This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences

Enhanced Security Measures in Place:   To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.

Unable to connect Global Protect VPN

cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Unable to connect Global Protect VPN

Jason.T
L2 Linker

‎01-17-2022 07:30 PM

All our users are able to connect to our PA220 using Global Protect VPN except one. We've tried reinstalling the Global Protect client multiple times and also connected successfully using their account from another computer, but it just refuses to work on his.

2 people had this problem.
0 Likes Likes
22 REPLIES 22

BPry
Cyber Elite
Cyber Elite

‎01-17-2022 07:37 PM

@Jason.T,

What's the actual behavior when you attempt to connect from that particular machine that isn't working? Do you get to the credential prompt, do you see an endless "connecting" window, does the connect button do anything? What OS are we talking about (Linux, macOS, Windows)? The logs will almost always tell you exactly what the issue is if you look at them on the endpoint in question. If you're having a service communication issue between the service and the agent, or simply can't connect to the portal/gateway.

 

There's some basic information missing that would help narrow down the likely cause of this particular machine not being able to connect. Troubleshooting actual endpoint issues however it's always best to review the actual endpoint logs and see what's actually being reported in the PanGPS.log file and subsequently the PanGPA.log file. The vast majority of issues are fairly well documented directly in the PanGPS.log file on the endpoint. 

0 Likes Likes

Jason.T
L2 Linker
In response to BPry

‎01-17-2022 07:54 PM

He get's prompted for credentials then it pretty much immediately fails to connect and displays an error that basically just says it failed to connect.

He's using Windows 7 Professional. Should I post the PanGPS log here?

0 Likes Likes

BPry
Cyber Elite
Cyber Elite

‎01-17-2022 08:01 PM

@Jason.T,

If you need help reviewing the logs I would include the relevant connection logs and include them here, keeping in mind that the logs will display the IP or FQDN that you are attempting to connect to. I would personally strip that and any other identifiable information out of the log file before posting it on a public forum. 

Also keep in mind that GlobalProtect support of Windows 7 has effectively ended. That OS is no longer supported in GlobalProtect 5.2 agents, and 5.1 demands that Service Pack 1 be installed to actually be supported. There's also some issues installing GlobalProtect on 32-bit Windows 7 installations even when using 5.1 that requires some manual adjustments to make things function correctly. 

Jason.T
L2 Linker
In response to BPry

‎01-17-2022 08:56 PM - edited ‎01-17-2022 08:56 PM

The router is handing out version 5.0.10-3 of the client.

Pasting the whole PanGPS log here just crashes the page so here's a chunk. Interestingly our RMM software reports the system as Windows 7 but this log lists it as Windows 10.

 

