About LCMember2099

Trying to replace a site to site VPN Cisco ASA firewall with Palo Alto PA-850.  Cisco ASA on this side has multiple ACLs configured which is equivalent to Proxy-IDs.  It is configued with IKEv1, policy based, no IKEv2.  I do not have access to the firewall on the other side.   I have multiple Proxy-IDs configured on the PA and matched with the existing Cisco ACLs.  Phase 1 comes up but fails on Phase 2.   What are the CLI commands to see what both Palo Alto and Cisco are seeing for the ProxyIDs?     ... View more

I can get to the GlobalProtect portal on the PA firewall from outside and login and download GlobalProtect client.  However, after installing the client and try to connect, it says "Portal not found"   Any ideas?   Client is joined to domain, it did not ask for credential when trying to connect SSL CA and Gateway is self signed on PA and Root CA and server cert are added to the client and host DNS modifed to reflect the same name on the cert.   PAN-OS GUI Gateways Local IP shows blank, but when you go into details,  external IP address shows up.  But when you click IPv4 Address, it shows with the external IP address.  But when you click on the IPv4 Address drop down, the IP address does not show up.  Only when you select another interface and hit ok and change it back to the outside interface then the IPv4 address shows up and is selectable again.  Very weird, maybe GUI bug?   PAN-OS is 8.0.7, GlobalProtect is 5.0.1-9   GlobaProtect Client log below   -----     0 Failed (T1020) 03/25/19 11:32:09:370 Debug(3874): CPD, index=2, iRet=-3, lastError=-3 (T1020) 03/25/19 11:32:09:370 Debug(3888): CPD, CaptivePortalDetectionThread: captive portal is not detected for CP server. iStatus = 0 (T1020) 03/25/19 11:32:09:370 Debug(4058): CaptivePortalDetectionThread: Didn't detect captive portal currently, and bCaptivePortalDetectedOnce=(0). (T1020) 03/25/19 11:32:09:370 Debug(3950): CaptivePortalDetectionThread: wait (-1 ms) for captive portal detection event. (T2608) 03/25/19 11:32:43:527 Info ( 474): msgtype = portal (T2608) 03/25/19 11:32:43:527 Debug(1651): ----portal processing starts---- (T2608) 03/25/19 11:32:43:527 Debug(1664): User profile type is 0(not roaming) (T2608) 03/25/19 11:32:43:527 Debug(1724): CheckUpdate is false. )(T2608) 03/25/19 11:32:43:527 Debug(1739): portal-certificate-verification is yes (T2608) 03/25/19 11:32:43:527 Debug(1779): No saml-load-cache tag. (T2608) 03/25/19 11:32:43:527 Debug(1799): no saml-auth-error tag. (T2608) 03/25/19 11:32:43:527 Debug(1810): allow-cached-portal is yes (T2608) 03/25/19 11:32:43:527 Debug(1854): NewWinUser is Administrator, WinUser is , PreviousSwitchOffMsg is false (T2608) 03/25/19 11:32:43:527 Debug(1855): GetPrelogonStatus() 0, m_userName ___empty_username___, m_preUsername Administrator (T2608) 03/25/19 11:32:43:527 Debug(5271): StopThreads starts: (T2608) 03/25/19 11:32:43:527 Debug(1171): Logging out gateway, reason is StopThreads (T2608) 03/25/19 11:32:43:527 Debug(1201): Logging out gateway over (T1020) 03/25/19 11:32:43:527 Debug(3953): CaptivePortalDetectionThread: got exit event. (T1020) 03/25/19 11:32:43:527 Debug(4107): CaptivePortalDetectionThread: captive portal detection thread exit status is (failed). (T3952) 03/25/19 11:32:43:527 Debug(5042): NetworkConnectionMonitorThread: got exit event. (T3952) 03/25/19 11:32:43:527 Debug(5057): NetworkConnectionMonitorThread: quits. (T3820) 03/25/19 11:32:43:527 Debug(4604): HipReportThread: got exit event. (T3820) 03/25/19 11:32:43:527 