GP 5.2.5 disconnects in connected standby

[TANielsenBest]

We recently upgraded our clients to 5.2.5 and since then we have had numerous reports (and I have experienced it myself) of disconnects occurring as soon as the comouter goes into modern standby/connected standby.

We have the computers setup to Never drop internet (windows 10 setting) when the computer enters sleep.  Yet we see this occurring often.

On multiple types of network connection media too.  Meaning over wifi, usb dongle, hardwired etc.  

Another noticeable issue when this occurs is the PANGP VIRTUAL ETHERNET ADAPTER is disabled when the computer wakes and the pangpa.exe is throwing an error saying could not connect.  In these cases users give up and restart.  However i have noticed that simply waiting longer allows the pangp service to reconnect.

Basically, none of this should be happening because we have the computers setup to not drop network during modern standby... but sometimes it does anyway.

Looking for advice or tips.

[sebastianvd]

following as we see the same disconnect issue with several users

[TANielsenBest]

Glad I'm not the only one.

I'm troubleshooting this problem on weekends now because it's extremely widespread.

I had this issue occur on my own laptop last night.  My laptop is setup for screen sleep after 1 minute (testing this problem). 

My laptop, when entering connected standby, immediately drops GP connection and never re-connects.  It's the dropping that I'm most interested in.

Here's a snippet of events that occurred once the computer went to connected standby.

