Global Protect 6.11 disconnects after updating to Panos 10.2.7-h3

Site Feedback
1

My users have started to randomly drop from GlobalProtect since we updated from 10.1.10-h2 to 10.2.7-h3. I saw on the release pages it says to disable ipv6 if you are using ssl as the transport protocol which we are. I do not see IPV6 enabled anywhere in the portal/gateway or interface or tunnel settings. There is nothing being blocked or denied in traffic and the global protect logs do no show any failures. Is there a place to find preferred release of Global Protect? I thought it was on the same page as the PANOS releases but I can’t find it. In the Global Protect logs I just see a bunch of messages like this before it disconnects:

​

(P6644-T11620)Debug( 938): 01/23/24 18:55:23:530 HandleDnsCallback: failed to parse dns req packet.

(P6644-T11620)Debug( 938): 01/23/24 18:55:33:540 HandleDnsCallback: failed to parse dns req packet.

(P6644-T5908)Debug(1033): 01/23/24 18:55:40:995 SSL_read(len 229) success after 3 retry

2

Such a cluster! Everything has such major issues lately.

3

Seeing something similar with GP 6.1.3 and PANOS 10.1.11-h4 (we just upgraded recently as well)

4

Might not be related but just had GP issues since update to 10.2.7-h3, GP running 6.1.x.
I checked there was a known bug with 6.1.x, tried different client versions, same problem.
I’ve been told to disable IPv6 on the PANGP NIC… Problem solved.
Absolutely nothing in logs mentioning IPv6…

5

This explains our disconnects and seems 10.1.11-H4 has a ton of bugs and is no lonmger the preferred version as of this morning! I have gone to 10.1.11-H5 on my standbys and testing now.

*

10.1.11-h4 12/14/23

Note:

Autocommit failures seen on PA-410. (PAN-227435).

DNS resolution fails if DNS server IP is retrieved from DHCP. (PAN-242784).

DNS resolution fails for plugins (PAN-235741)

GlobalProtect tunnel might disconnect shortly after being established when SSL is used as a transport protocol. Workaround: Disable Internet Protocol Version 6 (TCP/IPv6) on the PANGP Virtual Network Adapter (PAN-242561).

6

Enable ipsec works for me

7

This seems to have maybe been fixed for me by turning off HIP checks , not sure if this is acceptable in your environment but we don’t leverage them anyhow. If you don’t use them either it may be worth looking into testing disabling it and seeing if it helps. Im curious either way though if that helps or not for you or if you find anything else out.

8

Can you do it globally with settings somehow, or only manually on every user’s PC?

9

We had this exact issue on v 10.2.7 h3 (we do patches the third Saturday of the month).

10

Thanks I have seen that correlation in the GP Logs but we use the HIP checks so I can’t turn them off. Hoping the announced 10.1.11-H5 software has fixes for this but waiting on confirmaton before I deploy it.

11

We dont leverage hips but I am still hesitent to upgrade to 10.2.7 because of this. Did this problem did not occur to you anymore?

12

Asked a colleague to check registry settings or GPO.

13

The actual solution for us was disabling the ipv6 stack on the local machines virtual adapter for global protect. We had to do it via a powershell script i think, Im not on the endpoint side of things so I’m not 100% sure how the fix was deployed.

14

Omg… is the pangp nic ipv6 stuff referring to the GP client on the endpoint and not the firewall? That would explain a lot.

15

Yes. I just disabled the IPv6 in the PANGP NIC. And voilà.
My colleague mentioned he is working on something to deploy this setting through GPO.

16

Anyone looking to automate this can use this Powershell script. I’m utilizing an Intune Remediation

Detection:

$interface = (Get-NetAdapter | ?{$_. InterfaceDescription -like '*PanGP*'}).Name
$chkInterface = (Get-NetAdapterBinding -Name $interface -ComponentID ms_tcpip6 -Verbose).enabled
if ($chkInterface -eq $false) {
Write-Host "Detected"
Exit 0
}
Else {
Exit 1
}

Remediation:

$interface = (Get-NetAdapter | ?{$_. InterfaceDescription -like '*PanGP*'}).Name

Disable-NetAdapterBinding -Name $interface -ComponentID ms_tcpip6

17

Nice one, I think friend did something similar with:
> Get-NetAdapterBinding -InterfaceDescription PANGP* | Set-NetAdapterBinding -Enabled:$false -ComponentID ms_tcpip6

18

That works as well and slightly more efficient :slight_smile: