About nthen

nthen · ‎08-09-2013

The cert is correct. The FQDN is correct. I am trying to connect with the FQDN on the iPad and it is failing. All of my devices use vpn.celadontrucking.com. We do not use the IP as we get a certificate mismatch. The full certificate chain is also in place.

nthen · ‎08-09-2013

I have the global protect license and an active global protect subscription. Windows Laptops, Mac Laptops, and Android devices (using the app) can connect and access network resources. However I try with the iPad and it fails immediately. I get "Cannot connect to Global Protect. There appears to be a problem with your Internet connection or the GlobalProtect network. If the issue is persistent, contact your IT help desk." I see in the logs that the certificate could not be validated but I know there is nothing wrong with it. It works great on the other platforms. I am running Global Protect App 1.3.1-10 with iOS 6.1.3. I have tried a few different Internet connections as well and they all have the same behavior. Also, I removed the app from the iPad and reinstalled. Still no luck. P 344-T12035 Aug 09 18:36:03:717856 Error( 804): didFailWithError: Error Domain=NSURLErrorDomain Code=-1012 "The operation couldnâ€™t be completed. (NSURLErrorDomain error -1012.)" UserInfo=0x1c55bf90 {NSErrorFailingURLKey=https://198.199.129.150:443/ssl-vpn/prelogin.esp, NSErrorFailingURLStringKey=https://198.199.129.150:443/ssl-vpn/prelogin.esp} P 344-T12035 Aug 09 18:36:03:721530 Debug( 242): Server certificate verification failed Error Domain=GPErrorDomain Code=3 "The operation couldnâ€™t be completed. (GPErrorDomain error 3.)" UserInfo=0x1c669c40 {trustChain=( { Certificate = "<cert(0x1d041800) s: vpn.celadontrucking.com i: RapidSSL CA>"; }, { Certificate = "<cert(0x1c669010) s: RapidSSL CA i: GeoTrust Global CA>"; } ), ServerCert=<cert(0x1d041800) s: vpn.celadontrucking.com i: RapidSSL CA>} P 344-T12035 Aug 09 18:36:03:721651 Debug(2918): Show Gateway WAN: Server certificate verification failed P 344-T12035 Aug 09 18:36:03:721902 Error(1941): Failed to verify server certificate of gateway 198.199.129.150. P 344-T12035 Aug 09 18:36:03:721974 Debug(2918): Show Gateway WAN: Server certificate verification failed P 344-T12035 Aug 09 18:36:03:722025 Debug(1944): Failed to pre-login to the gateway 198.199.129.150 P 344-T12035 Aug 09 18:36:03:722074 Error(1353): Failed to retrieve info for gateway 198.199.129.150. P 344-T12035 Aug 09 18:36:03:722120 Debug( 599): session cleanup. P 344-T12035 Aug 09 18:36:03:722181 Debug(1362): tunnel to 198.199.129.150 is not created. P 344-T12035 Aug 09 18:36:03:722231 Error(2023): NetworkDiscoverThread: failed to discover external network. P 344-T12035 Aug 09 18:36:03:722283 Debug(2689): Set state to Disconnected P 344-T12035 Aug 09 18:36:03:726464 Debug(2058): NetworkDiscoverThread: m_nPortalStatus is 1, m_bHasLoggedOnGateway is 0 P 344-T12035 Aug 09 18:36:03:726611 Debug(2074): Network discovery is not ready, set GP VPN status as disconnected P 344-T12035 Aug 09 18:36:03:726672 Debug(2689): Set state to Disconnected P 344-T1799 Aug 09 18:36:03:742072 Debug( 262): Received message, session-1, msgtype-5

nthen · ‎08-07-2013

A custom syslog format may be the best way to go on this as it looks like I can capture everything that way. From there I can use SQL Reporting Services to generate all of the necessary reports.

nthen · ‎08-06-2013

Based on what I am seeing, there does not seem to be a way where I can limit what users can be reported against. For example, I have a help desk manager that needs to only see his staff. Right now, based on the way the firewall functions, he can see what the president of the company is doing online. Per our company policy, all URLs must be logged regardless of user so not logging some users would not really be the best option. We switched from Websense to the Palo Alto Brightcloud option and the reporting is quite limited. Few questions... Are there any 3rd party products that I can use to better secure the reports or to get better URL reports? Second, so Palo Alto could compete with Websense to attract more users looking for the reports when switching platforms, could an option be built into the user account on the firewall or Panorama where an admin could type a list of users or use a group of users that they are allowed to see when reporting. This way lower managers cannot see top execs or other departments. It would be huge for my employer and probably others if the reporting could allow this.

nthen · ‎08-06-2013

This happens with multiple systems. I think there is something going on between the Comcast Xfinity router and GlobalProtect. We have tried resetting it to factory defaults and it does not work. When using a Ethernet cable it connects without issue, however wireless will fail. We are trying a different router to see if that works, since the same laptop works fine on other wireless networks. When using wireless on this device we get a message stating the default could not be set.