3/6/2021 12:45:59 AM	Netwtw08	7026	7026 - Dump after return from D3 after cmd	Information
3/6/2021 12:45:55 AM	Microsoft-Windows-SMBClient	30805	The client lost its session to the server. Error: The transport connection is now disconnected. Server name: server Session ID: 0x344012C000C95 Guidance: If the server is a Windows Failover Cluster file server, then this message occurs when the file share moves between cluster nodes. There should also be an anti-event 30806 indicating the session to the server was re-established. If the server is not a failover cluster, it is likely that the server was previously online, but it is now inaccessible over the network.	Warning
3/6/2021 12:45:55 AM	Microsoft-Windows-SMBClient	30807	The connection to the share was lost. Error: The transport connection is now disconnected. Share name:  ID: 0xBBA3000000141D89 Tree ID: 0x1 Guidance: If the server is a Windows Failover Cluster file server, then this message occurs when the file share moves between cluster nodes. There should also be an anti-event 30808 indicating the session to the server was re-established. If the server is not a failover cluster, it is likely that the server was previously online, but it is now inaccessible over the network.	Warning
3/6/2021 12:45:55 AM	Microsoft-Windows-SMBClient	30804	A network connection was disconnected. Server name: \itconfigmgr Server address: 172.16.5.92:445 Connection type: Wsk Guidance: This indicates that the client's connection to the server was disconnected. Frequent, unexpected disconnects when using an RDMA over Converged Ethernet (RoCE) adapter may indicate a network misconfiguration. RoCE requires Priority Flow Control (PFC) to be configured for every host, switch and router on the RoCE network. Failure to properly configure PFC will cause packet loss, frequent disconnects and poor performance.	Error
3/6/2021 12:45:55 AM	Microsoft-Windows-SMBClient	30805	The client lost its session to the server. Error: The transport connection is now disconnected. Server name:  Session ID: 0xA0214C00050D Guidance: If the server is a Windows Failover Cluster file server, then this message occurs when the file share moves between cluster nodes. There should also be an anti-event 30806 indicating the session to the server was re-established. If the server is not a failover cluster, it is likely that the server was previously online, but it is now inaccessible over the network.	Warning
3/6/2021 12:45:55 AM	Microsoft-Windows-SMBClient	30805	The client lost its session to the server. Error: The transport connection is now disconnected. Server name:Session ID: 0xBBA3000000141D89 Guidance: If the server is a Windows Failover Cluster file server, then this message occurs when the file share moves between cluster nodes. There should also be an anti-event 30806 indicating the session to the server was re-established. If the server is not a failover cluster, it is likely that the server was previously online, but it is now inaccessible over the network.	Warning
3/6/2021 12:45:55 AM	Microsoft-Windows-SMBClient	30804	A network connection was disconnected. Server name:  Server address: 172.16.5.170:445 Connection type: Wsk Guidance: This indicates that the client's connection to the server was disconnected. Frequent, unexpected disconnects when using an RDMA over Converged Ethernet (RoCE) adapter may indicate a network misconfiguration. RoCE requires Priority Flow Control (PFC) to be configured for every host, switch and router on the RoCE network. Failure to properly configure PFC will cause packet loss, frequent disconnects and poor performance.	Error
3/6/2021 12:45:55 AM	Microsoft-Windows-SMBClient	30807	The connection to the share was lost. Error: The transport connection is now disconnected. Share name: xpprograms Session ID: 0xD33200000054CEF0 Tree ID: 0x4 Guidance: If the server is a Windows Failover Cluster file server, then this message occurs when the file share moves between cluster nodes. There should also be an anti-event 30808 indicating the session to the server was re-established. If the server is not a failover cluster, it is likely that the server was previously online, but it is now inaccessible over the network.	Warning
3/6/2021 12:45:55 AM	Microsoft-Windows-SMBClient	30805	The client lost its session to the server. Error: The transport connection is now disconnected. Server name:  Session ID: 0xD33200000054CEF0 Guidance: If the server is a Windows Failover Cluster file server, then this message occurs when the file share moves between cluster nodes. There should also be an anti-event 30806 indicating the session to the server was re-established. If the server is not a failover cluster, it is likely that the server was previously online, but it is now inaccessible over the network.	Warning
3/6/2021 12:45:55 AM	Microsoft-Windows-SMBClient	30804	A network connection was disconnected. Server name:  Server address: 172.25.7.102:445 Connection type: Wsk Guidance: This indicates that the client's connection to the server was disconnected. Frequent, unexpected disconnects when using an RDMA over Converged Ethernet (RoCE) adapter may indicate a network misconfiguration. RoCE requires Priority Flow Control (PFC) to be configured for every host, switch and router on the RoCE network. Failure to properly configure PFC will cause packet loss, frequent disconnects and poor performance.	Error