(T12120) 01/12/22 08:47:34:979 Debug(2731): There is no connected-gw-ip
(T12120) 01/12/22 08:47:34:979 Debug(4404): In SetGatewayRoute: The original route table:
(T12120) 01/12/22 08:47:34:979 Debug( 138): Destination NetMask Gateway Inf Metric
(T12120) 01/12/22 08:47:34:979 Debug( 153): 0.0.0.0 0.0.0.0 192.168.86.1 11 35
(T12120) 01/12/22 08:47:34:979 Debug( 153): 127.0.0.0 255.0.0.0 127.0.0.1 1 331
(T12120) 01/12/22 08:47:34:979 Debug( 153): 127.0.0.1 255.255.255.255 127.0.0.1 1 331
(T12120) 01/12/22 08:47:34:979 Debug( 153): 127.255.255.255 255.255.255.255 127.0.0.1 1 331
(T12120) 01/12/22 08:47:34:979 Debug( 153): 192.168.86.0 255.255.255.0 192.168.86.53 11 291
(T12120) 01/12/22 08:47:34:979 Debug( 153): 192.168.86.53 255.255.255.255 192.168.86.53 11 291
(T12120) 01/12/22 08:47:34:979 Debug( 153): 192.168.86.255 255.255.255.255 192.168.86.53 11 291
(T12120) 01/12/22 08:47:34:979 Debug( 153): 224.0.0.0 240.0.0.0 127.0.0.1 1 331
(T12120) 01/12/22 08:47:34:979 Debug( 153): 224.0.0.0 240.0.0.0 192.168.86.53 11 291
(T12120) 01/12/22 08:47:34:979 Debug( 153): 255.255.255.255 255.255.255.255 127.0.0.1 1 331
(T12120) 01/12/22 08:47:34:979 Debug( 153): 255.255.255.255 255.255.255.255 192.168.86.53 11 291
(T12120) 01/12/22 08:47:34:979 Debug(4414): SetGatewayRoute: GetBestRoute() returns Dest:0.0.0.0 Mask:0.0.0.0 if_index=11 metric1=35
(T12120) 01/12/22 08:47:34:979 Debug(4436): Created gateway route (144.xxx.xxx.xxx) succeeds
(T12120) 01/12/22 08:47:34:979 Debug( 271): Ipv6-connection is NULL
(T12120) 01/12/22 08:47:34:979 Debug( 318): gw-address-v6 is not specified
(T12120) 01/12/22 08:47:34:979 Debug( 324): remoteHostV6 is not specified
(T12120) 01/12/22 08:47:34:979 Debug( 349): ip-address-preferred value is yes
(T12120) 01/12/22 08:47:34:979 Debug( 374): ip-address-v6-preferred not found.
(T12120) 01/12/22 08:47:34:979 Debug(9707): Set preferred IP 192.168.253.26 for gateway 144.xxx.xxx.xxx user xxxx
(T12120) 01/12/22 08:47:34:979 Debug(9716): Set preferred IPv6 for gateway 144.xxx.xxx.xxx user xxxx
(T12120) 01/12/22 08:47:34:979 Debug( 514): DLSA, found no-direct-access-to-local-network tag, b_IsDLSASet set to false
(T12120) 01/12/22 08:47:34:979 Debug( 757): Encryption method is aes-256-gcm
(T12120) 01/12/22 08:47:34:979 Debug(3233): set driver connected as true
(T12120) 01/12/22 08:47:34:979 Debug( 594): use-ssl-only-tunnel is not configured and user cannnot change
(T12120) 01/12/22 08:47:34:979 Debug( 147): VPN idle timeout is 10800; config timeout is 10800
(T12120) 01/12/22 08:47:34:979 Debug( 70): c2s-spi is 0x43164BD3, s2c-spi is 0x36052CB2
(T12120) 01/12/22 08:47:34:979 Debug( 189): EnforceDns is enabled, set 2 GP pushed DNS servers
(T12120) 01/12/22 08:47:34:979 Debug( 164): Trying to do ipsec connection to 144.xxx.xxx.xxx[4501]
(T12120) 01/12/22 08:47:34:989 Debug( 550): Network is reachable
(T12120) 01/12/22 08:47:34:989 Info ( 176): Connected to: 144.xxx.xxx.xxx[4501], Sending keep alive to ipsec socket...
(T12120) 01/12/22 08:47:35:019 Info ( 214): Connected ipsec to 144.xxx.xxx.xxx(4501)
(T12120) 01/12/22 08:47:35:019 Info ( 329): tunnel to 144.xxx.xxx.xxx connected
(T12120) 01/12/22 08:47:35:164 Debug( 349): PsvRegister done
(T12120) 01/12/22 08:47:35:164 Debug( 25): create thread 0x494 with thread ID 12952
(T12952) 01/12/22 08:47:35:164 Debug( 398): VpnProcMonitor thread starts
(T12952) 01/12/22 08:47:35:164 Debug( 25): create thread 0x664 with thread ID 11476
(T11476) 01/12/22 08:47:35:164 Debug( 409): VpnProcDrv thread starts
(T12120) 01/12/22 08:47:35:169 Debug(1610): Get original UseDomainNameDevolution value 1
(T12120) 01/12/22 08:47:35:169 Debug(1636): Get original DNS SearchList value xxxxxx.local,lan
(T12120) 01/12/22 08:47:35:169 Debug(1657): searchList: xxxxxx.local
(T12120) 01/12/22 08:47:35:169 Debug(1657): searchList: lan
(T12120) 01/12/22 08:47:35:169 Error(1566): InstallClientConfig: Failed to find PANGP virtual adapter interface
(T6000) 01/12/22 08:47:35:169 Debug(2349): Setting debug level to 5
(T12120) 01/12/22 08:47:35:179 Error( 343): InstallClientConfig() failed
(T12120) 01/12/22 08:47:35:179 Error( 248): ProcMonitor: SetupNetwork() failed
(T12952) 01/12/22 08:47:35:179 Info ( 471): PktProcess: VPN disconnect event, get out of ProcMonitor
(T12952) 01/12/22 08:47:35:179 Debug( 544): Tunnel downtime is 16 miliseconds
(T11476) 01/12/22 08:47:35:179 Info ( 832): ProDrv: VPN disconnect event, get out of ProcDrv
(T11476) 01/12/22 08:47:35:179 Info ( 858): ProcDrv thread dies
(T12952) 01/12/22 08:47:35:179 Info ( 805): ProcDrv quit
(T12952) 01/12/22 08:47:35:179 Info ( 791): ProcMonitor thread dies
(T12120) 01/12/22 08:47:35:289 Debug( 293): do_disconnect is called in VPN stop
(T12120) 01/12/22 08:47:35:289 Debug( 227): IPSec anti-replay statistics: outside window count 0, replay count 0
(T12120) 01/12/22 08:47:35:289 Debug( 229): Disconnect udp socket
(T12120) 01/12/22 08:47:35:289 Debug( 505): unset network
(T12120) 01/12/22 08:47:35:289 Debug( 764): PreviousDNSInfo doesn't exist, no need to restore
(T12120) 01/12/22 08:47:35:299 Info ( 528): not call uninstallClientConfig, netSetup=000001EC5ADABDB0, clientConfig=000001EC5B978660, panMSService=000001EC5ADD25C0, panMSService->IsConfigInstalled()=0
(T12120) 01/12/22 08:47:35:299 Debug( 615): ipsec failed to start
(T12120) 01/12/22 08:47:35:299 Info ( 87): VPN is deleted
(T12120) 01/12/22 08:47:35:299 Debug( 147): VPN idle timeout is 10800; config timeout is 10800
(T12120) 01/12/22 08:47:35:299 Debug( 189): EnforceDns is enabled, set 2 GP pushed DNS servers
(T12120) 01/12/22 08:47:35:299 Debug( 62): Trying to do SSL connection to 144.xxx.xxx.xxx(443)
(T12120) 01/12/22 08:47:35:299 Debug( 777): SSL connecting to 144.xxx.xxx.xxx
(T12120) 01/12/22 08:47:35:299 Debug( 550): Network is reachable
(T12120) 01/12/22 08:47:35:369 Debug(1242): Failed to X509_LOOKUP_load_file
(T12120) 01/12/22 08:47:35:369 Debug( 363): Open_SSL_connection: subject '/CN=vpn.xxxxxxxxxx.com'
(T12120) 01/12/22 08:47:35:369 Debug( 367): Open_SSL_connection: issuer '/C=US/O=DigiCert Inc/CN=RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1'
(T12120) 01/12/22 08:47:35:389 Info ( 110): Connected ssl tunnel to 144.xxx.xxx.xxx(443)
(T12120) 01/12/22 08:47:35:389 Info ( 329): tunnel to 144.xxx.xxx.xxx connected
(T12120) 01/12/22 08:47:35:459 Debug( 349): PsvRegister done
(T12120) 01/12/22 08:47:35:459 Debug( 25): create thread 0x69c with thread ID 12724
(T12724) 01/12/22 08:47:35:459 Debug( 398): VpnProcMonitor thread starts
(T12724) 01/12/22 08:47:35:459 Debug( 25): create thread 0x7bc with thread ID 11092
(T11092) 01/12/22 08:47:35:459 Debug( 409): VpnProcDrv thread starts
(T12120) 01/12/22 08:47:35:469 Debug(1610): Get original UseDomainNameDevolution value 1
(T12120) 01/12/22 08:47:35:469 Debug(1636): Get original DNS SearchList value xxxxxx.local,lan
(T12120) 01/12/22 08:47:35:469 Debug(1657): searchList: xxxxxxx.local
(T12120) 01/12/22 08:47:35:469 Debug(1657): searchList: lan
(T12120) 01/12/22 08:47:35:469 Error(1566): InstallClientConfig: Failed to find PANGP virtual adapter interface
(T12120) 01/12/22 08:47:35:469 Error( 343): InstallClientConfig() failed
(T12120) 01/12/22 08:47:35:469 Error( 248): ProcMonitor: SetupNetwork() failed
(T12724) 01/12/22 08:47:35:469 Info ( 471): PktProcess: VPN disconnect event, get out of ProcMonitor
(T12724) 01/12/22 08:47:35:469 Debug( 544): Tunnel downtime is 15 miliseconds
(T11092) 01/12/22 08:47:35:469 Info ( 832): ProDrv: VPN disconnect event, get out of ProcDrv
(T11092) 01/12/22 08:47:35:469 Info ( 858): ProcDrv thread dies
(T12724) 01/12/22 08:47:35:469 Info ( 805): ProcDrv quit
(T12724) 01/12/22 08:47:35:469 Info ( 791): ProcMonitor thread dies
(T12120) 01/12/22 08:47:35:589 Debug( 293): do_disconnect is called in VPN stop
(T12120) 01/12/22 08:47:35:589 Debug(1318): OpenSSL alert write⚠️close notify
(T12120) 01/12/22 08:47:35:589 Debug( 505): unset network
(T12120) 01/12/22 08:47:35:589 Debug( 764): PreviousDNSInfo doesn't exist, no need to restore
(T12120) 01/12/22 08:47:35:599 Info ( 528): not call uninstallClientConfig, netSetup=000001EC5ADABDB0, clientConfig=000001EC5B978660, panMSService=000001EC5ADD25C0, panMSService->IsConfigInstalled()=0
(T12120) 01/12/22 08:47:35:599 Error( 666): sslvpn failed to start
(T12120) 01/12/22 08:47:35:599 Info ( 87): VPN is deleted
(T12120) 01/12/22 08:47:35:599 Error(2448): CreateTunnel: SetConfig() failed
(T12120) 01/12/22 08:47:35:599 Debug(5894): UnsetGatewayRoutes: DeleteIpForwardEntry(144.xxx.xxx.xxx)
(T12120) 01/12/22 08:47:35:599 Debug(5942): --Set state to Connection failed
(T12120) 01/12/22 08:47:35:599 Debug( 914): Display hip report V4 on the UI
(T12120) 01/12/22 08:47:35:599 Debug(2463): VPN tunnel is not connected.
(T12120) 01/12/22 08:47:35:599 Debug(2465): returns FALSE.
(T12120) 01/12/22 08:47:35:599 Debug(2518): failed to create tunnel with gateway vpn.xxxxxxxx.com
(T12120) 01/12/22 08:47:35:599 Info (2236): logout: user=xxxxxx, portal=xxxxxx Gateway-N, gateway=vpn.xxxxxxx.com, domain=xxxxxxxx, computerName=T9009
(T12120) 01/12/22 08:47:35:599 Debug(2268): Logout parameter is
(T12120) 01/12/22 08:47:35:599 Debug( 777): SSL connecting to 144.xxx.xxx.xxx
(T12120) 01/12/22 08:47:35:599 Debug( 550): Network is reachable
(T12120) 01/12/22 08:47:35:649 Debug(3974): SSL verify succeed
(T12120) 01/12/22 08:47:35:719 Debug(1318): OpenSSL alert write⚠️close notify
(T12120) 01/12/22 08:47:35:719 Debug(2314): Logged out gateway vpn.xxxxxxxxxx.com
(T12120) 01/12/22 08:47:35:719 Debug(2536): tunnel to vpn.xxxxxxxxxxxxxxx.com is not created.
(T12120) 01/12/22 08:47:35:719 Error(4937): NetworkDiscoverThread: failed to discover external network.
(T12120) 01/12/22 08:47:35:719 Debug(4939): local system error, set error as VPN connection could not be established. Please restart your computer to try again.
(T12120) 01/12/22 08:47:35:719 Debug(5942): --Set state to Disconnected
(T6000) 01/12/22 08:47:35:719 Debug(2349): Setting debug level to 5
(T12120) 01/12/22 08:47:35:719 Debug( 914): Display hip report V4 on the UI
(T12120) 01/12/22 08:47:35:719 Debug(4989): NetworkDiscoverThread: PortalStatus is 1, HasLoggedOnGateway is 1
(T12120) 01/12/22 08:47:35:719 Debug(5005): Network discovery is not ready, set GP VPN status as disconnected
(T12120) 01/12/22 08:47:35:719 Debug(9914): SetVpnStatus called with new status=0, Previous Status=0
(T12120) 01/12/22 08:47:35:719 Debug(4116): UpdatePrelogonStateForSSO() - User-logon tunnel state = Disconnected
(T12120) 01/12/22 08:47:35:719 Debug(5024): local system error, need user action or wait 30 minutes to re-do network discovery
(T10744) 01/12/22 08:47:48:499 Debug( 139): Got hip report in other process ready event.
(T10744) 01/12/22 08:47:48:499 Debug( 158): Read output from PanGpHip.exe
(T10744) 01/12/22 08:47:48:499 Debug( 195): write hip file now
(T10744) 01/12/22 08:47:48:499 Debug( 221): CheckHipInOtherProcess() sets hip report ready event.
(T10744) 01/12/22 08:47:48:499 Debug( 135): Wait for the ready event of hip report generated in other process.
(T14264) 01/12/22 08:47:48:499 Debug(5160): HipReportThread: got HIP report ready event.
(T14264) 01/12/22 08:47:48:499 Debug(5176): HipReportThread: wait for network discover ready event.
(T10744) 01/12/22 08:47:49:664 Debug( 143): Got event for PanGpHip process has quited.
(T10744) 01/12/22 08:47:49:664 Debug( 338): CheckHip over
(T10744) 01/12/22 08:47:49:664 Debug( 282): Hip checking is not initiated by clicking resubmit host profile.
(T10744) 01/12/22 08:47:49:664 Debug( 216): HipCheckThread: wait for hip check event for 3600000 ms);
(T1920) 01/12/22 08:47:53:399 Debug( 334): PanGpHipMp.exe exit for checking misssing patches.
(T1920) 01/12/22 08:47:53:399 Debug( 396): CheckHipMissingPatchInOtherProcess(): exits.
(T1920) 01/12/22 08:47:53:399 Debug( 474): Hip missing patch checking duration is 19
(T1920) 01/12/22 08:48:31:419 Debug( 442): HipMissingPatchThread: now is 1641937711, last hip check is 1641937654, hip check interval is 3600000
(T1920) 01/12/22 08:48:31:419 Debug( 447): HipMissingPatchThread: wait 3505000 ms
(T9804) 01/12/22 08:50:14:518 Debug( 548): WscCallback
(T9804) 01/12/22 08:50:14:518 Debug( 550): SetWscEvent
(T1832) 01/12/22 08:50:14:518 Debug( 548): WscCallback
(T1832) 01/12/22 08:50:14:518 Debug( 550): SetWscEvent
(T1832) 01/12/22 08:50:14:518 Debug( 548): WscCallback
(T1832) 01/12/22 08:50:14:518 Debug( 550): SetWscEvent
(T9804) 01/12/22 08:50:14:518 Debug( 548): WscCallback
(T9804) 01/12/22 08:50:14:518 Debug( 550): SetWscEvent
(T8772) 01/12/22 08:50:17:529 Debug( 426): before check wsc
(T8772) 01/12/22 08:50:17:529 Debug( 380): wsc-autodetect is enabled
(T8772) 01/12/22 08:50:17:529 Debug( 429): CheckWsc
(T8772) 01/12/22 08:50:17:529 Debug( 455): CheckWsc is called.
(T8772) 01/12/22 08:50:17:529 Debug( 469): WscCallback: health state change not detected. Ignore this one.
(T6164) 01/12/22 08:51:49:388 Info ( 475): msgtype = portal
(T6164) 01/12/22 08:51:49:388 Debug(1808): ----portal processing starts----
(T6164) 01/12/22 08:51:49:388 Debug(1830): User profile type is 0(not roaming)
(T6164) 01/12/22 08:51:49:388 Debug(1845): pg, source = 0, old source is 0
(T6164) 01/12/22 08:51:49:388 Debug(1867): pg, preferred gateway not set in message, old prefergateway=:)
(T6164) 01/12/22 08:51:49:388 Debug(1930): CheckUpdate is false.
)(T6164) 01/12/22 08:51:49:388 Debug(1945): portal-certificate-verification is yes
(T6164) 01/12/22 08:51:49:388 Debug(1985): No saml-load-cache tag.
(T6164) 01/12/22 08:51:49:388 Debug(2008): no saml-auth-error tag.
(T6164) 01/12/22 08:51:49:388 Debug(2019): allow-cached-portal is yes
(T6164) 01/12/22 08:51:49:388 Debug(2063): NewWinUser is xxxxxxxxxx, WinUser is , PreviousSwitchOffMsg is false
(T6164) 01/12/22 08:51:49:388 Debug(2064): GetPrelogonStatus() 0, m_userName xxxxxxxxx, m_preUsername xxxxxxxxx
(T6164) 01/12/22 08:51:49:388 Debug(5830): StopThreads starts:
(T6164) 01/12/22 08:51:49:388 Debug(1334): Logging out gateway, reason is StopThreads
(T14264) 01/12/22 08:51:49:388 Debug(5184): HipReportThread: got exit event.
(T6164) 01/12/22 08:51:49:388 Debug(1365): Logging out gateway over
(T5304) 01/12/22 08:51:49:388 Debug(4439): CaptivePortalDetectionThread: got exit event.
(T12120) 01/12/22 08:51:49:388 Debug(5081): NetworkDiscoverThread: got exit event while retry
(T12120) 01/12/22 08:51:49:388 Debug(5035): NetworkDiscoverThread: quits.
(T14264) 01/12/22 08:51:49:388 Debug(5462): HipReportThread: HipReportThread quits.
(T10976) 01/12/22 08:51:49:388 Debug(5601): NetworkConnectionMonitorThread: got exit event.
(T5304) 01/12/22 08:51:49:388 Debug(4603): CaptivePortalDetectionThread: captive portal detection thread exit status is (successful).
(T10976) 01/12/22 08:51:49:388 Debug(5616): NetworkConnectionMonitorThread: quits.
(T3520) 01/12/22 08:51:49:388 Debug(4239): NotificationTimerThread: got exit event.
(T6164) 01/12/22 08:51:49:508 Debug(5845): threads are gracefully stopped.
(T8772) 01/12/22 08:51:49:508 Debug( 418): HipMonitor gets quit event.
(T8772) 01/12/22 08:51:49:508 Debug( 435): Unregister -- WscUnRegisterChanges
(T10744) 01/12/22 08:51:49:508 Debug( 242): HipCheckThread: got thread exit event.
(T10744) 01/12/22 08:51:49:508 Debug( 287): HipCheckThread: Hip check thread quits.
(T1920) 01/12/22 08:51:49:518 Debug( 533): HipMissingPatchThread: Hip check missiing patch thread quits.
(T8772) 01/12/22 08:51:49:528 Debug( 763): HipMonitorThread quits.
(T6164) 01/12/22 08:51:49:528 Debug( 132): All hip collect threads quit gracefully.
(T6164) 01/12/22 08:51:49:528 Debug(5909): StopThreads ends.
(T6164) 01/12/22 08:51:49:528 Debug(5794): StartThreads starts:
(T6000) 01/12/22 08:51:49:528 Debug(2349): Setting debug level to 5
(T6164) 01/12/22 08:51:49:528 Debug( 25): create thread 0x79c with thread ID 6068
(T6164) 01/12/22 08:51:49:528 Debug( 25): create thread 0x724 with thread ID 6716
(T6068) 01/12/22 08:51:49:528 Debug(4082): NotificationTimerThread: notification timer thread starts.
(T6068) 01/12/22 08:51:49:528 Debug(4232): NotificationTimerThread: wait (-1 ms) for notification timer event.
(T6716) 01/12/22 08:51:49:528 Debug(4278): CaptivePortalDetectionThread: captive portal detection thread starts.
(T6716) 01/12/22 08:51:49:528 Debug(4436): CaptivePortalDetectionThread: wait (-1 ms) for captive portal detection event.
(T6164) 01/12/22 08:51:49:528 Debug( 25): create thread 0x6e8 with thread ID 13212
(T6164) 01/12/22 08:51:49:528 Debug( 25): create thread 0x370 with thread ID 2544
(T13212) 01/12/22 08:51:49:528 Debug(4613): NetworkDiscoverThread: network discover thread starts.
(T13212) 01/12/22 08:51:49:528 Debug(4638): NetworkDiscoverThread: wait for network discover event.
(T6164) 01/12/22 08:51:49:528 Debug( 25): create thread 0x67c with thread ID 4632
(T2544) 01/12/22 08:51:49:528 Debug(5122): HipReportThread: HipReportThread starts up.
(T2544) 01/12/22 08:51:49:528 Debug(5155): HipReportThread: wait for HIP report ready event.
(T4632) 01/12/22 08:51:49:528 Debug(5470): NetworkConnectionMonitorThread: network connection monitor thread starts.
(T6164) 01/12/22 08:51:49:528 Debug( 25): create thread 0x690 with thread ID 3556
(T3556) 01/12/22 08:51:49:528 Debug( 167): Start HipCheckThread
(T3556) 01/12/22 08:51:49:528 Debug( 210): HipCheckThread started...
(T3556) 01/12/22 08:51:49:528 Debug( 216): HipCheckThread: wait for hip check event for 3600000 ms);
(T6164) 01/12/22 08:51:49:528 Debug( 25): create thread 0x7e4 with thread ID 13844
(T6164) 01/12/22 08:51:49:528 Debug( 25): create thread 0x790 with thread ID 3388
(T13844) 01/12/22 08:51:49:528 Debug( 176): Start HipMissingPatchThread
(T13844) 01/12/22 08:51:49:528 Debug( 409): HipMissingPatchThread started...
(T13844) 01/12/22 08:51:49:528 Debug( 442): HipMissingPatchThread: now is 1641937909, last hip check is 1641937654, hip check interval is 3600000
(T13844) 01/12/22 08:51:49:528 Debug( 447): HipMissingPatchThread: wait 3345000 ms
(T3388) 01/12/22 08:51:49:528 Debug( 186): Start HipMonitorThread
(T3388) 01/12/22 08:51:49:528 Info ( 759): HipMonitorThread starts
(T6164) 01/12/22 08:51:49:528 Debug(2179): No user, using SSO
(T6164) 01/12/22 08:51:49:528 Debug(9388): Saved password is empty.
(T6164) 01/12/22 08:51:49:528 Debug(2239): Portal 144.xxx.xxx.xxx, user , logonDomain xxxxxxx, saved user xxxxxxx, path C:\Users\xxxxxx\AppData\Local\Palo Alto Networks\GlobalProtect\
(T6164) 01/12/22 08:51:49:528 Debug(2363): Pre-logon-then-on-demand value is no
(T6164) 01/12/22 08:51:49:528 Debug(1520): SSO starts.
(T6164) 01/12/22 08:51:49:528 Debug(1541): SSO ------ username = xxxxxxxx\xxxxxxxxxxx
(T6164) 01/12/22 08:51:49:528 Debug(1560): SSO GetSsoCredential starts.
(T6164) 01/12/22 08:51:49:528 Debug(1581): SSO ------ username = xxxxxxxxx\xxxxxxxxx
(T6164) 01/12/22 08:51:49:528 Debug(2463): m_preUsername xxxxxxxxx
(T6164) 01/12/22 08:51:49:528 Debug(2484): CheckCachedPortalForPrelogon 0, PrelogonNeedTimeout 0, RenameTimeout -1, userName xxxxxxxxxx, preUsername xxxxxxxxx
(T6164) 01/12/22 08:51:49:528 Debug(2619): Use ssl tunnel is no
(T6164) 01/12/22 08:51:49:528 Debug(5942): --Set state to Retrieving configuration...
(T6164) 01/12/22 08:51:49:528 Debug(1896): unknown network type.
(T6164) 01/12/22 08:51:49:528 Debug( 914): Display hip report V4 on the UI
(T3388) 01/12/22 08:51:49:528 Debug( 413): HipMonitorThread wait for exit event.
(T6164) 01/12/22 08:51:49:528 Debug( 923): Hip report changed. Include it in status message to client.
(T6164) 01/12/22 08:51:49:538 Debug(6988): SSO enable status is 1, user name is xxxxxxxx, domain name is xxxxxxxxx.
(T6164) 01/12/22 08:51:49:538 Debug(2182): open http session. agent is PAN GlobalProtect/5.0.10-3 (Microsoft Windows 10 Pro , 64-bit)
(T6164) 01/12/22 08:51:49:538 Debug( 456): winhttp SetSecureProtocol, hSession=5b998d30, bAllProtocol=0, gbFips=0
(T6164) 01/12/22 08:51:49:538 Debug( 456): winhttp SetSecureProtocol, hSession=5b999010, bAllProtocol=0, gbFips=0
(T6164) 01/12/22 08:51:49:538 Debug(1655): SetProxyForHost(https://144.xxx.xxx.xxx/😞 timeout:60 AutoDetect:1 url: proxy: bypass: proxystr:
(T6164) 01/12/22 08:51:49:538 Debug(5987): ----Portal Pre-login starts----
(T6164) 01/12/22 08:51:49:538 Debug(4312): TriggerCaptivePortalDetection() return due to captive portal detection is in progress (0) or PreLogin is Done (1)
(T6164) 01/12/22 08:51:49:538 Debug( 550): Network is reachable
(T6164) 01/12/22 08:51:49:538 Debug(6020): Pre-login...,verifyportalcert=yes
(T6164) 01/12/22 08:51:49:538 Debug(9762): Check cert of server 144.xxx.xxx.xxx
(T6164) 01/12/22 08:51:49:538 Debug(9777): File C:\Program Files\Palo Alto Networks\GlobalProtect\tca.cer does not exist.
(T6164) 01/12/22 08:51:49:538 Debug( 777): SSL connecting to 144.xxx.xxx.xxx
(T6164) 01/12/22 08:51:49:555 Debug( 550): Network is reachable
(T6164) 01/12/22 08:51:49:628 Debug(1242): Failed to X509_LOOKUP_load_file
(T6164) 01/12/22 08:51:49:628 Debug( 363): Open_SSL_connection: subject '/CN=vpn.xxxxxxxxx.com'
(T6164) 01/12/22 08:51:49:628 Debug( 367): Open_SSL_connection: issuer '/C=US/O=DigiCert Inc/CN=RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1'
(T6164) 01/12/22 08:51:49:628 Debug( 965): Hostname 144.xxx.xxx.xxx doesn't matche sub alt name vpn.xxxxxxxxxx.com
(T6164) 01/12/22 08:51:49:628 Debug( 987): Hostname 144.xxx.xxx.xxx doesn't match sub alt name or no sub alt name, fallback to CN
(T6164) 01/12/22 08:51:49:628 Debug(1023): Hostname 144.xxx.xxx.xxx NOT match vpn.xxxxxxxxxx.com
(T6164) 01/12/22 08:51:49:628 Debug(1318): OpenSSL alert write⚠️close notify
(T6164) 01/12/22 08:51:49:628 Debug(2625): encpostdata, encpostdata=000001EC5BBE7C20, encpostdatalen=160
(T6164) 01/12/22 08:51:49:628 Debug(2794): REQID=30,IPADDR=144.130.170.106,PORT=443,URL=/global-protect/prelogin.esp,POST=1,PROXY_AUTO=1,PROXY_CFGURL=NULL,PROXY=NULL,PROXY_BYPASS=NULL,PROXY_USER=NULL,PROXY_PASS=****,VERIFY_CERT=1,ADDITIONAL_CHECK=1,SCEP_CERT=,oid=
(T6164) 01/12/22 08:51:49:628 Debug(1302): Send response to client for request https_request
(T6164) 01/12/22 08:51:49:748 Debug(2904): receive pan_msg_ping, 3
(T6164) 01/12/22 08:51:49:848 Debug(6120): prelogin to portal result is
<?xml version="1.0" encoding="UTF-8" ?>
<prelogin-response>
<status>Success</status>
<ccusername></ccusername>
<autosubmit>false</autosubmit>
<msg></msg>
<newmsg></newmsg>
<authentication-message>Enter login credentials</authentication-message>
<username-label>Username</username-label>
<password-label>Password</password-label>
<panos-version>1</panos-version><region>AU</region>
</prelogin-response>
(T6164) 01/12/22 08:51:49:848 Debug(6374): Failed to pre-login to the portal 144.xxx.xxx.xxx with return value 0(0).
(T6164) 01/12/22 08:51:49:848 Debug(7227): Try to restore last portal config from file.
(T6164) 01/12/22 08:51:49:848 Debug( 41): Roaming profile is false
(T6164) 01/12/22 08:51:49:855 Debug( 167): profileInfo username xxxxxxx, profile path (null), server (null)
(T6164) 01/12/22 08:51:49:858 Debug(12252): Saved cache portal configuration hash does not exist
(T6164) 01/12/22 08:51:49:858 Debug(7238): last portal config is restored from file C:\Users\xxxxxxxx\AppData\Local\Palo Alto Networks\GlobalProtect\PanPortalCfg_923a7c2f1070da1789c0f151fbc88529.dat.
(T6164) 01/12/22 08:51:49:858 Debug(11621): REGION-PRIO, cached region code is AU
(T6164) 01/12/22 08:51:49:858 Debug( 696): No internal host detection defined
(T6164) 01/12/22 08:51:49:858 Debug( 784): REGION-PRIO, gateway 0(xxxxxx Gateway), 0, region = Any, priority = 1, portalRegion=AU
(T6164) 01/12/22 08:51:49:858 Debug( 413): REGION-PRIO, regioncode=AU, return priority 1, bManual=0
(T6164) 01/12/22 08:51:49:858 Debug( 889): No internal gateway defined
(T6164) 01/12/22 08:51:49:858 Debug( 908): Optional client-cert does not exist
(T6164) 01/12/22 08:51:49:858 Debug( 945): Optional root-ca does not exist
(T6164) 01/12/22 08:51:49:858 Debug(8490): Use proxy is true
(T6164) 01/12/22 08:51:49:858 Debug( 41): Roaming profile is false
(T6164) 01/12/22 08:51:49:868 Debug( 167): profileInfo username xxxxxxxx, profile path (null), server (null)
(T6164) 01/12/22 08:51:49:878 Debug( 82): Saved portal config to file C:\Users\xxxxxxxxx\AppData\Local\Palo Alto Networks\GlobalProtect\PanPortalCfg_923a7c2f1070da1789c0f151fbc88529.dat.
(T6164) 01/12/22 08:51:49:878 Debug(1603): Proxy auto detect is not needed
(T6164) 01/12/22 08:51:49:878 Debug(8534): RefreshPortalConfig is yes, RefreshPortalConfigInterval is 24 hours
(T6164) 01/12/22 08:51:49:878 Debug(1786): SerializePortalConfigDigest to file C:\Users\xxxxxxxxx\AppData\Local\Palo Alto Networks\GlobalProtect\PanPCD_923a7c2f1070da1789c0f151fbc88529.dat
(T6164) 01/12/22 08:51:49:878 Debug(1787): Portal config digest is 15fcedd6e958244cbb42d9022ee5cf6f
(T6164) 01/12/22 08:51:49:878 Debug(10899): kerberos, dynamic config value is yes, m_stopOnKerberosFail=0
(T6164) 01/12/22 08:51:49:878 Debug(10929): Timeout value: portal 30, connect 60, receive 30, retry 5
(T6164) 01/12/22 08:51:49:878 Debug(10932): Tunnel retry grace period is 1800 seconds
(T6164) 01/12/22 08:51:49:878 Debug(10935): override-cc-username is no
(T6164) 01/12/22 08:51:49:878 Debug(8574): Scep certificate renew period is 7 days. Scep cert auth cookie length is 0
(T6164) 01/12/22 08:51:49:878 Debug(8585): Otp portal 0, otp internal gateway 0, otp auto external gateway 0, otp manual only external gateway 0
(T6164) 01/12/22 08:51:49:878 Debug(8590): Prefer ipv6 is 1 after processing portal configuration.
(T6164) 01/12/22 08:51:49:878 Debug(10431): No scep profile
(T6164) 01/12/22 08:51:49:878 Debug(7248): this version of portal config is supported.
(T6164) 01/12/22 08:51:49:878 Debug(7216): portal status is Using cached portal config.
(T6164) 01/12/22 08:51:49:878 Debug(11163): Enforcer is not enabled
(T6164) 01/12/22 08:51:50:148 Debug(1700): Enforcer,found 0 filter object belonging to us.
(T6164) 01/12/22 08:51:50:153 Info (8134): Optional tag root-ca does not exist.
(T6164) 01/12/22 08:51:50:153 Debug(8238): client cert is empty in portal config
(T6164) 01/12/22 08:51:50:153 Debug(2420): Client cert is empty, no need to import to store
(T6164) 01/12/22 08:51:50:153 Info (7450): Connect method is user-logon
(T6164) 01/12/22 08:51:50:153 Debug(7461): On-demand mode is false.
(T6164) 01/12/22 08:51:50:153 Debug(8787): SavePrelogon: Portal is 144.xxx.xxx.xxx, PrelogonEnabled is 0
(T6164) 01/12/22 08:51:50:153 Debug( 477): Saved hip policy to file HipPolicy.dat.
(T6164) 01/12/22 08:51:50:153 Debug(7494): Hip check interval is 3600000 ms.
(T6164) 01/12/22 08:51:50:153 Debug(7498): Set check hip event
(T6164) 01/12/22 08:51:50:153 Debug( 809): m_bScheduleFlag is set to 0
(T6164) 01/12/22 08:51:50:153 Debug( 297): Set hip check event.
(T6164) 01/12/22 08:51:50:153 Debug(7500): Set hip missing patch check event.
(T3556) 01/12/22 08:51:50:153 Info ( 246): HipCheckThread: got check hip event or time out.
(T6164) 01/12/22 08:51:50:153 Debug(1646): Serialize empty cookie for portal 144.xxx.xxx.xxx and user xxxxxxxxx
(T3556) 01/12/22 08:51:50:153 Debug( 255): HipCheckThread: Got CheckHipEvent.
(T13844) 01/12/22 08:51:50:153 Debug( 452): HipMissingPatchThread: Got CheckHipMissingPatchEvent.
(T3556) 01/12/22 08:51:50:153 Debug( 787): SetNextScheduledHipCheckTime to 1641941510
(T13844) 01/12/22 08:51:50:153 Debug( 386): CheckHipMissingPatchInOtherProcess()
(T3556) 01/12/22 08:51:50:153 Debug( 276): Last hip check event wakeup tick is 1641937910
