Hello LiveCommunity Team!
I created this post to share my experience regarding an issue involving GlobalProtect users from Prisma Access who attempt to run gpupdate /force to update GPO policies from the DC server, and who encounter the following error:
CMD ERROR GPUPDATE /FORCE
C:\WINDOWS\system32>gpupdate /force
Updating policy...
User policy cannot be updated successfully due to the following errors:
Group policy cannot be processed because it cannot connect to a domain controller over the network. This condition may be temporary. A success message may be generated once the computer connects to the domain controller and the group policy is processed successfully. Contact your administrator.
- Given this error, I checked the GlobalProtect source IP logs and everything appeared to be allowed.
Then, I tried pinging from an affected endpoint with a custom length and the DF "Don't Fragment" bit active set to 1350 bytes, and the ping was dropped by fragmentation needed. as shown below:
PING TEST WITH 1350 BYTES
Then I try it with 1300 Bytes as the payload and the ping works!
PING TEST WITH 1300 BYTES
So, as a test, I changed the Prisma Access GlobalProtect tunnel MTU to 1300 bytes (default is 1400 bytes) and the gpupdate /force command works!
PRISMA ACCESS GLOBAL PROTECT CONNECTION MTU ADJUSTMENT FROM 1400 TO 1300 BYTES
CMD GPUPDATE /FORCE SUCCESFULLY
C:\Users\pcmolinaa>gpupdate /force
Updating policy...
The computer policy update completed successfully.
Conclusions:
- Some device in the path, most likely the on-premises NGFW, was dropping the LDAP packets because it has a lower MTU and the packets are sent with the DF bit set, disabling IP fragmentation and forcing the drop by some peer.
Thank you for your time, and I hope this information is helpful in your daily cybersecurity work. I would greatly appreciate your support by liking or accepting this as a useful post; it would help me a lot in becoming a CyberElite!
Best Regards,
Daniel Romero
Senior Network/Security Engineer
PANW Partner
Prisma Access NGFW GlobalProtect
