About BChana

Hi everyone, hope someone can help me out with this. I'm looking into an issue whereby a user suffers frequent drops when connected to Global Protect. Apparently he sits next to the router and Internet is good. Today he reports drops at the following times:   Log for 08:30 (only dropped for a few seconds) Log for 10:33 (dropped for 5 secs) Log for 10:44 (1 min drop)   I don't see anything at the first two times but 10:44 is interesting. I see the following:   ==================================================================================== (P15856-T15860)Debug(1132): 02/25/22 10:44:20:554 Display the main panel when user click the tray icon. (P15856-T15860)Debug(3071): 02/25/22 10:44:20:589 Show the main panel. (P15856-T15860)Debug( 686): 02/25/22 10:44:26:359 Receive inactive message. (P15856-T15860)Debug( 121): 02/25/22 10:45:00:433 Received data from Pan Service (P15856-T15860)Debug( 608): 02/25/22 10:45:00:435 Current status is changed to 10. (P15856-T15860)Debug( 174): 02/25/22 10:45:00:435 username field is not empty. not override the username. (P15856-T15860)Debug( 203): 02/25/22 10:45:00:435 CPanBaseReceiver::HandleStatus - found discover-ready tag. value = y. (P15856-T15860)Debug( 210): 02/25/22 10:45:00:435 CPanBaseReceiver::HandleStatus - found cdl-log tag. value = n. (P15856-T15860)Debug( 274): 02/25/22 10:45:00:435 message type from the service = s <?xml version="1.0" encoding="UTF-8"?> <response> <type>status</type> <status>Restoring VPN Connection</status> <protocol>IPSec</protocol> <portal-config-version>4100</portal-config-version> <error-must-show/> <error-must-show-level>error</error-must-show-level> <error/> <uptime>10202</uptime> <byte-received>1103354044</byte-received> <byte-sent>113878618</byte-sent> <packet-received>1912282</packet-received> <packet-sent>310376</packet-sent> <incorrect-packet-received>0</incorrect-packet-received> <incorrect-packet-sent>0</incorrect-packet-sent> <server-ip>208.127.55.212</server-ip> <local-ip>172.31.71.230</local-ip> <local-ipv6/> <connect-mode>0</connect-mode> <product-version>5.2.8-23</product-version> <product-code>&quot;{8D681217-A782-4C04-A72C-1F36D27118FB}&quot;</product-code> <portal-status>Connected</portal-status> <user-name>MunroAL</user-name> <username-type>regular</username-type> <state>Restoring VPN Connection</state> <check-version>no</check-version> <portal>everland.gpcloudservice.com</portal> <discover-ready>yes</discover-ready> <mdm-is-enabled>no</mdm-is-enabled> <gateway-list name="gateway-list" type="external" user="MunroAL"> <entry> <gateway>uk-ever.gpoccooyno22.gw.gpcloudservice.com</gateway> <tunnel>yes</tunnel> <manual>yes</manual> <description>UK</description> <allow-tunnel>yes</allow-tunnel> <passwd-expire-days>-1</passwd-expire-days> <priority>1</priority> <internal>no</internal> <authenticated>yes</authenticated> </entry> (P15856-T15860)Debug( 231): 02/25/22 10:45:00:435 CPanParserWin::responseToUI() is called for status event. (P15856-T15860)Debug( 393): 02/25/22 10:45:00:435 Receive gps message with type status. (P15856-T15860)Debug( 88): 02/25/22 10:45:00:435 Client Auth got cleanup. (P15856-T15860)Info (1578): 02/25/22 10:45:00:435 RSA Integration: Token service is already stopped. (P15856-T15860)Debug( 325): 02/25/22 10:45:00:435 ===> response sent to GPI = <response><type>status</type><state>Restoring VPN Connection</state><error></error><disabled>no</disabled></response> (P15856-T15860)Debug(1980): 02/25/22 10:45:00:435 Dialog Status is not connected, and clear the hip messages. (P15856-T15860)Debug( 624): 02/25/22 10:45:00:435 