Ubuntu Firefox GP Web issue

[RovshanRajabli]

Dear Team,Does anyone have a problem with GP on Ubuntu 22.04 when using Firefox?
Detail: I have an issue when I try to access some websites via Firefox while using GP, Firefox cannot open any of the websites.
When I turn off GP, everything is fine.Need some advice.
GP version is 6.1, Firefox version is latest, pan-os version is 11.0.0

[MajesticSteel]

Did you ever find a resolution for this?  Chrome seems to be fine but Firefox can't open any sites.

[RovshanRajabli]

Hi!

I find some workaround. I downgraded the agent version to 6.0.5-c12. Everything works fine on that version.

As I tested, 6.0.5-c12 is the most stable version for Firefox on Ubuntu 22.0.4

[jamesps]

I think this could be a conflict with Snap applications.

I had the same issue on our Ubuntu 22.04 machines. Snap apps try to use the DNS settings exposed via the systemd-resolved API, however, GlobalProtect replaces the /etc/resolv.conf file provided by systemd-resolved which breaks this behaviour.

I found a workaround is to add the following content to /etc/systemd/resolved.conf then restart the systemd-resolved service.

[Resolve]
DNSStubListenerExtra = 127.0.0.1:53

I'm not sure who's in the wrong here. I suspect GlobalProtect because it overwrites the /etc/resolv.conf file in a strange way (sym-linking to its own config file.)

Anyway, I hope this helps for you.

[fcaruso]

Hey @RovshanRajabli we've been using @jamesps fix for some time, but finally tracked it down to the Ubuntu package resolvconf not being installed on the endpoint.

The package is also installed if you run the script /opt/paloaltonetworks/globalprotect/gpui_apt_dep.sh, which also installs some other packages and gnome extensions. This doesn't seem to be installed when installing GlobalProtect.

Installing resolvconf also seems to solve some DNS issues in 6.2, but we are still monitoring.

I couldn't find a requirement to install resolvconf or to run /opt/paloaltonetworks/globalprotect/gpui_apt_dep.sh in any PaloAlto doc, not sure how to bring this to their attention.

Cheers,

[jamesps]

Yes, I heard the same from PaloAlto support about this issue. I was told `resolvconf` package was "recommended" for Ubuntu 22.04 or lower, but not listed as a dependency on the .deb

For 24.04 `resolvconf` package does not exist in the repos anymore. But GP client version 6.2.1-276 seems to have solved this issue for me.