(T13844) 01/12/22 08:51:50:153 Debug( 389): Need to check missing patch.
(T3556) 01/12/22 08:51:50:153 Debug( 278): HipCheckThread: check hip in other process.
(T3556) 01/12/22 08:51:50:153 Debug( 306): CheckHipInOtherProcess()
(T3556) 01/12/22 08:51:50:153 Debug( 310): Need to collect hip data
(T6164) 01/12/22 08:51:50:153 Debug( 41): Roaming profile is false
(T13844) 01/12/22 08:51:50:153 Debug( 310): CheckHipMissingPatchInOtherProcess(): Starting process PanGpHipMp.exe
(T3556) 01/12/22 08:51:50:153 Debug( 117): Starting process PanGpHip.exe
(T3556) 01/12/22 08:51:50:158 Debug( 135): Wait for the ready event of hip report generated in other process.
(T6164) 01/12/22 08:51:50:163 Debug( 167): profileInfo username xxxxxxxx, profile path (null), server (null)
(T6164) 01/12/22 08:51:50:188 Debug(1738): Serialized portal user auth cookie to file C:\Users\xxxxxxx\AppData\Local\Palo Alto Networks\GlobalProtect\PanPUAC_923a7c2f1070da1789c0f151fbc88529.dat. 162 bytes.
(T6164) 01/12/22 08:51:50:188 Debug(1529): Serialize empty cookie for portal 144.xxx.xxx.xxx and pre-logon user
(T6164) 01/12/22 08:51:50:188 Debug(1536): SerializePortalPrelogonAuthCookie to file PanPPAC_15a2b5ab57d1837e13ffccf8e75c3c.dat
(T6164) 01/12/22 08:51:50:188 Debug(7586): Retrieved pre-logon-tunnel-rename-timeout value -1
(T6164) 01/12/22 08:51:50:188 Debug(7594): Retrieved user-switch-tunnel-rename-timeout value 0
(T6164) 01/12/22 08:51:50:188 Debug(7605): Retrieved preserve-tunnel-upon-user-logoff-timeout value 0
(T6164) 01/12/22 08:51:50:188 Debug(7618): Set preserver tunnel timeout to 0
(T6164) 01/12/22 08:51:50:188 Debug(7630): The value of can-continue-if-portal-cert-invalid is yes
(T6164) 01/12/22 08:51:50:188 Debug(6623): prelogon status is 0
(T6164) 01/12/22 08:51:50:188 Debug(6792): Force discovery, set NetworkDiscoverEvent
(T13212) 01/12/22 08:51:50:188 Debug( 517): Set hip report quit event
(T13212) 01/12/22 08:51:50:188 Debug(4654): NetworkDiscoverThread: got network discover event.
(T13212) 01/12/22 08:51:50:188 Debug(4661): ----Network Discover starts----
(T13212) 01/12/22 08:51:50:188 Debug( 787): SetNextScheduledHipCheckTime to 0
(T13212) 01/12/22 08:51:50:188 Debug( 809): m_bScheduleFlag is set to 0
(T13212) 01/12/22 08:51:50:188 Debug(4673): UpdatePrelogonStateForSSO to GP_VPN_STATUS_DISCONNECTED
(T13212) 01/12/22 08:51:50:188 Debug(4116): UpdatePrelogonStateForSSO() - User-logon tunnel state = Disconnected
(T6164) 01/12/22 08:51:50:188 Debug(1302): Send response to client for request hip
(T13212) 01/12/22 08:51:50:208 Debug( 550): Network is reachable
(T13212) 01/12/22 08:51:50:208 Debug(1928): bNetworkAvailable is 1
(T13212) 01/12/22 08:51:50:208 Debug(1936): Network is available
(T13212) 01/12/22 08:51:50:208 Debug(4678): finish check host reachable
(T13212) 01/12/22 08:51:50:208 Debug(5942): --Set state to Discovering network...
(T13212) 01/12/22 08:51:50:208 Debug(1896): unknown network type.
(T13212) 01/12/22 08:51:50:208 Debug( 914): Display hip report V4 on the UI
(T13212) 01/12/22 08:51:50:208 Debug(4717): Logout gateways before network discover..., bJustResumed=0
(T13212) 01/12/22 08:51:50:208 Debug(4723): Logout gateways before network discover...
(T13212) 01/12/22 08:51:50:208 Debug(1334): Logging out gateway, reason is Network discover
(T13212) 01/12/22 08:51:50:208 Debug(1365): Logging out gateway over
(T13212) 01/12/22 08:51:50:208 Debug(11488): RetrieveClientIpByRemoteHost() - invalid remote host: .
(T13212) 01/12/22 08:51:50:208 Debug( 185): SelectInternalGateways - failed to retrieve client source ipv6!
(T13212) 01/12/22 08:51:50:208 Debug(5077): Process gateway: host vpn.xxxxxxxxxx.com, description xxxxxx Gateway
(T6716) 01/12/22 08:51:50:208 Debug(4459): CaptivePortalDetectionThread: IsDetectingCaptivePortal=1, PreLoginIsDone=0
(T6716) 01/12/22 08:51:50:208 Debug(4436): CaptivePortalDetectionThread: wait (2000 ms) for captive portal detection event.
(T13212) 01/12/22 08:51:50:208 Debug(5154): Gateway vpn.xxxxxxxxxx.com ipv4 address is 144.xxx.xxx.xxx
(T13212) 01/12/22 08:51:50:208 Debug(5222): Gateway vpn.xxxxxxxxx.com: ipv4 144.xxx.xxx.xxx, ipv6 , FQDN yes
(T13212) 01/12/22 08:51:50:208 Debug(4742): Set network discover in progress
(T13212) 01/12/22 08:51:50:208 Debug(4746): UpdatePrelogonStateForSSO to GP_VPN_STATUS_DISCONNECTED
(T13212) 01/12/22 08:51:50:213 Debug(4116): UpdatePrelogonStateForSSO() - User-logon tunnel state = Disconnected
(T13212) 01/12/22 08:51:50:213 Debug(11668): GetNetworkTypeDS
(T13212) 01/12/22 08:51:50:213 Debug(11671): No ipv6 internal host detection.
(T13212) 01/12/22 08:51:50:213 Debug(1814): Internal host detection is not defined
(T13212) 01/12/22 08:51:50:213 Debug(4807): NetworkDiscoverThread: network type is unknown.
(T13212) 01/12/22 08:51:50:213 Debug(4813): NetworkDiscoverThread: Discover internal network.
(T13212) 01/12/22 08:51:50:213 Info ( 360): Gateway count is 0 for internal network.
(T13212) 01/12/22 08:51:50:213 Error(4834): NetworkDiscoverThread: UNKNOWN_NETWORK (internal host detection is not set) and internal gateway list is empty.
(T13212) 01/12/22 08:51:50:213 Debug(4878): NetworkDiscoverThread: Discover external network.
(T13212) 01/12/22 08:51:50:213 Debug(4911): previous it is 2, now it is 2
(T13212) 01/12/22 08:51:50:213 Debug( 516): Discover external gateway: gateway count is 1, cutoff time is 5, bJustResumed=1
(T13212) 01/12/22 08:51:50:213 Debug( 536): One external gateway vpn.xxxxxxxxxx.com, priority=1, manual is 0
(T13212) 01/12/22 08:51:50:213 Debug(2859): Gateway: vpn.xxxxxxxxx.com, client IP: 192.168.86.53
(T13212) 01/12/22 08:51:50:213 Debug(2476): retrieve info of gateway vpn.xxxxxxx.com
(T13212) 01/12/22 08:51:50:213 Debug(2182): open http session. agent is PAN GlobalProtect/5.0.10-3 (Microsoft Windows 10 Pro , 64-bit)
(T13212) 01/12/22 08:51:50:213 Debug( 456): winhttp SetSecureProtocol, hSession=5b99a710, bAllProtocol=0, gbFips=0
(T13212) 01/12/22 08:51:50:213 Debug(2487): Skip setting proxy for creating tunnel to gateway vpn.xxxxxxxx.com
(T13212) 01/12/22 08:51:50:213 Debug(3289): m_msp->IsInPreserveTunnel() 0, m_msp->IsPrelogonRenameAuthFail() 0
(T13212) 01/12/22 08:51:50:213 Debug(12160): Set m_bPrelogonRenameAuthFail to 0
(T13212) 01/12/22 08:51:50:213 Debug(3324): ----Gateway Pre-login starts----
(T13212) 01/12/22 08:51:50:213 Debug(9762): Check cert of server 144.xxx.xxx.xxx
(T13212) 01/12/22 08:51:50:218 Debug(9777): File C:\Program Files\Palo Alto Networks\GlobalProtect\tca.cer does not exist.
(T13212) 01/12/22 08:51:50:218 Debug( 777): SSL connecting to 144.xxx.xxx.xxx
(T13212) 01/12/22 08:51:50:223 Debug( 550): Network is reachable
(T13212) 01/12/22 08:51:50:318 Debug(1242): Failed to X509_LOOKUP_load_file
(T13212) 01/12/22 08:51:50:318 Debug( 363): Open_SSL_connection: subject '/CN=vpn.xxxxxxxxxx.com'
(T13212) 01/12/22 08:51:50:318 Debug( 367): Open_SSL_connection: issuer '/C=US/O=DigiCert Inc/CN=RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1'
(T13212) 01/12/22 08:51:50:318 Debug( 960): Hostname vpn.xxxxxxxxx.com matches sub alt name vpn.xxxxxxxxxx.com
(T13212) 01/12/22 08:51:50:318 Debug(1318): OpenSSL alert write⚠️close notify
(T13212) 01/12/22 08:51:50:318 Debug(3373): m_msp->GetGwSamlAuthStatus() -2, m_msp->IsUserJustLoginInPrelogon() 0, m_msp->IsPrelogonRenameAuthFail() 0
(T13212) 01/12/22 08:51:50:318 Debug(3394): IsSamlAuth() 0, IsManualGatewayChallenge() 0, pwszConnectedIP null
(T13212) 01/12/22 08:51:50:318 Debug(9979): Need to check gateway cert for vpn.xxxxxxxxxxx.com
(T13212) 01/12/22 08:51:50:318 Debug(2625): encpostdata, encpostdata=000001EC5B9206D0, encpostdatalen=160
(T13212) 01/12/22 08:51:50:318 Debug(2794): REQID=31,IPADDR=vpn.xxxxxxxxxxx.com,PORT=443,URL=/ssl-vpn/prelogin.esp,POST=1,PROXY_AUTO=1,PROXY_CFGURL=NULL,PROXY=NULL,PROXY_BYPASS=NULL,PROXY_USER=NULL,PROXY_PASS=****,VERIFY_CERT=1,ADDITIONAL_CHECK=1,SCEP_CERT=,oid=
(T13212) 01/12/22 08:51:50:418 Debug(1302): Send response to client for request https_request
(T13212) 01/12/22 08:51:50:518 Debug(2904): receive pan_msg_ping, 3
(T13212) 01/12/22 08:51:50:608 Debug(3436): Login to gateway (null) vpn.xxxxxxxxxx.com without ipv6
(T13212) 01/12/22 08:51:50:608 Debug(10011): StopCaptivePortalDetection() captive portal detection is in progress
(T6716) 01/12/22 08:51:50:608 Debug(4459): CaptivePortalDetectionThread: IsDetectingCaptivePortal=0, PreLoginIsDone=1
(T6716) 01/12/22 08:51:50:608 Debug(4436): CaptivePortalDetectionThread: wait (-1 ms) for captive portal detection event.
(T13212) 01/12/22 08:51:50:608 Debug(3466): Pre-login response is <?xml version="1.0" encoding="UTF-8" ?>
<prelogin-response>
<status>Success</status>
<ccusername></ccusername>
<autosubmit>false</autosubmit>
<msg></msg>
<newmsg></newmsg>
<license>no</license>
<authentication-message>Enter login credentials</authentication-message>
<username-label>Username</username-label>
<password-label>Password</password-label>
<panos-version>1</panos-version><region>AU</region>
</prelogin-response>
(T13212) 01/12/22 08:51:50:608 Debug(3482): REGION-PRIO, gateway region code is AU
(T13212) 01/12/22 08:51:50:608 Debug(3514): REGION-PRIO, portal and gateway have same region code!
(T13212) 01/12/22 08:51:50:608 Debug(6122): Auth message is Enter login credentials for gateway vpn.xxxxxxxxxxxx.com
(T13212) 01/12/22 08:51:50:608 Debug(6150): Gateway license no, license-v6 yes
(T13212) 01/12/22 08:51:50:608 Debug(3721): ----Gateway Login starts----
(T13212) 01/12/22 08:51:50:608 Debug(10166): Set to service bUseCCUserGateway 0 and ccUserNameGateway
(T13212) 01/12/22 08:51:50:608 Debug(2095): Update user name from to xxxxxxxxxx
(T13212) 01/12/22 08:51:50:608 Debug(5744): OtpSaveCredential is save_username
(T13212) 01/12/22 08:51:50:608 Debug(5782): External network gateway without OTP authentication
(T13212) 01/12/22 08:51:50:608 Debug(5807): SSO is enabled. Using SSO credential to login to gateway.
(T13212) 01/12/22 08:51:50:608 Debug( 41): Roaming profile is false
(T13212) 01/12/22 08:51:50:608 Debug( 167): profileInfo username xxxxxxxxx, profile path (null), server (null)
(T13212) 01/12/22 08:51:50:618 Debug(1632): Unserialized empty cookie for portal 144.xxx.xxx.xxx and user xxxxxxxxx
(T13212) 01/12/22 08:51:50:618 Debug(1561): Unserialized empty cookie for portal 144.xxx.xxx.xxx and pre-logon user.
(T13212) 01/12/22 08:51:50:618 Debug(3780): bIsEmptyUser is 0, bDPGCforManualOnlyGateway is 0, bDPGCNotforManualOnlyGateway is 0
(T13212) 01/12/22 08:51:50:618 Debug(10166): Set to service bUseCCUserGateway 0 and ccUserNameGateway
(T13212) 01/12/22 08:51:50:618 Debug( 41): Roaming profile is false
(T13212) 01/12/22 08:51:50:618 Debug( 167): profileInfo username xxxxxxxxx, profile path (null), server (null)
(T13212) 01/12/22 08:51:50:628 Debug(1632): Unserialized empty cookie for portal 144.xxx.xxx.xxx and user xxxxxxxxx
(T13212) 01/12/22 08:51:50:628 Debug(1561): Unserialized empty cookie for portal 144.xxx.xxx.xxx and pre-logon user.
(T13212) 01/12/22 08:51:50:628 Debug(6841): use cached deviceSN
(T13212) 01/12/22 08:51:50:628 Debug(5544): Get preferred IPv4 192.168.253.26 for gateway 144.xxx.xxx.xxx and user xxxxxxx
(T13212) 01/12/22 08:51:50:628 Debug(5575): Get preferred IPv6 for gateway 144.xxx.xxx.xxx and user xxxxxxx
(T13212) 01/12/22 08:51:50:628 Debug(3921): Actual user for gateway login is xxxxxxxxxx
(T13212) 01/12/22 08:51:50:628 Debug(3925): Gateway selection type is auto
(T13212) 01/12/22 08:51:50:628 Debug(6841): use cached deviceSN
(T13212) 01/12/22 08:51:50:628 Debug(9979): Need to check gateway cert for vpn.xxxxxxx.com
(T13212) 01/12/22 08:51:50:628 Debug(2625): encpostdata, encpostdata=000001EC5B92A470, encpostdatalen=512
(T13212) 01/12/22 08:51:50:628 Debug(2794): REQID=32,IPADDR=vpn.xxxxxxxxx.com,PORT=443,URL=/ssl-vpn/login.esp,POST=1,PROXY_AUTO=1,PROXY_CFGURL=NULL,PROXY=NULL,PROXY_BYPASS=NULL,PROXY_USER=NULL,PROXY_PASS=****,VERIFY_CERT=0,ADDITIONAL_CHECK=1,SCEP_CERT=,oid=
(T13212) 01/12/22 08:51:50:718 Debug(1302): Send response to client for request https_request
(T13212) 01/12/22 08:51:50:838 Debug(2904): receive pan_msg_ping, 3
(T13212) 01/12/22 08:51:50:938 Debug(1646): Serialize empty cookie for portal 144.xxx.xxx.xxx and user xxxxxxxxxxx
(T13212) 01/12/22 08:51:50:938 Debug( 41): Roaming profile is false
(T13212) 01/12/22 08:51:50:938 Debug( 167): profileInfo username xxxxxxxxxxx, profile path (null), server (null)
(T13212) 01/12/22 08:51:50:948 Debug(1738): Serialized portal user auth cookie to file C:\Users\xxxxxx\AppData\Local\Palo Alto Networks\GlobalProtect\PanPUAC_923a7c2f1070da1789c0f151fbc88529.dat. 162 bytes.
(T13212) 01/12/22 08:51:50:948 Debug(1529): Serialize empty cookie for portal 144.xxx.xxx.xxx and pre-logon user
(T13212) 01/12/22 08:51:50:948 Debug(1536): SerializePortalPrelogonAuthCookie to file PanPPAC_15a2b5ab57d1837e13ffccf8e75c3c.dat
(T13212) 01/12/22 08:51:50:948 Debug(4323): Gateway vpn.xxxxxxxxxx.com has hip-report-version: 4
(T13212) 01/12/22 08:51:50:948 Debug(4338): Managed is no
(T13212) 01/12/22 08:51:50:948 Debug(4342): Gateway vpn.xxxxxxxxxx.com's location is
(T13212) 01/12/22 08:51:50:948 Debug(10152): NetworkDisoverEventSet is no, RedoNetworkDiscovery is no
(T13212) 01/12/22 08:51:50:948 Debug(2497): ----Tunnel creation starts----
(T13212) 01/12/22 08:51:50:948 Debug(2498): Try to create tunnel with gateway vpn.xxxxxxxxxxx.com
(T13212) 01/12/22 08:51:50:948 Debug(5942): --Set state to Connecting...
(T13212) 01/12/22 08:51:50:948 Debug( 914): Display hip report V4 on the UI
(T13212) 01/12/22 08:51:50:948 Debug(2358): proxy , proxyuser , domain xxxxxxxx, user xxxxxxxxxx, remotehost 144.xxx.xxx.xxx.
(T13212) 01/12/22 08:51:50:948 Debug(6841): use cached deviceSN
(T13212) 01/12/22 08:51:50:958 Debug(2638): Get gateway config.
(T13212) 01/12/22 08:51:50:958 Debug(9979): Need to check gateway cert for vpn.xxxxxxxxxxx.com
(T13212) 01/12/22 08:51:50:958 Debug(2625): encpostdata, encpostdata=000001EC5B9BEC70, encpostdatalen=448
(T13212) 01/12/22 08:51:50:958 Debug(2794): REQID=33,IPADDR=vpn.xxxxxxxxxx.com,PORT=443,URL=/ssl-vpn/getconfig.esp,POST=1,PROXY_AUTO=1,PROXY_CFGURL=NULL,PROXY=NULL,PROXY_BYPASS=NULL,PROXY_USER=NULL,PROXY_PASS=****,VERIFY_CERT=0,ADDITIONAL_CHECK=1,SCEP_CERT=,oid=
(T13212) 01/12/22 08:51:51:038 Debug(1302): Send response to client for request https_request
(T13212) 01/12/22 08:51:51:118 Debug(2904): receive pan_msg_ping, 1
(T13212) 01/12/22 08:51:51:118 Debug(2705): gateway vpn.xxxxxxxxxxxx.com's config is
<response status="success">
<need-tunnel>yes</need-tunnel>
<ssl-tunnel-url>/ssl-tunnel-connect.sslvpn</ssl-tunnel-url>
<portal>xxxxxxx Gateway-N</portal>
<user>xxxxxxxx</user>
<lifetime>2592000</lifetime>
<timeout>10800</timeout>
<disconnect-on-idle>10800</disconnect-on-idle>
<bw-c2s>1000</bw-c2s>
<bw-s2c>1000</bw-s2c>
<gw-address>144.xxx.xxx.xxx</gw-address>
<ip-address>192.168.253.26</ip-address>
<netmask>255.255.255.255</netmask>
<ip-address-preferred>yes</ip-address-preferred>
<dns>
<member>192.168.0.17</member>
<member>192.168.0.18</member>
</dns>
<wins>
</wins>
<dns-suffix>
<member>xxxxxxx.local</member>
</dns-suffix>
<default-gateway>192.168.253.26</default-gateway>
<mtu>0</mtu>
<no-direct-access-to-local-network>no</no-direct-access-to-local-network>
<access-routes>
<member>192.168.0.0/24</member>
<member>192.168.0.17/32</member>
<member>192.168.0.18/32</member>
</access-routes>
<exclude-access-routes>
</exclude-access-routes>
<ipsec>
<udp-port>4501</udp-port>
<ipsec-mode>esp-tunnel</ipsec-mode>
<enc-algo>aes-256-gcm</enc-algo>
<hmac-algo>sha1</hmac-algo>
(T13212) 01/12/22 08:51:51:118 Debug(2731): There is no connected-gw-ip
(T13212) 01/12/22 08:51:51:118 Debug(4404): In SetGatewayRoute: The original route table:
(T13212) 01/12/22 08:51:51:118 Debug( 138): Destination NetMask Gateway Inf Metric
(T13212) 01/12/22 08:51:51:118 Debug( 153): 0.0.0.0 0.0.0.0 192.168.86.1 11 35
(T13212) 01/12/22 08:51:51:118 Debug( 153): 127.0.0.0 255.0.0.0 127.0.0.1 1 331
(T13212) 01/12/22 08:51:51:118 Debug( 153): 127.0.0.1 255.255.255.255 127.0.0.1 1 331
(T13212) 01/12/22 08:51:51:118 Debug( 153): 127.255.255.255 255.255.255.255 127.0.0.1 1 331
(T13212) 01/12/22 08:51:51:118 Debug( 153): 192.168.86.0 255.255.255.0 192.168.86.53 11 291
(T13212) 01/12/22 08:51:51:118 Debug( 153): 192.168.86.53 255.255.255.255 192.168.86.53 11 291
(T13212) 01/12/22 08:51:51:118 Debug( 153): 192.168.86.255 255.255.255.255 192.168.86.53 11 291
(T13212) 01/12/22 08:51:51:118 Debug( 153): 224.0.0.0 240.0.0.0 127.0.0.1 1 331
(T13212) 01/12/22 08:51:51:118 Debug( 153): 224.0.0.0 240.0.0.0 192.168.86.53 11 291
(T13212) 01/12/22 08:51:51:118 Debug( 153): 255.255.255.255 255.255.255.255 127.0.0.1 1 331
(T13212) 01/12/22 08:51:51:118 Debug( 153): 255.255.255.255 255.255.255.255 192.168.86.53 11 291
(T13212) 01/12/22 08:51:51:118 Debug(4414): SetGatewayRoute: GetBestRoute() returns Dest:0.0.0.0 Mask:0.0.0.0 if_index=11 metric1=35
(T13212) 01/12/22 08:51:51:118 Debug(4436): Created gateway route (144.xxx.xxx.xxx) succeeds
(T13212) 01/12/22 08:51:51:118 Debug( 271): Ipv6-connection is NULL
(T13212) 01/12/22 08:51:51:118 Debug( 318): gw-address-v6 is not specified
(T13212) 01/12/22 08:51:51:118 Debug( 324): remoteHostV6 is not specified
(T13212) 01/12/22 08:51:51:118 Debug( 349): ip-address-preferred value is yes
(T13212) 01/12/22 08:51:51:118 Debug( 374): ip-address-v6-preferred not found.
(T13212) 01/12/22 08:51:51:118 Debug(9707): Set preferred IP 192.168.253.26 for gateway 144.xxx.xxx.xxx user xxxxxxxxxx
(T13212) 01/12/22 08:51:51:118 Debug(9716): Set preferred IPv6 for gateway 144.xxx.xxx.xxx user xxxxxxxxxx
(T13212) 01/12/22 08:51:51:118 Debug( 514): DLSA, found no-direct-access-to-local-network tag, b_IsDLSASet set to false
(T13212) 01/12/22 08:51:51:118 Debug( 757): Encryption method is aes-256-gcm
(T13212) 01/12/22 08:51:51:118 Debug(3233): set driver connected as true
(T13212) 01/12/22 08:51:51:118 Debug( 594): use-ssl-only-tunnel is not configured and user cannnot change
(T13212) 01/12/22 08:51:51:118 Debug( 147): VPN idle timeout is 10800; config timeout is 10800
(T13212) 01/12/22 08:51:51:118 Debug( 70): c2s-spi is 0x40FDCF92, s2c-spi is 0xFDB3FD9C
(T13212) 01/12/22 08:51:51:118 Debug( 189): EnforceDns is enabled, set 2 GP pushed DNS servers
(T13212) 01/12/22 08:51:51:118 Debug( 164): Trying to do ipsec connection to 144.xxx.xxx.xxx[4501]
(T13212) 01/12/22 08:51:51:128 Debug( 550): Network is reachable
(T13212) 01/12/22 08:51:51:128 Info ( 176): Connected to: 144.xxx.xxx.xxx[4501], Sending keep alive to ipsec socket...
(T13212) 01/12/22 08:51:51:148 Info ( 214): Connected ipsec to 144.xxx.xxx.xxx(4501)
(T13212) 01/12/22 08:51:51:148 Info ( 329): tunnel to 144.xxx.xxx.xxx connected
(T13212) 01/12/22 08:51:51:288 Debug( 349): PsvRegister done
(T13212) 01/12/22 08:51:51:288 Debug( 25): create thread 0x4d0 with thread ID 1628
(T1628) 01/12/22 08:51:51:288 Debug( 398): VpnProcMonitor thread starts
(T1628) 01/12/22 08:51:51:288 Debug( 25): create thread 0x680 with thread ID 4752
(T4752) 01/12/22 08:51:51:288 Debug( 409): VpnProcDrv thread starts
(T13212) 01/12/22 08:51:51:298 Debug(1610): Get original UseDomainNameDevolution value 1
(T13212) 01/12/22 08:51:51:298 Debug(1636): Get original DNS SearchList value xxxxxxxx.local,lan
(T13212) 01/12/22 08:51:51:298 Debug(1657): searchList: xxxxxxx.local
(T13212) 01/12/22 08:51:51:298 Debug(1657): searchList: lan
(T13212) 01/12/22 08:51:51:298 Error(1566): InstallClientConfig: Failed to find PANGP virtual adapter interface
(T6000) 01/12/22 08:51:51:298 Debug(2349): Setting debug level to 5
(T13212) 01/12/22 08:51:51:308 Error( 343): InstallClientConfig() failed
(T13212) 01/12/22 08:51:51:308 Error( 248): ProcMonitor: SetupNetwork() failed
(T1628) 01/12/22 08:51:51:308 Info ( 471): PktProcess: VPN disconnect event, get out of ProcMonitor
(T1628) 01/12/22 08:51:51:308 Debug( 544): Tunnel downtime is 16 miliseconds
(T4752) 01/12/22 08:51:51:308 Info ( 832): ProDrv: VPN disconnect event, get out of ProcDrv
(T4752) 01/12/22 08:51:51:308 Info ( 858): ProcDrv thread dies
(T1628) 01/12/22 08:51:51:308 Info ( 805): ProcDrv quit
(T1628) 01/12/22 08:51:51:308 Info ( 791): ProcMonitor thread dies
(T13212) 01/12/22 08:51:51:418 Debug( 293): do_disconnect is called in VPN stop
(T13212) 01/12/22 08:51:51:418 Debug( 227): IPSec anti-replay statistics: outside window count 0, replay count 0
(T13212) 01/12/22 08:51:51:418 Debug( 229): Disconnect udp socket
(T13212) 01/12/22 08:51:51:418 Debug( 505): unset network
(T13212) 01/12/22 08:51:51:418 Debug( 764): PreviousDNSInfo doesn't exist, no need to restore
(T13212) 01/12/22 08:51:51:418 Info ( 528): not call uninstallClientConfig, netSetup=000001EC5ADABDB0, clientConfig=000001EC5B9AE6F0, panMSService=000001EC5ADD25C0, panMSService->IsConfigInstalled()=0
(T13212) 01/12/22 08:51:51:418 Debug( 615): ipsec failed to start
(T13212) 01/12/22 08:51:51:418 Info ( 87): VPN is deleted
(T13212) 01/12/22 08:51:51:418 Debug( 147): VPN idle timeout is 10800; config timeout is 10800
(T13212) 01/12/22 08:51:51:418 Debug( 189): EnforceDns is enabled, set 2 GP pushed DNS servers
(T13212) 01/12/22 08:51:51:418 Debug( 62): Trying to do SSL connection to 144.xxx.xxx.xxx(443)
(T13212) 01/12/22 08:51:51:418 Debug( 777): SSL connecting to 144.xxx.xxx.xxx
(T13212) 01/12/22 08:51:51:428 Debug( 550): Network is reachable
(T13212) 01/12/22 08:51:51:498 Debug(1242): Failed to X509_LOOKUP_load_file
(T13212) 01/12/22 08:51:51:498 Debug( 363): Open_SSL_connection: subject '/CN=vpn.xxxxxxxxxx.com'
(T13212) 01/12/22 08:51:51:498 Debug( 367): Open_SSL_connection: issuer '/C=US/O=DigiCert Inc/CN=RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1'
(T13212) 01/12/22 08:51:51:518 Info ( 110): Connected ssl tunnel to 144.xxx.xxx.xxx(443)
(T13212) 01/12/22 08:51:51:518 Info ( 329): tunnel to 144.xxx.xxx.xxx connected
(T13212) 01/12/22 08:51:51:588 Debug( 349): PsvRegister done
(T13212) 01/12/22 08:51:51:588 Debug( 25): create thread 0x60c with thread ID 9064
(T9064) 01/12/22 08:51:51:588 Debug( 398): VpnProcMonitor thread starts
(T9064) 01/12/22 08:51:51:588 Debug( 25): create thread 0x794 with thread ID 10648
(T10648) 01/12/22 08:51:51:588 Debug( 409): VpnProcDrv thread starts
(T13212) 01/12/22 08:51:51:598 Debug(1610): Get original UseDomainNameDevolution value 1
(T13212) 01/12/22 08:51:51:598 Debug(1636): Get original DNS SearchList value xxxxxxxxx.local,lan
(T13212) 01/12/22 08:51:51:598 Debug(1657): searchList: xxxxxxxxx.local
(T13212) 01/12/22 08:51:51:598 Debug(1657): searchList: lan
(T13212) 01/12/22 08:51:51:598 Error(1566): InstallClientConfig: Failed to find PANGP virtual adapter interface
(T13212) 01/12/22 08:51:51:598 Error( 343): InstallClientConfig() failed
(T13212) 01/12/22 08:51:51:598 Error( 248): ProcMonitor: SetupNetwork() failed
(T9064) 01/12/22 08:51:51:598 Info ( 471): PktProcess: VPN disconnect event, get out of ProcMonitor
(T9064) 01/12/22 08:51:51:598 Debug( 544): Tunnel downtime is 0 miliseconds
(T10648) 01/12/22 08:51:51:598 Info ( 832): ProDrv: VPN disconnect event, get out of ProcDrv
(T10648) 01/12/22 08:51:51:598 Info ( 858): ProcDrv thread dies
(T9064) 01/12/22 08:51:51:598 Info ( 805): ProcDrv quit
(T9064) 01/12/22 08:51:51:598 Info ( 791): ProcMonitor thread dies
(T13212) 01/12/22 08:51:51:718 Debug( 293): do_disconnect is called in VPN stop
(T13212) 01/12/22 08:51:51:718 Debug(1318): OpenSSL alert write⚠️close notify
(T13212) 01/12/22 08:51:51:718 Debug( 505): unset network
(T13212) 01/12/22 08:51:51:718 Debug( 764): PreviousDNSInfo doesn't exist, no need to restore
(T13212) 01/12/22 08:51:51:718 Info ( 528): not call uninstallClientConfig, netSetup=000001EC5ADABDB0, clientConfig=000001EC5B9AE6F0, panMSService=000001EC5ADD25C0, panMSService->IsConfigInstalled()=0
(T13212) 01/12/22 08:51:51:718 Error( 666): sslvpn failed to start
(T13212) 01/12/22 08:51:51:718 Info ( 87): VPN is deleted
(T13212) 01/12/22 08:51:51:718 Error(2448): CreateTunnel: SetConfig() failed
(T13212) 01/12/22 08:51:51:718 Debug(5894): UnsetGatewayRoutes: DeleteIpForwardEntry(144.xxx.xxx.xxx)
(T13212) 01/12/22 08:51:51:718 Debug(5942): --Set state to Connection failed
(T13212) 01/12/22 08:51:51:718 Debug( 914): Display hip report V4 on the UI
(T13212) 01/12/22 08:51:51:718 Debug(2463): VPN tunnel is not connected.
(T13212) 01/12/22 08:51:51:718 Debug(2465): returns FALSE.
(T13212) 01/12/22 08:51:51:718 Debug(2518): failed to create tunnel with gateway vpn.xxxxxxxxxx.com
(T13212) 01/12/22 08:51:51:718 Info (2236): logout: user=xxxxxxxxxx, portal=xxxxxxxx Gateway-N, gateway=vpn.xxxxxxxxxxx.com, domain=xxxxxxxxxx, computerName=T9009
(T13212) 01/12/22 08:51:51:718 Debug(2268): Logout parameter is
(T13212) 01/12/22 08:51:51:728 Debug( 777): SSL connecting to 144.xxx.xxx.xxx
(T13212) 01/12/22 08:51:51:728 Debug( 550): Network is reachable
(T13212) 01/12/22 08:51:51:768 Debug(3974): SSL verify succeed
(T13212) 01/12/22 08:51:51:858 Debug(1318): OpenSSL alert write⚠️close notify
(T13212) 01/12/22 08:51:51:858 Debug(2314): Logged out gateway vpn.basfordbrands.com
(T13212) 01/12/22 08:51:51:858 Debug(2536): tunnel to vpn.xxxxxxxx.com is not created.
(T13212) 01/12/22 08:51:51:858 Error(4937): NetworkDiscoverThread: failed to discover external network.
(T13212) 01/12/22 08:51:51:858 Debug(4939): local system error, set error as VPN connection could not be established. Please restart your computer to try again.
(T13212) 01/12/22 08:51:51:858 Debug(5942): --Set state to Disconnected
(T6000) 01/12/22 08:51:51:858 Debug(2349): Setting debug level to 5
(T13212) 01/12/22 08:51:51:858 Debug( 914): Display hip report V4 on the UI
(T13212) 01/12/22 08:51:51:858 Debug(4989): NetworkDiscoverThread: PortalStatus is 2, HasLoggedOnGateway is 1
(T13212) 01/12/22 08:51:51:858 Debug(5005): Network discovery is not ready, set GP VPN status as disconnected
(T13212) 01/12/22 08:51:51:858 Debug(9914): SetVpnStatus called with new status=0, Previous Status=0
(T13212) 01/12/22 08:51:51:858 Debug(4116): UpdatePrelogonStateForSSO() - User-logon tunnel state = Disconnected
(T13212) 01/12/22 08:51:51:858 Debug(5024): local system error, need user action or wait 30 minutes to re-do network discovery
(T3556) 01/12/22 08:52:04:223 Debug( 139): Got hip report in other process ready event.
(T3556) 01/12/22 08:52:04:223 Debug( 158): Read output from PanGpHip.exe
(T3556) 01/12/22 08:52:04:223 Debug( 195): write hip file now
(T3556) 01/12/22 08:52:04:223 Debug( 221): CheckHipInOtherProcess() sets hip report ready event.
(T3556) 01/12/22 08:52:04:223 Debug( 135): Wait for the ready event of hip report generated in other process.
(T2544) 01/12/22 08:52:04:223 Debug(5160): HipReportThread: got HIP report ready event.
(T2544) 01/12/22 08:52:04:223 Debug(5176): HipReportThread: wait for network discover ready event.
(T3556) 01/12/22 08:52:05:403 Debug( 143): Got event for PanGpHip process has quited.
(T3556) 01/12/22 08:52:05:403 Debug( 338): CheckHip over
(T3556) 01/12/22 08:52:05:403 Debug( 282): Hip checking is not initiated by clicking resubmit host profile.
(T3556) 01/12/22 08:52:05:403 Debug( 216): HipCheckThread: wait for hip check event for 3600000 ms);
(T13844) 01/12/22 08:52:09:818 Debug( 334): PanGpHipMp.exe exit for checking misssing patches.
(T13844) 01/12/22 08:52:09:818 Debug( 396): CheckHipMissingPatchInOtherProcess(): exits.
(T13844) 01/12/22 08:52:09:818 Debug( 474): Hip missing patch checking duration is 19