Debug(4903): HipReportThread: HipReportThread quits. (T4796) 03/25/19 11:32:43:527 Debug(4151): NetworkDiscoverThread: got exit event. (T4796) 03/25/19 11:32:43:527 Debug(4478): NetworkDiscoverThread: quits. (T4412) 03/25/19 11:32:43:527 Debug(3758): NotificationTimerThread: got exit event. (T2576) 03/25/19 11:32:43:527 Debug(2325): Setting debug level to 5 (T2608) 03/25/19 11:32:43:636 Debug(5286): threads are gracefully stopped. (T4688) 03/25/19 11:32:43:636 Debug( 437): HipMissingPatchThread: got thread exit event. (T4688) 03/25/19 11:32:43:636 Debug( 535): HipMissingPatchThread: Hip check missiing patch thread quits. (T2492) 03/25/19 11:32:43:636 Debug( 242): HipCheckThread: got thread exit event. (T2492) 03/25/19 11:32:43:636 Debug( 287): HipCheckThread: Hip check thread quits. (T2608) 03/25/19 11:32:43:636 Debug( 132): All hip collect threads quit gracefully. (T2608) 03/25/19 11:32:43:636 Debug(5350): StopThreads ends. (T2608) 03/25/19 11:32:43:636 Debug(5235): StartThreads starts: (T2608) 03/25/19 11:32:43:636 Debug( 25): create thread 0x414 with thread ID 4032 (T2608) 03/25/19 11:32:43:636 Debug( 25): create thread 0x440 with thread ID 3692 (T2608) 03/25/19 11:32:43:636 Debug( 25): create thread 0x448 with thread ID 4468 (T2608) 03/25/19 11:32:43:636 Debug( 25): create thread 0x3e4 with thread ID 4056 (T2608) 03/25/19 11:32:43:636 Debug( 25): create thread 0x4b0 with thread ID 4088 (T2608) 03/25/19 11:32:43:636 Debug( 25): create thread 0x478 with thread ID 4144 (T2608) 03/25/19 11:32:43:636 Debug( 25): create thread 0x488 with thread ID 808 (T2608) 03/25/19 11:32:43:636 Debug( 25): create thread 0x4d4 with thread ID 4304 (T2608) 03/25/19 11:32:43:636 Debug(1956): No user, using SSO (T2608) 03/25/19 11:32:43:636 Debug(8519): Saved password is empty. (T2608) 03/25/19 11:32:43:636 Debug(2016): Portal XX.XX.XX, user , logonDomain GHQ1S1, saved user , path C:\Users\Administrator.GHQ1S1\AppData\Local\Palo Alto Networks\GlobalProtect\ (T2608) 03/25/19 11:32:43:636 Debug(2140): Pre-logon-then-on-demand value is no (T2608) 03/25/19 11:32:43:636 Debug(1496): SSO starts. (T2608) 03/25/19 11:32:43:636 Info (1525): SSO ----- PanCredGet failed with error Element not found. (T2608) 03/25/19 11:32:43:636 Debug(1536): SSO GetSsoCredential starts. (T2608) 03/25/19 11:32:43:636 Info (1566): SSO ----- PanCredGet failed with error Element not found. (T2608) 03/25/19 11:32:43:636 Debug(8536): SSO password is empty (T2608) 03/25/19 11:32:43:636 Debug(2208): Empty username (T2608) 03/25/19 11:32:43:636 Debug(2240): m_preUsername ___empty_username___ (T2608) 03/25/19 11:32:43:636 Debug(8496): Password is empty. (T2608) 03/25/19 11:32:43:636 Debug(6236): Empty user for GetCachedPortalCfgOldNewFileName (T2608) 03/25/19 11:32:43:636 Debug(2257): CheckCachedPortalForPrelogon 0, PrelogonNeedTimeout 0, RenameTimeout -1, userName ___empty_username___, preUsername ___empty_username___ (T2608) 03/25/19 11:32:43:636 Debug(5383): --Set state to Retrieving configuration... (T2608) 03/25/19 11:32:43:636 Debug( 833): Display hip report V4 on the UI (T2608) 03/25/19 11:32:43:636 Debug(10837): Portal's ipv4 address X.X.X.X (T2608) 03/25/19 11:32:43:636 Debug(6333): SSO enable status is 1, user name is ___empty_username___, domain name is . (T2608) 03/25/19 11:32:43:636 Debug(2158): open http session. agent is PAN GlobalProtect/5.0.1-9 (Microsoft Windows Server 2012 Standard Edition, 64-bit) (T2608) 03/25/19 11:32:43:636 Debug( 433): winhttp SetSecureProtocol, hSession=7ecc2ac0, bAllProtocol=0, gbFips=0 (T2608) 03/25/19 11:32:43:636 Debug( 433): winhttp SetSecureProtocol, hSession=7ecc2240, bAllProtocol=0, gbFips=0 (T4032) 03/25/19 11:32:43:636 Debug(3602): NotificationTimerThread: notification timer thread starts. (T4032) 03/25/19 11:32:43:636 Debug(3751): NotificationTimerThread: wait (-1 ms) for notification timer event. (T3692) 03/25/19 11:32:43:636 Debug(3797): CaptivePortalDetectionThread: captive portal detection thread starts. (T3692) 03/25/19 11:32:43:636 Debug(3950): CaptivePortalDetectionThread: wait (-1 ms) for captive portal detection event. (T4468) 03/25/19 11:32:43:636 Debug(4117): NetworkDiscoverThread: network discover thread starts. (T4468) 03/25/19 11:32:43:636 Debug(4142): NetworkDiscoverThread: wait for network discover event. (T4056) 03/25/19 11:32:43:636 Debug(4563): HipReportThread: HipReportThread starts up. (T4056) 03/25/19 11:32:43:636 Debug(4596): HipReportThread: wait for HIP report ready event. (T4088) 03/25/19 11:32:43:636 Debug(4911): NetworkConnectionMonitorThread: network connection monitor thread starts. (T4144) 03/25/19 11:32:43:636 Debug( 167): Start HipCheckThread (T4144) 03/25/19 11:32:43:636 Debug( 210): HipCheckThread started... (T4144) 03/25/19 11:32:43:636 Debug( 216): HipCheckThread: wait for hip check event for 3600000 ms); (T808) 03/25/19 11:32:43:636 Debug( 176): Start HipMissingPatchThread (T808) 03/25/19 11:32:43:636 Debug( 409): HipMissingPatchThread started... (T808) 03/25/19 11:32:43:636 Debug( 41): Roaming profile is false (T808) 03/25/19 11:32:43:636 Debug( 167): profileInfo username Administrator, profile path (null), server (null) (T4304) 03/25/19 11:32:43:636 Debug( 186): Start HipMonitorThread (T4304) 03/25/19 11:32:43:636 Info ( 761): HipMonitorThread starts (T4304) 03/25/19 11:32:43:636 Info ( 439): HipMonitorThread is using WMI. (T4304) 03/25/19 11:32:43:636 Error( 596): Could not connect. Error code = 0x8004100e (T4304) 03/25/19 11:32:43:636 Debug( 765): HipMonitorThread quits. (T2608) 03/25/19 11:32:43:636 Debug(1631): SetProxyForHost(https://XX.XX.XX/ 😞 timeout:5 AutoDetect:1 url: proxy: bypass: proxystr: (T2608) 03/25/19 11:32:43:636 Debug(5428): ----Portal Pre-login starts---- (T3692) 03/25/19 11:32:43:636 Debug(3973): CaptivePortalDetectionThread: IsDetectingCaptivePortal=1, PreLoginIsDone=0 (T3692) 03/25/19 11:32:43:636 Debug(3950): CaptivePortalDetectionThread: wait (2000 ms) for captive portal detection event. (T2608) 03/25/19 11:32:43:652 Debug( 527): Network is reachable (T2608) 03/25/19 11:32:43:652 Debug(5454): Pre-login...,verifyportalcert=yes (T2608) 03/25/19 11:32:43:652 Debug(8867): Check cert of server X.X.X.X (T2608) 03/25/19 11:32:43:652 Debug(8882): File C:\Program Files\Palo Alto Networks\GlobalProtect\tca.cer does not exist. (T2608) 03/25/19 11:32:43:652 Debug( 769): SSL connecting to X.X.X.X (T2608) 03/25/19 11:32:43:652 Debug( 527): Network is reachable (T3692) 03/25/19 11:32:45:651 Debug(3862): CPD, reset cp detection history (T3692) 03/25/19 11:32:45:714 Debug( 527): Network is reachable (T2608) 03/25/19 11:32:48:730 Debug( 100): connect failed with 5 seconds timeout. (T2608) 03/25/19 11:32:48:730 Debug( 550): Failed to connect to X.X.X.X on 443 with return value -1 and socket error 0(0) (T2608) 03/25/19 11:32:48:730 Debug( 773): do_tcp_connect() failed (T2608) 03/25/19 11:32:48:730 Error(8913): ConnectSSL: Failed to connect to 'X.X.X.X:443'. Disconnect ssl. (T2608) 03/25/19 11:32:48:730 Debug(8926): Cannot get server cert of X.X.X.X (T2608) 03/25/19 11:32:48:730 