Incomplete network connection with Global Protect Over Public WiFi

[GQMerdian]

Hi Everyone

One of our user is experiencing the issue with GlobalProtect. When the user connect with globalprotect over public WiFi, he can only ping the LDAP server in the network and nothing else. I am wondering what can cause this issue and why the user cannot access the other network resources. Can someone please share your thoughts about this that what areas should we look into for this kind of problem. Also what settings we need to check for global protect. 

Any help in this regard will be highly appreciated. 

Thank you in Advance. 

[BPry]

@GQMerdian,

What do you see in your traffic logs on the firewall, do you see the other traffic even coming across the tunnel? When troubleshooting with the user have you verified that the endpoint route table is being updated properly and you don't have any overlapping going on if you have split-tunnel or local network access enabled? 

[GQMerdian]

Thanks for your response. Yes i see the global protect logs from all the users. We are troubleshooting this particular case over the public wifi. This user mentioned that he is able to ping the LDAP server which means routing is working fine as he is able to ping the network but not everything so the global protect session is kind of incomplete so this being said "pre-logon" is working but incomplete. 

[TomYoung]

Hi @GQMerdian ,

Please also verify the "endpoint route table" that @BPry mentioned.  On Windows, this is "route print" and on macOS/Linux it is "netstat -r".  If GP works fine for everyone else, then it may be a conflicting route injected by the public WiFi.  Adding that same route to GP split tunnel will cause it to inject a route with a better metric on the endpoint and fix the issue.

Thanks,

Tom