0 Likes Likes

Jason.T
L2 Linker
In response to BPry

‎01-17-2022 09:28 PM

Great, I sanitised a log and posted it here and now it's vanished.

0 Likes Likes

Jason.T
L2 Linker
In response to BPry

‎01-17-2022 09:49 PM

The router is handing out version 5.0.10-3 of the GlobalProtect client. Weirdly although our RMM software reports the computer is Windows 7, the log lists it as Windows 10.

I couldn't post the whole log without the page crashing so here is a section of PanGPS.

 

(T12120) 01/12/22 08:47:35:719 Debug(5024): local system error, need user action or wait 30 minutes to re-do network discovery
(T10744) 01/12/22 08:47:48:499 Debug( 139): Got hip report in other process ready event.
(T10744) 01/12/22 08:47:48:499 Debug( 158): Read output from PanGpHip.exe
(T10744) 01/12/22 08:47:48:499 Debug( 195): write hip file now
(T10744) 01/12/22 08:47:48:499 Debug( 221): CheckHipInOtherProcess() sets hip report ready event.
(T10744) 01/12/22 08:47:48:499 Debug( 135): Wait for the ready event of hip report generated in other process.
(T14264) 01/12/22 08:47:48:499 Debug(5160): HipReportThread: got HIP report ready event.
(T14264) 01/12/22 08:47:48:499 Debug(5176): HipReportThread: wait for network discover ready event.
(T10744) 01/12/22 08:47:49:664 Debug( 143): Got event for PanGpHip process has quited.
(T10744) 01/12/22 08:47:49:664 Debug( 338): CheckHip over
(T10744) 01/12/22 08:47:49:664 Debug( 282): Hip checking is not initiated by clicking resubmit host profile.
(T10744) 01/12/22 08:47:49:664 Debug( 216): HipCheckThread: wait for hip check event for 3600000 ms);
(T1920) 01/12/22 08:47:53:399 Debug( 334): PanGpHipMp.exe exit for checking misssing patches.
(T1920) 01/12/22 08:47:53:399 Debug( 396): CheckHipMissingPatchInOtherProcess(): exits.
(T1920) 01/12/22 08:47:53:399 Debug( 474): Hip missing patch checking duration is 19
(T1920) 01/12/22 08:48:31:419 Debug( 442): HipMissingPatchThread: now is 1641937711, last hip check is 1641937654, hip check interval is 3600000
(T1920) 01/12/22 08:48:31:419 Debug( 447): HipMissingPatchThread: wait 3505000 ms
(T9804) 01/12/22 08:50:14:518 Debug( 548): WscCallback
(T9804) 01/12/22 08:50:14:518 Debug( 550): SetWscEvent
(T1832) 01/12/22 08:50:14:518 Debug( 548): WscCallback
(T1832) 01/12/22 08:50:14:518 Debug( 550): SetWscEvent
(T1832) 01/12/22 08:50:14:518 Debug( 548): WscCallback
(T1832) 01/12/22 08:50:14:518 Debug( 550): SetWscEvent
(T9804) 01/12/22 08:50:14:518 Debug( 548): WscCallback
(T9804) 01/12/22 08:50:14:518 Debug( 550): SetWscEvent
(T8772) 01/12/22 08:50:17:529 Debug( 426): before check wsc
(T8772) 01/12/22 08:50:17:529 Debug( 380): wsc-autodetect is enabled
(T8772) 01/12/22 08:50:17:529 Debug( 429): CheckWsc
(T8772) 01/12/22 08:50:17:529 Debug( 455): CheckWsc is called.
(T8772) 01/12/22 08:50:17:529 Debug( 469): WscCallback: health state change not detected. Ignore this one.
(T6164) 01/12/22 08:51:49:388 Info ( 475): msgtype = portal
(T6164) 01/12/22 08:51:49:388 Debug(1808): ----portal processing starts----
(T6164) 01/12/22 08:51:49:388 Debug(1830): User profile type is 0(not roaming)
(T6164) 01/12/22 08:51:49:388 Debug(1845): pg, source = 0, old source is 0
(T6164) 01/12/22 08:51:49:388 Debug(1867): pg, preferred gateway not set in message, old prefergateway=:)
(T6164) 01/12/22 08:51:49:388 Debug(1930): CheckUpdate is false.
)(T6164) 01/12/22 08:51:49:388 Debug(1945): portal-certificate-verification is yes
(T6164) 01/12/22 08:51:49:388 Debug(1985): No saml-load-cache tag.
(T6164) 01/12/22 08:51:49:388 Debug(2008): no saml-auth-error tag.
(T6164) 01/12/22 08:51:49:388 Debug(2019): allow-cached-portal is yes
(T6164) 01/12/22 08:51:49:388 Debug(2063): NewWinUser is xxxxxxxx, WinUser is , PreviousSwitchOffMsg is false
(T6164) 01/12/22 08:51:49:388 Debug(2064): GetPrelogonStatus() 0, m_userName xxxxxxxxxx, m_preUsername xxxxxxxxxxx
(T6164) 01/12/22 08:51:49:388 Debug(5830): StopThreads starts:
(T6164) 01/12/22 08:51:49:388 Debug(1334): Logging out gateway, reason is StopThreads
(T14264) 01/12/22 08:51:49:388 Debug(5184): HipReportThread: got exit event.
(T6164) 01/12/22 08:51:49:388 Debug(1365): Logging out gateway over
(T5304) 01/12/22 08:51:49:388 Debug(4439): CaptivePortalDetectionThread: got exit event.
(T12120) 01/12/22 08:51:49:388 Debug(5081): NetworkDiscoverThread: got exit event while retry
(T12120) 01/12/22 08:51:49:388 Debug(5035): NetworkDiscoverThread: quits.
(T14264) 01/12/22 08:51:49:388 Debug(5462): HipReportThread: HipReportThread quits.
(T10976) 01/12/22 08:51:49:388 Debug(5601): NetworkConnectionMonitorThread: got exit event.
(T5304) 01/12/22 08:51:49:388 Debug(4603): CaptivePortalDetectionThread: captive portal detection thread exit status is (successful).
(T10976) 01/12/22 08:51:49:388 Debug(5616): NetworkConnectionMonitorThread: quits.
(T3520) 01/12/22 08:51:49:388 Debug(4239): NotificationTimerThread: got exit event.
(T6164) 01/12/22 08:51:49:508 Debug(5845): threads are gracefully stopped.
(T8772) 01/12/22 08:51:49:508 Debug( 418): HipMonitor gets quit event.
(T8772) 01/12/22 08:51:49:508 Debug( 435): Unregister -- WscUnRegisterChanges
(T10744) 01/12/22 08:51:49:508 Debug( 242): HipCheckThread: got thread exit event.
(T10744) 01/12/22 08:51:49:508 Debug( 287): HipCheckThread: Hip check thread quits.
(T1920) 01/12/22 08:51:49:518 Debug( 533): HipMissingPatchThread: Hip check missiing patch thread quits.
(T8772) 01/12/22 08:51:49:528 Debug( 763): HipMonitorThread quits.
(T6164) 01/12/22 08:51:49:528 Debug( 132): All hip collect threads quit gracefully.
(T6164) 01/12/22 08:51:49:528 Debug(5909): StopThreads ends.
(T6164) 01/12/22 08:51:49:528 Debug(5794): StartThreads starts:
(T6000) 01/12/22 08:51:49:528 Debug(2349): Setting debug level to 5
(T6164) 01/12/22 08:51:49:528 Debug( 25): create thread 0x79c with thread ID 6068
(T6164) 01/12/22 08:51:49:528 Debug( 25): create thread 0x724 with thread ID 6716
(T6068) 01/12/22 08:51:49:528 Debug(4082): NotificationTimerThread: notification timer thread starts.
(T6068) 01/12/22 08:51:49:528 Debug(4232): NotificationTimerThread: wait (-1 ms) for notification timer event.
(T6716) 01/12/22 08:51:49:528 Debug(4278): CaptivePortalDetectionThread: captive portal detection thread starts.
(T6716) 01/12/22 08:51:49:528 Debug(4436): CaptivePortalDetectionThread: wait (-1 ms) for captive portal detection event.
(T6164) 01/12/22 08:51:49:528 Debug( 25): create thread 0x6e8 with thread ID 13212
(T6164) 01/12/22 08:51:49:528 Debug( 25): create thread 0x370 with thread ID 2544
(T13212) 01/12/22 08:51:49:528 Debug(4613): NetworkDiscoverThread: network discover thread starts.
(T13212) 01/12/22 08:51:49:528 Debug(4638): NetworkDiscoverThread: wait for network discover event.
(T6164) 01/12/22 08:51:49:528 Debug( 25): create thread 0x67c with thread ID 4632
(T2544) 01/12/22 08:51:49:528 Debug(5122): HipReportThread: HipReportThread starts up.
(T2544) 01/12/22 08:51:49:528 Debug(5155): HipReportThread: wait for HIP report ready event.
(T4632) 01/12/22 08:51:49:528 Debug(5470): NetworkConnectionMonitorThread: network connection monitor thread starts.
(T6164) 01/12/22 08:51:49:528 Debug( 25): create thread 0x690 with thread ID 3556
(T3556) 01/12/22 08:51:49:528 Debug( 167): Start HipCheckThread
(T3556) 01/12/22 08:51:49:528 Debug( 210): HipCheckThread started...
(T3556) 01/12/22 08:51:49:528 Debug( 216): HipCheckThread: wait for hip check event for 3600000 ms);
(T6164) 01/12/22 08:51:49:528 Debug( 25): create thread 0x7e4 with thread ID 13844
(T6164) 01/12/22 08:51:49:528 Debug( 25): create thread 0x790 with thread ID 3388
(T13844) 01/12/22 08:51:49:528 Debug( 176): Start HipMissingPatchThread
(T13844) 01/12/22 08:51:49:528 Debug( 409): HipMissingPatchThread started...
(T13844) 01/12/22 08:51:49:528 Debug( 442): HipMissingPatchThread: now is 1641937909, last hip check is 1641937654, hip check interval is 3600000
(T13844) 01/12/22 08:51:49:528 Debug( 447): HipMissingPatchThread: wait 3345000 ms
(T3388) 01/12/22 08:51:49:528 Debug( 186): Start HipMonitorThread
(T3388) 01/12/22 08:51:49:528 Info ( 759): HipMonitorThread starts
(T6164) 01/12/22 08:51:49:528 Debug(2179): No user, using SSO
(T6164) 01/12/22 08:51:49:528 Debug(9388): Saved password is empty.
(T6164) 01/12/22 08:51:49:528 Debug(2239): Portal 144.xxx.xxx.xxx, user , logonDomain xxxxxxx, saved user xxxxxxx, path C:\Users\xxxxxxx\AppData\Local\Palo Alto Networks\GlobalProtect\
(T6164) 01/12/22 08:51:49:528 Debug(2363): Pre-logon-then-on-demand value is no
(T6164) 01/12/22 08:51:49:528 Debug(1520): SSO starts.
(T6164) 01/12/22 08:51:49:528 Debug(1541): SSO ------ username = xxxxxxx\xxxxxxx
(T6164) 01/12/22 08:51:49:528 Debug(1560): SSO GetSsoCredential starts.
(T6164) 01/12/22 08:51:49:528 Debug(1581): SSO ------ username = xxxxxxx\xxxxxxxx
(T6164) 01/12/22 08:51:49:528 Debug(2463): m_preUsername xxxxxxxxx
(T6164) 01/12/22 08:51:49:528 Debug(2484): CheckCachedPortalForPrelogon 0, PrelogonNeedTimeout 0, RenameTimeout -1, userName xxxxxxxx, preUsername xxxxxxxxx
(T6164) 01/12/22 08:51:49:528 Debug(2619): Use ssl tunnel is no
(T6164) 01/12/22 08:51:49:528 Debug(5942): --Set state to Retrieving configuration...
(T6164) 01/12/22 08:51:49:528 Debug(1896): unknown network type.
(T6164) 01/12/22 08:51:49:528 Debug( 914): Display hip report V4 on the UI
(T3388) 01/12/22 08:51:49:528 Debug( 413): HipMonitorThread wait for exit event.
(T6164) 01/12/22 08:51:49:528 Debug( 923): Hip report changed. Include it in status message to client.
(T6164) 01/12/22 08:51:49:538 Debug(6988): SSO enable status is 1, user name is xxxxxxxxx, domain name is xxxxxxx.
(T6164) 01/12/22 08:51:49:538 Debug(2182): open http session. agent is PAN GlobalProtect/5.0.10-3 (Microsoft Windows 10 Pro , 64-bit)
(T6164) 01/12/22 08:51:49:538 Debug( 456): winhttp SetSecureProtocol, hSession=5b998d30, bAllProtocol=0, gbFips=0
(T6164) 01/12/22 08:51:49:538 Debug( 456): winhttp SetSecureProtocol, hSession=5b999010, bAllProtocol=0, gbFips=0
(T6164) 01/12/22 08:51:49:538 Debug(1655): SetProxyForHost(https://144.xxx.xxx.xxx/😞 timeout:60 AutoDetect:1 url: proxy: bypass: proxystr:
(T6164) 01/12/22 08:51:49:538 Debug(5987): ----Portal Pre-login starts----
(T6164) 01/12/22 08:51:49:538 Debug(4312): TriggerCaptivePortalDetection() return due to captive portal detection is in progress (0) or PreLogin is Done (1)
(T6164) 01/12/22 08:51:49:538 Debug( 550): Network is reachable
(T6164) 01/12/22 08:51:49:538 Debug(6020): Pre-login...,verifyportalcert=yes
(T6164) 01/12/22 08:51:49:538 Debug(9762): Check cert of server 144.xxx.xxx.xxx
(T6164) 01/12/22 08:51:49:538 Debug(9777): File C:\Program Files\Palo Alto Networks\GlobalProtect\tca.cer does not exist.
(T6164) 01/12/22 08:51:49:538 Debug( 777): SSL connecting to 144.xxx.xxx.xxx
(T6164) 01/12/22 08:51:49:555 Debug( 550): Network is reachable
(T6164) 01/12/22 08:51:49:628 Debug(1242): Failed to X509_LOOKUP_load_file
(T6164) 01/12/22 08:51:49:628 Debug( 363): Open_SSL_connection: subject '/CN=vpn.xxxxxxxxxx.com'
(T6164) 01/12/22 08:51:49:628 Debug( 367): Open_SSL_connection: issuer '/C=US/O=DigiCert Inc/CN=RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1'
(T6164) 01/12/22 08:51:49:628 Debug( 965): Hostname 144.xxx.xxx.xxx doesn't matche sub alt name vpn.xxxxxxxxxxx.com
(T6164) 01/12/22 08:51:49:628 Debug( 987): Hostname 144.xxx.xxx.xxx doesn't match sub alt name or no sub alt name, fallback to CN
(T6164) 01/12/22 08:51:49:628 Debug(1023): Hostname 144.xxx.xxx.xxx NOT match vpn.xxxxxxxxxx.com
(T6164) 01/12/22 08:51:49:628 Debug(1318): OpenSSL alert write⚠️close notify
(T6164) 01/12/22 08:51:49:628 Debug(2625): encpostdata, encpostdata=000001EC5BBE7C20, encpostdatalen=160
(T6164) 01/12/22 08:51:49:628 Debug(2794): REQID=30,IPADDR=144.xxx.xxx.xxx,PORT=443,URL=/global-protect/prelogin.esp,POST=1,PROXY_AUTO=1,PROXY_CFGURL=NULL,PROXY=NULL,PROXY_BYPASS=NULL,PROXY_USER=NULL,PROXY_PASS=****,VERIFY_CERT=1,ADDITIONAL_CHECK=1,SCEP_CERT=,oid=
(T6164) 01/12/22 08:51:49:628 Debug(1302): Send response to client for request https_request
(T6164) 01/12/22 08:51:49:748 Debug(2904): receive pan_msg_ping, 3
(T6164) 01/12/22 08:51:49:848 Debug(6120): prelogin to portal result is
<?xml version="1.0" encoding="UTF-8" ?>
<prelogin-response>
<status>Success</status>
<ccusername></ccusername>
<autosubmit>false</autosubmit>
<msg></msg>
<newmsg></newmsg>
<authentication-message>Enter login credentials</authentication-message>
<username-label>Username</username-label>
<password-label>Password</password-label>
<panos-version>1</panos-version><region>AU</region>
</prelogin-response>
(T6164) 01/12/22 08:51:49:848 Debug(6374): Failed to pre-login to the portal 144.xxx.xxx.xxx with return value 0(0).
(T6164) 01/12/22 08:51:49:848 Debug(7227): Try to restore last portal config from file.
(T6164) 01/12/22 08:51:49:848 Debug( 41): Roaming profile is false
(T6164) 01/12/22 08:51:49:855 Debug( 167): profileInfo username xxxxxxx, profile path (null), server (null)
(T6164) 01/12/22 08:51:49:858 Debug(12252): Saved cache portal configuration hash does not exist
(T6164) 01/12/22 08:51:49:858 Debug(7238): last portal config is restored from file C:\Users\xxxxxxxx\AppData\Local\Palo Alto Networks\GlobalProtect\PanPortalCfg_923a7c2f1070da1789c0f151fbc88529.dat.
(T6164) 01/12/22 08:51:49:858 Debug(11621): REGION-PRIO, cached region code is AU
(T6164) 01/12/22 08:51:49:858 Debug( 696): No internal host detection defined
(T6164) 01/12/22 08:51:49:858 Debug( 784): REGION-PRIO, gateway 0(xxxxxx Gateway), 0, region = Any, priority = 1, portalRegion=AU
(T6164) 01/12/22 08:51:49:858 Debug( 413): REGION-PRIO, regioncode=AU, return priority 1, bManual=0
(T6164) 01/12/22 08:51:49:858 Debug( 889): No internal gateway defined
(T6164) 01/12/22 08:51:49:858 Debug( 908): Optional client-cert does not exist
(T6164) 01/12/22 08:51:49:858 Debug( 945): Optional root-ca does not exist
(T6164) 01/12/22 08:51:49:858 Debug(8490): Use proxy is true
(T6164) 01/12/22 08:51:49:858 Debug( 41): Roaming profile is false
(T6164) 01/12/22 08:51:49:868 Debug( 167): profileInfo username dranabahu, profile path (null), server (null)
(T6164) 01/12/22 08:51:49:878 Debug( 82): Saved portal config to file C:\Users\xxxxxxx\AppData\Local\Palo Alto Networks\GlobalProtect\PanPortalCfg_923a7c2f1070da1789c0f151fbc88529.dat.
(T6164) 01/12/22 08:51:49:878 Debug(1603): Proxy auto detect is not needed
(T6164) 01/12/22 08:51:49:878 Debug(8534): RefreshPortalConfig is yes, RefreshPortalConfigInterval is 24 hours
(T6164) 01/12/22 08:51:49:878 Debug(1786): SerializePortalConfigDigest to file C:\Users\xxxxxxx\AppData\Local\Palo Alto Networks\GlobalProtect\PanPCD_923a7c2f1070da1789c0f151fbc88529.dat
(T6164) 01/12/22 08:51:49:878 Debug(1787): Portal config digest is 15fcedd6e958244cbb42d9022ee5cf6f
(T6164) 01/12/22 08:51:49:878 Debug(10899): kerberos, dynamic config value is yes, m_stopOnKerberosFail=0
(T6164) 01/12/22 08:51:49:878 Debug(10929): Timeout value: portal 30, connect 60, receive 30, retry 5
(T6164) 01/12/22 08:51:49:878 Debug(10932): Tunnel retry grace period is 1800 seconds
(T6164) 01/12/22 08:51:49:878 Debug(10935): override-cc-username is no
(T6164) 01/12/22 08:51:49:878 Debug(8574): Scep certificate renew period is 7 days. Scep cert auth cookie length is 0
(T6164) 01/12/22 08:51:49:878 Debug(8585): Otp portal 0, otp internal gateway 0, otp auto external gateway 0, otp manual only external gateway 0
(T6164) 01/12/22 08:51:49:878 Debug(8590): Prefer ipv6 is 1 after processing portal configuration.
(T6164) 01/12/22 08:51:49:878 Debug(10431): No scep profile
(T6164) 01/12/22 08:51:49:878 Debug(7248): this version of portal config is supported.
(T6164) 01/12/22 08:51:49:878 Debug(7216): portal status is Using cached portal config.
(T6164) 01/12/22 08:51:49:878 Debug(11163): Enforcer is not enabled
(T6164) 01/12/22 08:51:50:148 Debug(1700): Enforcer,found 0 filter object belonging to us.
(T6164) 01/12/22 08:51:50:153 Info (8134): Optional tag root-ca does not exist.
(T6164) 01/12/22 08:51:50:153 Debug(8238): client cert is empty in portal config
(T6164) 01/12/22 08:51:50:153 Debug(2420): Client cert is empty, no need to import to store
(T6164) 01/12/22 08:51:50:153 Info (7450): Connect method is user-logon
(T6164) 01/12/22 08:51:50:153 Debug(7461): On-demand mode is false.
(T6164) 01/12/22 08:51:50:153 Debug(8787): SavePrelogon: Portal is 144.xxx.xxx.xxx, PrelogonEnabled is 0
(T6164) 01/12/22 08:51:50:153 Debug( 477): Saved hip policy to file HipPolicy.dat.
(T6164) 01/12/22 08:51:50:153 Debug(7494): Hip check interval is 3600000 ms.
(T6164) 01/12/22 08:51:50:153 Debug(7498): Set check hip event
(T6164) 01/12/22 08:51:50:153 Debug( 809): m_bScheduleFlag is set to 0
(T6164) 01/12/22 08:51:50:153 Debug( 297): Set hip check event.
(T6164) 01/12/22 08:51:50:153 Debug(7500): Set hip missing patch check event.
(T3556) 01/12/22 08:51:50:153 Info ( 246): HipCheckThread: got check hip event or time out.
(T6164) 01/12/22 08:51:50:153 Debug(1646): Serialize empty cookie for portal 144.xxx.xxx.xxx and user xxxxxx
(T3556) 01/12/22 08:51:50:153 Debug( 255): HipCheckThread: Got CheckHipEvent.
(T13844) 01/12/22 08:51:50:153 Debug( 452): HipMissingPatchThread: Got CheckHipMissingPatchEvent.
(T3556) 01/12/22 08:51:50:153 Debug( 787): SetNextScheduledHipCheckTime to 1641941510
(T13844) 01/12/22 08:51:50:153 Debug( 386): CheckHipMissingPatchInOtherProcess()
(T3556) 01/12/22 08:51:50:153 Debug( 276): Last hip check event wakeup tick is 1641937910
(T13844) 01/12/22 08:51:50:153 Debug( 389): Need to check missing patch.
(T3556) 01/12/22 08:51:50:153 Debug( 278): HipCheckThread: check hip in other process.
(T3556) 01/12/22 08:51:50:153 Debug( 306): CheckHipInOtherProcess()
(T3556) 01/12/22 08:51:50:153 Debug( 310): Need to collect hip data
(T6164) 01/12/22 08:51:50:153 Debug( 41): Roaming profile is false
(T13844) 01/12/22 08:51:50:153 Debug( 310): CheckHipMissingPatchInOtherProcess(): Starting process PanGpHipMp.exe
(T3556) 01/12/22 08:51:50:153 Debug( 117): Starting process PanGpHip.exe
(T3556) 01/12/22 08:51:50:158 Debug( 135): Wait for the ready event of hip report generated in other process.
(T6164) 01/12/22 08:51:50:163 Debug( 167): profileInfo username dranabahu, profile path (null), server (null)
(T6164) 01/12/22 08:51:50:188 Debug(1738): Serialized portal user auth cookie to file C:\Users\xxxxxxx\AppData\Local\Palo Alto Networks\GlobalProtect\PanPUAC_923a7c2f1070da1789c0f151fbc88529.dat. 162 bytes.
(T6164) 01/12/22 08:51:50:188 Debug(1529): Serialize empty cookie for portal 144.xxx.xxx.xxx and pre-logon user
(T6164) 01/12/22 08:51:50:188 Debug(1536): SerializePortalPrelogonAuthCookie to file PanPPAC_15a2b5ab57d1837e13ffccf8e75c3c.dat
(T6164) 01/12/22 08:51:50:188 Debug(7586): Retrieved pre-logon-tunnel-rename-timeout value -1
(T6164) 01/12/22 08:51:50:188 Debug(7594): Retrieved user-switch-tunnel-rename-timeout value 0
(T6164) 01/12/22 08:51:50:188 Debug(7605): Retrieved preserve-tunnel-upon-user-logoff-timeout value 0
(T6164) 01/12/22 08:51:50:188 Debug(7618): Set preserver tunnel timeout to 0
(T6164) 01/12/22 08:51:50:188 Debug(7630): The value of can-continue-if-portal-cert-invalid is yes
(T6164) 01/12/22 08:51:50:188 Debug(6623): prelogon status is 0
(T6164) 01/12/22 08:51:50:188 Debug(6792): Force discovery, set NetworkDiscoverEvent
(T13212) 01/12/22 08:51:50:188 Debug( 517): Set hip report quit event
(T13212) 01/12/22 08:51:50:188 Debug(4654): NetworkDiscoverThread: got network discover event.
(T13212) 01/12/22 08:51:50:188 Debug(4661): ----Network Discover starts----
(T13212) 01/12/22 08:51:50:188 Debug( 787): SetNextScheduledHipCheckTime to 0
(T13212) 01/12/22 08:51:50:188 Debug( 809): m_bScheduleFlag is set to 0
(T13212) 01/12/22 08:51:50:188 Debug(4673): UpdatePrelogonStateForSSO to GP_VPN_STATUS_DISCONNECTED
(T13212) 01/12/22 08:51:50:188 Debug(4116): UpdatePrelogonStateForSSO() - User-logon tunnel state = Disconnected
(T6164) 01/12/22 08:51:50:188 Debug(1302): Send response to client for request hip
(T13212) 01/12/22 08:51:50:208 Debug( 550): Network is reachable
(T13212) 01/12/22 08:51:50:208 Debug(1928): bNetworkAvailable is 1
(T13212) 01/12/22 08:51:50:208 Debug(1936): Network is available
(T13212) 01/12/22 08:51:50:208 Debug(4678): finish check host reachable
(T13212) 01/12/22 08:51:50:208 Debug(5942): --Set state to Discovering network...
(T13212) 01/12/22 08:51:50:208 Debug(1896): unknown network type.
(T13212) 01/12/22 08:51:50:208 Debug( 914): Display hip report V4 on the UI
(T13212) 01/12/22 08:51:50:208 Debug(4717): Logout gateways before network discover..., bJustResumed=0
(T13212) 01/12/22 08:51:50:208 Debug(4723): Logout gateways before network discover...
(T13212) 01/12/22 08:51:50:208 Debug(1334): Logging out gateway, reason is Network discover
(T13212) 01/12/22 08:51:50:208 Debug(1365): Logging out gateway over
(T13212) 01/12/22 08:51:50:208 Debug(11488): RetrieveClientIpByRemoteHost() - invalid remote host: .
(T13212) 01/12/22 08:51:50:208 Debug( 185): SelectInternalGateways - failed to retrieve client source ipv6!
(T13212) 01/12/22 08:51:50:208 Debug(5077): Process gateway: host vpn.xxxxxxxxx.com, description xxxxxx Gateway
(T6716) 01/12/22 08:51:50:208 Debug(4459): CaptivePortalDetectionThread: IsDetectingCaptivePortal=1, PreLoginIsDone=0
(T6716) 01/12/22 08:51:50:208 Debug(4436): CaptivePortalDetectionThread: wait (2000 ms) for captive portal detection event.
(T13212) 01/12/22 08:51:50:208 Debug(5154): Gateway vpn.xxxxxxxxxxx.com ipv4 address is 144.xxx.xxx.xxx
(T13212) 01/12/22 08:51:50:208 Debug(5222): Gateway vpn.xxxxxxxxxx.com: ipv4 144.xxx.xxx.xxx, ipv6 , FQDN yes
(T13212) 01/12/22 08:51:50:208 Debug(4742): Set network discover in progress
(T13212) 01/12/22 08:51:50:208 Debug(4746): UpdatePrelogonStateForSSO to GP_VPN_STATUS_DISCONNECTED
(T13212) 01/12/22 08:51:50:213 Debug(4116): UpdatePrelogonStateForSSO() - User-logon tunnel state = Disconnected
(T13212) 01/12/22 08:51:50:213 Debug(11668): GetNetworkTypeDS
(T13212) 01/12/22 08:51:50:213 Debug(11671): No ipv6 internal host detection.
(T13212) 01/12/22 08:51:50:213 Debug(1814): Internal host detection is not defined
(T13212) 01/12/22 08:51:50:213 Debug(4807): NetworkDiscoverThread: network type is unknown.
(T13212) 01/12/22 08:51:50:213 Debug(4813): NetworkDiscoverThread: Discover internal network.
(T13212) 01/12/22 08:51:50:213 Info ( 360): Gateway count is 0 for internal network.