Debug(5488): Skip CheckServerCert result (T2608) 03/25/19 11:32:48:730 Debug(2600): encpostdata, encpostdata=000001707EC5C1A0, encpostdatalen=176 (T2608) 03/25/19 11:32:48:730 Debug(2764): REQID=6,IPADDR=XX.XX.XX,PORT=443,URL=/global-protect/prelogin.esp,POST=1,PROXY_AUTO=1,PROXY_CFGURL=NULL,PROXY=NULL,PROXY_BYPASS=NULL,PROXY_USER=NULL,PROXY_PASS=****,VERIFY_CERT=1,ADDITIONAL_CHECK=1,SCEP_CERT=,oid= (T2608) 03/25/19 11:32:48:730 Debug(1203): Send response to client for request https_request (T2608) 03/25/19 11:32:48:839 Debug(2874): receive pan_msg_ping, 3 (T2608) 03/25/19 11:32:49:823 Debug(5554): prelogin to portal result is (null) (T2608) 03/25/19 11:32:49:823 Debug(5774): Failed to pre-login to the portal XX.XX.XX with return value 0(0). (T2608) 03/25/19 11:32:49:823 Info (7954): Portal config does not exist, try registry/plist (T2608) 03/25/19 11:32:49:823 Info (6519): failed to retrieve value of the tag version. (T2608) 03/25/19 11:32:49:823 Debug(6530): Failed to get portal config from portal XX.XX.XX. (T2608) 03/25/19 11:32:49:823 Debug(6558): Try to restore last portal config from file. (T2608) 03/25/19 11:32:49:823 Debug(6600): Skip retrieve cached portal configuration for empty user (T2608) 03/25/19 11:32:49:823 Debug(6550): portal status is Invalid portal. (T2608) 03/25/19 11:32:49:823 Debug(5383): --Set state to Disconnected (T2608) 03/25/19 11:32:49:823 Debug( 833): Display hip report V4 on the UI (T2608) 03/25/19 11:32:49:823 Debug(1203): Send response to client for request portal (T2576) 03/25/19 11:32:49:823 Debug(2325): Setting debug level to 5 (T3692) 03/25/19 11:32:50:761 Debug( 100): connect failed with 5 seconds timeout. (T3692) 03/25/19 11:32:50:761 Debug( 550): Failed to connect to X.X.X.X on 80 with return value -1 and socket error 0(0) (T3692) 03/25/19 11:32:50:761 Debug( 110): CPD, Connect to captive portal X.X.X.X:80 Failed (T3692) 03/25/19 11:32:50:761 Debug(3874): CPD, index=0, iRet=-3, lastError=0 (T3692) 03/25/19 11:32:50:761 Debug(3888): CPD, CaptivePortalDetectionThread: captive portal is not detected for CP server. iStatus = 0 (T3692) 03/25/19 11:32:50:761 Debug( 527): Network is reachable (T3692) 03/25/19 11:32:55:817 Debug( 100): connect failed with 5 seconds timeout. (T3692) 03/25/19 11:32:55:817 Debug( 550): Failed to connect to X.X.X.X on 80 with return value -1 and socket error 0(0) (T3692) 03/25/19 11:32:55:817 Debug( 110): CPD, Connect to captive portal X.X.X.X:80 Failed (T3692) 03/25/19 11:32:55:817 Debug(3874): CPD, index=1, iRet=-3, lastError=-3 (T3692) 03/25/19 11:32:55:817 Debug(3888): CPD, CaptivePortalDetectionThread: captive portal is not detected for CP server. iStatus = 0 (T3692) 03/25/19 11:32:56:317 Debug( 527): Network is reachable (T3692) 03/25/19 11:33:01:349 Debug( 100): connect failed with 5 seconds timeout. (T3692) 03/25/19 11:33:01:349 Debug( 550): Failed to connect to X.X.X.X on 80 with return value -1 and socket error 0(0) (T3692) 03/25/19 11:33:01:349 Debug( 110): CPD, Connect to captive portal X.X.X.X:80 Failed (T3692) 03/25/19 11:33:01:349 Debug(3874): CPD, index=2, iRet=-3, lastError=-3 (T3692) 03/25/19 11:33:01:349 Debug(3888): CPD, CaptivePortalDetectionThread: captive portal is not detected for CP server. iStatus = 0 (T3692) 03/25/19 11:33:01:349 Debug(4058): CaptivePortalDetectionThread: Didn't detect captive portal currently, and bCaptivePortalDetectedOnce=(0). (T3692) 03/25/19 11:33:01:349 Debug(3950): CaptivePortalDetectionThread: wait (-1 ms) for captive portal detection event. ... View more