GP Issue Gateway Fake

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

GP Issue Gateway Fake

L0 Member

Hi,

 

I am facing the issue with Pan GP where I get an error Gateway Fake: Could not connect to the GlobalProtect gateway. Please contact your IT administrator.

I tried to remove the certificate and also reinstall it multiple times and delete the Palo alto network file also and re-install the Pan GP but no luck. Uninstall all applications but no solution I find. It was working fine before that but suddenly start the error.

 

chanderjain_0-1638027354282.png

 

I getting these logs from the files.

11/27/0021 20:17:50.979 [Info ]: GlobalProtect service started (client version: 5.1.1-12, OS version: Microsoft Windows 10 Pro , 64-bit).
11/27/0021 20:19:24.121 [Info ]: Portal login completed with address 203.122.6.28 and conect method of user-logon.
11/27/0021 20:19:24.199 [Info ]: Network discovery started.
11/27/0021 20:19:25.708 [Error]: Gateway Fake: Could not connect to the GlobalProtect gateway. Please contact your IT administrator.

 

 

11/27/21 20:17:46:733[Debug 743]: No oem .inf existing.
11/27/21 20:17:47:629[Debug 306]: Driver inf file is installed successfully.
11/27/21 20:17:49:667[Debug 359]: Driver gets installed successfully.
11/27/21 20:17:50:204[Debug 375]: Set debug level as 4
11/27/21 20:17:50:766[Debug 1196]: Driver status is: 4.
11/27/21 20:17:50:776[Debug 565]: Found pangpd device ROOT\PANGPD\0000, remove it now.
11/27/21 20:17:50:778[Debug 1196]: Driver status is: 4.
11/27/21 20:17:50:787[Debug 565]: Found pangpd device ROOT\PANGPD\0000, remove it now.
11/27/21 20:17:50:788[Debug 944]: Disable adapter be called.
11/27/21 20:17:50:868[Debug 824]: Disable Adapter success.

 

 

(T12520)Debug(2278): 11/27/21 20:17:58:741 No user, using SSO
(T12520)Debug(9709): 11/27/21 20:17:58:742 Saved password is empty.
(T12520)Debug(2338): 11/27/21 20:17:58:742 Portal 203.122.6.28, user , logonDomain DESKTOP-8H9MAI8, saved user , path C:\Users\Chander Jain\AppData\Local\Palo Alto Networks\GlobalProtect\
(T12520)Debug(2404): 11/27/21 20:17:58:742 use proxy is 1
(T12520)Debug(2462): 11/27/21 20:17:58:742 Pre-logon-then-on-demand value is no
(T12520)Debug(1469): 11/27/21 20:17:58:742 SSO starts.
(T12520)Info (1498): 11/27/21 20:17:58:743 SSO ----- PanCredGet failed with error Element not found.
(T12520)Debug(1509): 11/27/21 20:17:58:744 SSO GetSsoCredential starts.
(T12520)Info (1539): 11/27/21 20:17:58:744 SSO ----- PanCredGet failed with error Element not found.