(T13212) 01/12/22 08:51:50:213 Error(4834): NetworkDiscoverThread: UNKNOWN_NETWORK (internal host detection is not set) and internal gateway list is empty.
(T13212) 01/12/22 08:51:50:213 Debug(4878): NetworkDiscoverThread: Discover external network.
(T13212) 01/12/22 08:51:50:213 Debug(4911): previous it is 2, now it is 2
(T13212) 01/12/22 08:51:50:213 Debug( 516): Discover external gateway: gateway count is 1, cutoff time is 5, bJustResumed=1
(T13212) 01/12/22 08:51:50:213 Debug( 536): One external gateway vpn.xxxxxxxxx.com, priority=1, manual is 0
(T13212) 01/12/22 08:51:50:213 Debug(2859): Gateway: vpn.xxxxxxxxx.com, client IP: 192.168.86.53
(T13212) 01/12/22 08:51:50:213 Debug(2476): retrieve info of gateway vpn.xxxxxxxxxxxxx.com
(T13212) 01/12/22 08:51:50:213 Debug(2182): open http session. agent is PAN GlobalProtect/5.0.10-3 (Microsoft Windows 10 Pro , 64-bit)
(T13212) 01/12/22 08:51:50:213 Debug( 456): winhttp SetSecureProtocol, hSession=5b99a710, bAllProtocol=0, gbFips=0
(T13212) 01/12/22 08:51:50:213 Debug(2487): Skip setting proxy for creating tunnel to gateway vpn.xxxxxxxxxx.com
(T13212) 01/12/22 08:51:50:213 Debug(3289): m_msp->IsInPreserveTunnel() 0, m_msp->IsPrelogonRenameAuthFail() 0
(T13212) 01/12/22 08:51:50:213 Debug(12160): Set m_bPrelogonRenameAuthFail to 0
(T13212) 01/12/22 08:51:50:213 Debug(3324): ----Gateway Pre-login starts----
(T13212) 01/12/22 08:51:50:213 Debug(9762): Check cert of server 144.xxx.xxx.xxx
(T13212) 01/12/22 08:51:50:218 Debug(9777): File C:\Program Files\Palo Alto Networks\GlobalProtect\tca.cer does not exist.
(T13212) 01/12/22 08:51:50:218 Debug( 777): SSL connecting to 144.xxx.xxx.xxx
(T13212) 01/12/22 08:51:50:223 Debug( 550): Network is reachable
(T13212) 01/12/22 08:51:50:318 Debug(1242): Failed to X509_LOOKUP_load_file
(T13212) 01/12/22 08:51:50:318 Debug( 363): Open_SSL_connection: subject '/CN=vpn.xxxxxxx.com'
(T13212) 01/12/22 08:51:50:318 Debug( 367): Open_SSL_connection: issuer '/C=US/O=DigiCert Inc/CN=RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1'
(T13212) 01/12/22 08:51:50:318 Debug( 960): Hostname vpn.basfordbrands.com matches sub alt name vpn.xxxxxx.com
(T13212) 01/12/22 08:51:50:318 Debug(1318): OpenSSL alert write⚠️close notify
(T13212) 01/12/22 08:51:50:318 Debug(3373): m_msp->GetGwSamlAuthStatus() -2, m_msp->IsUserJustLoginInPrelogon() 0, m_msp->IsPrelogonRenameAuthFail() 0
(T13212) 01/12/22 08:51:50:318 Debug(3394): IsSamlAuth() 0, IsManualGatewayChallenge() 0, pwszConnectedIP null
(T13212) 01/12/22 08:51:50:318 Debug(9979): Need to check gateway cert for vpn.xxxxxxxxxxx.com
(T13212) 01/12/22 08:51:50:318 Debug(2625): encpostdata, encpostdata=000001EC5B9206D0, encpostdatalen=160
(T13212) 01/12/22 08:51:50:318 Debug(2794): REQID=31,IPADDR=vpn.xxxxxxxxxx.com,PORT=443,URL=/ssl-vpn/prelogin.esp,POST=1,PROXY_AUTO=1,PROXY_CFGURL=NULL,PROXY=NULL,PROXY_BYPASS=NULL,PROXY_USER=NULL,PROXY_PASS=****,VERIFY_CERT=1,ADDITIONAL_CHECK=1,SCEP_CERT=,oid=
(T13212) 01/12/22 08:51:50:418 Debug(1302): Send response to client for request https_request
(T13212) 01/12/22 08:51:50:518 Debug(2904): receive pan_msg_ping, 3
(T13212) 01/12/22 08:51:50:608 Debug(3436): Login to gateway (null) vpn.xxxxxxxxxx.com without ipv6
(T13212) 01/12/22 08:51:50:608 Debug(10011): StopCaptivePortalDetection() captive portal detection is in progress
(T6716) 01/12/22 08:51:50:608 Debug(4459): CaptivePortalDetectionThread: IsDetectingCaptivePortal=0, PreLoginIsDone=1
(T6716) 01/12/22 08:51:50:608 Debug(4436): CaptivePortalDetectionThread: wait (-1 ms) for captive portal detection event.
(T13212) 01/12/22 08:51:50:608 Debug(3466): Pre-login response is <?xml version="1.0" encoding="UTF-8" ?>
<prelogin-response>
<status>Success</status>
<ccusername></ccusername>
<autosubmit>false</autosubmit>
<msg></msg>
<newmsg></newmsg>
<license>no</license>
<authentication-message>Enter login credentials</authentication-message>
<username-label>Username</username-label>
<password-label>Password</password-label>
<panos-version>1</panos-version><region>AU</region>
</prelogin-response>
(T13212) 01/12/22 08:51:50:608 Debug(3482): REGION-PRIO, gateway region code is AU
(T13212) 01/12/22 08:51:50:608 Debug(3514): REGION-PRIO, portal and gateway have same region code!
(T13212) 01/12/22 08:51:50:608 Debug(6122): Auth message is Enter login credentials for gateway vpn.xxxxxxxxxxx.com
(T13212) 01/12/22 08:51:50:608 Debug(6150): Gateway license no, license-v6 yes
(T13212) 01/12/22 08:51:50:608 Debug(3721): ----Gateway Login starts----
(T13212) 01/12/22 08:51:50:608 Debug(10166): Set to service bUseCCUserGateway 0 and ccUserNameGateway
(T13212) 01/12/22 08:51:50:608 Debug(2095): Update user name from to xxxxxxxxx
(T13212) 01/12/22 08:51:50:608 Debug(5744): OtpSaveCredential is save_username
(T13212) 01/12/22 08:51:50:608 Debug(5782): External network gateway without OTP authentication
(T13212) 01/12/22 08:51:50:608 Debug(5807): SSO is enabled. Using SSO credential to login to gateway.
(T13212) 01/12/22 08:51:50:608 Debug( 41): Roaming profile is false
(T13212) 01/12/22 08:51:50:608 Debug( 167): profileInfo username xxxxxxx, profile path (null), server (null)
(T13212) 01/12/22 08:51:50:618 Debug(1632): Unserialized empty cookie for portal 144.xxx.xxx.xxx and user xxxxxxxx
(T13212) 01/12/22 08:51:50:618 Debug(1561): Unserialized empty cookie for portal 144.xxx.xxx.xxx and pre-logon user.
(T13212) 01/12/22 08:51:50:618 Debug(3780): bIsEmptyUser is 0, bDPGCforManualOnlyGateway is 0, bDPGCNotforManualOnlyGateway is 0
(T13212) 01/12/22 08:51:50:618 Debug(10166): Set to service bUseCCUserGateway 0 and ccUserNameGateway
(T13212) 01/12/22 08:51:50:618 Debug( 41): Roaming profile is false
(T13212) 01/12/22 08:51:50:618 Debug( 167): profileInfo username xxxxxxxx, profile path (null), server (null)
(T13212) 01/12/22 08:51:50:628 Debug(1632): Unserialized empty cookie for portal 144.xxx.xxx.xxx and user xxxxxxxxx
(T13212) 01/12/22 08:51:50:628 Debug(1561): Unserialized empty cookie for portal 144.xxx.xxx.xxx and pre-logon user.
(T13212) 01/12/22 08:51:50:628 Debug(6841): use cached deviceSN
(T13212) 01/12/22 08:51:50:628 Debug(5544): Get preferred IPv4 192.168.253.26 for gateway 144.xxx.xxx.xxx and user xxxxxxxx
(T13212) 01/12/22 08:51:50:628 Debug(5575): Get preferred IPv6 for gateway 144.xxx.xxx.xxx and user xxxxxxxx
(T13212) 01/12/22 08:51:50:628 Debug(3921): Actual user for gateway login is xxxxxxxx
(T13212) 01/12/22 08:51:50:628 Debug(3925): Gateway selection type is auto
(T13212) 01/12/22 08:51:50:628 Debug(6841): use cached deviceSN
(T13212) 01/12/22 08:51:50:628 Debug(9979): Need to check gateway cert for vpn.xxxxxxxxxxx.com
(T13212) 01/12/22 08:51:50:628 Debug(2625): encpostdata, encpostdata=000001EC5B92A470, encpostdatalen=512
(T13212) 01/12/22 08:51:50:628 Debug(2794): REQID=32,IPADDR=vpn.xxxxxxxxxx.com,PORT=443,URL=/ssl-vpn/login.esp,POST=1,PROXY_AUTO=1,PROXY_CFGURL=NULL,PROXY=NULL,PROXY_BYPASS=NULL,PROXY_USER=NULL,PROXY_PASS=****,VERIFY_CERT=0,ADDITIONAL_CHECK=1,SCEP_CERT=,oid=
(T13212) 01/12/22 08:51:50:718 Debug(1302): Send response to client for request https_request
(T13212) 01/12/22 08:51:50:838 Debug(2904): receive pan_msg_ping, 3
(T13212) 01/12/22 08:51:50:938 Debug(1646): Serialize empty cookie for portal 144.xxx.xxx.xxx and user xxxxxxxxx
(T13212) 01/12/22 08:51:50:938 Debug( 41): Roaming profile is false
(T13212) 01/12/22 08:51:50:938 Debug( 167): profileInfo username xxxxxxx, profile path (null), server (null)
(T13212) 01/12/22 08:51:50:948 Debug(1738): Serialized portal user auth cookie to file C:\Users\xxxxxxxx\AppData\Local\Palo Alto Networks\GlobalProtect\PanPUAC_923a7c2f1070da1789c0f151fbc88529.dat. 162 bytes.
(T13212) 01/12/22 08:51:50:948 Debug(1529): Serialize empty cookie for portal 144.xxx.xxx.xxx and pre-logon user
(T13212) 01/12/22 08:51:50:948 Debug(1536): SerializePortalPrelogonAuthCookie to file PanPPAC_15a2b5ab57d1837e13ffccf8e75c3c.dat
(T13212) 01/12/22 08:51:50:948 Debug(4323): Gateway vpn.xxxxxxxxxx.com has hip-report-version: 4
(T13212) 01/12/22 08:51:50:948 Debug(4338): Managed is no
(T13212) 01/12/22 08:51:50:948 Debug(4342): Gateway vpn.xxxxxxxxxx.com's location is
(T13212) 01/12/22 08:51:50:948 Debug(10152): NetworkDisoverEventSet is no, RedoNetworkDiscovery is no
(T13212) 01/12/22 08:51:50:948 Debug(2497): ----Tunnel creation starts----
(T13212) 01/12/22 08:51:50:948 Debug(2498): Try to create tunnel with gateway vpn.xxxxxxxxxxx.com
(T13212) 01/12/22 08:51:50:948 Debug(5942): --Set state to Connecting...
(T13212) 01/12/22 08:51:50:948 Debug( 914): Display hip report V4 on the UI
(T13212) 01/12/22 08:51:50:948 Debug(2358): proxy , proxyuser , domain xxxxxxxxx, user xxxxxxxxx, remotehost 144.xxx.xxx.xxx.
(T13212) 01/12/22 08:51:50:948 Debug(6841): use cached deviceSN
(T13212) 01/12/22 08:51:50:958 Debug(2638): Get gateway config.
(T13212) 01/12/22 08:51:50:958 Debug(9979): Need to check gateway cert for vpn.xxxxxxxxxxx.com
(T13212) 01/12/22 08:51:50:958 Debug(2625): encpostdata, encpostdata=000001EC5B9BEC70, encpostdatalen=448
(T13212) 01/12/22 08:51:50:958 Debug(2794): REQID=33,IPADDR=vpn.xxxxxxxxx.com,PORT=443,URL=/ssl-vpn/getconfig.esp,POST=1,PROXY_AUTO=1,PROXY_CFGURL=NULL,PROXY=NULL,PROXY_BYPASS=NULL,PROXY_USER=NULL,PROXY_PASS=****,VERIFY_CERT=0,ADDITIONAL_CHECK=1,SCEP_CERT=,oid=
(T13212) 01/12/22 08:51:51:038 Debug(1302): Send response to client for request https_request
(T13212) 01/12/22 08:51:51:118 Debug(2904): receive pan_msg_ping, 1
(T13212) 01/12/22 08:51:51:118 Debug(2705): gateway vpn.xxxxxxxxxxxx.com's config is
<response status="success">
<need-tunnel>yes</need-tunnel>
<ssl-tunnel-url>/ssl-tunnel-connect.sslvpn</ssl-tunnel-url>
<portal>Basford Gateway-N</portal>
<user>xxxxxxxxxx</user>
<lifetime>2592000</lifetime>
<timeout>10800</timeout>
<disconnect-on-idle>10800</disconnect-on-idle>
<bw-c2s>1000</bw-c2s>
<bw-s2c>1000</bw-s2c>
<gw-address>144.xxx.xxx.xxx</gw-address>
<ip-address>192.168.253.26</ip-address>
<netmask>255.255.255.255</netmask>
<ip-address-preferred>yes</ip-address-preferred>
<dns>
<member>192.168.0.17</member>
<member>192.168.0.18</member>
</dns>
<wins>
</wins>
<dns-suffix>
<member>xxxxxxxxxx.local</member>
</dns-suffix>
<default-gateway>192.168.253.26</default-gateway>
<mtu>0</mtu>
<no-direct-access-to-local-network>no</no-direct-access-to-local-network>
<access-routes>
<member>192.168.0.0/24</member>
<member>192.168.0.17/32</member>
<member>192.168.0.18/32</member>
</access-routes>
<exclude-access-routes>
</exclude-access-routes>
<ipsec>
<udp-port>4501</udp-port>
<ipsec-mode>esp-tunnel</ipsec-mode>
<enc-algo>aes-256-gcm</enc-algo>
<hmac-algo>sha1</hmac-algo>
(T13212) 01/12/22 08:51:51:118 Debug(2731): There is no connected-gw-ip
(T13212) 01/12/22 08:51:51:118 Debug(4404): In SetGatewayRoute: The original route table:
(T13212) 01/12/22 08:51:51:118 Debug( 138): Destination NetMask Gateway Inf Metric
(T13212) 01/12/22 08:51:51:118 Debug( 153): 0.0.0.0 0.0.0.0 192.168.86.1 11 35
(T13212) 01/12/22 08:51:51:118 Debug( 153): 127.0.0.0 255.0.0.0 127.0.0.1 1 331
(T13212) 01/12/22 08:51:51:118 Debug( 153): 127.0.0.1 255.255.255.255 127.0.0.1 1 331
(T13212) 01/12/22 08:51:51:118 Debug( 153): 127.255.255.255 255.255.255.255 127.0.0.1 1 331
(T13212) 01/12/22 08:51:51:118 Debug( 153): 192.168.86.0 255.255.255.0 192.168.86.53 11 291
(T13212) 01/12/22 08:51:51:118 Debug( 153): 192.168.86.53 255.255.255.255 192.168.86.53 11 291
(T13212) 01/12/22 08:51:51:118 Debug( 153): 192.168.86.255 255.255.255.255 192.168.86.53 11 291
(T13212) 01/12/22 08:51:51:118 Debug( 153): 224.0.0.0 240.0.0.0 127.0.0.1 1 331
(T13212) 01/12/22 08:51:51:118 Debug( 153): 224.0.0.0 240.0.0.0 192.168.86.53 11 291
(T13212) 01/12/22 08:51:51:118 Debug( 153): 255.255.255.255 255.255.255.255 127.0.0.1 1 331
(T13212) 01/12/22 08:51:51:118 Debug( 153): 255.255.255.255 255.255.255.255 192.168.86.53 11 291
(T13212) 01/12/22 08:51:51:118 Debug(4414): SetGatewayRoute: GetBestRoute() returns Dest:0.0.0.0 Mask:0.0.0.0 if_index=11 metric1=35
(T13212) 01/12/22 08:51:51:118 Debug(4436): Created gateway route (144.xxx.xxx.xxx) succeeds
(T13212) 01/12/22 08:51:51:118 Debug( 271): Ipv6-connection is NULL
(T13212) 01/12/22 08:51:51:118 Debug( 318): gw-address-v6 is not specified
(T13212) 01/12/22 08:51:51:118 Debug( 324): remoteHostV6 is not specified
(T13212) 01/12/22 08:51:51:118 Debug( 349): ip-address-preferred value is yes
(T13212) 01/12/22 08:51:51:118 Debug( 374): ip-address-v6-preferred not found.
(T13212) 01/12/22 08:51:51:118 Debug(9707): Set preferred IP 192.168.253.26 for gateway 144.xxx.xxx.xxx user xxxxxxxxx
(T13212) 01/12/22 08:51:51:118 Debug(9716): Set preferred IPv6 for gateway 144.xxx.xxx.xxx user xxxxxxxxx
(T13212) 01/12/22 08:51:51:118 Debug( 514): DLSA, found no-direct-access-to-local-network tag, b_IsDLSASet set to false
(T13212) 01/12/22 08:51:51:118 Debug( 757): Encryption method is aes-256-gcm
(T13212) 01/12/22 08:51:51:118 Debug(3233): set driver connected as true
(T13212) 01/12/22 08:51:51:118 Debug( 594): use-ssl-only-tunnel is not configured and user cannnot change
(T13212) 01/12/22 08:51:51:118 Debug( 147): VPN idle timeout is 10800; config timeout is 10800
(T13212) 01/12/22 08:51:51:118 Debug( 70): c2s-spi is 0x40FDCF92, s2c-spi is 0xFDB3FD9C
(T13212) 01/12/22 08:51:51:118 Debug( 189): EnforceDns is enabled, set 2 GP pushed DNS servers
(T13212) 01/12/22 08:51:51:118 Debug( 164): Trying to do ipsec connection to 144.xxx.xxx.xxx[4501]
(T13212) 01/12/22 08:51:51:128 Debug( 550): Network is reachable
(T13212) 01/12/22 08:51:51:128 Info ( 176): Connected to: 144.xxx.xxx.xxx[4501], Sending keep alive to ipsec socket...
(T13212) 01/12/22 08:51:51:148 Info ( 214): Connected ipsec to 144.xxx.xxx.xxx(4501)
(T13212) 01/12/22 08:51:51:148 Info ( 329): tunnel to 144.xxx.xxx.xxx connected
(T13212) 01/12/22 08:51:51:288 Debug( 349): PsvRegister done
(T13212) 01/12/22 08:51:51:288 Debug( 25): create thread 0x4d0 with thread ID 1628
(T1628) 01/12/22 08:51:51:288 Debug( 398): VpnProcMonitor thread starts
(T1628) 01/12/22 08:51:51:288 Debug( 25): create thread 0x680 with thread ID 4752
(T4752) 01/12/22 08:51:51:288 Debug( 409): VpnProcDrv thread starts
(T13212) 01/12/22 08:51:51:298 Debug(1610): Get original UseDomainNameDevolution value 1
(T13212) 01/12/22 08:51:51:298 Debug(1636): Get original DNS SearchList value xxxxxxxxx.local,lan
(T13212) 01/12/22 08:51:51:298 Debug(1657): searchList: xxxxxxxxx.local
(T13212) 01/12/22 08:51:51:298 Debug(1657): searchList: lan
(T13212) 01/12/22 08:51:51:298 Error(1566): InstallClientConfig: Failed to find PANGP virtual adapter interface
(T6000) 01/12/22 08:51:51:298 Debug(2349): Setting debug level to 5
(T13212) 01/12/22 08:51:51:308 Error( 343): InstallClientConfig() failed
(T13212) 01/12/22 08:51:51:308 Error( 248): ProcMonitor: SetupNetwork() failed
(T1628) 01/12/22 08:51:51:308 Info ( 471): PktProcess: VPN disconnect event, get out of ProcMonitor
(T1628) 01/12/22 08:51:51:308 Debug( 544): Tunnel downtime is 16 miliseconds
(T4752) 01/12/22 08:51:51:308 Info ( 832): ProDrv: VPN disconnect event, get out of ProcDrv
(T4752) 01/12/22 08:51:51:308 Info ( 858): ProcDrv thread dies
(T1628) 01/12/22 08:51:51:308 Info ( 805): ProcDrv quit
(T1628) 01/12/22 08:51:51:308 Info ( 791): ProcMonitor thread dies
(T13212) 01/12/22 08:51:51:418 Debug( 293): do_disconnect is called in VPN stop
(T13212) 01/12/22 08:51:51:418 Debug( 227): IPSec anti-replay statistics: outside window count 0, replay count 0
(T13212) 01/12/22 08:51:51:418 Debug( 229): Disconnect udp socket
(T13212) 01/12/22 08:51:51:418 Debug( 505): unset network
(T13212) 01/12/22 08:51:51:418 Debug( 764): PreviousDNSInfo doesn't exist, no need to restore
(T13212) 01/12/22 08:51:51:418 Info ( 528): not call uninstallClientConfig, netSetup=000001EC5ADABDB0, clientConfig=000001EC5B9AE6F0, panMSService=000001EC5ADD25C0, panMSService->IsConfigInstalled()=0
(T13212) 01/12/22 08:51:51:418 Debug( 615): ipsec failed to start
(T13212) 01/12/22 08:51:51:418 Info ( 87): VPN is deleted
(T13212) 01/12/22 08:51:51:418 Debug( 147): VPN idle timeout is 10800; config timeout is 10800
(T13212) 01/12/22 08:51:51:418 Debug( 189): EnforceDns is enabled, set 2 GP pushed DNS servers
(T13212) 01/12/22 08:51:51:418 Debug( 62): Trying to do SSL connection to 144.xxx.xxx.xxx(443)
(T13212) 01/12/22 08:51:51:418 Debug( 777): SSL connecting to 144.xxx.xxx.xxx
(T13212) 01/12/22 08:51:51:428 Debug( 550): Network is reachable
(T13212) 01/12/22 08:51:51:498 Debug(1242): Failed to X509_LOOKUP_load_file
(T13212) 01/12/22 08:51:51:498 Debug( 363): Open_SSL_connection: subject '/CN=vpn.xxxxxxxxxx.com'
(T13212) 01/12/22 08:51:51:498 Debug( 367): Open_SSL_connection: issuer '/C=US/O=DigiCert Inc/CN=RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1'
(T13212) 01/12/22 08:51:51:518 Info ( 110): Connected ssl tunnel to 144.xxx.xxx.xxx(443)
(T13212) 01/12/22 08:51:51:518 Info ( 329): tunnel to 144.xxx.xxx.xxx connected
(T13212) 01/12/22 08:51:51:588 Debug( 349): PsvRegister done
(T13212) 01/12/22 08:51:51:588 Debug( 25): create thread 0x60c with thread ID 9064
(T9064) 01/12/22 08:51:51:588 Debug( 398): VpnProcMonitor thread starts
(T9064) 01/12/22 08:51:51:588 Debug( 25): create thread 0x794 with thread ID 10648
(T10648) 01/12/22 08:51:51:588 Debug( 409): VpnProcDrv thread starts
(T13212) 01/12/22 08:51:51:598 Debug(1610): Get original UseDomainNameDevolution value 1
(T13212) 01/12/22 08:51:51:598 Debug(1636): Get original DNS SearchList value xxxxxxxxxx.local,lan
(T13212) 01/12/22 08:51:51:598 Debug(1657): searchList: xxxxxxxxxx.local
(T13212) 01/12/22 08:51:51:598 Debug(1657): searchList: lan
(T13212) 01/12/22 08:51:51:598 Error(1566): InstallClientConfig: Failed to find PANGP virtual adapter interface
(T13212) 01/12/22 08:51:51:598 Error( 343): InstallClientConfig() failed
(T13212) 01/12/22 08:51:51:598 Error( 248): ProcMonitor: SetupNetwork() failed
(T9064) 01/12/22 08:51:51:598 Info ( 471): PktProcess: VPN disconnect event, get out of ProcMonitor
(T9064) 01/12/22 08:51:51:598 Debug( 544): Tunnel downtime is 0 miliseconds
(T10648) 01/12/22 08:51:51:598 Info ( 832): ProDrv: VPN disconnect event, get out of ProcDrv
(T10648) 01/12/22 08:51:51:598 Info ( 858): ProcDrv thread dies
(T9064) 01/12/22 08:51:51:598 Info ( 805): ProcDrv quit
(T9064) 01/12/22 08:51:51:598 Info ( 791): ProcMonitor thread dies
(T13212) 01/12/22 08:51:51:718 Debug( 293): do_disconnect is called in VPN stop
(T13212) 01/12/22 08:51:51:718 Debug(1318): OpenSSL alert write⚠️close notify
(T13212) 01/12/22 08:51:51:718 Debug( 505): unset network
(T13212) 01/12/22 08:51:51:718 Debug( 764): PreviousDNSInfo doesn't exist, no need to restore
(T13212) 01/12/22 08:51:51:718 Info ( 528): not call uninstallClientConfig, netSetup=000001EC5ADABDB0, clientConfig=000001EC5B9AE6F0, panMSService=000001EC5ADD25C0, panMSService->IsConfigInstalled()=0
(T13212) 01/12/22 08:51:51:718 Error( 666): sslvpn failed to start
(T13212) 01/12/22 08:51:51:718 Info ( 87): VPN is deleted
(T13212) 01/12/22 08:51:51:718 Error(2448): CreateTunnel: SetConfig() failed
(T13212) 01/12/22 08:51:51:718 Debug(5894): UnsetGatewayRoutes: DeleteIpForwardEntry(144.xxx.xxx.xxx)
(T13212) 01/12/22 08:51:51:718 Debug(5942): --Set state to Connection failed
(T13212) 01/12/22 08:51:51:718 Debug( 914): Display hip report V4 on the UI
(T13212) 01/12/22 08:51:51:718 Debug(2463): VPN tunnel is not connected.
(T13212) 01/12/22 08:51:51:718 Debug(2465): returns FALSE.
(T13212) 01/12/22 08:51:51:718 Debug(2518): failed to create tunnel with gateway vpn.xxxxxxxxxx.com
(T13212) 01/12/22 08:51:51:718 Info (2236): logout: user=xxxxxxx, portal=xxxxxxxx Gateway-N, gateway=vpn.xxxxxxxxx.com, domain=xxxxxxxx, computerName=T9009
(T13212) 01/12/22 08:51:51:718 Debug(2268): Logout parameter is
(T13212) 01/12/22 08:51:51:728 Debug( 777): SSL connecting to 144.xxx.xxx.xxx
(T13212) 01/12/22 08:51:51:728 Debug( 550): Network is reachable
(T13212) 01/12/22 08:51:51:768 Debug(3974): SSL verify succeed
(T13212) 01/12/22 08:51:51:858 Debug(1318): OpenSSL alert write⚠️close notify
(T13212) 01/12/22 08:51:51:858 Debug(2314): Logged out gateway vpn.xxxxxxxxxxx.com
(T13212) 01/12/22 08:51:51:858 Debug(2536): tunnel to vpn.xxxxxxxxx.com is not created.
(T13212) 01/12/22 08:51:51:858 Error(4937): NetworkDiscoverThread: failed to discover external network.
(T13212) 01/12/22 08:51:51:858 Debug(4939): local system error, set error as VPN connection could not be established. Please restart your computer to try again.
(T13212) 01/12/22 08:51:51:858 Debug(5942): --Set state to Disconnected
(T6000) 01/12/22 08:51:51:858 Debug(2349): Setting debug level to 5
(T13212) 01/12/22 08:51:51:858 Debug( 914): Display hip report V4 on the UI
(T13212) 01/12/22 08:51:51:858 Debug(4989): NetworkDiscoverThread: PortalStatus is 2, HasLoggedOnGateway is 1
(T13212) 01/12/22 08:51:51:858 Debug(5005): Network discovery is not ready, set GP VPN status as disconnected
(T13212) 01/12/22 08:51:51:858 Debug(9914): SetVpnStatus called with new status=0, Previous Status=0
(T13212) 01/12/22 08:51:51:858 Debug(4116): UpdatePrelogonStateForSSO() - User-logon tunnel state = Disconnected
(T13212) 01/12/22 08:51:51:858 Debug(5024): local system error, need user action or wait 30 minutes to re-do network discovery
(T3556) 01/12/22 08:52:04:223 Debug( 139): Got hip report in other process ready event.
(T3556) 01/12/22 08:52:04:223 Debug( 158): Read output from PanGpHip.exe
(T3556) 01/12/22 08:52:04:223 Debug( 195): write hip file now
(T3556) 01/12/22 08:52:04:223 Debug( 221): CheckHipInOtherProcess() sets hip report ready event.
(T3556) 01/12/22 08:52:04:223 Debug( 135): Wait for the ready event of hip report generated in other process.
(T2544) 01/12/22 08:52:04:223 Debug(5160): HipReportThread: got HIP report ready event.
(T2544) 01/12/22 08:52:04:223 Debug(5176): HipReportThread: wait for network discover ready event.
(T3556) 01/12/22 08:52:05:403 Debug( 143): Got event for PanGpHip process has quited.
(T3556) 01/12/22 08:52:05:403 Debug( 338): CheckHip over
(T3556) 01/12/22 08:52:05:403 Debug( 282): Hip checking is not initiated by clicking resubmit host profile.
(T3556) 01/12/22 08:52:05:403 Debug( 216): HipCheckThread: wait for hip check event for 3600000 ms);
(T13844) 01/12/22 08:52:09:818 Debug( 334): PanGpHipMp.exe exit for checking misssing patches.
(T13844) 01/12/22 08:52:09:818 Debug( 396): CheckHipMissingPatchInOtherProcess(): exits.
(T13844) 01/12/22 08:52:09:818 Debug( 474): Hip missing patch checking duration is 19