3/6/2021 12:45:55 AM	Microsoft-Windows-SMBClient	30811	Deleted a TCP/IP transport interface. Name: Ethernet InterfaceIndex: 0x12 Guidance: A TCP/IP binding was removed from the specified network adapter for the SMB client. You should expect this event when a computer shuts down or when a previously enabled network adaptor is disabled. No user action is required.	Information
3/6/2021 12:45:55 AM	Microsoft-Windows-SMBClient	30810	Added a TCP/IP transport interface. Name: Ethernet 4 InterfaceIndex: 0x1E Guidance: A TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.	Information
3/6/2021 12:45:55 AM	Microsoft-Windows-SMBClient	30804	A network connection was disconnected. Server name:Server address: 172.20.7.101:445 Connection type: Wsk Guidance: This indicates that the client's connection to the server was disconnected. Frequent, unexpected disconnects when using an RDMA over Converged Ethernet (RoCE) adapter may indicate a network misconfiguration. RoCE requires Priority Flow Control (PFC) to be configured for every host, switch and router on the RoCE network. Failure to properly configure PFC will cause packet loss, frequent disconnects and poor performance.	Error
3/6/2021 12:45:55 AM	Microsoft-Windows-SMBClient	30807	The connection to the share was lost. Error: The transport connection is now disconnected. Share name: Session ID: 0x344012C000C95 Tree ID: 0x5 Guidance: If the server is a Windows Failover Cluster file server, then this message occurs when the file share moves between cluster nodes. There should also be an anti-event 30808 indicating the session to the server was re-established. If the server is not a failover cluster, it is likely that the server was previously online, but it is now inaccessible over the network.	Warning
3/6/2021 12:45:54 AM	e1dexpress	27		Warning
3/6/2021 12:45:53 AM	Microsoft-Windows-SMBClient	30810	Added a TCP/IP transport interface. Name: Ethernet 4 InterfaceIndex: 0x1E Guidance: A TCP/IP binding was added to the specified network adapter for the SMB client. The SMB client can now send and receive SMB traffic on this network adapter using TCP/IP. You should expect this event when a computer restarts or when a previously disabled network adaptor is re-enabled. No user action is required.	Information
3/6/2021 12:45:53 AM	Microsoft-Windows-SMBServer	1011	Endpoint removed. Name: Domain Name: Transport Name: \Device\NetBT_Tcpip_{58C6A8E8-34D8-4715-9D15-C54BE1BA6C77} Guidance: You should expect this event when the server stops listening on an interface, such as during shutdown or when disabling a network adaptor. No user action is required.	Information
3/6/2021 12:45:53 AM	Netwtw08	7026	7026 - Dump after return from D3 after cmd	Information
3/6/2021 12:45:53 AM	Netwtw08	7025	7025 - Dump after return from D3 before cmd	Information
3/6/2021 12:45:53 AM	Netwtw08	7026	7026 - Dump after return from D3 after cmd	Information
3/6/2021 12:45:53 AM	Microsoft-Windows-SMBClient	30813	Deleted a TDI transport interface. Name: \Device\NetBT_Tcpip_{58C6A8E8-34D8-4715-9D15-C54BE1BA6C77} Guidance: A TDI (NetBIOS) binding was removed from the specified network adapter for the SMB client. You should expect this event when a computer shuts down or when a previously enabled network adaptor is disabled. No user action is required.	Information
3/6/2021 12:45:53 AM	Microsoft-Windows-SMBClient	30811	Deleted a TCP/IP transport interface. Name: Ethernet 4 InterfaceIndex: 0x1E Guidance: A TCP/IP binding was removed from the specified network adapter for the SMB client. You should expect this event when a computer shuts down or when a previously enabled network adaptor is disabled. No user action is required.	Information
3/6/2021 12:45:52 AM	Microsoft-Windows-SMBClient	30811	Deleted a TCP/IP transport interface. Name: Ethernet 4 InterfaceIndex: 0x1E Guidance: A TCP/IP binding was removed from the specified network adapter for the SMB client. You should expect this event when a computer shuts down or when a previously enabled network adaptor is disabled. No user action is required.	Information
3/6/2021 12:45:52 AM	Microsoft-Windows-SMBClient	30813	Deleted a TDI transport interface. Name: \Device\NetBT_Tcpip_{DDC88452-FFC6-4B38-8A79-713612547C5A} Guidance: A TDI (NetBIOS) binding was removed from the specified network adapter for the SMB client. You should expect this event when a computer shuts down or when a previously enabled network adaptor is disabled. No user action is required.	Information
3/6/2021 12:45:52 AM	Microsoft-Windows-SMBServer	1011	Endpoint removed. Name: Domain Name: Transport Name: \Device\NetBT_Tcpip_{DDC88452-FFC6-4B38-8A79-713612547C5A} Guidance: You should expect this event when the server stops listening on an interface, such as during shutdown or when disabling a network adaptor. No user action is required.	Information
3/6/2021 12:45:52 AM	Netwtw08	7025	7025 - Dump after return from D3 before cmd	Information