nthen · ‎08-02-2013

There is no other 3rd party VPN and the routes are getting installed. It seems at this point the issue is related to Global Protect 1.2.5 and Comcast Xfinity routers. The 1.2.4 client works correctly. We are trying going to downgrade the client to see if that makes a difference, There do seem to be a lot of bugs with the Global Protect client compared to SonicWALL and CheckPoint options.

nthen · ‎08-01-2013

There is no overlapping subnet as the VPN is using 172.31.254.x and the local connection is using 10.0.0.x. I have uninstalled and reinstalled multiple times and this machine still has issues. I realize it could be the system that is hosed somehow, but I would like to track it down as it seems this issue happens to more and more people at random times.

nthen · ‎08-01-2013

A GP issue I am dealing with at the moment is where the client will successfully connect but I cannot ping anything on my network. It appears to immediately disconnect. I have attached the log files if anyone may know how to help determine the cause. I have gone through them but I am not having any luck just yet. The user is running the latest 1.2.5 client. We have tried numerous reboots, resetting a home router to factory defaults, re-installed the client, completely removed the client and re-installed and the problem continues.

nthen · ‎07-24-2013

I am having the same issue with one of my remote users, but he is not using RDP. Did anyone find anything?

nthen · ‎07-18-2013

I was able to solve the issue. The problem was with our vendor's network. They have a transparent proxy in place. When users aren't surfing the web the VPN does not work, however when they open Google or other public sites it does work. Their engineers are working on a fix.

nthen · ‎07-16-2013

On some workstations, the Global Protect client (latest 1.2.4) will not connect. If I re-install the client it begins working and then 2 days later will continually show Connecting in the taskbar until the client is re-installed again. Right now I have a mix of this happening on WIndows XP 32-bit, Windows 7 32-bit and Windows 7 64-bit. Some systems are brand new builds and others have been in use for awhile. Does anyone know what could cause this besides having to re-install on users workstations to correct? I have tried different Internet connections with and without firewalls and the issue continues.

nthen · ‎07-01-2013

I recently did something similar to this. Since the appliance will detect all applications regardless of the port they are running on you can make a custom service object. Instead of using Application Default with allows both 25 and 587, choose your custom service for just 587.

nthen · ‎07-01-2013

I am wanting to split internal and external DNS lookups on my PAN appliance to cut down on some traffic hitting our internal DNS servers. I think I can use a DNS Proxy to specify where the resolution occurs and what interface. Does anyone have experience in splitting DNS lookups in this fashion?

nthen · ‎06-27-2013

Do you know were to set the domain under the XML file? Do I change the DNSDomain option or something else?

nthen · ‎06-27-2013

All my groups are in the local domain and I just add the trusted users to it so I can keep all my groups together. I think this is due to the ForiegnSecurityPrincipals in Active Directory. When I put an LDAP browser on it, I can see my local users and a SID of the remote user. I don't think the PAN can resolve trusted domain users since it doesn't come back from LDAP that way. I was reading about a way to trick the agent on the remote end to send a different domain name. This would work for me if anyone knows where to set it since I have the same user in both domains for the Global Protect to work correctly.

Member Since	‎03-28-2013 07:10 AM
Date Last Visited	‎08-26-2015 06:13 AM
Posts	65
Total Likes Received	7

Online Status	Offline
Date Last Visited	‎08-26-2015 06:13 AM

About nthen

GlobalProtect Pre-Logon with Windows 8.1

Re: VPN with overlapping subnets

VPN with overlapping subnets

Ultrasurf 13.03 appearing as unknown-tcp

Re: Wildfire & ZIP files

Wildfire & ZIP files

Re: Possible Bug in Global Protect

Re: VPN to dynamic (ddns) destination

Re: What is still missing or needs to be improved in PA Next Generation Firewalls ?

Re: Possible Bug in Global Protect

Re: VPN with overlapping subnets

VPN with overlapping subnets

Re: iPad App fails to connect

Global Protect with multiple portals

Re: What is still missing or needs to be improved in PA Next Generation Firewalls ?

Re: What is still missing or needs to be improved in PA Next Generation Firewalls ?

Re: iPad App fails to connect

iPad App fails to connect

Re: User usage report enhancements

User usage report enhancements

Re: Global Protect will connect then immediately disconnect

Re: Global Protect will connect then immediately disconnect

Re: Global Protect will connect then immediately disconnect

Global Protect will connect then immediately disconnect

Re: GlobalProtect client doesn't inform the user that the portal/gateway connection is timing out

Re: Global Protect stuck on Connecting

Global Protect stuck on Connecting

Re: Restricting Application Port

Split internal and external DNS lookups

Re: PAN AGENT WITH MULTI-FOREST

Re: LDAP and trusted domains

Unlock your full community experience!

About nthen