0 Likes Likes

Jason.T
L2 Linker
In response to BPry

‎01-18-2022 01:37 PM

(T12120) 01/12/22 08:47:35:719 Debug(5024): local system error, need user action or wait 30 minutes to re-do network discovery
(T10744) 01/12/22 08:47:48:499 Debug( 139): Got hip report in other process ready event.
(T10744) 01/12/22 08:47:48:499 Debug( 158): Read output from PanGpHip.exe
(T10744) 01/12/22 08:47:48:499 Debug( 195): write hip file now
(T10744) 01/12/22 08:47:48:499 Debug( 221): CheckHipInOtherProcess() sets hip report ready event.
(T10744) 01/12/22 08:47:48:499 Debug( 135): Wait for the ready event of hip report generated in other process.
(T14264) 01/12/22 08:47:48:499 Debug(5160): HipReportThread: got HIP report ready event.
(T14264) 01/12/22 08:47:48:499 Debug(5176): HipReportThread: wait for network discover ready event.
(T10744) 01/12/22 08:47:49:664 Debug( 143): Got event for PanGpHip process has quited.
(T10744) 01/12/22 08:47:49:664 Debug( 338): CheckHip over
(T10744) 01/12/22 08:47:49:664 Debug( 282): Hip checking is not initiated by clicking resubmit host profile.
(T10744) 01/12/22 08:47:49:664 Debug( 216): HipCheckThread: wait for hip check event for 3600000 ms);
(T1920) 01/12/22 08:47:53:399 Debug( 334): PanGpHipMp.exe exit for checking misssing patches.
(T1920) 01/12/22 08:47:53:399 Debug( 396): CheckHipMissingPatchInOtherProcess(): exits.
(T1920) 01/12/22 08:47:53:399 Debug( 474): Hip missing patch checking duration is 19
(T1920) 01/12/22 08:48:31:419 Debug( 442): HipMissingPatchThread: now is 1641937711, last hip check is 1641937654, hip check interval is 3600000
(T1920) 01/12/22 08:48:31:419 Debug( 447): HipMissingPatchThread: wait 3505000 ms
(T9804) 01/12/22 08:50:14:518 Debug( 548): WscCallback
(T9804) 01/12/22 08:50:14:518 Debug( 550): SetWscEvent
(T1832) 01/12/22 08:50:14:518 Debug( 548): WscCallback
(T1832) 01/12/22 08:50:14:518 Debug( 550): SetWscEvent
(T1832) 01/12/22 08:50:14:518 Debug( 548): WscCallback
(T1832) 01/12/22 08:50:14:518 Debug( 550): SetWscEvent
(T9804) 01/12/22 08:50:14:518 Debug( 548): WscCallback
(T9804) 01/12/22 08:50:14:518 Debug( 550): SetWscEvent
(T8772) 01/12/22 08:50:17:529 Debug( 426): before check wsc
(T8772) 01/12/22 08:50:17:529 Debug( 380): wsc-autodetect is enabled
(T8772) 01/12/22 08:50:17:529 Debug( 429): CheckWsc
(T8772) 01/12/22 08:50:17:529 Debug( 455): CheckWsc is called.
(T8772) 01/12/22 08:50:17:529 Debug( 469): WscCallback: health state change not detected. Ignore this one.
(T6164) 01/12/22 08:51:49:388 Info ( 475): msgtype = portal
(T6164) 01/12/22 08:51:49:388 Debug(1808): ----portal processing starts----
(T6164) 01/12/22 08:51:49:388 Debug(1830): User profile type is 0(not roaming)
(T6164) 01/12/22 08:51:49:388 Debug(1845): pg, source = 0, old source is 0
(T6164) 01/12/22 08:51:49:388 Debug(1867): pg, preferred gateway not set in message, old prefergateway=:)
(T6164) 01/12/22 08:51:49:388 Debug(1930): CheckUpdate is false.
)(T6164) 01/12/22 08:51:49:388 Debug(1945): portal-certificate-verification is yes
(T6164) 01/12/22 08:51:49:388 Debug(1985): No saml-load-cache tag.
(T6164) 01/12/22 08:51:49:388 Debug(2008): no saml-auth-error tag.
(T6164) 01/12/22 08:51:49:388 Debug(2019): allow-cached-portal is yes
(T6164) 01/12/22 08:51:49:388 Debug(2063): NewWinUser is xxxxxxxx, WinUser is , PreviousSwitchOffMsg is false
(T6164) 01/12/22 08:51:49:388 Debug(2064): GetPrelogonStatus() 0, m_userName xxxxxxxxxx, m_preUsername xxxxxxxxxxx
(T6164) 01/12/22 08:51:49:388 Debug(5830): StopThreads starts:
(T6164) 01/12/22 08:51:49:388 Debug(1334): Logging out gateway, reason is StopThreads
(T14264) 01/12/22 08:51:49:388 Debug(5184): HipReportThread: got exit event.
(T6164) 01/12/22 08:51:49:388 Debug(1365): Logging out gateway over
(T5304) 01/12/22 08:51:49:388 Debug(4439): CaptivePortalDetectionThread: got exit event.
(T12120) 01/12/22 08:51:49:388 Debug(5081): NetworkDiscoverThread: got exit event while retry
(T12120) 01/12/22 08:51:49:388 Debug(5035): NetworkDiscoverThread: quits.
(T14264) 01/12/22 08:51:49:388 Debug(5462): HipReportThread: HipReportThread quits.
(T10976) 01/12/22 08:51:49:388 Debug(5601): NetworkConnectionMonitorThread: got exit event.
(T5304) 01/12/22 08:51:49:388 Debug(4603): CaptivePortalDetectionThread: captive portal detection thread exit status is (successful).
(T10976) 01/12/22 08:51:49:388 Debug(5616): NetworkConnectionMonitorThread: quits.
(T3520) 01/12/22 08:51:49:388 Debug(4239): NotificationTimerThread: got exit event.
(T6164) 01/12/22 08:51:49:508 Debug(5845): threads are gracefully stopped.
(T8772) 01/12/22 08:51:49:508 Debug( 418): HipMonitor gets quit event.
(T8772) 01/12/22 08:51:49:508 Debug( 435): Unregister -- WscUnRegisterChanges
(T10744) 01/12/22 08:51:49:508 Debug( 242): HipCheckThread: got thread exit event.
(T10744) 01/12/22 08:51:49:508 Debug( 287): HipCheckThread: Hip check thread quits.
(T1920) 01/12/22 08:51:49:518 Debug( 533): HipMissingPatchThread: Hip check missiing patch thread quits.
(T8772) 01/12/22 08:51:49:528 Debug( 763): HipMonitorThread quits.
(T6164) 01/12/22 08:51:49:528 Debug( 132): All hip collect threads quit gracefully.
(T6164) 01/12/22 08:51:49:528 Debug(5909): StopThreads ends.
(T6164) 01/12/22 08:51:49:528 Debug(5794): StartThreads starts:
(T6000) 01/12/22 08:51:49:528 Debug(2349): Setting debug level to 5
(T6164) 01/12/22 08:51:49:528 Debug( 25): create thread 0x79c with thread ID 6068
(T6164) 01/12/22 08:51:49:528 Debug( 25): create thread 0x724 with thread ID 6716
(T6068) 01/12/22 08:51:49:528 Debug(4082): NotificationTimerThread: notification timer thread starts.
(T6068) 01/12/22 08:51:49:528 Debug(4232): NotificationTimerThread: wait (-1 ms) for notification timer event.
(T6716) 01/12/22 08:51:49:528 Debug(4278): CaptivePortalDetectionThread: captive portal detection thread starts.
(T6716) 01/12/22 08:51:49:528 Debug(4436): CaptivePortalDetectionThread: wait (-1 ms) for captive portal detection event.
(T6164) 01/12/22 08:51:49:528 Debug( 25): create thread 0x6e8 with thread ID 13212
(T6164) 01/12/22 08:51:49:528 Debug( 25): create thread 0x370 with thread ID 2544
(T13212) 01/12/22 08:51:49:528 Debug(4613): NetworkDiscoverThread: network discover thread starts.
(T13212) 01/12/22 08:51:49:528 Debug(4638): NetworkDiscoverThread: wait for network discover event.
(T6164) 01/12/22 08:51:49:528 Debug( 25): create thread 0x67c with thread ID 4632
(T2544) 01/12/22 08:51:49:528 Debug(5122): HipReportThread: HipReportThread starts up.
(T2544) 01/12/22 08:51:49:528 Debug(5155): HipReportThread: wait for HIP report ready event.
(T4632) 01/12/22 08:51:49:528 Debug(5470): NetworkConnectionMonitorThread: network connection monitor thread starts.
(T6164) 01/12/22 08:51:49:528 Debug( 25): create thread 0x690 with thread ID 3556
(T3556) 01/12/22 08:51:49:528 Debug( 167): Start HipCheckThread
(T3556) 01/12/22 08:51:49:528 Debug( 210): HipCheckThread started...
(T3556) 01/12/22 08:51:49:528 Debug( 216): HipCheckThread: wait for hip check event for 3600000 ms);
(T6164) 01/12/22 08:51:49:528 Debug( 25): create thread 0x7e4 with thread ID 13844
(T6164) 01/12/22 08:51:49:528 Debug( 25): create thread 0x790 with thread ID 3388
(T13844) 01/12/22 08:51:49:528 Debug( 176): Start HipMissingPatchThread
(T13844) 01/12/22 08:51:49:528 Debug( 409): HipMissingPatchThread started...
(T13844) 01/12/22 08:51:49:528 Debug( 442): HipMissingPatchThread: now is 1641937909, last hip check is 1641937654, hip check interval is 3600000
(T13844) 01/12/22 08:51:49:528 Debug( 447): HipMissingPatchThread: wait 3345000 ms
(T3388) 01/12/22 08:51:49:528 Debug( 186): Start HipMonitorThread
(T3388) 01/12/22 08:51:49:528 Info ( 759): HipMonitorThread starts
(T6164) 01/12/22 08:51:49:528 Debug(2179): No user, using SSO
(T6164) 01/12/22 08:51:49:528 Debug(9388): Saved password is empty.
(T6164) 01/12/22 08:51:49:528 Debug(2239): Portal 144.xxx.xxx.xxx, user , logonDomain xxxxxxx, saved user xxxxxxx, path C:\Users\xxxxxxx\AppData\Local\Palo Alto Networks\GlobalProtect\
(T6164) 01/12/22 08:51:49:528 Debug(2363): Pre-logon-then-on-demand value is no
(T6164) 01/12/22 08:51:49:528 Debug(1520): SSO starts.
(T6164) 01/12/22 08:51:49:528 Debug(1541): SSO ------ username = xxxxxxx\xxxxxxx
(T6164) 01/12/22 08:51:49:528 Debug(1560): SSO GetSsoCredential starts.
(T6164) 01/12/22 08:51:49:528 Debug(1581): SSO ------ username = xxxxxxx\xxxxxxxx
(T6164) 01/12/22 08:51:49:528 Debug(2463): m_preUsername xxxxxxxxx
(T6164) 01/12/22 08:51:49:528 Debug(2484): CheckCachedPortalForPrelogon 0, PrelogonNeedTimeout 0, RenameTimeout -1, userName xxxxxxxx, preUsername xxxxxxxxx
(T6164) 01/12/22 08:51:49:528 Debug(2619): Use ssl tunnel is no
(T6164) 01/12/22 08:51:49:528 Debug(5942): --Set state to Retrieving configuration...
(T6164) 01/12/22 08:51:49:528 Debug(1896): unknown network type.
(T6164) 01/12/22 08:51:49:528 Debug( 914): Display hip report V4 on the UI
(T3388) 01/12/22 08:51:49:528 Debug( 413): HipMonitorThread wait for exit event.
(T6164) 01/12/22 08:51:49:528 Debug( 923): Hip report changed. Include it in status message to client.
(T6164) 01/12/22 08:51:49:538 Debug(6988): SSO enable status is 1, user name is xxxxxxxxx, domain name is xxxxxxx.
(T6164) 01/12/22 08:51:49:538 Debug(2182): open http session. agent is PAN GlobalProtect/5.0.10-3 (Microsoft Windows 10 Pro , 64-bit)
(T6164) 01/12/22 08:51:49:538 Debug( 456): winhttp SetSecureProtocol, hSession=5b998d30, bAllProtocol=0, gbFips=0
(T6164) 01/12/22 08:51:49:538 Debug( 456): winhttp SetSecureProtocol, hSession=5b999010, bAllProtocol=0, gbFips=0
(T6164) 01/12/22 08:51:49:538 Debug(1655): SetProxyForHost(https://144.xxx.xxx.xxx/😞 timeout:60 AutoDetect:1 url: proxy: bypass: proxystr:
(T6164) 01/12/22 08:51:49:538 Debug(5987): ----Portal Pre-login starts----
(T6164) 01/12/22 08:51:49:538 Debug(4312): TriggerCaptivePortalDetection() return due to captive portal detection is in progress (0) or PreLogin is Done (1)
(T6164) 01/12/22 08:51:49:538 Debug( 550): Network is reachable
(T6164) 01/12/22 08:51:49:538 Debug(6020): Pre-login...,verifyportalcert=yes
(T6164) 01/12/22 08:51:49:538 Debug(9762): Check cert of server 144.xxx.xxx.xxx
(T6164) 01/12/22 08:51:49:538 Debug(9777): File C:\Program Files\Palo Alto Networks\GlobalProtect\tca.cer does not exist.
(T6164) 01/12/22 08:51:49:538 Debug( 777): SSL connecting to 144.xxx.xxx.xxx
(T6164) 01/12/22 08:51:49:555 Debug( 550): Network is reachable
(T6164) 01/12/22 08:51:49:628 Debug(1242): Failed to X509_LOOKUP_load_file
(T6164) 01/12/22 08:51:49:628 Debug( 363): Open_SSL_connection: subject '/CN=vpn.xxxxxxxxxx.com'
(T6164) 01/12/22 08:51:49:628 Debug( 367): Open_SSL_connection: issuer '/C=US/O=DigiCert Inc/CN=RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1'
(T6164) 01/12/22 08:51:49:628 Debug( 965): Hostname 144.xxx.xxx.xxx doesn't matche sub alt name vpn.xxxxxxxxxxx.com
(T6164) 01/12/22 08:51:49:628 Debug( 987): Hostname 144.xxx.xxx.xxx doesn't match sub alt name or no sub alt name, fallback to CN
(T6164) 01/12/22 08:51:49:628 Debug(1023): Hostname 144.xxx.xxx.xxx NOT match vpn.xxxxxxxxxx.com
(T6164) 01/12/22 08:51:49:628 Debug(1318): OpenSSL alert write⚠️close notify
(T6164) 01/12/22 08:51:49:628 Debug(2625): encpostdata, encpostdata=000001EC5BBE7C20, encpostdatalen=160
(T6164) 01/12/22 08:51:49:628 Debug(2794): REQID=30,IPADDR=144.xxx.xxx.xxx,PORT=443,URL=/global-protect/prelogin.esp,POST=1,PROXY_AUTO=1,PROXY_CFGURL=NULL,PROXY=NULL,PROXY_BYPASS=NULL,PROXY_USER=NULL,PROXY_PASS=****,VERIFY_CERT=1,ADDITIONAL_CHECK=1,SCEP_CERT=,oid=
(T6164) 01/12/22 08:51:49:628 Debug(1302): Send response to client for request https_request
(T6164) 01/12/22 08:51:49:748 Debug(2904): receive pan_msg_ping, 3
(T6164) 01/12/22 08:51:49:848 Debug(6120): prelogin to portal result is
<?xml version="1.0" encoding="UTF-8" ?>
<prelogin-response>
<status>Success</status>
<ccusername></ccusername>
<autosubmit>false</autosubmit>
<msg></msg>
<newmsg></newmsg>
<authentication-message>Enter login credentials</authentication-message>
<username-label>Username</username-label>
<password-label>Password</password-label>
<panos-version>1</panos-version><region>AU</region>
</prelogin-response>
(T6164) 01/12/22 08:51:49:848 Debug(6374): Failed to pre-login to the portal 144.xxx.xxx.xxx with return value 0(0).
(T6164) 01/12/22 08:51:49:848 Debug(7227): Try to restore last portal config from file.
(T6164) 01/12/22 08:51:49:848 Debug( 41): Roaming profile is false
(T6164) 01/12/22 08:51:49:855 Debug( 167): profileInfo username xxxxxxx, profile path (null), server (null)
(T6164) 01/12/22 08:51:49:858 Debug(12252): Saved cache portal configuration hash does not exist
(T6164) 01/12/22 08:51:49:858 Debug(7238): last portal config is restored from file C:\Users\xxxxxxxx\AppData\Local\Palo Alto Networks\GlobalProtect\PanPortalCfg_923a7c2f1070da1789c0f151fbc88529.dat.
(T6164) 01/12/22 08:51:49:858 Debug(11621): REGION-PRIO, cached region code is AU
(T6164) 01/12/22 08:51:49:858 Debug( 696): No internal host detection defined
(T6164) 01/12/22 08:51:49:858 Debug( 784): REGION-PRIO, gateway 0(xxxxxx Gateway), 0, region = Any, priority = 1, portalRegion=AU
(T6164) 01/12/22 08:51:49:858 Debug( 413): REGION-PRIO, regioncode=AU, return priority 1, bManual=0
(T6164) 01/12/22 08:51:49:858 Debug( 889): No internal gateway defined
(T6164) 01/12/22 08:51:49:858 Debug( 908): Optional client-cert does not exist
(T6164) 01/12/22 08:51:49:858 Debug( 945): Optional root-ca does not exist
(T6164) 01/12/22 08:51:49:858 Debug(8490): Use proxy is true
(T6164) 01/12/22 08:51:49:858 Debug( 41): Roaming profile is false
(T6164) 01/12/22 08:51:49:868 Debug( 167): profileInfo username dranabahu, profile path (null), server (null)
(T6164) 01/12/22 08:51:49:878 Debug( 82): Saved portal config to file C:\Users\xxxxxxx\AppData\Local\Palo Alto Networks\GlobalProtect\PanPortalCfg_923a7c2f1070da1789c0f151fbc88529.dat.
(T6164) 01/12/22 08:51:49:878 Debug(1603): Proxy auto detect is not needed
(T6164) 01/12/22 08:51:49:878 Debug(8534): RefreshPortalConfig is yes, RefreshPortalConfigInterval is 24 hours
(T6164) 01/12/22 08:51:49:878 Debug(1786): SerializePortalConfigDigest to file C:\Users\xxxxxxx\AppData\Local\Palo Alto Networks\GlobalProtect\PanPCD_923a7c2f1070da1789c0f151fbc88529.dat
(T6164) 01/12/22 08:51:49:878 Debug(1787): Portal config digest is 15fcedd6e958244cbb42d9022ee5cf6f
(T6164) 01/12/22 08:51:49:878 Debug(10899): kerberos, dynamic config value is yes, m_stopOnKerberosFail=0
(T6164) 01/12/22 08:51:49:878 Debug(10929): Timeout value: portal 30, connect 60, receive 30, retry 5
(T6164) 01/12/22 08:51:49:878 Debug(10932): Tunnel retry grace period is 1800 seconds
(T6164) 01/12/22 08:51:49:878 Debug(10935): override-cc-username is no
(T6164) 01/12/22 08:51:49:878 Debug(8574): Scep certificate renew period is 7 days. Scep cert auth cookie length is 0
(T6164) 01/12/22 08:51:49:878 Debug(8585): Otp portal 0, otp internal gateway 0, otp auto external gateway 0, otp manual only external gateway 0
(T6164) 01/12/22 08:51:49:878 Debug(8590): Prefer ipv6 is 1 after processing portal configuration.
(T6164) 01/12/22 08:51:49:878 Debug(10431): No scep profile
(T6164) 01/12/22 08:51:49:878 Debug(7248): this version of portal config is supported.
(T6164) 01/12/22 08:51:49:878 Debug(7216): portal status is Using cached portal config.
(T6164) 01/12/22 08:51:49:878 Debug(11163): Enforcer is not enabled
(T6164) 01/12/22 08:51:50:148 Debug(1700): Enforcer,found 0 filter object belonging to us.
(T6164) 01/12/22 08:51:50:153 Info (8134): Optional tag root-ca does not exist.
(T6164) 01/12/22 08:51:50:153 Debug(8238): client cert is empty in portal config
(T6164) 01/12/22 08:51:50:153 Debug(2420): Client cert is empty, no need to import to store
(T6164) 01/12/22 08:51:50:153 Info (7450): Connect method is user-logon
(T6164) 01/12/22 08:51:50:153 Debug(7461): On-demand mode is false.
(T6164) 01/12/22 08:51:50:153 Debug(8787): SavePrelogon: Portal is 144.xxx.xxx.xxx, PrelogonEnabled is 0
(T6164) 01/12/22 08:51:50:153 Debug( 477): Saved hip policy to file HipPolicy.dat.
(T6164) 01/12/22 08:51:50:153 Debug(7494): Hip check interval is 3600000 ms.
(T6164) 01/12/22 08:51:50:153 Debug(7498): Set check hip event
(T6164) 01/12/22 08:51:50:153 Debug( 809): m_bScheduleFlag is set to 0
(T6164) 01/12/22 08:51:50:153 Debug( 297): Set hip check event.
(T6164) 01/12/22 08:51:50:153 Debug(7500): Set hip missing patch check event.
(T3556) 01/12/22 08:51:50:153 Info ( 246): HipCheckThread: got check hip event or time out.
(T6164) 01/12/22 08:51:50:153 Debug(1646): Serialize empty cookie for portal 144.xxx.xxx.xxx and user xxxxxx
(T3556) 01/12/22 08:51:50:153 Debug( 255): HipCheckThread: Got CheckHipEvent.
(T13844) 01/12/22 08:51:50:153 Debug( 452): HipMissingPatchThread: Got CheckHipMissingPatchEvent.
(T3556) 01/12/22 08:51:50:153 Debug( 787): SetNextScheduledHipCheckTime to 1641941510
(T13844) 01/12/22 08:51:50:153 Debug( 386): CheckHipMissingPatchInOtherProcess()
(T3556) 01/12/22 08:51:50:153 Debug( 276): Last hip check event wakeup tick is 1641937910
(T13844) 01/12/22 08:51:50:153 Debug( 389): Need to check missing patch.
(T3556) 01/12/22 08:51:50:153 Debug( 278): HipCheckThread: check hip in other process.
(T3556) 01/12/22 08:51:50:153 Debug( 306): CheckHipInOtherProcess()
(T3556) 01/12/22 08:51:50:153 Debug( 310): Need to collect hip data
(T6164) 01/12/22 08:51:50:153 Debug( 41): Roaming profile is false
(T13844) 01/12/22 08:51:50:153 Debug( 310): CheckHipMissingPatchInOtherProcess(): Starting process PanGpHipMp.exe
(T3556) 01/12/22 08:51:50:153 Debug( 117): Starting process PanGpHip.exe
(T3556) 01/12/22 08:51:50:158 Debug( 135): Wait for the ready event of hip report generated in other process.
(T6164) 01/12/22 08:51:50:163 Debug( 167): profileInfo username dranabahu, profile path (null), server (null)
(T6164) 01/12/22 08:51:50:188 Debug(1738): Serialized portal user auth cookie to file C:\Users\xxxxxxx\AppData\Local\Palo Alto Networks\GlobalProtect\PanPUAC_923a7c2f1070da1789c0f151fbc88529.dat. 162 bytes.
(T6164) 01/12/22 08:51:50:188 Debug(1529): Serialize empty cookie for portal 144.xxx.xxx.xxx and pre-logon user
(T6164) 01/12/22 08:51:50:188 Debug(1536): SerializePortalPrelogonAuthCookie to file PanPPAC_15a2b5ab57d1837e13ffccf8e75c3c.dat
(T6164) 01/12/22 08:51:50:188 Debug(7586): Retrieved pre-logon-tunnel-rename-timeout value -1
(T6164) 01/12/22 08:51:50:188 Debug(7594): Retrieved user-switch-tunnel-rename-timeout value 0
(T6164) 01/12/22 08:51:50:188 Debug(7605): Retrieved preserve-tunnel-upon-user-logoff-timeout value 0
(T6164) 01/12/22 08:51:50:188 Debug(7618): Set preserver tunnel timeout to 0
(T6164) 01/12/22 08:51:50:188 Debug(7630): The value of can-continue-if-portal-cert-invalid is yes
(T6164) 01/12/22 08:51:50:188 Debug(6623): prelogon status is 0
(T6164) 01/12/22 08:51:50:188 Debug(6792): Force discovery, set NetworkDiscoverEvent
(T13212) 01/12/22 08:51:50:188 Debug( 517): Set hip report quit event
(T13212) 01/12/22 08:51:50:188 Debug(4654): NetworkDiscoverThread: got network discover event.
(T13212) 01/12/22 08:51:50:188 Debug(4661): ----Network Discover starts----
(T13212) 01/12/22 08:51:50:188 Debug( 787): SetNextScheduledHipCheckTime to 0
(T13212) 01/12/22 08:51:50:188 Debug( 809): m_bScheduleFlag is set to 0
(T13212) 01/12/22 08:51:50:188 Debug(4673): UpdatePrelogonStateForSSO to GP_VPN_STATUS_DISCONNECTED
(T13212) 01/12/22 08:51:50:188 Debug(4116): UpdatePrelogonStateForSSO() - User-logon tunnel state = Disconnected
(T6164) 01/12/22 08:51:50:188 Debug(1302): Send response to client for request hip
(T13212) 01/12/22 08:51:50:208 Debug( 550): Network is reachable
(T13212) 01/12/22 08:51:50:208 Debug(1928): bNetworkAvailable is 1
(T13212) 01/12/22 08:51:50:208 Debug(1936): Network is available
(T13212) 01/12/22 08:51:50:208 Debug(4678): finish check host reachable
(T13212) 01/12/22 08:51:50:208 Debug(5942): --Set state to Discovering network...
(T13212) 01/12/22 08:51:50:208 Debug(1896): unknown network type.
(T13212) 01/12/22 08:51:50:208 Debug( 914): Display hip report V4 on the UI
(T13212) 01/12/22 08:51:50:208 Debug(4717): Logout gateways before network discover..., bJustResumed=0
(T13212) 01/12/22 08:51:50:208 Debug(4723): Logout gateways before network discover...
(T13212) 01/12/22 08:51:50:208 Debug(1334): Logging out gateway, reason is Network discover
(T13212) 01/12/22 08:51:50:208 Debug(1365): Logging out gateway over
(T13212) 01/12/22 08:51:50:208 Debug(11488): RetrieveClientIpByRemoteHost() - invalid remote host: .
(T13212) 01/12/22 08:51:50:208 Debug( 185): SelectInternalGateways - failed to retrieve client source ipv6!
(T13212) 01/12/22 08:51:50:208 Debug(5077): Process gateway: host vpn.xxxxxxxxx.com, description xxxxxx Gateway
(T6716) 01/12/22 08:51:50:208 Debug(4459): CaptivePortalDetectionThread: IsDetectingCaptivePortal=1, PreLoginIsDone=0
(T6716) 01/12/22 08:51:50:208 Debug(4436): CaptivePortalDetectionThread: wait (2000 ms) for captive portal detection event.
(T13212) 01/12/22 08:51:50:208 Debug(5154): Gateway vpn.xxxxxxxxxxx.com ipv4 address is 144.xxx.xxx.xxx
(T13212) 01/12/22 08:51:50:208 Debug(5222): Gateway vpn.xxxxxxxxxx.com: ipv4 144.xxx.xxx.xxx, ipv6 , FQDN yes
(T13212) 01/12/22 08:51:50:208 Debug(4742): Set network discover in progress
(T13212) 01/12/22 08:51:50:208 Debug(4746): UpdatePrelogonStateForSSO to GP_VPN_STATUS_DISCONNECTED
(T13212) 01/12/22 08:51:50:213 Debug(4116): UpdatePrelogonStateForSSO() - User-logon tunnel state = Disconnected
(T13212) 01/12/22 08:51:50:213 Debug(11668): GetNetworkTypeDS
(T13212) 01/12/22 08:51:50:213 Debug(11671): No ipv6 internal host detection.
(T13212) 01/12/22 08:51:50:213 Debug(1814): Internal host detection is not defined
(T13212) 01/12/22 08:51:50:213 Debug(4807): NetworkDiscoverThread: network type is unknown.
(T13212) 01/12/22 08:51:50:213 Debug(4813): NetworkDiscoverThread: Discover internal network.
(T13212) 01/12/22 08:51:50:213 Info ( 360): Gateway count is 0 for internal network.
(T13212) 01/12/22 08:51:50:213 Error(4834): NetworkDiscoverThread: UNKNOWN_NETWORK (internal host detection is not set) and internal gateway list is empty.
(T13212) 01/12/22 08:51:50:213 Debug(4878): NetworkDiscoverThread: Discover external network.
(T13212) 01/12/22 08:51:50:213 Debug(4911): previous it is 2, now it is 2
(T13212) 01/12/22 08:51:50:213 Debug( 516): Discover external gateway: gateway count is 1, cutoff time is 5, bJustResumed=1
(T13212) 01/12/22 08:51:50:213 Debug( 536): One external gateway vpn.xxxxxxxxx.com, priority=1, manual is 0
(T13212) 01/12/22 08:51:50:213 Debug(2859): Gateway: vpn.xxxxxxxxx.com, client IP: 192.168.86.53
(T13212) 01/12/22 08:51:50:213 Debug(2476): retrieve info of gateway vpn.xxxxxxxxxxxxx.com
(T13212) 01/12/22 08:51:50:213 Debug(2182): open http session. agent is PAN GlobalProtect/5.0.10-3 (Microsoft Windows 10 Pro , 64-bit)
(T13212) 01/12/22 08:51:50:213 Debug( 456): winhttp SetSecureProtocol, hSession=5b99a710, bAllProtocol=0, gbFips=0
(T13212) 01/12/22 08:51:50:213 Debug(2487): Skip setting proxy for creating tunnel to gateway vpn.xxxxxxxxxx.com
(T13212) 01/12/22 08:51:50:213 Debug(3289): m_msp->IsInPreserveTunnel() 0, m_msp->IsPrelogonRenameAuthFail() 0
(T13212) 01/12/22 08:51:50:213 Debug(12160): Set m_bPrelogonRenameAuthFail to 0
(T13212) 01/12/22 08:51:50:213 Debug(3324): ----Gateway Pre-login starts----
(T13212) 01/12/22 08:51:50:213 Debug(9762): Check cert of server 144.xxx.xxx.xxx
(T13212) 01/12/22 08:51:50:218 Debug(9777): File C:\Program Files\Palo Alto Networks\GlobalProtect\tca.cer does not exist.
(T13212) 01/12/22 08:51:50:218 Debug( 777): SSL connecting to 144.xxx.xxx.xxx
(T13212) 01/12/22 08:51:50:223 Debug( 550): Network is reachable
(T13212) 01/12/22 08:51:50:318 Debug(1242): Failed to X509_LOOKUP_load_file
(T13212) 01/12/22 08:51:50:318 Debug( 363): Open_SSL_connection: subject '/CN=vpn.xxxxxxx.com'
(T13212) 01/12/22 08:51:50:318 Debug( 367): Open_SSL_connection: issuer '/C=US/O=DigiCert Inc/CN=RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1'
(T13212) 01/12/22 08:51:50:318 Debug( 960): Hostname vpn.basfordbrands.com matches sub alt name vpn.xxxxxx.com
(T13212) 01/12/22 08:51:50:318 Debug(1318): OpenSSL alert write⚠️close notify
(T13212) 01/12/22 08:51:50:318 Debug(3373): m_msp->GetGwSamlAuthStatus() -2, m_msp->IsUserJustLoginInPrelogon() 0, m_msp->IsPrelogonRenameAuthFail() 0
(T13212) 01/12/22 08:51:50:318 Debug(3394): IsSamlAuth() 0, IsManualGatewayChallenge() 0, pwszConnectedIP null
(T13212) 01/12/22 08:51:50:318 Debug(9979): Need to check gateway cert for vpn.xxxxxxxxxxx.com
(T13212) 01/12/22 08:51:50:318 Debug(2625): encpostdata, encpostdata=000001EC5B9206D0, encpostdatalen=160
(T13212) 01/12/22 08:51:50:318 Debug(2794): REQID=31,IPADDR=vpn.xxxxxxxxxx.com,PORT=443,URL=/ssl-vpn/prelogin.esp,POST=1,PROXY_AUTO=1,PROXY_CFGURL=NULL,PROXY=NULL,PROXY_BYPASS=NULL,PROXY_USER=NULL,PROXY_PASS=****,VERIFY_CERT=1,ADDITIONAL_CHECK=1,SCEP_CERT=,oid=
(T13212) 01/12/22 08:51:50:418 Debug(1302): Send response to client for request https_request
(T13212) 01/12/22 08:51:50:518 Debug(2904): receive pan_msg_ping, 3
(T13212) 01/12/22 08:51:50:608 Debug(3436): Login to gateway (null) vpn.xxxxxxxxxx.com without ipv6
(T13212) 01/12/22 08:51:50:608 Debug(10011): StopCaptivePortalDetection() captive portal detection is in progress
(T6716) 01/12/22 08:51:50:608 Debug(4459): CaptivePortalDetectionThread: IsDetectingCaptivePortal=0, PreLoginIsDone=1
(T6716) 01/12/22 08:51:50:608 Debug(4436): CaptivePortalDetectionThread: wait (-1 ms) for captive portal detection event.
(T13212) 01/12/22 08:51:50:608 Debug(3466): Pre-login response is <?xml version="1.0" encoding="UTF-8" ?>
<prelogin-response>
<status>Success</status>
<ccusername></ccusername>
<autosubmit>false</autosubmit>
<msg></msg>
<newmsg></newmsg>
<license>no</license>
<authentication-message>Enter login credentials</authentication-message>
<username-label>Username</username-label>
<password-label>Password</password-label>
<panos-version>1</panos-version><region>AU</region>
</prelogin-response>
(T13212) 01/12/22 08:51:50:608 Debug(3482): REGION-PRIO, gateway region code is AU
(T13212) 01/12/22 08:51:50:608 Debug(3514): REGION-PRIO, portal and gateway have same region code!
(T13212) 01/12/22 08:51:50:608 Debug(6122): Auth message is Enter login credentials for gateway vpn.xxxxxxxxxxx.com
(T13212) 01/12/22 08:51:50:608 Debug(6150): Gateway license no, license-v6 yes
(T13212) 01/12/22 08:51:50:608 Debug(3721): ----Gateway Login starts----
(T13212) 01/12/22 08:51:50:608 Debug(10166): Set to service bUseCCUserGateway 0 and ccUserNameGateway
(T13212) 01/12/22 08:51:50:608 Debug(2095): Update user name from to xxxxxxxxx
(T13212) 01/12/22 08:51:50:608 Debug(5744): OtpSaveCredential is save_username
(T13212) 01/12/22 08:51:50:608 Debug(5782): External network gateway without OTP authentication
(T13212) 01/12/22 08:51:50:608 Debug(5807): SSO is enabled. Using SSO credential to login to gateway.
(T13212) 01/12/22 08:51:50:608 Debug( 41): Roaming profile is false
(T13212) 01/12/22 08:51:50:608 Debug( 167): profileInfo username xxxxxxx, profile path (null), server (null)
(T13212) 01/12/22 08:51:50:618 Debug(1632): Unserialized empty cookie for portal 144.xxx.xxx.xxx and user xxxxxxxx
(T13212) 01/12/22 08:51:50:618 Debug(1561): Unserialized empty cookie for portal 144.xxx.xxx.xxx and pre-logon user.
(T13212) 01/12/22 08:51:50:618 Debug(3780): bIsEmptyUser is 0, bDPGCforManualOnlyGateway is 0, bDPGCNotforManualOnlyGateway is 0
(T13212) 01/12/22 08:51:50:618 Debug(10166): Set to service bUseCCUserGateway 0 and ccUserNameGateway
(T13212) 01/12/22 08:51:50:618 Debug( 41): Roaming profile is false
(T13212) 01/12/22 08:51:50:618 Debug( 167): profileInfo username xxxxxxxx, profile path (null), server (null)
(T13212) 01/12/22 08:51:50:628 Debug(1632): Unserialized empty cookie for portal 144.xxx.xxx.xxx and user xxxxxxxxx
(T13212) 01/12/22 08:51:50:628 Debug(1561): Unserialized empty cookie for portal 144.xxx.xxx.xxx and pre-logon user.
(T13212) 01/12/22 08:51:50:628 Debug(6841): use cached deviceSN
(T13212) 01/12/22 08:51:50:628 Debug(5544): Get preferred IPv4 192.168.253.26 for gateway 144.xxx.xxx.xxx and user xxxxxxxx
(T13212) 01/12/22 08:51:50:628 Debug(5575): Get preferred IPv6 for gateway 144.xxx.xxx.xxx and user xxxxxxxx
(T13212) 01/12/22 08:51:50:628 Debug(3921): Actual user for gateway login is xxxxxxxx
(T13212) 01/12/22 08:51:50:628 Debug(3925): Gateway selection type is auto
(T13212) 01/12/22 08:51:50:628 Debug(6841): use cached deviceSN
(T13212) 01/12/22 08:51:50:628 Debug(9979): Need to check gateway cert for vpn.xxxxxxxxxxx.com
(T13212) 01/12/22 08:51:50:628 Debug(2625): encpostdata, encpostdata=000001EC5B92A470, encpostdatalen=512
(T13212) 01/12/22 08:51:50:628 Debug(2794): REQID=32,IPADDR=vpn.xxxxxxxxxx.com,PORT=443,URL=/ssl-vpn/login.esp,POST=1,PROXY_AUTO=1,PROXY_CFGURL=NULL,PROXY=NULL,PROXY_BYPASS=NULL,PROXY_USER=NULL,PROXY_PASS=****,VERIFY_CERT=0,ADDITIONAL_CHECK=1,SCEP_CERT=,oid=
(T13212) 01/12/22 08:51:50:718 Debug(1302): Send response to client for request https_request
(T13212) 01/12/22 08:51:50:838 Debug(2904): receive pan_msg_ping, 3
(T13212) 01/12/22 08:51:50:938 Debug(1646): Serialize empty cookie for portal 144.xxx.xxx.xxx and user xxxxxxxxx
(T13212) 01/12/22 08:51:50:938 Debug( 41): Roaming profile is false
(T13212) 01/12/22 08:51:50:938 Debug( 167): profileInfo username xxxxxxx, profile path (null), server (null)
(T13212) 01/12/22 08:51:50:948 Debug(1738): Serialized portal user auth cookie to file C:\Users\xxxxxxxx\AppData\Local\Palo Alto Networks\GlobalProtect\PanPUAC_923a7c2f1070da1789c0f151fbc88529.dat. 162 bytes.
(T13212) 01/12/22 08:51:50:948 Debug(1529): Serialize empty cookie for portal 144.xxx.xxx.xxx and pre-logon user
(T13212) 01/12/22 08:51:50:948 Debug(1536): SerializePortalPrelogonAuthCookie to file PanPPAC_15a2b5ab57d1837e13ffccf8e75c3c.dat
(T13212) 01/12/22 08:51:50:948 Debug(4323): Gateway vpn.xxxxxxxxxx.com has hip-report-version: 4
(T13212) 01/12/22 08:51:50:948 Debug(4338): Managed is no
(T13212) 01/12/22 08:51:50:948 Debug(4342): Gateway vpn.xxxxxxxxxx.com's location is
(T13212) 01/12/22 08:51:50:948 Debug(10152): NetworkDisoverEventSet is no, RedoNetworkDiscovery is no
(T13212) 01/12/22 08:51:50:948 Debug(2497): ----Tunnel creation starts----
(T13212) 01/12/22 08:51:50:948 Debug(2498): Try to create tunnel with gateway vpn.xxxxxxxxxxx.com
(T13212) 01/12/22 08:51:50:948 Debug(5942): --Set state to Connecting...
(T13212) 01/12/22 08:51:50:948 Debug( 914): Display hip report V4 on the UI
(T13212) 01/12/22 08:51:50:948 Debug(2358): proxy , proxyuser , domain xxxxxxxxx, user xxxxxxxxx, remotehost 144.xxx.xxx.xxx.
(T13212) 01/12/22 08:51:50:948 Debug(6841): use cached deviceSN
(T13212) 01/12/22 08:51:50:958 Debug(2638): Get gateway config.
(T13212) 01/12/22 08:51:50:958 Debug(9979): Need to check gateway cert for vpn.xxxxxxxxxxx.com
(T13212) 01/12/22 08:51:50:958 Debug(2625): encpostdata, encpostdata=000001EC5B9BEC70, encpostdatalen=448
(T13212) 01/12/22 08:51:50:958 Debug(2794): REQID=33,IPADDR=vpn.xxxxxxxxx.com,PORT=443,URL=/ssl-vpn/getconfig.esp,POST=1,PROXY_AUTO=1,PROXY_CFGURL=NULL,PROXY=NULL,PROXY_BYPASS=NULL,PROXY_USER=NULL,PROXY_PASS=****,VERIFY_CERT=0,ADDITIONAL_CHECK=1,SCEP_CERT=,oid=
(T13212) 01/12/22 08:51:51:038 Debug(1302): Send response to client for request https_request
(T13212) 01/12/22 08:51:51:118 Debug(2904): receive pan_msg_ping, 1
(T13212) 01/12/22 08:51:51:118 Debug(2705): gateway vpn.xxxxxxxxxxxx.com's config is
<response status="success">
<need-tunnel>yes</need-tunnel>
<ssl-tunnel-url>/ssl-tunnel-connect.sslvpn</ssl-tunnel-url>
<portal>Basford Gateway-N</portal>
<user>xxxxxxxxxx</user>
<lifetime>2592000</lifetime>
<timeout>10800</timeout>
<disconnect-on-idle>10800</disconnect-on-idle>
<bw-c2s>1000</bw-c2s>
<bw-s2c>1000</bw-s2c>
<gw-address>144.xxx.xxx.xxx</gw-address>
<ip-address>192.168.253.26</ip-address>
<netmask>255.255.255.255</netmask>
<ip-address-preferred>yes</ip-address-preferred>
<dns>
<member>192.168.0.17</member>
<member>192.168.0.18</member>
</dns>
<wins>
</wins>
<dns-suffix>
<member>xxxxxxxxxx.local</member>
</dns-suffix>
<default-gateway>192.168.253.26</default-gateway>
<mtu>0</mtu>
<no-direct-access-to-local-network>no</no-direct-access-to-local-network>
<access-routes>
<member>192.168.0.0/24</member>
<member>192.168.0.17/32</member>
<member>192.168.0.18/32</member>
</access-routes>
<exclude-access-routes>
</exclude-access-routes>
<ipsec>
<udp-port>4501</udp-port>
<ipsec-mode>esp-tunnel</ipsec-mode>
<enc-algo>aes-256-gcm</enc-algo>
<hmac-algo>sha1</hmac-algo>
(T13212) 01/12/22 08:51:51:118 Debug(2731): There is no connected-gw-ip
(T13212) 01/12/22 08:51:51:118 Debug(4404): In SetGatewayRoute: The original route table:
(T13212) 01/12/22 08:51:51:118 Debug( 138): Destination NetMask Gateway Inf Metric
(T13212) 01/12/22 08:51:51:118 Debug( 153): 0.0.0.0 0.0.0.0 192.168.86.1 11 35
(T13212) 01/12/22 08:51:51:118 Debug( 153): 127.0.0.0 255.0.0.0 127.0.0.1 1 331
(T13212) 01/12/22 08:51:51:118 Debug( 153): 127.0.0.1 255.255.255.255 127.0.0.1 1 331
(T13212) 01/12/22 08:51:51:118 Debug( 153): 127.255.255.255 255.255.255.255 127.0.0.1 1 331
(T13212) 01/12/22 08:51:51:118 Debug( 153): 192.168.86.0 255.255.255.0 192.168.86.53 11 291
(T13212) 01/12/22 08:51:51:118 Debug( 153): 192.168.86.53 255.255.255.255 192.168.86.53 11 291
(T13212) 01/12/22 08:51:51:118 Debug( 153): 192.168.86.255 255.255.255.255 192.168.86.53 11 291
(T13212) 01/12/22 08:51:51:118 Debug( 153): 224.0.0.0 240.0.0.0 127.0.0.1 1 331
(T13212) 01/12/22 08:51:51:118 Debug( 153): 224.0.0.0 240.0.0.0 192.168.86.53 11 291
(T13212) 01/12/22 08:51:51:118 Debug( 153): 255.255.255.255 255.255.255.255 127.0.0.1 1 331
(T13212) 01/12/22 08:51:51:118 Debug( 153): 255.255.255.255 255.255.255.255 192.168.86.53 11 291
(T13212) 01/12/22 08:51:51:118 Debug(4414): SetGatewayRoute: GetBestRoute() returns Dest:0.0.0.0 Mask:0.0.0.0 if_index=11 metric1=35
(T13212) 01/12/22 08:51:51:118 Debug(4436): Created gateway route (144.xxx.xxx.xxx) succeeds
(T13212) 01/12/22 08:51:51:118 Debug( 271): Ipv6-connection is NULL
(T13212) 01/12/22 08:51:51:118 Debug( 318): gw-address-v6 is not specified
(T13212) 01/12/22 08:51:51:118 Debug( 324): remoteHostV6 is not specified
(T13212) 01/12/22 08:51:51:118 Debug( 349): ip-address-preferred value is yes
(T13212) 01/12/22 08:51:51:118 Debug( 374): ip-address-v6-preferred not found.
(T13212) 01/12/22 08:51:51:118 Debug(9707): Set preferred IP 192.168.253.26 for gateway 144.xxx.xxx.xxx user xxxxxxxxx
(T13212) 01/12/22 08:51:51:118 Debug(9716): Set preferred IPv6 for gateway 144.xxx.xxx.xxx user xxxxxxxxx
(T13212) 01/12/22 08:51:51:118 Debug( 514): DLSA, found no-direct-access-to-local-network tag, b_IsDLSASet set to false
(T13212) 01/12/22 08:51:51:118 Debug( 757): Encryption method is aes-256-gcm
(T13212) 01/12/22 08:51:51:118 Debug(3233): set driver connected as true
(T13212) 01/12/22 08:51:51:118 Debug( 594): use-ssl-only-tunnel is not configured and user cannnot change
(T13212) 01/12/22 08:51:51:118 Debug( 147): VPN idle timeout is 10800; config timeout is 10800
(T13212) 01/12/22 08:51:51:118 Debug( 70): c2s-spi is 0x40FDCF92, s2c-spi is 0xFDB3FD9C
(T13212) 01/12/22 08:51:51:118 Debug( 189): EnforceDns is enabled, set 2 GP pushed DNS servers
(T13212) 01/12/22 08:51:51:118 Debug( 164): Trying to do ipsec connection to 144.xxx.xxx.xxx[4501]
(T13212) 01/12/22 08:51:51:128 Debug( 550): Network is reachable
(T13212) 01/12/22 08:51:51:128 Info ( 176): Connected to: 144.xxx.xxx.xxx[4501], Sending keep alive to ipsec socket...
(T13212) 01/12/22 08:51:51:148 Info ( 214): Connected ipsec to 144.xxx.xxx.xxx(4501)
(T13212) 01/12/22 08:51:51:148 Info ( 329): tunnel to 144.xxx.xxx.xxx connected
(T13212) 01/12/22 08:51:51:288 Debug( 349): PsvRegister done
(T13212) 01/12/22 08:51:51:288 Debug( 25): create thread 0x4d0 with thread ID 1628
(T1628) 01/12/22 08:51:51:288 Debug( 398): VpnProcMonitor thread starts
(T1628) 01/12/22 08:51:51:288 Debug( 25): create thread 0x680 with thread ID 4752
(T4752) 01/12/22 08:51:51:288 Debug( 409): VpnProcDrv thread starts
(T13212) 01/12/22 08:51:51:298 Debug(1610): Get original UseDomainNameDevolution value 1
(T13212) 01/12/22 08:51:51:298 Debug(1636): Get original DNS SearchList value xxxxxxxxx.local,lan
(T13212) 01/12/22 08:51:51:298 Debug(1657): searchList: xxxxxxxxx.local
(T13212) 01/12/22 08:51:51:298 Debug(1657): searchList: lan
(T13212) 01/12/22 08:51:51:298 Error(1566): InstallClientConfig: Failed to find PANGP virtual adapter interface
(T6000) 01/12/22 08:51:51:298 Debug(2349): Setting debug level to 5
(T13212) 01/12/22 08:51:51:308 Error( 343): InstallClientConfig() failed
(T13212) 01/12/22 08:51:51:308 Error( 248): ProcMonitor: SetupNetwork() failed
(T1628) 01/12/22 08:51:51:308 Info ( 471): PktProcess: VPN disconnect event, get out of ProcMonitor
(T1628) 01/12/22 08:51:51:308 Debug( 544): Tunnel downtime is 16 miliseconds
(T4752) 01/12/22 08:51:51:308 Info ( 832): ProDrv: VPN disconnect event, get out of ProcDrv
(T4752) 01/12/22 08:51:51:308 Info ( 858): ProcDrv thread dies
(T1628) 01/12/22 08:51:51:308 Info ( 805): ProcDrv quit
(T1628) 01/12/22 08:51:51:308 Info ( 791): ProcMonitor thread dies
(T13212) 01/12/22 08:51:51:418 Debug( 293): do_disconnect is called in VPN stop
(T13212) 01/12/22 08:51:51:418 Debug( 227): IPSec anti-replay statistics: outside window count 0, replay count 0
(T13212) 01/12/22 08:51:51:418 Debug( 229): Disconnect udp socket
(T13212) 01/12/22 08:51:51:418 Debug( 505): unset network
(T13212) 01/12/22 08:51:51:418 Debug( 764): PreviousDNSInfo doesn't exist, no need to restore
(T13212) 01/12/22 08:51:51:418 Info ( 528): not call uninstallClientConfig, netSetup=000001EC5ADABDB0, clientConfig=000001EC5B9AE6F0, panMSService=000001EC5ADD25C0, panMSService->IsConfigInstalled()=0
(T13212) 01/12/22 08:51:51:418 Debug( 615): ipsec failed to start
(T13212) 01/12/22 08:51:51:418 Info ( 87): VPN is deleted
(T13212) 01/12/22 08:51:51:418 Debug( 147): VPN idle timeout is 10800; config timeout is 10800
(T13212) 01/12/22 08:51:51:418 Debug( 189): EnforceDns is enabled, set 2 GP pushed DNS servers
(T13212) 01/12/22 08:51:51:418 Debug( 62): Trying to do SSL connection to 144.xxx.xxx.xxx(443)
(T13212) 01/12/22 08:51:51:418 Debug( 777): SSL connecting to 144.xxx.xxx.xxx
(T13212) 01/12/22 08:51:51:428 Debug( 550): Network is reachable
(T13212) 01/12/22 08:51:51:498 Debug(1242): Failed to X509_LOOKUP_load_file
(T13212) 01/12/22 08:51:51:498 Debug( 363): Open_SSL_connection: subject '/CN=vpn.xxxxxxxxxx.com'
(T13212) 01/12/22 08:51:51:498 Debug( 367): Open_SSL_connection: issuer '/C=US/O=DigiCert Inc/CN=RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1'
(T13212) 01/12/22 08:51:51:518 Info ( 110): Connected ssl tunnel to 144.xxx.xxx.xxx(443)
(T13212) 01/12/22 08:51:51:518 Info ( 329): tunnel to 144.xxx.xxx.xxx connected
(T13212) 01/12/22 08:51:51:588 Debug( 349): PsvRegister done
(T13212) 01/12/22 08:51:51:588 Debug( 25): create thread 0x60c with thread ID 9064
(T9064) 01/12/22 08:51:51:588 Debug( 398): VpnProcMonitor thread starts
(T9064) 01/12/22 08:51:51:588 Debug( 25): create thread 0x794 with thread ID 10648
(T10648) 01/12/22 08:51:51:588 Debug( 409): VpnProcDrv thread starts
(T13212) 01/12/22 08:51:51:598 Debug(1610): Get original UseDomainNameDevolution value 1
(T13212) 01/12/22 08:51:51:598 Debug(1636): Get original DNS SearchList value xxxxxxxxxx.local,lan
(T13212) 01/12/22 08:51:51:598 Debug(1657): searchList: xxxxxxxxxx.local
(T13212) 01/12/22 08:51:51:598 Debug(1657): searchList: lan
(T13212) 01/12/22 08:51:51:598 Error(1566): InstallClientConfig: Failed to find PANGP virtual adapter interface
(T13212) 01/12/22 08:51:51:598 Error( 343): InstallClientConfig() failed
(T13212) 01/12/22 08:51:51:598 Error( 248): ProcMonitor: SetupNetwork() failed
(T9064) 01/12/22 08:51:51:598 Info ( 471): PktProcess: VPN disconnect event, get out of ProcMonitor
(T9064) 01/12/22 08:51:51:598 Debug( 544): Tunnel downtime is 0 miliseconds
(T10648) 01/12/22 08:51:51:598 Info ( 832): ProDrv: VPN disconnect event, get out of ProcDrv
(T10648) 01/12/22 08:51:51:598 Info ( 858): ProcDrv thread dies
(T9064) 01/12/22 08:51:51:598 Info ( 805): ProcDrv quit
(T9064) 01/12/22 08:51:51:598 Info ( 791): ProcMonitor thread dies
(T13212) 01/12/22 08:51:51:718 Debug( 293): do_disconnect is called in VPN stop
(T13212) 01/12/22 08:51:51:718 Debug(1318): OpenSSL alert write⚠️close notify
(T13212) 01/12/22 08:51:51:718 Debug( 505): unset network
(T13212) 01/12/22 08:51:51:718 Debug( 764): PreviousDNSInfo doesn't exist, no need to restore
(T13212) 01/12/22 08:51:51:718 Info ( 528): not call uninstallClientConfig, netSetup=000001EC5ADABDB0, clientConfig=000001EC5B9AE6F0, panMSService=000001EC5ADD25C0, panMSService->IsConfigInstalled()=0
(T13212) 01/12/22 08:51:51:718 Error( 666): sslvpn failed to start
(T13212) 01/12/22 08:51:51:718 Info ( 87): VPN is deleted
(T13212) 01/12/22 08:51:51:718 Error(2448): CreateTunnel: SetConfig() failed
(T13212) 01/12/22 08:51:51:718 Debug(5894): UnsetGatewayRoutes: DeleteIpForwardEntry(144.xxx.xxx.xxx)
(T13212) 01/12/22 08:51:51:718 Debug(5942): --Set state to Connection failed
(T13212) 01/12/22 08:51:51:718 Debug( 914): Display hip report V4 on the UI
(T13212) 01/12/22 08:51:51:718 Debug(2463): VPN tunnel is not connected.
(T13212) 01/12/22 08:51:51:718 Debug(2465): returns FALSE.
(T13212) 01/12/22 08:51:51:718 Debug(2518): failed to create tunnel with gateway vpn.xxxxxxxxxx.com
(T13212) 01/12/22 08:51:51:718 Info (2236): logout: user=xxxxxxx, portal=xxxxxxxx Gateway-N, gateway=vpn.xxxxxxxxx.com, domain=xxxxxxxx, computerName=T9009
(T13212) 01/12/22 08:51:51:718 Debug(2268): Logout parameter is
(T13212) 01/12/22 08:51:51:728 Debug( 777): SSL connecting to 144.xxx.xxx.xxx
(T13212) 01/12/22 08:51:51:728 Debug( 550): Network is reachable
(T13212) 01/12/22 08:51:51:768 Debug(3974): SSL verify succeed
(T13212) 01/12/22 08:51:51:858 Debug(1318): OpenSSL alert write⚠️close notify
(T13212) 01/12/22 08:51:51:858 Debug(2314): Logged out gateway vpn.xxxxxxxxxxx.com
(T13212) 01/12/22 08:51:51:858 Debug(2536): tunnel to vpn.xxxxxxxxx.com is not created.
(T13212) 01/12/22 08:51:51:858 Error(4937): NetworkDiscoverThread: failed to discover external network.
(T13212) 01/12/22 08:51:51:858 Debug(4939): local system error, set error as VPN connection could not be established. Please restart your computer to try again.
(T13212) 01/12/22 08:51:51:858 Debug(5942): --Set state to Disconnected
(T6000) 01/12/22 08:51:51:858 Debug(2349): Setting debug level to 5
(T13212) 01/12/22 08:51:51:858 Debug( 914): Display hip report V4 on the UI
(T13212) 01/12/22 08:51:51:858 Debug(4989): NetworkDiscoverThread: PortalStatus is 2, HasLoggedOnGateway is 1
(T13212) 01/12/22 08:51:51:858 Debug(5005): Network discovery is not ready, set GP VPN status as disconnected
(T13212) 01/12/22 08:51:51:858 Debug(9914): SetVpnStatus called with new status=0, Previous Status=0
(T13212) 01/12/22 08:51:51:858 Debug(4116): UpdatePrelogonStateForSSO() - User-logon tunnel state = Disconnected
(T13212) 01/12/22 08:51:51:858 Debug(5024): local system error, need user action or wait 30 minutes to re-do network discovery
(T3556) 01/12/22 08:52:04:223 Debug( 139): Got hip report in other process ready event.
(T3556) 01/12/22 08:52:04:223 Debug( 158): Read output from PanGpHip.exe
(T3556) 01/12/22 08:52:04:223 Debug( 195): write hip file now
(T3556) 01/12/22 08:52:04:223 Debug( 221): CheckHipInOtherProcess() sets hip report ready event.
(T3556) 01/12/22 08:52:04:223 Debug( 135): Wait for the ready event of hip report generated in other process.
(T2544) 01/12/22 08:52:04:223 Debug(5160): HipReportThread: got HIP report ready event.
(T2544) 01/12/22 08:52:04:223 Debug(5176): HipReportThread: wait for network discover ready event.
(T3556) 01/12/22 08:52:05:403 Debug( 143): Got event for PanGpHip process has quited.
(T3556) 01/12/22 08:52:05:403 Debug( 338): CheckHip over
(T3556) 01/12/22 08:52:05:403 Debug( 282): Hip checking is not initiated by clicking resubmit host profile.
(T3556) 01/12/22 08:52:05:403 Debug( 216): HipCheckThread: wait for hip check event for 3600000 ms);
(T13844) 01/12/22 08:52:09:818 Debug( 334): PanGpHipMp.exe exit for checking misssing patches.
(T13844) 01/12/22 08:52:09:818 Debug( 396): CheckHipMissingPatchInOtherProcess(): exits.
(T13844) 01/12/22 08:52:09:818 Debug( 474): Hip missing patch checking duration is 19