3/6/2021 12:45:45 AM	Microsoft-Windows-TCPIP	1302	Network adapter Luid 0x600800D000000 received a wake packet matching pattern . Protocol: UDP. Destination MAC address: 0x3C18A013E34F. Source: 64.124.98.66 : 4501, Destination: 192.168.1.14 : 56409.	Information
3/6/2021 12:45:42 AM	Microsoft-Windows-TCPIP	1302	Network adapter Luid 0x600800D000000 received a wake packet matching pattern . Protocol: TCP. Destination MAC address: 0x3C18A013E34F. Source: 50.18.194.39 : 443, Destination: 192.168.1.14 : 49734.	Information
3/6/2021 12:45:18 AM	Microsoft-Windows-TCPIP	1303	Network adapter Luid 0x600800D000000 received a wake packet matching pattern . Protocol: ICMPV6. Destination MAC address: 0x3C18A013E34F. Source: fe80::baf8:53ff:fe91:e981 : 135, Destination fe80::bdbe:343e:801f:2992 : 0.	Information
3/6/2021 12:45:15 AM	Microsoft-Windows-TCPIP	1302	Network adapter Luid 0x600800D000000 received a wake packet matching pattern . Protocol: UDP. Destination MAC address: 0x3C18A013E34F. Source: 64.124.98.66 : 4501, Destination: 192.168.1.14 : 56409.	Information
3/6/2021 12:45:02 AM	Microsoft-Windows-TCPIP	1302	Network adapter Luid 0x600800D000000 received a wake packet matching pattern . Protocol: UDP. Destination MAC address: 0x3C18A013E34F. Source: 64.124.98.66 : 4501, Destination: 192.168.1.14 : 56409.	Information
3/6/2021 12:44:41 AM	Microsoft-Windows-TCPIP	1302	Network adapter Luid 0x600800D000000 received a wake packet matching pattern . Protocol: TCP. Destination MAC address: 0x3C18A013E34F. Source: 50.18.194.39 : 443, Destination: 192.168.1.14 : 49734.	Information
3/6/2021 12:44:24 AM	Microsoft-Windows-TCPIP	1302	Network adapter Luid 0x600800D000000 received a wake packet matching pattern . Protocol: TCP. Destination MAC address: 0x3C18A013E34F. Source: 50.18.194.39 : 443, Destination: 192.168.1.14 : 49734.	Information
3/6/2021 12:44:19 AM	Microsoft-Windows-TCPIP	1302	Network adapter Luid 0x600800D000000 received a wake packet matching pattern . Protocol: UDP. Destination MAC address: 0x3C18A013E34F. Source: 64.124.98.66 : 4501, Destination: 192.168.1.14 : 56409.	Information
3/6/2021 12:44:05 AM	Microsoft-Windows-TCPIP	1302	Network adapter Luid 0x600800D000000 received a wake packet matching pattern . Protocol: TCP. Destination MAC address: 0x3C18A013E34F. Source: 50.18.194.39 : 443, Destination: 192.168.1.14 : 49734.	Information
3/6/2021 12:43:57 AM	Microsoft-Windows-TCPIP	1302	Network adapter Luid 0x600800D000000 received a wake packet matching pattern . Protocol: UDP. Destination MAC address: 0x3C18A013E34F. Source: 64.124.98.66 : 4501, Destination: 192.168.1.14 : 56409.	Information
3/6/2021 12:43:44 AM	Microsoft-Windows-TCPIP	1302	Network adapter Luid 0x600800D000000 received a wake packet matching pattern . Protocol: UDP. Destination MAC address: 0x3C18A013E34F. Source: 64.124.98.66 : 4501, Destination: 192.168.1.14 : 56409.	Information
3/6/2021 12:43:31 AM	Microsoft-Windows-TCPIP	1302	Network adapter Luid 0x600800D000000 received a wake packet matching pattern . Protocol: UDP. Destination MAC address: 0x3C18A013E34F. Source: 64.124.98.66 : 4501, Destination: 192.168.1.14 : 56409.	Information
3/6/2021 12:43:13 AM	PanGPA.log	669	balltip, m_hipMsg=0000000000000000	Debug
3/6/2021 12:43:13 AM	PanGPA.log	2482	Window session changed with state 7	Info
3/6/2021 12:43:13 AM	PanGPA.log	2532	user session locked.	Debug
3/6/2021 12:43:12 AM	Microsoft-Windows-Kernel-Power	506	The system is entering connected standby Reason: Idle Timeout.	Information
3/6/2021 12:40:27 AM	PanGPA.log	2539	user session changed with state=8	Debug
3/6/2021 12:40:27 AM	PanGPA.log	669	balltip, m_hipMsg=0000000000000000	Debug
3/6/2021 12:40:27 AM	PanGPA.log	2482	Window session changed with state 8	Info
3/6/2021 12:40:11 AM	Lenovo-Sif-Core	104	<?xml version="1.0" encoding="utf-16"?> <event xmlns:i="http://www.w3.org/2001/XMLSchema-instance"> <classification>Device</classification> <collectedDate>2021-03-06T00:40:06</collectedDate> <name>Imc-Lifecycle-Action</name> <occuredDate>2021-03-06T00:40:06</occuredDate> <productName>imc</productName> <productVersion>1.1.19.8</productVersion> <sid>S-1-5-21-2143771791-1300785627-1788637320-70592</sid> <variables> <var> <name>LifcycleActivity</name> <value>Suspend</value> </var> <var> <name>ImcVersion</name> <value>1.1.19.8</value> </var> <var> <name>DriverVersion</name> <value>2.0.0.0</value> </var> <var> <name>MinutesSinceServiceStart</name> <value>157</value> </var> <var> <name>MinutesSinceSessionStart</name> <value>0</value> </var> <var> <name>WindowsSessionID</name> <value>f2778404-789d-4745-b415-f32f09e578e3</value> </var> </variables> </event>	Information
3/6/2021 12:40:11 AM	Lenovo-Sif-Core	104	<?xml version="1.0" encoding="utf-16"?> <event xmlns:i="http://www.w3.org/2001/XMLSchema-instance"> <classification>Device</classification> <collectedDate>2021-03-06T00:40:11</collectedDate> <name>Imc-Lifecycle-Action</name> <occuredDate>2021-03-06T00:40:11</occuredDate> <productName>imc</productName> <productVersion>1.1.19.8</productVersion> <sid>S-1-5-21-2143771791-1300785627-1788637320-70592</sid> <variables> <var> <name>LifcycleActivity</name> <value>Resume</value> </var> <var> <name>ImcVersion</name> <value>1.1.19.8</value> </var> <var> <name>DriverVersion</name> <value>2.0.0.0</value> </var> <var> <name>MinutesSinceServiceStart</name> <value>157</value> </var> <var> <name>MinutesSinceSessionStart</name> <value>0</value> </var> <var> <name>WindowsSessionID</name> <value>f2778404-789d-4745-b415-f32f09e578e3</value> </var> </variables> </event>	Information
