Unable to make GlobalProtect Changes

[B.Rana]

Hi all,

We recently upgraded to 11.2 and noticed that when trying to make changes on any of our Globalprotect portals I see an "Operation Failed" and it calls out the clientless-vpn (when we don't use or have this configured). This issue is also seen at one of our branch sites, PA-1420 on same OS
11.2.10-h3.

Thanks

[TomYoung]

Hi @B.Rana ,

It sounds like the configuration got corrupted during the upgrade.  I know 3 ways to fix it from least to most time consuming.  If the NGFW is managed by Panorama, do the steps there.

1. Fix the issue in the GUI.  Go to Network > GlobalProtect > Portals > gp-int-portal-2 > Clientless VPN > General and Crypto Settings and make sure nothing is configured.  You will see the box for RC4, but since the configuration is "unexpected" fixing the GUI may not fix the issue.
2. Fix the issue in the CLI.  Run the following commands:

set cli config-outout-format set
configure
show | match enc-algo-rc4

If you see the clientless VPN config in the CLI, copy the line; replace the set with delete, paste; commit.

3. Fix the issue in the XML.  Export the configuration under Device > Setup > Operations > Export > Export configuration version > top version.  Open the XML file in a text editor.  Search for enc-algo-rc4.  Make sure you found the Clientless VPN section based upon the XML tags.  Remove the XML element from the proper start to end tag.  Save. Rename.  Import the XML file under Device > Setup > Operations > Import > Import named configuration snapshot.  Load the configuration into the candidate config under Load > Load named configuration snapshot.  Commit.

Thanks,

Tom