0 Likes Likes

Jason.T
L2 Linker
In response to BPry

‎01-18-2022 04:05 PM

(T13212) 01/12/22 08:51:50:208 Debug(1928): bNetworkAvailable is 1
(T13212) 01/12/22 08:51:50:208 Debug(1936): Network is available
(T13212) 01/12/22 08:51:50:208 Debug(4678): finish check host reachable
(T13212) 01/12/22 08:51:50:208 Debug(5942): --Set state to Discovering network...
(T13212) 01/12/22 08:51:50:208 Debug(1896): unknown network type.
(T13212) 01/12/22 08:51:50:208 Debug( 914): Display hip report V4 on the UI
(T13212) 01/12/22 08:51:50:208 Debug(4717): Logout gateways before network discover..., bJustResumed=0
(T13212) 01/12/22 08:51:50:208 Debug(4723): Logout gateways before network discover...
(T13212) 01/12/22 08:51:50:208 Debug(1334): Logging out gateway, reason is Network discover
(T13212) 01/12/22 08:51:50:208 Debug(1365): Logging out gateway over
(T13212) 01/12/22 08:51:50:208 Debug(11488): RetrieveClientIpByRemoteHost() - invalid remote host: .
(T13212) 01/12/22 08:51:50:208 Debug( 185): SelectInternalGateways - failed to retrieve client source ipv6!
(T13212) 01/12/22 08:51:50:208 Debug(5077): Process gateway: host vpn.xxxxxxxxx.com, description xxxxxx Gateway
(T6716) 01/12/22 08:51:50:208 Debug(4459): CaptivePortalDetectionThread: IsDetectingCaptivePortal=1, PreLoginIsDone=0
(T6716) 01/12/22 08:51:50:208 Debug(4436): CaptivePortalDetectionThread: wait (2000 ms) for captive portal detection event.
(T13212) 01/12/22 08:51:50:208 Debug(5154): Gateway vpn.xxxxxxxxxxx.com ipv4 address is 144.xxx.xxx.xxx
(T13212) 01/12/22 08:51:50:208 Debug(5222): Gateway vpn.xxxxxxxxxx.com: ipv4 144.xxx.xxx.xxx, ipv6 , FQDN yes
(T13212) 01/12/22 08:51:50:208 Debug(4742): Set network discover in progress
(T13212) 01/12/22 08:51:50:208 Debug(4746): UpdatePrelogonStateForSSO to GP_VPN_STATUS_DISCONNECTED
(T13212) 01/12/22 08:51:50:213 Debug(4116): UpdatePrelogonStateForSSO() - User-logon tunnel state = Disconnected
(T13212) 01/12/22 08:51:50:213 Debug(11668): GetNetworkTypeDS
(T13212) 01/12/22 08:51:50:213 Debug(11671): No ipv6 internal host detection.
(T13212) 01/12/22 08:51:50:213 Debug(1814): Internal host detection is not defined
(T13212) 01/12/22 08:51:50:213 Debug(4807): NetworkDiscoverThread: network type is unknown.
(T13212) 01/12/22 08:51:50:213 Debug(4813): NetworkDiscoverThread: Discover internal network.
(T13212) 01/12/22 08:51:50:213 Info ( 360): Gateway count is 0 for internal network.
(T13212) 01/12/22 08:51:50:213 Error(4834): NetworkDiscoverThread: UNKNOWN_NETWORK (internal host detection is not set) and internal gateway list is empty.
(T13212) 01/12/22 08:51:50:213 Debug(4878): NetworkDiscoverThread: Discover external network.
(T13212) 01/12/22 08:51:50:213 Debug(4911): previous it is 2, now it is 2
(T13212) 01/12/22 08:51:50:213 Debug( 516): Discover external gateway: gateway count is 1, cutoff time is 5, bJustResumed=1
(T13212) 01/12/22 08:51:50:213 Debug( 536): One external gateway vpn.xxxxxxxxx.com, priority=1, manual is 0
(T13212) 01/12/22 08:51:50:213 Debug(2859): Gateway: vpn.xxxxxxxxx.com, client IP: 192.168.86.53
(T13212) 01/12/22 08:51:50:213 Debug(2476): retrieve info of gateway vpn.xxxxxxxxxxxxx.com
(T13212) 01/12/22 08:51:50:213 Debug(2182): open http session. agent is PAN GlobalProtect/5.0.10-3 (Microsoft Windows 10 Pro , 64-bit)
(T13212) 01/12/22 08:51:50:213 Debug( 456): winhttp SetSecureProtocol, hSession=5b99a710, bAllProtocol=0, gbFips=0
(T13212) 01/12/22 08:51:50:213 Debug(2487): Skip setting proxy for creating tunnel to gateway vpn.xxxxxxxxxx.com
(T13212) 01/12/22 08:51:50:213 Debug(3289): m_msp->IsInPreserveTunnel() 0, m_msp->IsPrelogonRenameAuthFail() 0
(T13212) 01/12/22 08:51:50:213 Debug(12160): Set m_bPrelogonRenameAuthFail to 0
(T13212) 01/12/22 08:51:50:213 Debug(3324): ----Gateway Pre-login starts----
(T13212) 01/12/22 08:51:50:213 Debug(9762): Check cert of server 144.xxx.xxx.xxx
(T13212) 01/12/22 08:51:50:218 Debug(9777): File C:\Program Files\Palo Alto Networks\GlobalProtect\tca.cer does not exist.
(T13212) 01/12/22 08:51:50:218 Debug( 777): SSL connecting to 144.xxx.xxx.xxx
(T13212) 01/12/22 08:51:50:223 Debug( 550): Network is reachable
(T13212) 01/12/22 08:51:50:318 Debug(1242): Failed to X509_LOOKUP_load_file
(T13212) 01/12/22 08:51:50:318 Debug( 363): Open_SSL_connection: subject '/CN=vpn.xxxxxxx.com'
(T13212) 01/12/22 08:51:50:318 Debug( 367): Open_SSL_connection: issuer '/C=US/O=DigiCert Inc/CN=RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1'
(T13212) 01/12/22 08:51:50:318 Debug( 960): Hostname vpn.basfordbrands.com matches sub alt name vpn.xxxxxx.com
(T13212) 01/12/22 08:51:50:318 Debug(1318): OpenSSL alert write⚠️close notify
(T13212) 01/12/22 08:51:50:318 Debug(3373): m_msp->GetGwSamlAuthStatus() -2, m_msp->IsUserJustLoginInPrelogon() 0, m_msp->IsPrelogonRenameAuthFail() 0
(T13212) 01/12/22 08:51:50:318 Debug(3394): IsSamlAuth() 0, IsManualGatewayChallenge() 0, pwszConnectedIP null
(T13212) 01/12/22 08:51:50:318 Debug(9979): Need to check gateway cert for vpn.xxxxxxxxxxx.com
(T13212) 01/12/22 08:51:50:318 Debug(2625): encpostdata, encpostdata=000001EC5B9206D0, encpostdatalen=160
(T13212) 01/12/22 08:51:50:318 Debug(2794): REQID=31,IPADDR=vpn.xxxxxxxxxx.com,PORT=443,URL=/ssl-vpn/prelogin.esp,POST=1,PROXY_AUTO=1,PROXY_CFGURL=NULL,PROXY=NULL,PROXY_BYPASS=NULL,PROXY_USER=NULL,PROXY_PASS=****,VERIFY_CERT=1,ADDITIONAL_CHECK=1,SCEP_CERT=,oid=
(T13212) 01/12/22 08:51:50:418 Debug(1302): Send response to client for request https_request
(T13212) 01/12/22 08:51:50:518 Debug(2904): receive pan_msg_ping, 3
(T13212) 01/12/22 08:51:50:608 Debug(3436): Login to gateway (null) vpn.xxxxxxxxxx.com without ipv6
(T13212) 01/12/22 08:51:50:608 Debug(10011): StopCaptivePortalDetection() captive portal detection is in progress
(T6716) 01/12/22 08:51:50:608 Debug(4459): CaptivePortalDetectionThread: IsDetectingCaptivePortal=0, PreLoginIsDone=1
(T6716) 01/12/22 08:51:50:608 Debug(4436): CaptivePortalDetectionThread: wait (-1 ms) for captive portal detection event.
(T13212) 01/12/22 08:51:50:608 Debug(3466): Pre-login response is <?xml version="1.0" encoding="UTF-8" ?>
<prelogin-response>
<status>Success</status>
<ccusername></ccusername>
<autosubmit>false</autosubmit>
<msg></msg>
<newmsg></newmsg>
<license>no</license>
<authentication-message>Enter login credentials</authentication-message>
<username-label>Username</username-label>
<password-label>Password</password-label>
<panos-version>1</panos-version><region>AU</region>
</prelogin-response>
(T13212) 01/12/22 08:51:50:608 Debug(3482): REGION-PRIO, gateway region code is AU
(T13212) 01/12/22 08:51:50:608 Debug(3514): REGION-PRIO, portal and gateway have same region code!
(T13212) 01/12/22 08:51:50:608 Debug(6122): Auth message is Enter login credentials for gateway vpn.xxxxxxxxxxx.com
(T13212) 01/12/22 08:51:50:608 Debug(6150): Gateway license no, license-v6 yes
(T13212) 01/12/22 08:51:50:608 Debug(3721): ----Gateway Login starts----
(T13212) 01/12/22 08:51:50:608 Debug(10166): Set to service bUseCCUserGateway 0 and ccUserNameGateway
(T13212) 01/12/22 08:51:50:608 Debug(2095): Update user name from to xxxxxxxxx
(T13212) 01/12/22 08:51:50:608 Debug(5744): OtpSaveCredential is save_username
(T13212) 01/12/22 08:51:50:608 Debug(5782): External network gateway without OTP authentication
(T13212) 01/12/22 08:51:50:608 Debug(5807): SSO is enabled. Using SSO credential to login to gateway.
(T13212) 01/12/22 08:51:50:608 Debug( 41): Roaming profile is false
(T13212) 01/12/22 08:51:50:608 Debug( 167): profileInfo username xxxxxxx, profile path (null), server (null)
(T13212) 01/12/22 08:51:50:618 Debug(1632): Unserialized empty cookie for portal 144.xxx.xxx.xxx and user xxxxxxxx
(T13212) 01/12/22 08:51:50:618 Debug(1561): Unserialized empty cookie for portal 144.xxx.xxx.xxx and pre-logon user.
(T13212) 01/12/22 08:51:50:618 Debug(3780): bIsEmptyUser is 0, bDPGCforManualOnlyGateway is 0, bDPGCNotforManualOnlyGateway is 0
(T13212) 01/12/22 08:51:50:618 Debug(10166): Set to service bUseCCUserGateway 0 and ccUserNameGateway
(T13212) 01/12/22 08:51:50:618 Debug( 41): Roaming profile is false
(T13212) 01/12/22 08:51:50:618 Debug( 167): profileInfo username xxxxxxxx, profile path (null), server (null)
(T13212) 01/12/22 08:51:50:628 Debug(1632): Unserialized empty cookie for portal 144.xxx.xxx.xxx and user xxxxxxxxx
(T13212) 01/12/22 08:51:50:628 Debug(1561): Unserialized empty cookie for portal 144.xxx.xxx.xxx and pre-logon user.
(T13212) 01/12/22 08:51:50:628 Debug(6841): use cached deviceSN
(T13212) 01/12/22 08:51:50:628 Debug(5544): Get preferred IPv4 192.168.253.26 for gateway 144.xxx.xxx.xxx and user xxxxxxxx
(T13212) 01/12/22 08:51:50:628 Debug(5575): Get preferred IPv6 for gateway 144.xxx.xxx.xxx and user xxxxxxxx
(T13212) 01/12/22 08:51:50:628 Debug(3921): Actual user for gateway login is xxxxxxxx
(T13212) 01/12/22 08:51:50:628 Debug(3925): Gateway selection type is auto
(T13212) 01/12/22 08:51:50:628 Debug(6841): use cached deviceSN
(T13212) 01/12/22 08:51:50:628 Debug(9979): Need to check gateway cert for vpn.xxxxxxxxxxx.com
(T13212) 01/12/22 08:51:50:628 Debug(2625): encpostdata, encpostdata=000001EC5B92A470, encpostdatalen=512
(T13212) 01/12/22 08:51:50:628 Debug(2794): REQID=32,IPADDR=vpn.xxxxxxxxxx.com,PORT=443,URL=/ssl-vpn/login.esp,POST=1,PROXY_AUTO=1,PROXY_CFGURL=NULL,PROXY=NULL,PROXY_BYPASS=NULL,PROXY_USER=NULL,PROXY_PASS=****,VERIFY_CERT=0,ADDITIONAL_CHECK=1,SCEP_CERT=,oid=
(T13212) 01/12/22 08:51:50:718 Debug(1302): Send response to client for request https_request
(T13212) 01/12/22 08:51:50:838 Debug(2904): receive pan_msg_ping, 3
(T13212) 01/12/22 08:51:50:938 Debug(1646): Serialize empty cookie for portal 144.xxx.xxx.xxx and user xxxxxxxxx
(T13212) 01/12/22 08:51:50:938 Debug( 41): Roaming profile is false
(T13212) 01/12/22 08:51:50:938 Debug( 167): profileInfo username xxxxxxx, profile path (null), server (null)
(T13212) 01/12/22 08:51:50:948 Debug(1738): Serialized portal user auth cookie to file C:\Users\xxxxxxxx\AppData\Local\Palo Alto Networks\GlobalProtect\PanPUAC_923a7c2f1070da1789c0f151fbc88529.dat. 162 bytes.
(T13212) 01/12/22 08:51:50:948 Debug(1529): Serialize empty cookie for portal 144.xxx.xxx.xxx and pre-logon user
(T13212) 01/12/22 08:51:50:948 Debug(1536): SerializePortalPrelogonAuthCookie to file PanPPAC_15a2b5ab57d1837e13ffccf8e75c3c.dat
(T13212) 01/12/22 08:51:50:948 Debug(4323): Gateway vpn.xxxxxxxxxx.com has hip-report-version: 4
(T13212) 01/12/22 08:51:50:948 Debug(4338): Managed is no
(T13212) 01/12/22 08:51:50:948 Debug(4342): Gateway vpn.xxxxxxxxxx.com's location is
(T13212) 01/12/22 08:51:50:948 Debug(10152): NetworkDisoverEventSet is no, RedoNetworkDiscovery is no
(T13212) 01/12/22 08:51:50:948 Debug(2497): ----Tunnel creation starts----
(T13212) 01/12/22 08:51:50:948 Debug(2498): Try to create tunnel with gateway vpn.xxxxxxxxxxx.com
(T13212) 01/12/22 08:51:50:948 Debug(5942): --Set state to Connecting...
(T13212) 01/12/22 08:51:50:948 Debug( 914): Display hip report V4 on the UI
(T13212) 01/12/22 08:51:50:948 Debug(2358): proxy , proxyuser , domain xxxxxxxxx, user xxxxxxxxx, remotehost 144.xxx.xxx.xxx.
(T13212) 01/12/22 08:51:50:948 Debug(6841): use cached deviceSN
(T13212) 01/12/22 08:51:50:958 Debug(2638): Get gateway config.
(T13212) 01/12/22 08:51:50:958 Debug(9979): Need to check gateway cert for vpn.xxxxxxxxxxx.com
(T13212) 01/12/22 08:51:50:958 Debug(2625): encpostdata, encpostdata=000001EC5B9BEC70, encpostdatalen=448
(T13212) 01/12/22 08:51:50:958 Debug(2794): REQID=33,IPADDR=vpn.xxxxxxxxx.com,PORT=443,URL=/ssl-vpn/getconfig.esp,POST=1,PROXY_AUTO=1,PROXY_CFGURL=NULL,PROXY=NULL,PROXY_BYPASS=NULL,PROXY_USER=NULL,PROXY_PASS=****,VERIFY_CERT=0,ADDITIONAL_CHECK=1,SCEP_CERT=,oid=
(T13212) 01/12/22 08:51:51:038 Debug(1302): Send response to client for request https_request
(T13212) 01/12/22 08:51:51:118 Debug(2904): receive pan_msg_ping, 1
(T13212) 01/12/22 08:51:51:118 Debug(2705): gateway vpn.xxxxxxxxxxxx.com's config is
<response status="success">
<need-tunnel>yes</need-tunnel>
<ssl-tunnel-url>/ssl-tunnel-connect.sslvpn</ssl-tunnel-url>
<portal>Basford Gateway-N</portal>
<user>xxxxxxxxxx</user>
<lifetime>2592000</lifetime>
<timeout>10800</timeout>
<disconnect-on-idle>10800</disconnect-on-idle>
<bw-c2s>1000</bw-c2s>
<bw-s2c>1000</bw-s2c>
<gw-address>144.xxx.xxx.xxx</gw-address>
<ip-address>192.168.253.26</ip-address>
<netmask>255.255.255.255</netmask>
<ip-address-preferred>yes</ip-address-preferred>
<dns>
<member>192.168.0.17</member>
<member>192.168.0.18</member>
</dns>
<wins>
</wins>
<dns-suffix>
<member>xxxxxxxxxx.local</member>
</dns-suffix>
<default-gateway>192.168.253.26</default-gateway>
<mtu>0</mtu>
<no-direct-access-to-local-network>no</no-direct-access-to-local-network>
<access-routes>
<member>192.168.0.0/24</member>
<member>192.168.0.17/32</member>
<member>192.168.0.18/32</member>
</access-routes>
<exclude-access-routes>
</exclude-access-routes>
<ipsec>
<udp-port>4501</udp-port>
<ipsec-mode>esp-tunnel</ipsec-mode>
<enc-algo>aes-256-gcm</enc-algo>
<hmac-algo>sha1</hmac-algo>
(T13212) 01/12/22 08:51:51:118 Debug(2731): There is no connected-gw-ip
(T13212) 01/12/22 08:51:51:118 Debug(4404): In SetGatewayRoute: The original route table:
(T13212) 01/12/22 08:51:51:118 Debug( 138): Destination NetMask Gateway Inf Metric
(T13212) 01/12/22 08:51:51:118 Debug( 153): 0.0.0.0 0.0.0.0 192.168.86.1 11 35
(T13212) 01/12/22 08:51:51:118 Debug( 153): 127.0.0.0 255.0.0.0 127.0.0.1 1 331
(T13212) 01/12/22 08:51:51:118 Debug( 153): 127.0.0.1 255.255.255.255 127.0.0.1 1 331
(T13212) 01/12/22 08:51:51:118 Debug( 153): 127.255.255.255 255.255.255.255 127.0.0.1 1 331
(T13212) 01/12/22 08:51:51:118 Debug( 153): 192.168.86.0 255.255.255.0 192.168.86.53 11 291
(T13212) 01/12/22 08:51:51:118 Debug( 153): 192.168.86.53 255.255.255.255 192.168.86.53 11 291
(T13212) 01/12/22 08:51:51:118 Debug( 153): 192.168.86.255 255.255.255.255 192.168.86.53 11 291
(T13212) 01/12/22 08:51:51:118 Debug( 153): 224.0.0.0 240.0.0.0 127.0.0.1 1 331
(T13212) 01/12/22 08:51:51:118 Debug( 153): 224.0.0.0 240.0.0.0 192.168.86.53 11 291
(T13212) 01/12/22 08:51:51:118 Debug( 153): 255.255.255.255 255.255.255.255 127.0.0.1 1 331
(T13212) 01/12/22 08:51:51:118 Debug( 153): 255.255.255.255 255.255.255.255 192.168.86.53 11 291
(T13212) 01/12/22 08:51:51:118 Debug(4414): SetGatewayRoute: GetBestRoute() returns Dest:0.0.0.0 Mask:0.0.0.0 if_index=11 metric1=35
(T13212) 01/12/22 08:51:51:118 Debug(4436): Created gateway route (144.xxx.xxx.xxx) succeeds
(T13212) 01/12/22 08:51:51:118 Debug( 271): Ipv6-connection is NULL
(T13212) 01/12/22 08:51:51:118 Debug( 318): gw-address-v6 is not specified
(T13212) 01/12/22 08:51:51:118 Debug( 324): remoteHostV6 is not specified
(T13212) 01/12/22 08:51:51:118 Debug( 349): ip-address-preferred value is yes
(T13212) 01/12/22 08:51:51:118 Debug( 374): ip-address-v6-preferred not found.
(T13212) 01/12/22 08:51:51:118 Debug(9707): Set preferred IP 192.168.253.26 for gateway 144.xxx.xxx.xxx user xxxxxxxxx
(T13212) 01/12/22 08:51:51:118 Debug(9716): Set preferred IPv6 for gateway 144.xxx.xxx.xxx user xxxxxxxxx
(T13212) 01/12/22 08:51:51:118 Debug( 514): DLSA, found no-direct-access-to-local-network tag, b_IsDLSASet set to false
(T13212) 01/12/22 08:51:51:118 Debug( 757): Encryption method is aes-256-gcm
(T13212) 01/12/22 08:51:51:118 Debug(3233): set driver connected as true
(T13212) 01/12/22 08:51:51:118 Debug( 594): use-ssl-only-tunnel is not configured and user cannnot change
(T13212) 01/12/22 08:51:51:118 Debug( 147): VPN idle timeout is 10800; config timeout is 10800
(T13212) 01/12/22 08:51:51:118 Debug( 70): c2s-spi is 0x40FDCF92, s2c-spi is 0xFDB3FD9C
(T13212) 01/12/22 08:51:51:118 Debug( 189): EnforceDns is enabled, set 2 GP pushed DNS servers
(T13212) 01/12/22 08:51:51:118 Debug( 164): Trying to do ipsec connection to 144.xxx.xxx.xxx[4501]
(T13212) 01/12/22 08:51:51:128 Debug( 550): Network is reachable
(T13212) 01/12/22 08:51:51:128 Info ( 176): Connected to: 144.xxx.xxx.xxx[4501], Sending keep alive to ipsec socket...
(T13212) 01/12/22 08:51:51:148 Info ( 214): Connected ipsec to 144.xxx.xxx.xxx(4501)
(T13212) 01/12/22 08:51:51:148 Info ( 329): tunnel to 144.xxx.xxx.xxx connected
(T13212) 01/12/22 08:51:51:288 Debug( 349): PsvRegister done
(T13212) 01/12/22 08:51:51:288 Debug( 25): create thread 0x4d0 with thread ID 1628
(T1628) 01/12/22 08:51:51:288 Debug( 398): VpnProcMonitor thread starts
(T1628) 01/12/22 08:51:51:288 Debug( 25): create thread 0x680 with thread ID 4752
(T4752) 01/12/22 08:51:51:288 Debug( 409): VpnProcDrv thread starts
(T13212) 01/12/22 08:51:51:298 Debug(1610): Get original UseDomainNameDevolution value 1
(T13212) 01/12/22 08:51:51:298 Debug(1636): Get original DNS SearchList value xxxxxxxxx.local,lan
(T13212) 01/12/22 08:51:51:298 Debug(1657): searchList: xxxxxxxxx.local
(T13212) 01/12/22 08:51:51:298 Debug(1657): searchList: lan
(T13212) 01/12/22 08:51:51:298 Error(1566): InstallClientConfig: Failed to find PANGP virtual adapter interface
(T6000) 01/12/22 08:51:51:298 Debug(2349): Setting debug level to 5
(T13212) 01/12/22 08:51:51:308 Error( 343): InstallClientConfig() failed
(T13212) 01/12/22 08:51:51:308 Error( 248): ProcMonitor: SetupNetwork() failed
(T1628) 01/12/22 08:51:51:308 Info ( 471): PktProcess: VPN disconnect event, get out of ProcMonitor
(T1628) 01/12/22 08:51:51:308 Debug( 544): Tunnel downtime is 16 miliseconds
(T4752) 01/12/22 08:51:51:308 Info ( 832): ProDrv: VPN disconnect event, get out of ProcDrv
(T4752) 01/12/22 08:51:51:308 Info ( 858): ProcDrv thread dies
(T1628) 01/12/22 08:51:51:308 Info ( 805): ProcDrv quit
(T1628) 01/12/22 08:51:51:308 Info ( 791): ProcMonitor thread dies
(T13212) 01/12/22 08:51:51:418 Debug( 293): do_disconnect is called in VPN stop
(T13212) 01/12/22 08:51:51:418 Debug( 227): IPSec anti-replay statistics: outside window count 0, replay count 0
(T13212) 01/12/22 08:51:51:418 Debug( 229): Disconnect udp socket
(T13212) 01/12/22 08:51:51:418 Debug( 505): unset network
(T13212) 01/12/22 08:51:51:418 Debug( 764): PreviousDNSInfo doesn't exist, no need to restore
(T13212) 01/12/22 08:51:51:418 Info ( 528): not call uninstallClientConfig, netSetup=000001EC5ADABDB0, clientConfig=000001EC5B9AE6F0, panMSService=000001EC5ADD25C0, panMSService->IsConfigInstalled()=0
(T13212) 01/12/22 08:51:51:418 Debug( 615): ipsec failed to start
(T13212) 01/12/22 08:51:51:418 Info ( 87): VPN is deleted
(T13212) 01/12/22 08:51:51:418 Debug( 147): VPN idle timeout is 10800; config timeout is 10800
(T13212) 01/12/22 08:51:51:418 Debug( 189): EnforceDns is enabled, set 2 GP pushed DNS servers
(T13212) 01/12/22 08:51:51:418 Debug( 62): Trying to do SSL connection to 144.xxx.xxx.xxx(443)
(T13212) 01/12/22 08:51:51:418 Debug( 777): SSL connecting to 144.xxx.xxx.xxx
(T13212) 01/12/22 08:51:51:428 Debug( 550): Network is reachable
(T13212) 01/12/22 08:51:51:498 Debug(1242): Failed to X509_LOOKUP_load_file
(T13212) 01/12/22 08:51:51:498 Debug( 363): Open_SSL_connection: subject '/CN=vpn.xxxxxxxxxx.com'
(T13212) 01/12/22 08:51:51:498 Debug( 367): Open_SSL_connection: issuer '/C=US/O=DigiCert Inc/CN=RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1'
(T13212) 01/12/22 08:51:51:518 Info ( 110): Connected ssl tunnel to 144.xxx.xxx.xxx(443)
(T13212) 01/12/22 08:51:51:518 Info ( 329): tunnel to 144.xxx.xxx.xxx connected
(T13212) 01/12/22 08:51:51:588 Debug( 349): PsvRegister done
(T13212) 01/12/22 08:51:51:588 Debug( 25): create thread 0x60c with thread ID 9064
(T9064) 01/12/22 08:51:51:588 Debug( 398): VpnProcMonitor thread starts
(T9064) 01/12/22 08:51:51:588 Debug( 25): create thread 0x794 with thread ID 10648
(T10648) 01/12/22 08:51:51:588 Debug( 409): VpnProcDrv thread starts
(T13212) 01/12/22 08:51:51:598 Debug(1610): Get original UseDomainNameDevolution value 1
(T13212) 01/12/22 08:51:51:598 Debug(1636): Get original DNS SearchList value xxxxxxxxxx.local,lan
(T13212) 01/12/22 08:51:51:598 Debug(1657): searchList: xxxxxxxxxx.local
(T13212) 01/12/22 08:51:51:598 Debug(1657): searchList: lan
(T13212) 01/12/22 08:51:51:598 Error(1566): InstallClientConfig: Failed to find PANGP virtual adapter interface
(T13212) 01/12/22 08:51:51:598 Error( 343): InstallClientConfig() failed
(T13212) 01/12/22 08:51:51:598 Error( 248): ProcMonitor: SetupNetwork() failed
(T9064) 01/12/22 08:51:51:598 Info ( 471): PktProcess: VPN disconnect event, get out of ProcMonitor
(T9064) 01/12/22 08:51:51:598 Debug( 544): Tunnel downtime is 0 miliseconds
(T10648) 01/12/22 08:51:51:598 Info ( 832): ProDrv: VPN disconnect event, get out of ProcDrv
(T10648) 01/12/22 08:51:51:598 Info ( 858): ProcDrv thread dies
(T9064) 01/12/22 08:51:51:598 Info ( 805): ProcDrv quit
(T9064) 01/12/22 08:51:51:598 Info ( 791): ProcMonitor thread dies
(T13212) 01/12/22 08:51:51:718 Debug( 293): do_disconnect is called in VPN stop
(T13212) 01/12/22 08:51:51:718 Debug(1318): OpenSSL alert write⚠️close notify
(T13212) 01/12/22 08:51:51:718 Debug( 505): unset network
(T13212) 01/12/22 08:51:51:718 Debug( 764): PreviousDNSInfo doesn't exist, no need to restore
(T13212) 01/12/22 08:51:51:718 Info ( 528): not call uninstallClientConfig, netSetup=000001EC5ADABDB0, clientConfig=000001EC5B9AE6F0, panMSService=000001EC5ADD25C0, panMSService->IsConfigInstalled()=0
(T13212) 01/12/22 08:51:51:718 Error( 666): sslvpn failed to start
(T13212) 01/12/22 08:51:51:718 Info ( 87): VPN is deleted
(T13212) 01/12/22 08:51:51:718 Error(2448): CreateTunnel: SetConfig() failed
(T13212) 01/12/22 08:51:51:718 Debug(5894): UnsetGatewayRoutes: DeleteIpForwardEntry(144.xxx.xxx.xxx)
(T13212) 01/12/22 08:51:51:718 Debug(5942): --Set state to Connection failed
(T13212) 01/12/22 08:51:51:718 Debug( 914): Display hip report V4 on the UI
(T13212) 01/12/22 08:51:51:718 Debug(2463): VPN tunnel is not connected.
(T13212) 01/12/22 08:51:51:718 Debug(2465): returns FALSE.
(T13212) 01/12/22 08:51:51:718 Debug(2518): failed to create tunnel with gateway vpn.xxxxxxxxxx.com
(T13212) 01/12/22 08:51:51:718 Info (2236): logout: user=xxxxxxx, portal=xxxxxxxx Gateway-N, gateway=vpn.xxxxxxxxx.com, domain=xxxxxxxx, computerName=T9009
(T13212) 01/12/22 08:51:51:718 Debug(2268): Logout parameter is
(T13212) 01/12/22 08:51:51:728 Debug( 777): SSL connecting to 144.xxx.xxx.xxx
(T13212) 01/12/22 08:51:51:728 Debug( 550): Network is reachable
(T13212) 01/12/22 08:51:51:768 Debug(3974): SSL verify succeed
(T13212) 01/12/22 08:51:51:858 Debug(1318): OpenSSL alert write⚠️close notify
(T13212) 01/12/22 08:51:51:858 Debug(2314): Logged out gateway vpn.xxxxxxxxxxx.com
(T13212) 01/12/22 08:51:51:858 Debug(2536): tunnel to vpn.xxxxxxxxx.com is not created.
(T13212) 01/12/22 08:51:51:858 Error(4937): NetworkDiscoverThread: failed to discover external network.
(T13212) 01/12/22 08:51:51:858 Debug(4939): local system error, set error as VPN connection could not be established. Please restart your computer to try again.
(T13212) 01/12/22 08:51:51:858 Debug(5942): --Set state to Disconnected
(T6000) 01/12/22 08:51:51:858 Debug(2349): Setting debug level to 5
(T13212) 01/12/22 08:51:51:858 Debug( 914): Display hip report V4 on the UI
(T13212) 01/12/22 08:51:51:858 Debug(4989): NetworkDiscoverThread: PortalStatus is 2, HasLoggedOnGateway is 1
(T13212) 01/12/22 08:51:51:858 Debug(5005): Network discovery is not ready, set GP VPN status as disconnected
(T13212) 01/12/22 08:51:51:858 Debug(9914): SetVpnStatus called with new status=0, Previous Status=0
(T13212) 01/12/22 08:51:51:858 Debug(4116): UpdatePrelogonStateForSSO() - User-logon tunnel state = Disconnected
(T13212) 01/12/22 08:51:51:858 Debug(5024): local system error, need user action or wait 30 minutes to re-do network discovery
(T3556) 01/12/22 08:52:04:223 Debug( 139): Got hip report in other process ready event.
(T3556) 01/12/22 08:52:04:223 Debug( 158): Read output from PanGpHip.exe
(T3556) 01/12/22 08:52:04:223 Debug( 195): write hip file now
(T3556) 01/12/22 08:52:04:223 Debug( 221): CheckHipInOtherProcess() sets hip report ready event.
(T3556) 01/12/22 08:52:04:223 Debug( 135): Wait for the ready event of hip report generated in other process.
(T2544) 01/12/22 08:52:04:223 Debug(5160): HipReportThread: got HIP report ready event.
(T2544) 01/12/22 08:52:04:223 Debug(5176): HipReportThread: wait for network discover ready event.
(T3556) 01/12/22 08:52:05:403 Debug( 143): Got event for PanGpHip process has quited.
(T3556) 01/12/22 08:52:05:403 Debug( 338): CheckHip over
(T3556) 01/12/22 08:52:05:403 Debug( 282): Hip checking is not initiated by clicking resubmit host profile.
(T3556) 01/12/22 08:52:05:403 Debug( 216): HipCheckThread: wait for hip check event for 3600000 ms);
(T13844) 01/12/22 08:52:09:818 Debug( 334): PanGpHipMp.exe exit for checking misssing patches.
(T13844) 01/12/22 08:52:09:818 Debug( 396): CheckHipMissingPatchInOtherProcess(): exits.
(T13844) 01/12/22 08:52:09:818 Debug( 474): Hip missing patch checking duration is 19

