GP Alert - Error code 44 - Invalid authentication cookie

[GregorJus]

Hi,

all of our users seem to be successfully connected to GP, however, I am receiving the alerts like below (I've only removed/amended some sensitive information).

Can anyone shed some light on this Error 44 and invalid authentication cookie? Anything I should be worried and anything I should/could do to rectify this?

Thanks,

G

receive_time: 2025/06/30 09:11:06
actionflags: 0x0
type: GLOBALPROTECT
subtype: 0
config_ver: 2817
time_generated: 2025/06/30 09:11:06
high_res_timestamp: 2025-06-30T09:11:06.815+02:00
dg_hier_level_1: 0
dg_hier_level_2: 0
dg_hier_level_3: 0
dg_hier_level_4: 0
vsys_id: 1
vsys: vsys1
eventid: gateway-hip-check
status: failure
stage: host-info
auth_method:
tunnel_type:
portal: GP gateway - Internal
srcuser: user@domain.com
private_ip: 10.0.2.25
private_ipv6: 0.0.0.0
hostid: 20d2155b-769e-4c0b-ba83-b9f1c55636e7
client_ver: 6.2.7
client_os: any
client_os_ver:
repeatcnt: 1
login_duration: 0
connect_method:
reason:
location:
error_code: 44
error: Invalid authentication cookie
opaque:
gateway:
selection_type:
response_time:
priority:
cluster_name:
attempted_gateways:

[BPry · Accepted solution]

@GregorJus,

This is normal to see in the logs and usually associated with gatewa-hip-check events like what you're seeing. I always see it on gateway-hip-check events and it's always between a gateway-logout event and a portal-auth/portal-gen-cookie event.

If I would have to guess what is going on, I think the user is likely suspending the machine and upon it resuming the agent sends spurious HIP check reports; since the HIP reports utilize a cookie with the gateway and the gateway session has already been cleared, the cookie is invalid and the reports aren't processed.

I've seen this on BYOD endpoints that aren't forced onto the VPN at random times well prior to them connecting to the VPN tens of minutes later, so that leads credence to it being an issue with the agent when exiting sleep. This is just a hypothesis, but it's the best I can offer. 

[GregorJus]

Hi @BPry,

This is bloomin' amazing explanation - I was thinking it could be related to users' devices going to sleep but couldn't come up with the actual explanation like you did!

Many thanks for this, mate!

Gregor