GP Internal Gateway does not work after upgrading to 10.2.7-h3

[Jorge_Lopez]

Our customer has configured internal gateways to retrieve mapping information for users from devices that are not joined to the domain.

This was working fine after Firewalls and Panorama were upgraded to 10.2.7-h3.

For example, one of the peer's firewalls (Active/Passive) was upgraded and this task was completed without issues around 7:30 PM.

Before 7:30 PM, the users were able to connect to the internal gateway without any problems, but from then onwards users were no longer able to connect to the Internal Gateway showing the error in the GP firewall logs "status: failure - error: Invalid tunnel end point IP address".

There can be no other explanation if just before the upgrade the connections to the internal gateway were successful and just after the upgrade they started to fail.

Checking known issues for version 10.2.7 or addressed issues for the next release 10.2.8 and I can't find anyone that matches this concrete issue.

Could it be an internal bug or not yet published?

Thanks in advance to the community

[Claw4609 · Accepted solution]

Hello,

Out of curiosity, does this issue apply? 

If not are there any error on the GlobalProtect logs on the firewall itself? If you grab a clients GlobalProtect debug logs and look at the PanGPA and PanGPS files, is there anything in those around the time frame this provides additional information into the issue?

[Jorge_Lopez]

Hi @Claw4609,

Thank you so much for updating this discussion.

Finally, the case was escalated to the TAC. I will share it with you once it is resolved.

[Jorge_Lopez]

Finally, it was a certificate issue. The certificate of the internal gateways was expired...

Thanks @Claw4609, I will not hesitate to check the logs more thoroughly next time.