GP Internal Gateway does not work after upgrading to 10.2.7-h3

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

GP Internal Gateway does not work after upgrading to 10.2.7-h3

L1 Bithead

Our customer has configured internal gateways to retrieve mapping information for users from devices that are not joined to the domain.

 

This was working fine after Firewalls and Panorama were upgraded to 10.2.7-h3.

 

For example, one of the peer's firewalls (Active/Passive) was upgraded and this task was completed without issues around 7:30 PM.

 

Before 7:30 PM, the users were able to connect to the internal gateway without any problems, but from then onwards users were no longer able to connect to the Internal Gateway showing the error in the GP firewall logs "status: failure - error: Invalid tunnel end point IP address".

 

There can be no other explanation if just before the upgrade the connections to the internal gateway were successful and just after the upgrade they started to fail.

 

Checking known issues for version 10.2.7 or addressed issues for the next release 10.2.8 and I can't find anyone that matches this concrete issue.

 

Could it be an internal bug or not yet published?

 

Thanks in advance to the community

 

 

1 accepted solution

Accepted Solutions

Cyber Elite
Cyber Elite

Hello,

 

Out of curiosity, does this issue apply? 

Claw4609_0-1711139000910.png

If not are there any error on the GlobalProtect logs on the firewall itself? If you grab a clients GlobalProtect debug logs and look at the PanGPA and PanGPS files, is there anything in those around the time frame this provides additional information into the issue?

 

Claw4609_1-1711139091194.png

 

View solution in original post

3 REPLIES 3

Cyber Elite
Cyber Elite

Hello,

 

Out of curiosity, does this issue apply? 

Claw4609_0-1711139000910.png

If not are there any error on the GlobalProtect logs on the firewall itself? If you grab a clients GlobalProtect debug logs and look at the PanGPA and PanGPS files, is there anything in those around the time frame this provides additional information into the issue?

 

Claw4609_1-1711139091194.png

 

L1 Bithead

Hi @Claw4609,

 

Thank you so much for updating this discussion.

 

Finally, the case was escalated to the TAC. I will share it with you once it is resolved.

 

 

Finally, it was a certificate issue. The certificate of the internal gateways was expired...

Thanks @Claw4609, I will not hesitate to check the logs more thoroughly next time.

  • 1 accepted solution
  • 1808 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!