GP Connection Failed - gateway could not verify the server certiticate of the gateway.

[PA_nts]

Hi All,

I have GP setup and working like a dream..... most of the times.

however i have a strange issue.. and seems to only affect Azure cloud PCs at the moment, normal users with laptops and desktops can connect no problem.

my certs are all valid and signed by an external CA.

however on Azure cloud PC's the connections are very intermittent.. works maybe 1/6 attempts. most of the time users get the error around unable to verify the certificate on the gateway.

pan-os running 10.1.10-h2

gp app version is 6.1.2

windows cloud PC running windows 365 enterprise, 2vCPU, 8gb and 256 GB SSD

tried deleting dat files on local drive, no luck.

tried unistall / reinstall GP app no luck.

tried with full admin rights, same issue.

tried installing the certs locally to the PC's in the certificate store.. no luck.

from these cloud PC's, i can log into the portal fine and no complaints about certificate

any ideas doubt there are much testing around these as yet.. might have to log a call with MS also.

thanks in adv

[Claw4609]

Hello,

Do verify, is your Gateway certificate a public cert or just the portal? And do you Azure machines trust this public root/intermediate certificate? 

I would also check the GlobalProtect logs on the firewall gateway and see if there is any more error information that points to anything.

I would also check the clients GlobalProtect debug logs, specfically the pangps and pangpa logs, as there should be more information related to specifically what it didnt like.

[matt]

Did you ever find a fix for this? I am dealing with the same problem. Thanks. 

[PA_nts]

Hey Matt,

shu long time ago..

yes it was resolved and the issue in our case was down to the users not having the correct permissions on the cloud PCs to install the certs locally.

I think the Application teams in the end included the certs to install when they did a cloud pc rollout/deployment.

rgds

[matt]

Thank you for taking the time to reply. 

If you are able to provide any further insight then please do, this issue is getting old fast and I want it resolved! 

[PA_nts]

I dont have more info unfortunately..

what you can do however, is export the cert from the portal, then connect to the cloud PC. and see if you can install said certificate from your portal to your local certificate store with the account that does not work.. chances are  you wont be able to due to insufficient permissions..

If this is the case, then try and elevate the permissions to admin rights or similar and retry the cert install - if this works and install then log out, change your permissions back to what it was.. log back in and test.. if this works then you have found your issue..

then you will need to work with the system admin to allow users to add this cert to their local cert store.. another option is for them to do this via the group policy (assuming you are running windows ad) to install the certs locally on these machines.

sorry it is all the info i have atm

good luck.