0 Likes Likes

Jason.T
L2 Linker
In response to BPry

‎01-18-2022 04:28 PM

(T13212) 01/12/22 08:51:50:618 Debug(3780): bIsEmptyUser is 0, bDPGCforManualOnlyGateway is 0, bDPGCNotforManualOnlyGateway is 0
(T13212) 01/12/22 08:51:50:618 Debug(10166): Set to service bUseCCUserGateway 0 and ccUserNameGateway
(T13212) 01/12/22 08:51:50:618 Debug( 41): Roaming profile is false
(T13212) 01/12/22 08:51:50:618 Debug( 167): profileInfo username xxxxxxxx, profile path (null), server (null)
(T13212) 01/12/22 08:51:50:628 Debug(1632): Unserialized empty cookie for portal 144.xxx.xxx.xxx and user xxxxxxxxx
(T13212) 01/12/22 08:51:50:628 Debug(1561): Unserialized empty cookie for portal 144.xxx.xxx.xxx and pre-logon user.
(T13212) 01/12/22 08:51:50:628 Debug(6841): use cached deviceSN
(T13212) 01/12/22 08:51:50:628 Debug(5544): Get preferred IPv4 192.168.253.26 for gateway 144.xxx.xxx.xxx and user xxxxxxxx
(T13212) 01/12/22 08:51:50:628 Debug(5575): Get preferred IPv6 for gateway 144.xxx.xxx.xxx and user xxxxxxxx
(T13212) 01/12/22 08:51:50:628 Debug(3921): Actual user for gateway login is xxxxxxxx
(T13212) 01/12/22 08:51:50:628 Debug(3925): Gateway selection type is auto
(T13212) 01/12/22 08:51:50:628 Debug(6841): use cached deviceSN
(T13212) 01/12/22 08:51:50:628 Debug(9979): Need to check gateway cert for vpn.xxxxxxxxxxx.com
(T13212) 01/12/22 08:51:50:628 Debug(2625): encpostdata, encpostdata=000001EC5B92A470, encpostdatalen=512
(T13212) 01/12/22 08:51:50:628 Debug(2794): REQID=32,IPADDR=vpn.xxxxxxxxxx.com,PORT=443,URL=/ssl-vpn/login.esp,POST=1,PROXY_AUTO=1,PROXY_CFGURL=NULL,PROXY=NULL,PROXY_BYPASS=NULL,PROXY_USER=NULL,PROXY_PASS=****,VERIFY_CERT=0,ADDITIONAL_CHECK=1,SCEP_CERT=,oid=
(T13212) 01/12/22 08:51:50:718 Debug(1302): Send response to client for request https_request
(T13212) 01/12/22 08:51:50:838 Debug(2904): receive pan_msg_ping, 3
(T13212) 01/12/22 08:51:50:938 Debug(1646): Serialize empty cookie for portal 144.xxx.xxx.xxx and user xxxxxxxxx
(T13212) 01/12/22 08:51:50:938 Debug( 41): Roaming profile is false
(T13212) 01/12/22 08:51:50:938 Debug( 167): profileInfo username xxxxxxx, profile path (null), server (null)
(T13212) 01/12/22 08:51:50:948 Debug(1738): Serialized portal user auth cookie to file C:\Users\xxxxxxxx\AppData\Local\Palo Alto Networks\GlobalProtect\PanPUAC_923a7c2f1070da1789c0f151fbc88529.dat. 162 bytes.
(T13212) 01/12/22 08:51:50:948 Debug(1529): Serialize empty cookie for portal 144.xxx.xxx.xxx and pre-logon user
(T13212) 01/12/22 08:51:50:948 Debug(1536): SerializePortalPrelogonAuthCookie to file PanPPAC_15a2b5ab57d1837e13ffccf8e75c3c.dat
(T13212) 01/12/22 08:51:50:948 Debug(4323): Gateway vpn.xxxxxxxxxx.com has hip-report-version: 4
(T13212) 01/12/22 08:51:50:948 Debug(4338): Managed is no
(T13212) 01/12/22 08:51:50:948 Debug(4342): Gateway vpn.xxxxxxxxxx.com's location is
(T13212) 01/12/22 08:51:50:948 Debug(10152): NetworkDisoverEventSet is no, RedoNetworkDiscovery is no
(T13212) 01/12/22 08:51:50:948 Debug(2497): ----Tunnel creation starts----
(T13212) 01/12/22 08:51:50:948 Debug(2498): Try to create tunnel with gateway vpn.xxxxxxxxxxx.com
(T13212) 01/12/22 08:51:50:948 Debug(5942): --Set state to Connecting...
(T13212) 01/12/22 08:51:50:948 Debug( 914): Display hip report V4 on the UI
(T13212) 01/12/22 08:51:50:948 Debug(2358): proxy , proxyuser , domain xxxxxxxxx, user xxxxxxxxx, remotehost 144.xxx.xxx.xxx.
(T13212) 01/12/22 08:51:50:948 Debug(6841): use cached deviceSN
(T13212) 01/12/22 08:51:50:958 Debug(2638): Get gateway config.
(T13212) 01/12/22 08:51:50:958 Debug(9979): Need to check gateway cert for vpn.xxxxxxxxxxx.com
(T13212) 01/12/22 08:51:50:958 Debug(2625): encpostdata, encpostdata=000001EC5B9BEC70, encpostdatalen=448
(T13212) 01/12/22 08:51:50:958 Debug(2794): REQID=33,IPADDR=vpn.xxxxxxxxx.com,PORT=443,URL=/ssl-vpn/getconfig.esp,POST=1,PROXY_AUTO=1,PROXY_CFGURL=NULL,PROXY=NULL,PROXY_BYPASS=NULL,PROXY_USER=NULL,PROXY_PASS=****,VERIFY_CERT=0,ADDITIONAL_CHECK=1,SCEP_CERT=,oid=
(T13212) 01/12/22 08:51:51:038 Debug(1302): Send response to client for request https_request
(T13212) 01/12/22 08:51:51:118 Debug(2904): receive pan_msg_ping, 1
(T13212) 01/12/22 08:51:51:118 Debug(2705): gateway vpn.xxxxxxxxxxxx.com's config is
<response status="success">
<need-tunnel>yes</need-tunnel>
<ssl-tunnel-url>/ssl-tunnel-connect.sslvpn</ssl-tunnel-url>
<portal>Basford Gateway-N</portal>
<user>xxxxxxxxxx</user>
<lifetime>2592000</lifetime>
<timeout>10800</timeout>
<disconnect-on-idle>10800</disconnect-on-idle>
<bw-c2s>1000</bw-c2s>
<bw-s2c>1000</bw-s2c>
<gw-address>144.xxx.xxx.xxx</gw-address>
<ip-address>192.168.253.26</ip-address>
<netmask>255.255.255.255</netmask>
<ip-address-preferred>yes</ip-address-preferred>
<dns>
<member>192.168.0.17</member>
<member>192.168.0.18</member>
</dns>
<wins>
</wins>
<dns-suffix>
<member>xxxxxxxxxx.local</member>
</dns-suffix>
<default-gateway>192.168.253.26</default-gateway>
<mtu>0</mtu>
<no-direct-access-to-local-network>no</no-direct-access-to-local-network>
<access-routes>
<member>192.168.0.0/24</member>
<member>192.168.0.17/32</member>
<member>192.168.0.18/32</member>
</access-routes>
<exclude-access-routes>
</exclude-access-routes>
<ipsec>
<udp-port>4501</udp-port>
<ipsec-mode>esp-tunnel</ipsec-mode>
<enc-algo>aes-256-gcm</enc-algo>
<hmac-algo>sha1</hmac-algo>
(T13212) 01/12/22 08:51:51:118 Debug(2731): There is no connected-gw-ip
(T13212) 01/12/22 08:51:51:118 Debug(4404): In SetGatewayRoute: The original route table:
(T13212) 01/12/22 08:51:51:118 Debug( 138): Destination NetMask Gateway Inf Metric
(T13212) 01/12/22 08:51:51:118 Debug( 153): 0.0.0.0 0.0.0.0 192.168.86.1 11 35
(T13212) 01/12/22 08:51:51:118 Debug( 153): 127.0.0.0 255.0.0.0 127.0.0.1 1 331
(T13212) 01/12/22 08:51:51:118 Debug( 153): 127.0.0.1 255.255.255.255 127.0.0.1 1 331
(T13212) 01/12/22 08:51:51:118 Debug( 153): 127.255.255.255 255.255.255.255 127.0.0.1 1 331
(T13212) 01/12/22 08:51:51:118 Debug( 153): 192.168.86.0 255.255.255.0 192.168.86.53 11 291
(T13212) 01/12/22 08:51:51:118 Debug( 153): 192.168.86.53 255.255.255.255 192.168.86.53 11 291
(T13212) 01/12/22 08:51:51:118 Debug( 153): 192.168.86.255 255.255.255.255 192.168.86.53 11 291
(T13212) 01/12/22 08:51:51:118 Debug( 153): 224.0.0.0 240.0.0.0 127.0.0.1 1 331
(T13212) 01/12/22 08:51:51:118 Debug( 153): 224.0.0.0 240.0.0.0 192.168.86.53 11 291
(T13212) 01/12/22 08:51:51:118 Debug( 153): 255.255.255.255 255.255.255.255 127.0.0.1 1 331
(T13212) 01/12/22 08:51:51:118 Debug( 153): 255.255.255.255 255.255.255.255 192.168.86.53 11 291
(T13212) 01/12/22 08:51:51:118 Debug(4414): SetGatewayRoute: GetBestRoute() returns Dest:0.0.0.0 Mask:0.0.0.0 if_index=11 metric1=35
(T13212) 01/12/22 08:51:51:118 Debug(4436): Created gateway route (144.xxx.xxx.xxx) succeeds
(T13212) 01/12/22 08:51:51:118 Debug( 271): Ipv6-connection is NULL
(T13212) 01/12/22 08:51:51:118 Debug( 318): gw-address-v6 is not specified
(T13212) 01/12/22 08:51:51:118 Debug( 324): remoteHostV6 is not specified
(T13212) 01/12/22 08:51:51:118 Debug( 349): ip-address-preferred value is yes
(T13212) 01/12/22 08:51:51:118 Debug( 374): ip-address-v6-preferred not found.
(T13212) 01/12/22 08:51:51:118 Debug(9707): Set preferred IP 192.168.253.26 for gateway 144.xxx.xxx.xxx user xxxxxxxxx
(T13212) 01/12/22 08:51:51:118 Debug(9716): Set preferred IPv6 for gateway 144.xxx.xxx.xxx user xxxxxxxxx
(T13212) 01/12/22 08:51:51:118 Debug( 514): DLSA, found no-direct-access-to-local-network tag, b_IsDLSASet set to false
(T13212) 01/12/22 08:51:51:118 Debug( 757): Encryption method is aes-256-gcm
(T13212) 01/12/22 08:51:51:118 Debug(3233): set driver connected as true
(T13212) 01/12/22 08:51:51:118 Debug( 594): use-ssl-only-tunnel is not configured and user cannnot change
(T13212) 01/12/22 08:51:51:118 Debug( 147): VPN idle timeout is 10800; config timeout is 10800
(T13212) 01/12/22 08:51:51:118 Debug( 70): c2s-spi is 0x40FDCF92, s2c-spi is 0xFDB3FD9C
(T13212) 01/12/22 08:51:51:118 Debug( 189): EnforceDns is enabled, set 2 GP pushed DNS servers
(T13212) 01/12/22 08:51:51:118 Debug( 164): Trying to do ipsec connection to 144.xxx.xxx.xxx[4501]
(T13212) 01/12/22 08:51:51:128 Debug( 550): Network is reachable
(T13212) 01/12/22 08:51:51:128 Info ( 176): Connected to: 144.xxx.xxx.xxx[4501], Sending keep alive to ipsec socket...
(T13212) 01/12/22 08:51:51:148 Info ( 214): Connected ipsec to 144.xxx.xxx.xxx(4501)
(T13212) 01/12/22 08:51:51:148 Info ( 329): tunnel to 144.xxx.xxx.xxx connected
(T13212) 01/12/22 08:51:51:288 Debug( 349): PsvRegister done
(T13212) 01/12/22 08:51:51:288 Debug( 25): create thread 0x4d0 with thread ID 1628
(T1628) 01/12/22 08:51:51:288 Debug( 398): VpnProcMonitor thread starts
(T1628) 01/12/22 08:51:51:288 Debug( 25): create thread 0x680 with thread ID 4752
(T4752) 01/12/22 08:51:51:288 Debug( 409): VpnProcDrv thread starts
(T13212) 01/12/22 08:51:51:298 Debug(1610): Get original UseDomainNameDevolution value 1
(T13212) 01/12/22 08:51:51:298 Debug(1636): Get original DNS SearchList value xxxxxxxxx.local,lan
(T13212) 01/12/22 08:51:51:298 Debug(1657): searchList: xxxxxxxxx.local
(T13212) 01/12/22 08:51:51:298 Debug(1657): searchList: lan
(T13212) 01/12/22 08:51:51:298 Error(1566): InstallClientConfig: Failed to find PANGP virtual adapter interface
(T6000) 01/12/22 08:51:51:298 Debug(2349): Setting debug level to 5
(T13212) 01/12/22 08:51:51:308 Error( 343): InstallClientConfig() failed
(T13212) 01/12/22 08:51:51:308 Error( 248): ProcMonitor: SetupNetwork() failed
(T1628) 01/12/22 08:51:51:308 Info ( 471): PktProcess: VPN disconnect event, get out of ProcMonitor
(T1628) 01/12/22 08:51:51:308 Debug( 544): Tunnel downtime is 16 miliseconds
(T4752) 01/12/22 08:51:51:308 Info ( 832): ProDrv: VPN disconnect event, get out of ProcDrv
(T4752) 01/12/22 08:51:51:308 Info ( 858): ProcDrv thread dies
(T1628) 01/12/22 08:51:51:308 Info ( 805): ProcDrv quit
(T1628) 01/12/22 08:51:51:308 Info ( 791): ProcMonitor thread dies
(T13212) 01/12/22 08:51:51:418 Debug( 293): do_disconnect is called in VPN stop
(T13212) 01/12/22 08:51:51:418 Debug( 227): IPSec anti-replay statistics: outside window count 0, replay count 0
(T13212) 01/12/22 08:51:51:418 Debug( 229): Disconnect udp socket
(T13212) 01/12/22 08:51:51:418 Debug( 505): unset network
(T13212) 01/12/22 08:51:51:418 Debug( 764): PreviousDNSInfo doesn't exist, no need to restore
(T13212) 01/12/22 08:51:51:418 Info ( 528): not call uninstallClientConfig, netSetup=000001EC5ADABDB0, clientConfig=000001EC5B9AE6F0, panMSService=000001EC5ADD25C0, panMSService->IsConfigInstalled()=0
(T13212) 01/12/22 08:51:51:418 Debug( 615): ipsec failed to start
(T13212) 01/12/22 08:51:51:418 Info ( 87): VPN is deleted
(T13212) 01/12/22 08:51:51:418 Debug( 147): VPN idle timeout is 10800; config timeout is 10800
(T13212) 01/12/22 08:51:51:418 Debug( 189): EnforceDns is enabled, set 2 GP pushed DNS servers
(T13212) 01/12/22 08:51:51:418 Debug( 62): Trying to do SSL connection to 144.xxx.xxx.xxx(443)
(T13212) 01/12/22 08:51:51:418 Debug( 777): SSL connecting to 144.xxx.xxx.xxx
(T13212) 01/12/22 08:51:51:428 Debug( 550): Network is reachable
(T13212) 01/12/22 08:51:51:498 Debug(1242): Failed to X509_LOOKUP_load_file
(T13212) 01/12/22 08:51:51:498 Debug( 363): Open_SSL_connection: subject '/CN=vpn.xxxxxxxxxx.com'
(T13212) 01/12/22 08:51:51:498 Debug( 367): Open_SSL_connection: issuer '/C=US/O=DigiCert Inc/CN=RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1'
(T13212) 01/12/22 08:51:51:518 Info ( 110): Connected ssl tunnel to 144.xxx.xxx.xxx(443)
(T13212) 01/12/22 08:51:51:518 Info ( 329): tunnel to 144.xxx.xxx.xxx connected
(T13212) 01/12/22 08:51:51:588 Debug( 349): PsvRegister done
(T13212) 01/12/22 08:51:51:588 Debug( 25): create thread 0x60c with thread ID 9064
(T9064) 01/12/22 08:51:51:588 Debug( 398): VpnProcMonitor thread starts
(T9064) 01/12/22 08:51:51:588 Debug( 25): create thread 0x794 with thread ID 10648
(T10648) 01/12/22 08:51:51:588 Debug( 409): VpnProcDrv thread starts
(T13212) 01/12/22 08:51:51:598 Debug(1610): Get original UseDomainNameDevolution value 1
(T13212) 01/12/22 08:51:51:598 Debug(1636): Get original DNS SearchList value xxxxxxxxxx.local,lan
(T13212) 01/12/22 08:51:51:598 Debug(1657): searchList: xxxxxxxxxx.local
(T13212) 01/12/22 08:51:51:598 Debug(1657): searchList: lan
(T13212) 01/12/22 08:51:51:598 Error(1566): InstallClientConfig: Failed to find PANGP virtual adapter interface
(T13212) 01/12/22 08:51:51:598 Error( 343): InstallClientConfig() failed
(T13212) 01/12/22 08:51:51:598 Error( 248): ProcMonitor: SetupNetwork() failed
(T9064) 01/12/22 08:51:51:598 Info ( 471): PktProcess: VPN disconnect event, get out of ProcMonitor
(T9064) 01/12/22 08:51:51:598 Debug( 544): Tunnel downtime is 0 miliseconds
(T10648) 01/12/22 08:51:51:598 Info ( 832): ProDrv: VPN disconnect event, get out of ProcDrv
(T10648) 01/12/22 08:51:51:598 Info ( 858): ProcDrv thread dies
(T9064) 01/12/22 08:51:51:598 Info ( 805): ProcDrv quit
(T9064) 01/12/22 08:51:51:598 Info ( 791): ProcMonitor thread dies
(T13212) 01/12/22 08:51:51:718 Debug( 293): do_disconnect is called in VPN stop
(T13212) 01/12/22 08:51:51:718 Debug(1318): OpenSSL alert write⚠️close notify
(T13212) 01/12/22 08:51:51:718 Debug( 505): unset network
(T13212) 01/12/22 08:51:51:718 Debug( 764): PreviousDNSInfo doesn't exist, no need to restore
(T13212) 01/12/22 08:51:51:718 Info ( 528): not call uninstallClientConfig, netSetup=000001EC5ADABDB0, clientConfig=000001EC5B9AE6F0, panMSService=000001EC5ADD25C0, panMSService->IsConfigInstalled()=0
(T13212) 01/12/22 08:51:51:718 Error( 666): sslvpn failed to start
(T13212) 01/12/22 08:51:51:718 Info ( 87): VPN is deleted
(T13212) 01/12/22 08:51:51:718 Error(2448): CreateTunnel: SetConfig() failed
(T13212) 01/12/22 08:51:51:718 Debug(5894): UnsetGatewayRoutes: DeleteIpForwardEntry(144.xxx.xxx.xxx)
(T13212) 01/12/22 08:51:51:718 Debug(5942): --Set state to Connection failed
(T13212) 01/12/22 08:51:51:718 Debug( 914): Display hip report V4 on the UI
(T13212) 01/12/22 08:51:51:718 Debug(2463): VPN tunnel is not connected.
(T13212) 01/12/22 08:51:51:718 Debug(2465): returns FALSE.
(T13212) 01/12/22 08:51:51:718 Debug(2518): failed to create tunnel with gateway vpn.xxxxxxxxxx.com
(T13212) 01/12/22 08:51:51:718 Info (2236): logout: user=xxxxxxx, portal=xxxxxxxx Gateway-N, gateway=vpn.xxxxxxxxx.com, domain=xxxxxxxx, computerName=T9009
(T13212) 01/12/22 08:51:51:718 Debug(2268): Logout parameter is
(T13212) 01/12/22 08:51:51:728 Debug( 777): SSL connecting to 144.xxx.xxx.xxx
(T13212) 01/12/22 08:51:51:728 Debug( 550): Network is reachable
(T13212) 01/12/22 08:51:51:768 Debug(3974): SSL verify succeed
(T13212) 01/12/22 08:51:51:858 Debug(1318): OpenSSL alert write⚠️close notify
(T13212) 01/12/22 08:51:51:858 Debug(2314): Logged out gateway vpn.xxxxxxxxxxx.com
(T13212) 01/12/22 08:51:51:858 Debug(2536): tunnel to vpn.xxxxxxxxx.com is not created.
(T13212) 01/12/22 08:51:51:858 Error(4937): NetworkDiscoverThread: failed to discover external network.
(T13212) 01/12/22 08:51:51:858 Debug(4939): local system error, set error as VPN connection could not be established. Please restart your computer to try again.
(T13212) 01/12/22 08:51:51:858 Debug(5942): --Set state to Disconnected
(T6000) 01/12/22 08:51:51:858 Debug(2349): Setting debug level to 5
(T13212) 01/12/22 08:51:51:858 Debug( 914): Display hip report V4 on the UI
(T13212) 01/12/22 08:51:51:858 Debug(4989): NetworkDiscoverThread: PortalStatus is 2, HasLoggedOnGateway is 1
(T13212) 01/12/22 08:51:51:858 Debug(5005): Network discovery is not ready, set GP VPN status as disconnected
(T13212) 01/12/22 08:51:51:858 Debug(9914): SetVpnStatus called with new status=0, Previous Status=0
(T13212) 01/12/22 08:51:51:858 Debug(4116): UpdatePrelogonStateForSSO() - User-logon tunnel state = Disconnected
(T13212) 01/12/22 08:51:51:858 Debug(5024): local system error, need user action or wait 30 minutes to re-do network discovery
(T3556) 01/12/22 08:52:04:223 Debug( 139): Got hip report in other process ready event.
(T3556) 01/12/22 08:52:04:223 Debug( 158): Read output from PanGpHip.exe
(T3556) 01/12/22 08:52:04:223 Debug( 195): write hip file now
(T3556) 01/12/22 08:52:04:223 Debug( 221): CheckHipInOtherProcess() sets hip report ready event.
(T3556) 01/12/22 08:52:04:223 Debug( 135): Wait for the ready event of hip report generated in other process.
(T2544) 01/12/22 08:52:04:223 Debug(5160): HipReportThread: got HIP report ready event.
(T2544) 01/12/22 08:52:04:223 Debug(5176): HipReportThread: wait for network discover ready event.
(T3556) 01/12/22 08:52:05:403 Debug( 143): Got event for PanGpHip process has quited.
(T3556) 01/12/22 08:52:05:403 Debug( 338): CheckHip over
(T3556) 01/12/22 08:52:05:403 Debug( 282): Hip checking is not initiated by clicking resubmit host profile.
(T3556) 01/12/22 08:52:05:403 Debug( 216): HipCheckThread: wait for hip check event for 3600000 ms);
(T13844) 01/12/22 08:52:09:818 Debug( 334): PanGpHipMp.exe exit for checking misssing patches.
(T13844) 01/12/22 08:52:09:818 Debug( 396): CheckHipMissingPatchInOtherProcess(): exits.
(T13844) 01/12/22 08:52:09:818 Debug( 474): Hip missing patch checking duration is 19

0 Likes Likes

Jason.T
L2 Linker
In response to BPry

‎01-18-2022 05:02 PM - edited ‎01-18-2022 05:03 PM

(T13212) 01/12/22 08:51:51:118 Debug(2705): gateway vpn.xxxxxxxxxxxx.com's config is
<response status="success">
<need-tunnel>yes</need-tunnel>
<ssl-tunnel-url>/ssl-tunnel-connect.sslvpn</ssl-tunnel-url>
<portal>xxxxxxxxx Gateway-N</portal>
<user>xxxxxxxxxx</user>
<lifetime>2592000</lifetime>
<timeout>10800</timeout>
<disconnect-on-idle>10800</disconnect-on-idle>
<bw-c2s>1000</bw-c2s>
<bw-s2c>1000</bw-s2c>
<gw-address>144.xxx.xxx.xxx</gw-address>
<ip-address>192.168.253.26</ip-address>
<netmask>255.255.255.255</netmask>
<ip-address-preferred>yes</ip-address-preferred>
<dns>
<member>192.168.0.17</member>
<member>192.168.0.18</member>
</dns>
<wins>
</wins>
<dns-suffix>
<member>xxxxxxxxxx.local</member>
</dns-suffix>
<default-gateway>192.168.253.26</default-gateway>
<mtu>0</mtu>
<no-direct-access-to-local-network>no</no-direct-access-to-local-network>
<access-routes>
<member>192.168.0.0/24</member>
<member>192.168.0.17/32</member>
<member>192.168.0.18/32</member>
</access-routes>
<exclude-access-routes>
</exclude-access-routes>
<ipsec>
<udp-port>4501</udp-port>
<ipsec-mode>esp-tunnel</ipsec-mode>
<enc-algo>aes-256-gcm</enc-algo>
<hmac-algo>sha1</hmac-algo>
(T13212) 01/12/22 08:51:51:118 Debug(2731): There is no connected-gw-ip
(T13212) 01/12/22 08:51:51:118 Debug(4404): In SetGatewayRoute: The original route table:
(T13212) 01/12/22 08:51:51:118 Debug( 138): Destination NetMask Gateway Inf Metric
(T13212) 01/12/22 08:51:51:118 Debug( 153): 0.0.0.0 0.0.0.0 192.168.86.1 11 35
(T13212) 01/12/22 08:51:51:118 Debug( 153): 127.0.0.0 255.0.0.0 127.0.0.1 1 331
(T13212) 01/12/22 08:51:51:118 Debug( 153): 127.0.0.1 255.255.255.255 127.0.0.1 1 331
(T13212) 01/12/22 08:51:51:118 Debug( 153): 127.255.255.255 255.255.255.255 127.0.0.1 1 331
(T13212) 01/12/22 08:51:51:118 Debug( 153): 192.168.86.0 255.255.255.0 192.168.86.53 11 291
(T13212) 01/12/22 08:51:51:118 Debug( 153): 192.168.86.53 255.255.255.255 192.168.86.53 11 291
(T13212) 01/12/22 08:51:51:118 Debug( 153): 192.168.86.255 255.255.255.255 192.168.86.53 11 291
(T13212) 01/12/22 08:51:51:118 Debug( 153): 224.0.0.0 240.0.0.0 127.0.0.1 1 331
(T13212) 01/12/22 08:51:51:118 Debug( 153): 224.0.0.0 240.0.0.0 192.168.86.53 11 291
(T13212) 01/12/22 08:51:51:118 Debug( 153): 255.255.255.255 255.255.255.255 127.0.0.1 1 331
(T13212) 01/12/22 08:51:51:118 Debug( 153): 255.255.255.255 255.255.255.255 192.168.86.53 11 291
(T13212) 01/12/22 08:51:51:118 Debug(4414): SetGatewayRoute: GetBestRoute() returns Dest:0.0.0.0 Mask:0.0.0.0 if_index=11 metric1=35
(T13212) 01/12/22 08:51:51:118 Debug(4436): Created gateway route (144.xxx.xxx.xxx) succeeds
(T13212) 01/12/22 08:51:51:118 Debug( 271): Ipv6-connection is NULL
(T13212) 01/12/22 08:51:51:118 Debug( 318): gw-address-v6 is not specified
(T13212) 01/12/22 08:51:51:118 Debug( 324): remoteHostV6 is not specified
(T13212) 01/12/22 08:51:51:118 Debug( 349): ip-address-preferred value is yes
(T13212) 01/12/22 08:51:51:118 Debug( 374): ip-address-v6-preferred not found.
(T13212) 01/12/22 08:51:51:118 Debug(9707): Set preferred IP 192.168.253.26 for gateway 144.xxx.xxx.xxx user xxxxxxxxx
(T13212) 01/12/22 08:51:51:118 Debug(9716): Set preferred IPv6 for gateway 144.xxx.xxx.xxx user xxxxxxxxx
(T13212) 01/12/22 08:51:51:118 Debug( 514): DLSA, found no-direct-access-to-local-network tag, b_IsDLSASet set to false
(T13212) 01/12/22 08:51:51:118 Debug( 757): Encryption method is aes-256-gcm
(T13212) 01/12/22 08:51:51:118 Debug(3233): set driver connected as true
(T13212) 01/12/22 08:51:51:118 Debug( 594): use-ssl-only-tunnel is not configured and user cannnot change
(T13212) 01/12/22 08:51:51:118 Debug( 147): VPN idle timeout is 10800; config timeout is 10800
(T13212) 01/12/22 08:51:51:118 Debug( 70): c2s-spi is 0x40FDCF92, s2c-spi is 0xFDB3FD9C
(T13212) 01/12/22 08:51:51:118 Debug( 189): EnforceDns is enabled, set 2 GP pushed DNS servers
(T13212) 01/12/22 08:51:51:118 Debug( 164): Trying to do ipsec connection to 144.xxx.xxx.xxx[4501]
(T13212) 01/12/22 08:51:51:128 Debug( 550): Network is reachable
(T13212) 01/12/22 08:51:51:128 Info ( 176): Connected to: 144.xxx.xxx.xxx[4501], Sending keep alive to ipsec socket...
(T13212) 01/12/22 08:51:51:148 Info ( 214): Connected ipsec to 144.xxx.xxx.xxx(4501)
(T13212) 01/12/22 08:51:51:148 Info ( 329): tunnel to 144.xxx.xxx.xxx connected
(T13212) 01/12/22 08:51:51:288 Debug( 349): PsvRegister done
(T13212) 01/12/22 08:51:51:288 Debug( 25): create thread 0x4d0 with thread ID 1628
(T1628) 01/12/22 08:51:51:288 Debug( 398): VpnProcMonitor thread starts
(T1628) 01/12/22 08:51:51:288 Debug( 25): create thread 0x680 with thread ID 4752
(T4752) 01/12/22 08:51:51:288 Debug( 409): VpnProcDrv thread starts
(T13212) 01/12/22 08:51:51:298 Debug(1610): Get original UseDomainNameDevolution value 1
(T13212) 01/12/22 08:51:51:298 Debug(1636): Get original DNS SearchList value xxxxxxxxx.local,lan
(T13212) 01/12/22 08:51:51:298 Debug(1657): searchList: xxxxxxxxx.local
(T13212) 01/12/22 08:51:51:298 Debug(1657): searchList: lan
(T13212) 01/12/22 08:51:51:298 Error(1566): InstallClientConfig: Failed to find PANGP virtual adapter interface
(T6000) 01/12/22 08:51:51:298 Debug(2349): Setting debug level to 5
(T13212) 01/12/22 08:51:51:308 Error( 343): InstallClientConfig() failed
(T13212) 01/12/22 08:51:51:308 Error( 248): ProcMonitor: SetupNetwork() failed
(T1628) 01/12/22 08:51:51:308 Info ( 471): PktProcess: VPN disconnect event, get out of ProcMonitor
(T1628) 01/12/22 08:51:51:308 Debug( 544): Tunnel downtime is 16 miliseconds
(T4752) 01/12/22 08:51:51:308 Info ( 832): ProDrv: VPN disconnect event, get out of ProcDrv
(T4752) 01/12/22 08:51:51:308 Info ( 858): ProcDrv thread dies
(T1628) 01/12/22 08:51:51:308 Info ( 805): ProcDrv quit
(T1628) 01/12/22 08:51:51:308 Info ( 791): ProcMonitor thread dies
(T13212) 01/12/22 08:51:51:418 Debug( 293): do_disconnect is called in VPN stop
(T13212) 01/12/22 08:51:51:418 Debug( 227): IPSec anti-replay statistics: outside window count 0, replay count 0
(T13212) 01/12/22 08:51:51:418 Debug( 229): Disconnect udp socket
(T13212) 01/12/22 08:51:51:418 Debug( 505): unset network
(T13212) 01/12/22 08:51:51:418 Debug( 764): PreviousDNSInfo doesn't exist, no need to restore
(T13212) 01/12/22 08:51:51:418 Info ( 528): not call uninstallClientConfig, netSetup=000001EC5ADABDB0, clientConfig=000001EC5B9AE6F0, panMSService=000001EC5ADD25C0, panMSService->IsConfigInstalled()=0
(T13212) 01/12/22 08:51:51:418 Debug( 615): ipsec failed to start
(T13212) 01/12/22 08:51:51:418 Info ( 87): VPN is deleted
(T13212) 01/12/22 08:51:51:418 Debug( 147): VPN idle timeout is 10800; config timeout is 10800
(T13212) 01/12/22 08:51:51:418 Debug( 189): EnforceDns is enabled, set 2 GP pushed DNS servers
(T13212) 01/12/22 08:51:51:418 Debug( 62): Trying to do SSL connection to 144.xxx.xxx.xxx(443)
(T13212) 01/12/22 08:51:51:418 Debug( 777): SSL connecting to 144.xxx.xxx.xxx
(T13212) 01/12/22 08:51:51:428 Debug( 550): Network is reachable
(T13212) 01/12/22 08:51:51:498 Debug(1242): Failed to X509_LOOKUP_load_file
(T13212) 01/12/22 08:51:51:498 Debug( 363): Open_SSL_connection: subject '/CN=vpn.xxxxxxxxxx.com'
(T13212) 01/12/22 08:51:51:498 Debug( 367): Open_SSL_connection: issuer '/C=US/O=DigiCert Inc/CN=RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1'
(T13212) 01/12/22 08:51:51:518 Info ( 110): Connected ssl tunnel to 144.xxx.xxx.xxx(443)
(T13212) 01/12/22 08:51:51:518 Info ( 329): tunnel to 144.xxx.xxx.xxx connected
(T13212) 01/12/22 08:51:51:588 Debug( 349): PsvRegister done
(T13212) 01/12/22 08:51:51:588 Debug( 25): create thread 0x60c with thread ID 9064
(T9064) 01/12/22 08:51:51:588 Debug( 398): VpnProcMonitor thread starts
(T9064) 01/12/22 08:51:51:588 Debug( 25): create thread 0x794 with thread ID 10648
(T10648) 01/12/22 08:51:51:588 Debug( 409): VpnProcDrv thread starts
(T13212) 01/12/22 08:51:51:598 Debug(1610): Get original UseDomainNameDevolution value 1
(T13212) 01/12/22 08:51:51:598 Debug(1636): Get original DNS SearchList value xxxxxxxxxx.local,lan
(T13212) 01/12/22 08:51:51:598 Debug(1657): searchList: xxxxxxxxxx.local
(T13212) 01/12/22 08:51:51:598 Debug(1657): searchList: lan
(T13212) 01/12/22 08:51:51:598 Error(1566): InstallClientConfig: Failed to find PANGP virtual adapter interface
(T13212) 01/12/22 08:51:51:598 Error( 343): InstallClientConfig() failed
(T13212) 01/12/22 08:51:51:598 Error( 248): ProcMonitor: SetupNetwork() failed
(T9064) 01/12/22 08:51:51:598 Info ( 471): PktProcess: VPN disconnect event, get out of ProcMonitor
(T9064) 01/12/22 08:51:51:598 Debug( 544): Tunnel downtime is 0 miliseconds
(T10648) 01/12/22 08:51:51:598 Info ( 832): ProDrv: VPN disconnect event, get out of ProcDrv
(T10648) 01/12/22 08:51:51:598 Info ( 858): ProcDrv thread dies
(T9064) 01/12/22 08:51:51:598 Info ( 805): ProcDrv quit
(T9064) 01/12/22 08:51:51:598 Info ( 791): ProcMonitor thread dies
(T13212) 01/12/22 08:51:51:718 Debug( 293): do_disconnect is called in VPN stop
(T13212) 01/12/22 08:51:51:718 Debug(1318): OpenSSL alert write⚠️close notify
(T13212) 01/12/22 08:51:51:718 Debug( 505): unset network
(T13212) 01/12/22 08:51:51:718 Debug( 764): PreviousDNSInfo doesn't exist, no need to restore
(T13212) 01/12/22 08:51:51:718 Info ( 528): not call uninstallClientConfig, netSetup=000001EC5ADABDB0, clientConfig=000001EC5B9AE6F0, panMSService=000001EC5ADD25C0, panMSService->IsConfigInstalled()=0
(T13212) 01/12/22 08:51:51:718 Error( 666): sslvpn failed to start
(T13212) 01/12/22 08:51:51:718 Info ( 87): VPN is deleted
(T13212) 01/12/22 08:51:51:718 Error(2448): CreateTunnel: SetConfig() failed
(T13212) 01/12/22 08:51:51:718 Debug(5894): UnsetGatewayRoutes: DeleteIpForwardEntry(144.xxx.xxx.xxx)
(T13212) 01/12/22 08:51:51:718 Debug(5942): --Set state to Connection failed
(T13212) 01/12/22 08:51:51:718 Debug( 914): Display hip report V4 on the UI
(T13212) 01/12/22 08:51:51:718 Debug(2463): VPN tunnel is not connected.
(T13212) 01/12/22 08:51:51:718 Debug(2465): returns FALSE.
(T13212) 01/12/22 08:51:51:718 Debug(2518): failed to create tunnel with gateway vpn.xxxxxxxxxx.com
(T13212) 01/12/22 08:51:51:718 Info (2236): logout: user=xxxxxxx, portal=xxxxxxxx Gateway-N, gateway=vpn.xxxxxxxxx.com, domain=xxxxxxxx, computerName=T9009
(T13212) 01/12/22 08:51:51:718 Debug(2268): Logout parameter is
(T13212) 01/12/22 08:51:51:728 Debug( 777): SSL connecting to 144.xxx.xxx.xxx
(T13212) 01/12/22 08:51:51:728 Debug( 550): Network is reachable
(T13212) 01/12/22 08:51:51:768 Debug(3974): SSL verify succeed
(T13212) 01/12/22 08:51:51:858 Debug(1318): OpenSSL alert write⚠️close notify
(T13212) 01/12/22 08:51:51:858 Debug(2314): Logged out gateway vpn.xxxxxxxxxxx.com
(T13212) 01/12/22 08:51:51:858 Debug(2536): tunnel to vpn.xxxxxxxxx.com is not created.
(T13212) 01/12/22 08:51:51:858 Error(4937): NetworkDiscoverThread: failed to discover external network.
(T13212) 01/12/22 08:51:51:858 Debug(4939): local system error, set error as VPN connection could not be established. Please restart your computer to try again.
(T13212) 01/12/22 08:51:51:858 Debug(5942): --Set state to Disconnected
(T6000) 01/12/22 08:51:51:858 Debug(2349): Setting debug level to 5
(T13212) 01/12/22 08:51:51:858 Debug( 914): Display hip report V4 on the UI
(T13212) 01/12/22 08:51:51:858 Debug(4989): NetworkDiscoverThread: PortalStatus is 2, HasLoggedOnGateway is 1
(T13212) 01/12/22 08:51:51:858 Debug(5005): Network discovery is not ready, set GP VPN status as disconnected
(T13212) 01/12/22 08:51:51:858 Debug(9914): SetVpnStatus called with new status=0, Previous Status=0
(T13212) 01/12/22 08:51:51:858 Debug(4116): UpdatePrelogonStateForSSO() - User-logon tunnel state = Disconnected
(T13212) 01/12/22 08:51:51:858 Debug(5024): local system error, need user action or wait 30 minutes to re-do network discovery
(T3556) 01/12/22 08:52:04:223 Debug( 139): Got hip report in other process ready event.
(T3556) 01/12/22 08:52:04:223 Debug( 158): Read output from PanGpHip.exe
(T3556) 01/12/22 08:52:04:223 Debug( 195): write hip file now
(T3556) 01/12/22 08:52:04:223 Debug( 221): CheckHipInOtherProcess() sets hip report ready event.
(T3556) 01/12/22 08:52:04:223 Debug( 135): Wait for the ready event of hip report generated in other process.
(T2544) 01/12/22 08:52:04:223 Debug(5160): HipReportThread: got HIP report ready event.
(T2544) 01/12/22 08:52:04:223 Debug(5176): HipReportThread: wait for network discover ready event.
(T3556) 01/12/22 08:52:05:403 Debug( 143): Got event for PanGpHip process has quited.
(T3556) 01/12/22 08:52:05:403 Debug( 338): CheckHip over
(T3556) 01/12/22 08:52:05:403 Debug( 282): Hip checking is not initiated by clicking resubmit host profile.
(T3556) 01/12/22 08:52:05:403 Debug( 216): HipCheckThread: wait for hip check event for 3600000 ms);
(T13844) 01/12/22 08:52:09:818 Debug( 334): PanGpHipMp.exe exit for checking misssing patches.
(T13844) 01/12/22 08:52:09:818 Debug( 396): CheckHipMissingPatchInOtherProcess(): exits.
(T13844) 01/12/22 08:52:09:818 Debug( 474): Hip missing patch checking duration is 19

0 Likes Likes

Jason.T
L2 Linker
In response to BPry

‎01-18-2022 06:08 PM

Every time I try to post the log, the post disappears. Any ideas?

0 Likes Likes

laurence64
L4 Transporter
In response to Jason.T

‎01-19-2022 02:41 AM

Hi 

 

As @BPry  has advised there is many issues with the installation of the GP client on windows 7, without the logs I too am unable to assist with any analysis ( I have no idea unfortunately why they keep disappearing from here ) if you have the licenses for it I would suggest that you could possibly clientless VPN for users that are running such legacy operating systems.

PCCSA PCNSA PCNSE PCSAE
Mode44 LTD Palo Alto Consultants
0 Likes Likes

kiwi
Community Team Member
In response to Jason.T

‎01-19-2022 02:53 AM

Hi@Jason.T ,

 

Your posts got marked as spam by the spam crawler.  I've cleared them an are now visible.

 

Cheers !

-Kiwi.

 
LIVEcommunity team member, CISSP
Cheers,
Kiwi
Please help out other users and “Accept as Solution” if a post helps solve your problem !

Read more about how and why to accept solutions.

laurence64
L4 Transporter
In response to Jason.T

‎01-19-2022 02:57 AM

This looks suspiciously like permissions issues when installing the PAN-GP adaptor 

 

T13212) 01/12/22 08:51:51:598 Error(1566): InstallClientConfig: Failed to find PANGP virtual adapter interface
(T13212) 01/12/22 08:51:51:598 Error( 343): InstallClientConfig() failed
(T13212) 01/12/22 08:51:51:598 Error( 248): ProcMonitor: SetupNetwork() failed
(T9064) 01/12/22 08:51:51:598 Info ( 471): PktProcess: VPN disconnect event, get out of ProcMonitor

 

Is the user a local admin or have admin privileges ?

 

It may not be the issue but worth looking at for a start.

PCCSA PCNSA PCNSE PCSAE
Mode44 LTD Palo Alto Consultants
0 Likes Likes
  • 24845 Views
  • 22 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!

LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2024 - Palo Alto Networks