CPanBaseConfigMgr::AddPortal - portal everland.gpcloudservice.com is already in list. (P15856-T15860)Debug( 624): 02/25/22 10:45:00:435 CPanBaseConfigMgr::AddPortal - portal everland.gpcloudservice.com is already in list. (P15856-T15860)Debug(1988): 02/25/22 10:45:00:435 Dialog Status is going to change from Connected to . (P15856-T15860)Debug( 624): 02/25/22 10:45:00:570 CPanBaseConfigMgr::AddPortal - portal everland.gpcloudservice.com is already in list. (P15856-T15860)Debug( 624): 02/25/22 10:45:00:570 CPanBaseConfigMgr::AddPortal - portal everland.gpcloudservice.com is already in list. (P15856-T15860)Debug( 686): 02/25/22 10:45:15:659 Receive inactive message. (P15856-T15860)Debug( 121): 02/25/22 10:45:19:760 Received data from Pan Service (P15856-T15860)Debug( 608): 02/25/22 10:45:19:763 Current status is changed to 3. (P15856-T15860)Debug( 174): 02/25/22 10:45:19:763 username field is not empty. not override the username. (P15856-T15860)Debug( 203): 02/25/22 10:45:19:764 CPanBaseReceiver::HandleStatus - found discover-ready tag. value = y. (P15856-T15860)Debug( 210): 02/25/22 10:45:19:764 CPanBaseReceiver::HandleStatus - found cdl-log tag. value = n. (P15856-T15860)Debug( 274): 02/25/22 10:45:19:764 message type from the service = s <?xml version="1.0" encoding="UTF-8"?> <response> <type>status</type> <status>Connected</status> <protocol>IPSec</protocol> <portal-config-version>4100</portal-config-version> <error-must-show/> <error-must-show-level>error</error-must-show-level> <error/> <uptime>10221</uptime> <byte-received>1103354044</byte-received> <byte-sent>113878618</byte-sent> <packet-received>1912282</packet-received> <packet-sent>310376</packet-sent> <incorrect-packet-received>0</incorrect-packet-received> <incorrect-packet-sent>0</incorrect-packet-sent> <server-ip>208.127.55.212</server-ip> <local-ip>172.31.71.230</local-ip> <local-ipv6/> <connect-mode>0</connect-mode> <product-version>5.2.8-23</product-version> <product-code>&quot;{8D681217-A782-4C04-A72C-1F36D27118FB}&quot;</product-code> <portal-status>Connected</portal-status> <user-name>MunroAL</user-name> <username-type>regular</username-type> <state>Connected</state> <check-version>no</check-version> <portal>everland.gpcloudservice.com</portal> <discover-ready>yes</discover-ready> <mdm-is-enabled>no</mdm-is-enabled> <gateway-list name="gateway-list" type="external" user="MunroAL"> <entry> <gateway>uk-ever.gpoccooyno22.gw.gpcloudservice.com</gateway> <tunnel>yes</tunnel> <manual>yes</manual> <description>UK</description> <allow-tunnel>yes</allow-tunnel> <passwd-expire-days>-1</passwd-expire-days> <priority>1</priority> <internal>no</internal> <authenticated>yes</authenticated> </entry> (P15856-T15860)Debug( 231): 02/25/22 10:45:19:764 CPanParserWin::responseToUI() is called for status event. (P15856-T15860)Debug( 393): 02/25/22 10:45:19:764 Receive gps message with type status. (P15856-T15860)Debug( 88): 02/25/22 10:45:19:764 Client Auth got cleanup. (P15856-T15860)Info (1578): 02/25/22 10:45:19:764 RSA Integration: Token service is already stopped. (P15856-T15860)Debug( 325): 02/25/22 10:45:19:764 ===> response sent to GPI = <response><type>status</type><state>Connected</state><error></error><disabled>no</disabled></response> (P15856-T15860)Debug( 624): 02/25/22 10:45:19:765 CPanBaseConfigMgr::AddPortal - portal everland.gpcloudservice.com is already in list. (P15856-T15860)Debug( 624): 02/25/22 10:45:19:765 CPanBaseConfigMgr::AddPortal - portal everland.gpcloudservice.com is already in list. (P15856-T15860)Debug(1988): 02/25/22 10:45:19:765 Dialog Status is going to change from to