(T12520)Debug(9726): 11/27/21 20:17:58:744 SSO password is empty
(T12520)Debug(2568): 11/27/21 20:17:58:744 Empty username
(T12520)Debug(2600): 11/27/21 20:17:58:744 m_preUsername
(T12520)Debug(9686): 11/27/21 20:17:58:744 Password is empty.
(T12520)Debug(7091): 11/27/21 20:17:58:744 Empty user for GetCachedPortalCfgOldNewFileName
(T12520)Debug(2621): 11/27/21 20:17:58:744 CheckCachedPortalForPrelogon 0, PrelogonNeedTimeout 0, RenameTimeout -1, userName ___empty_username___, preUsername
(T12520)Debug(2762): 11/27/21 20:17:58:744 Use ssl tunnel is no
(T12520)Debug(6140): 11/27/21 20:17:58:745 --Set state to Retrieving configuration...
(T8776)Debug( 413): 11/27/21 20:17:58:766 HipMonitorThread wait for exit event.
(T12520)Debug(7188): 11/27/21 20:17:58:768 SSO enable status is 1, user name is ___empty_username___, domain name is .
(T12520)Debug(2131): 11/27/21 20:17:58:768 open http session. agent is PAN GlobalProtect/5.1.1-12 (Microsoft Windows 10 Pro , 64-bit)
(T12520)Debug( 456): 11/27/21 20:17:58:771 winhttp SetSecureProtocol, hSession=2cafe1b0, bAllProtocol=0, gbFips=0
(T12520)Debug( 456): 11/27/21 20:17:58:771 winhttp SetSecureProtocol, hSession=2cb00b80, bAllProtocol=0, gbFips=0
(T12520)Debug(1604): 11/27/21 20:17:58:773 SetProxyForHost(https://203.122.6.28/😞 timeout:5 AutoDetect:1 url: proxy: bypass: proxystr:
(T12520)Debug(6185): 11/27/21 20:17:58:773 ----Portal Pre-login starts----
(T12756)Debug(4651): 11/27/21 20:17:58:773 CaptivePortalDetectionThread: IsDetectingCaptivePortal=1, PreLoginIsDone=0
(T12756)Debug(4628): 11/27/21 20:17:58:773 CaptivePortalDetectionThread: wait (2000 ms) for captive portal detection event.
(T12520)Debug( 550): 11/27/21 20:17:58:781 Network is reachable
(T12520)Debug(6211): 11/27/21 20:17:58:783 Pre-login...,verifyportalcert=yes
(T12520)Debug(10107): 11/27/21 20:17:58:783 Check cert of server 203.122.6.28
(T12520)Debug(10122): 11/27/21 20:17:58:783 File C:\Program Files\Palo Alto Networks\GlobalProtect\tca.cer does not exist.
(T12520)Debug( 777): 11/27/21 20:17:58:783 SSL connecting to 203.122.6.28
(T12520)Debug( 550): 11/27/21 20:17:58:790 Network is reachable
(T12520)Debug(1242): 11/27/21 20:17:59:027 Failed to X509_LOOKUP_load_file
(T12520)Debug( 363): 11/27/21 20:17:59:027 Open_SSL_connection: subject '/CN=203.122.6.28'
(T12520)Debug( 367): 11/27/21 20:17:59:027 Open_SSL_connection: issuer '/CN=203.122.6.28'
(T12520)Debug( 987): 11/27/21 20:17:59:027 Hostname 203.122.6.28 doesn't match sub alt name or no sub alt name, fallback to CN
(T12520)Debug(1023): 11/27/21 20:17:59:027 Hostname 203.122.6.28 match 203.122.6.28
(T12520)Debug(1318): 11/27/21 20:17:59:027 OpenSSL alert write⚠️close notify
(T12520)Debug(2574): 11/27/21 20:17:59:027 encpostdata, encpostdata=0000028D2C035280, encpostdatalen=160
(T12520)Debug(2744): 11/27/21 20:17:59:028 REQID=1,IPADDR=203.122.6.28,PORT=443,URL=/global-protect/prelogin.esp,POST=1,PROXY_AUTO=1,PROXY_CFGURL=NULL,PROXY=NULL,PROXY_BYPASS=NULL,PROXY_USER=NULL,PROXY_PASS=****,VERIFY_CERT=1,ADDITIONAL_CHECK=1,SCEP_CERT=,oid=
(T12520)Debug(1399): 11/27/21 20:17:59:028 Send response to client for request https_request
(T12520)Debug(2854): 11/27/21 20:17:59:182 receive pan_msg_ping, 3
(T12520)Debug(3006): 11/27/21 20:17:59:501 winhttpObj, cert error, 00000008.
(T12520)Debug(3011): 11/27/21 20:17:59:501 winhttpObj, cert erro is 00000008
(T12520)Debug(6322): 11/27/21 20:17:59:501 prelogin to portal result is
(null)
(T12520)Debug(6573): 11/27/21 20:17:59:501 Failed to pre-login to the portal 203.122.6.28 with return value 0(0).
(T12520)Debug(7416): 11/27/21 20:17:59:501 Try to restore last portal config from file.
(T12520)Debug(7463): 11/27/21 20:17:59:502 Skip retrieve cached portal configuration for empty user
(T12520)Debug(6645): 11/27/21 20:17:59:502 Need to send portal certificate verification message to PanGPA.
(T12520)Debug(6647): 11/27/21 20:17:59:502 Set state to Disconnected
(T12520)Debug(6140): 11/27/21 20:17:59:502 --Set state to Disconnected
(T12520)Debug(1006): 11/27/21 20:17:59:502 Display hip report V4 on the UI
(T12520)Debug(1399): 11/27/21 20:17:59:503 Send response to client for request portal-certificate-verification
(T12756)Debug(4539): 11/27/21 20:18:00:788 CPD, reset cp detection history
(T12756)Debug( 550): 11/27/21 20:18:00:897 Network is reachable

 

 

2 REPLIES 2

L3 Networker

Hi Chanderjain,

 

If the GP configurations are okay, then the following steps should resolve the issue.


• Disable WMI services: run - services.msc - Windows Management Instrumentation(WMI) - stop the service.
• Delete the files under C:\Windows\System32\wbem\Repository
• Open Windows Registry (Regedit)
Go to HKEY_LOCAL_MACHINE > Software and HKEY_CURRENT_USER > Software. Delete the Palo Alto Networks folder.
• Delete the same if the same folder is present in any other user under HKEY_USERS.
• Un-install GlobalProtect from Windows 'Programs and Features.'
• Make sure that the virtual adapter is not present in the Network adapter settings.
• Reboot the machine.
• Reinstall GlobalProtect with admin privileges.
• Confirm that WMI service is running.

Hope this helps!

--
"The Simplicity is the ultimate sophistication." - Leonardo da Vinci.

Hi  AnalysisMan,

 

Thanks for sharing the solution but there I have one more concern. What I did there was I used my credential in another system's GPVPN and I see the same error and then I tried his credential in my machine's GPVPN what I see My GPVPN is connecting without any issue and error. Could you please help me here to understand where the issue is getting?

  • 2908 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!