/2021 12:40:10 AMPanGPA.log788 CAC, do nothing for device remove messageDebug
3/6/2021 12:40:08 AMMicrosoft-Windows-SMBClient30808The connection to the share was re-established. Share name: xpprograms Server address: 172.25.7.102:445 Session ID: 0xD33200000054CEF0 Tree ID: 0x4 Guidance: You should expect this event if there was a previous event 30807, but the client successfully resumed the cached connection before the timeout expired.Information
3/6/2021 12:40:06 AMPanGPA.log669 balltip, m_hipMsg=0000000000000000Debug
3/6/2021 12:40:06 AMPanGPA.log2532 user session locked.Debug
3/6/2021 12:40:06 AMPanGPA.log2482 Window session changed with state 7Info
3/6/2021 12:40:05 AMMicrosoft-Windows-Kernel-Power506The system is entering connected standby Reason: Idle Timeout.Information
3/6/2021 12:39:12 AMMicrosoft-Windows-SMBClient30806The client re-established its session to the server. Server name:  Server address: 172.25.7.102:445 Session ID: 0xD33200000054CEF0 Guidance: You should expect this event if there was a previous event 30805, but the client successfully resumed the cached connection before the timeout expired.Information
3/6/2021 12:39:12 AMMicrosoft-Windows-SMBClient30904The server does not support multichannel. Server name:  Guidance: The client attempted to use SMB Multichannel, but an administrator has disabled multichannel support on the server. This may also be a non-Microsoft file server that does not support multichannel or has multichannel disabled. You can enable SMB Multichannel on the server using this Windows PowerShell cmdlet: Set-SmbServerConfiguration -EnableMultiChannel:$true. This event does not apply to the multichannel settings of SMB client, which are controlled by the Set-SmbClientConfiguration Windows PowerShell cmdlet. Enabling or disabling client multichannel support does not affect server multichannel support.Information
3/6/2021 12:38:22 AMMicrosoft-Windows-SMBClient30904The server does not support multichannel. Server name:Guidance: The client attempted to use SMB Multichannel, but an administrator has disabled multichannel support on the server. This may also be a non-Microsoft file server that does not support multichannel or has multichannel disabled. You can enable SMB Multichannel on the server using this Windows PowerShell cmdlet: Set-SmbServerConfiguration -EnableMultiChannel:$true. This event does not apply to the multichannel settings of SMB client, which are controlled by the Set-SmbClientConfiguration Windows PowerShell cmdlet. Enabling or disabling client multichannel support does not affect server multichannel support.Information
3/6/2021 12:38:22 AMMicrosoft-Windows-SMBClient30806The client re-established its session to the server. Server name:  Server address: 172.16.5.170:445 Session ID: 0xA0214C00050D Guidance: You should expect this event if there was a previous event 30805, but the client successfully resumed the cached connection before the timeout expired.Information
3/6/2021 12:38:22 AMMicrosoft-Windows-SMBClient30806The client re-established its session to the server. Server name:Server address: 172.20.7.101:445 Session ID: 0xBBA3000000141D89 Guidance: You should expect this event if there was a previous event 30805, but the client successfully resumed the cached connection before the timeout expired.Information
3/6/2021 12:38:22 AMMicrosoft-Windows-SMBClient30808The connection to the share was re-established. Share name: \nacifsnj\MIS Server address: 172.20.7.101:445 Session ID: 0xBBA3000000141D89 Tree ID: 0x1 Guidance: You should expect this event if there was a previous event 30807, but the client successfully resumed the cached connection before the timeout expired.Information

Bumping, as we still see this occurring.

some fixes mentioning this issue have been made:

A hotfix for 5.2.5 has been released with a lot of fixes btw: Addressed Issues in GlobalProtect App 5.2 (paloaltonetworks.com)

 

Havent tested it yet though.

L2 Linker

Bumping again.  We are on version 5.2.9 now, things have improved but I still see many user machines are dropping the VPN connection when the user closes the laptop lid and it goes into Modern Standby (which the device does support Sleep state S0).  This should NOT be happening.  We have the group policies in place to never drop network when the machine goes into Modern Standby.  We can also see that the computer itself does have a network connection, but VPN doesn't stay connected.

  • 5862 Views
  • 5 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!