Connected. (P15856-T15860)Debug( 404): 02/25/22 10:45:19:768 Portal is connected. (P15856-T15860)Debug( 624): 02/25/22 10:45:19:769 CPanBaseConfigMgr::AddPortal - portal everland.gpcloudservice.com is already in list. (P15856-T15860)Debug( 624): 02/25/22 10:45:19:769 CPanBaseConfigMgr::AddPortal - portal everland.gpcloudservice.com is already in list. (P15856-T15860)Debug( 647): 02/25/22 10:45:20:443 Enter connected display, hide connect button in always-on, hide cancel button. (P15856-T15860)Debug( 624): 02/25/22 10:45:20:880 CPanBaseConfigMgr::AddPortal - portal everland.gpcloudservice.com is already in list. (P15856-T15860)Debug( 624): 02/25/22 10:45:20:880 CPanBaseConfigMgr::AddPortal - portal everland.gpcloudservice.com is already in list. (P15856-T15860)Debug(2113): 02/25/22 10:45:20:882 receive resize message from 1, and new height is 243. (P15856-T15860)Debug(2113): 02/25/22 10:45:20:891 receive resize message from 1, and new height is 243. ====================================================================================   I'm wondering whether there's timeout setting that needs amended. I'd really appreciate any assistance, this one has me a bit stumped.   Would appreciate any assistance provided. Thanks, ... View more

Hi everyone, hope someone can help with this query.   We've recently rolled out Global Protect to our users and all is working fine. General feedback, compared to the previous Checkpoint VPN connectivity, has been very positive.   One of our users raised an issue the other day which I'm unable to find any clarification for. We have been provided with 6 x UK gateways in the 208.127.55.8 range. These IPs were provided to 3rd parties to add to their whitelist in order for our users to be allowed to access secure systems/sites.   However, one of these third parties advises that another customer has already asked for the same IPs to be whitelisted, therefore our request has been reverted due to security risk. My question to them was perhaps the other customer provided them with a bigger range, rather than the six /32 addresses we have provided.   Alternatively, can anyone tell me whether gateway IPs within GP are designed to be shared, considering we are all set up with unique portal names?   Thanks very much for your time, I'd appreciate any advice. ... View more

Hi everyone, hope you're well. I hope somebody can help with this.     I'm looking to introduce a local Internet breakout, by installing a Palo Alto 220 firewall, as the site has been reporting slow Internet recently. ... View more

Hi everyone, hope you're all safe and well. My company is in the process of rolling out Palo Alto, Prisma and Global Protect worldwide. I've come across an issue that is causing me a bit of a headache. I hope someone can help.   Current setup Site A - 172.35.0.0 /16 Site B - 172.33.0.0 /16 Site A has a Cacheflow proxy server AT&T provide a MPLS WAN circuit. Inside traffic routes via the WAN, while Internet traffic breaks out via Site A Cacheflow. New setup Palo Alto device to sit in Site A and connect to Prisma How does site B get Internet access? From what I can, there are two options: 1) set up a VPN between Site A and B, which Internet routes through then breaks out in Site A   The second option is something I'd like some advice on. Do you think it would be possible to carry out this requirement in the AT&T MPLS? I can't quite understand how I can differentiate the traffic (Internal/External) in this space.   Is there anything in Prisma that I could use?   I hope the above makes sense and someone can help.   Thanks ... View more