Subject: GlobalProtect Connection Issue After SSL/TLS Certificate Renewal

[Jagdeep1]

Hello Team,

We’re currently experiencing an issue where GlobalProtect is not accessible after renewing the server certificate associated with the SSL/TLS profile used by our GlobalProtect portal.

Error message:
GlobalProtect: Connection Failed. The network is unreachable or the portal is unresponsive. Check the network connection and reconnect.

The portal is also not loading in a web browser, returning a ERR_TIMED_OUT error.

Additional details:

• We confirmed that traffic is reaching the firewall and hitting the correct interface.

• We have two portals configured on different interfaces. The second portal (which still uses the old certificate) is functioning normally.

• We’ve already restarted sslmgr, sslvpn-web-server, and the management server.

• PAN-OS version: 11.1.4-h13

Has anyone encountered a similar issue after a certificate renewal? Any suggestions or insights would be greatly appreciated.

Thank you!

[Mudhireddy]

I've seen this issue before. The fact that the other portal works points directly to the new certificate or its configuration on the affected portal. The ERR_TIMED_OUT error is likely a symptom of a failed SSL handshake.

Here's a quick checklist to troubleshoot:

1. Certificate Chain:

   • Confirm the new certificate and its intermediate CAs are all correctly installed and linked. A missing intermediate cert is the most common cause.

2. SSL/TLS Profile:

   • Verify the new certificate is correctly assigned in the SSL/TLS Profile for that portal.

   • Check for any restrictive TLS versions or cipher suites in the profile.

3. Logs and Packet Capture:

   • Review the firewall's system, GlobalProtect, and sslvpn-web-server logs for specific errors.

   • Run a packet capture on the external interface to see where the SSL handshake is failing.

This issue is almost always a certificate or profile misconfiguration. Let's start by methodically checking those first.