3/6/2021 12:40:10 AM	PanGPA.log	703	CAC, type is 8004, data=0000000C6C4FFCC0	Debug
3/6/2021 12:40:10 AM	PanGPA.log	747	CAC, DBT_DEVICEREMOVECOMPLETE, device type=00000005, cacUnplugLogout=0	Debug
3/6/2021 12:40:10 AM	Microsoft-Windows-Kernel-Power	507	The system is exiting connected standby Reason: Input Keyboard.	Information
3/6/2021 12:40:10 AM	PanGPA.log	788	CAC, do nothing for device remove message	Debug
3/6/2021 12:40:08 AM	Microsoft-Windows-SMBClient	30808	The connection to the share was re-established. Share name: xpprograms Server address: 172.25.7.102:445 Session ID: 0xD33200000054CEF0 Tree ID: 0x4 Guidance: You should expect this event if there was a previous event 30807, but the client successfully resumed the cached connection before the timeout expired.	Information
3/6/2021 12:40:06 AM	PanGPA.log	669	balltip, m_hipMsg=0000000000000000	Debug
3/6/2021 12:40:06 AM	PanGPA.log	2532	user session locked.	Debug
3/6/2021 12:40:06 AM	PanGPA.log	2482	Window session changed with state 7	Info
3/6/2021 12:40:05 AM	Microsoft-Windows-Kernel-Power	506	The system is entering connected standby Reason: Idle Timeout.	Information
3/6/2021 12:39:12 AM	Microsoft-Windows-SMBClient	30806	The client re-established its session to the server. Server name:  Server address: 172.25.7.102:445 Session ID: 0xD33200000054CEF0 Guidance: You should expect this event if there was a previous event 30805, but the client successfully resumed the cached connection before the timeout expired.	Information
3/6/2021 12:39:12 AM	Microsoft-Windows-SMBClient	30904	The server does not support multichannel. Server name:  Guidance: The client attempted to use SMB Multichannel, but an administrator has disabled multichannel support on the server. This may also be a non-Microsoft file server that does not support multichannel or has multichannel disabled. You can enable SMB Multichannel on the server using this Windows PowerShell cmdlet: Set-SmbServerConfiguration -EnableMultiChannel:$true. This event does not apply to the multichannel settings of SMB client, which are controlled by the Set-SmbClientConfiguration Windows PowerShell cmdlet. Enabling or disabling client multichannel support does not affect server multichannel support.	Information
3/6/2021 12:38:22 AM	Microsoft-Windows-SMBClient	30904	The server does not support multichannel. Server name:Guidance: The client attempted to use SMB Multichannel, but an administrator has disabled multichannel support on the server. This may also be a non-Microsoft file server that does not support multichannel or has multichannel disabled. You can enable SMB Multichannel on the server using this Windows PowerShell cmdlet: Set-SmbServerConfiguration -EnableMultiChannel:$true. This event does not apply to the multichannel settings of SMB client, which are controlled by the Set-SmbClientConfiguration Windows PowerShell cmdlet. Enabling or disabling client multichannel support does not affect server multichannel support.	Information
3/6/2021 12:38:22 AM	Microsoft-Windows-SMBClient	30806	The client re-established its session to the server. Server name:  Server address: 172.16.5.170:445 Session ID: 0xA0214C00050D Guidance: You should expect this event if there was a previous event 30805, but the client successfully resumed the cached connection before the timeout expired.	Information
3/6/2021 12:38:22 AM	Microsoft-Windows-SMBClient	30806	The client re-established its session to the server. Server name:Server address: 172.20.7.101:445 Session ID: 0xBBA3000000141D89 Guidance: You should expect this event if there was a previous event 30805, but the client successfully resumed the cached connection before the timeout expired.	Information
3/6/2021 12:38:22 AM	Microsoft-Windows-SMBClient	30808	The connection to the share was re-established. Share name: \nacifsnj\MIS Server address: 172.20.7.101:445 Session ID: 0xBBA3000000141D89 Tree ID: 0x1 Guidance: You should expect this event if there was a previous event 30807, but the client successfully resumed the cached connection before the timeout expired.	Information

[TANielsenBest]

Bumping, as we still see this occurring.

[sebastianvd]

some fixes mentioning this issue have been made:

A hotfix for 5.2.5 has been released with a lot of fixes btw: Addressed Issues in GlobalProtect App 5.2 (paloaltonetworks.com)

Havent tested it yet though.

[TANielsenBest]

Bumping again.  We are on version 5.2.9 now, things have improved but I still see many user machines are dropping the VPN connection when the user closes the laptop lid and it goes into Modern Standby (which the device does support Sleep state S0).  This should NOT be happening.  We have the group policies in place to never drop network when the machine goes into Modern Standby.  We can also see that the computer itself does have a network connection, but VPN doesn't stay connected.