University Client VPN Troubleshooting Guide

This guide is meant to provide helpful troubleshooting steps to empower Local Support Providers to resolve issues they find with the installation and/or operation of the University Client VPN “Palo Alto – GlobalProtect”. 

Can the user log in to the portal website? If not, see the list below for troubleshooting steps.

Is the user having an authentication error?

The University Client VPN is authenticated via PennKey. If the user has forgotten their PennKey username or password or is having trouble with those credentials, have them contact PennKey Support.

Is the user enrolled in Penn Two-Step?

Users must first be enrolled in Penn Two-Step to access the University Client VPN. To enroll, access the Two-Step Verification site. Have the user enroll and then try again.

Trouble with DUO Universal Prompt with Palo Alto VPN Pre-Logon functionality?

The transition to DUO Universal Prompt can cause an issue with the Palo Alto VPN Pre-Logon functionality. A user who attempts to do this will pass primary authentication but will be unable to complete secondary authentication. There is a way to resolve this by modifying the Windows registry entry for pre-logon to include the DUO domain(s).

The following Windows registry entry should be added to fix this:

• Path: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\CBL
• Type: Reg_SZ
• Value Name: TrustedIdpDomains
• (The value is comma-separated for multiple domain names) Value Data: api-ecae067e.duosecurity.com

Note: This may be done via BigFix if that is how the software is pushed out and configured for end-user workstations.

Is the user in the proper PennGroups group for VPN access?

Have the user visit the Penn Campus VPN access analysis page. The user should see a message that says "Penn VPN status: Yes, you can log in to the Penn Campus VPN".

If not, please submit a ticket to the ISC PennGroups team.

Can the user receive a ping response from vpn.upenn.edu?

If not, there could be connectivity issues at the user’s home.

Are there certificate issues in the browser?

Try using a different browser, clearing browser cache, or using Incognito Mode.

Can the user resolve vpn.upenn.edu to its correct IP address? (128.91.250.251)

If not, there could be DNS issues. Ensure the user doesn’t have any local DNS setup and that they have the correct responding Penn DNS Servers: 128.91.18.2, 128.91.49.2

Is the user using more than one VPN?

Make sure the user is connecting to GlobalProtect first and that the second VPN is not a full tunnel.

Is the user connected to the VPN network once they log in?

Run ipconfig in Windows or ifconfig in MacOS and make sure they are part of one of these subnets: 10.100.128.0/19 or 10.100.160.0/19

Reboot

Rebooting can resolve many issues and is a good first step to try.

Is the VPN client installed properly?

Make sure you are obtaining the client from the UPenn GlobalProtect portal. If not, uninstall, download, and reinstall.

Windows Defender Problems

In the PanGPHip.log file search for “defender” an “opswat” error shows up which doesn’t allow the client to connect or keeps dropping the connection as soon as it does. This has been fixed in the newest version so far, so make sure the user is running the newest version.

Port 4767

There can be problems with the connection on port 4767.  This shows up in the PanGPA.log.  When reviewing this log, search for 4767. You may see an error about failure to connect on port 4767.  Verify the computer is listening for the connection:

On a Mac from a terminal

Netstat -an | grep 4767 you should see this below:

tcp4       0      0  127.0.0.1.4767         *.*       LISTEN

On Windows from CLI

Netstat -an | find “4767”

TCP 127.0.0.1:4767   0.0.0.0/0          LISTENING

If it isn’t listening you might try restarting the client or rebooting the computer. You can also temporarily disable the local firewall and see if the machine is able to connect.  If you can connect after this step, you can add an exception to Windows Firewall. 

Driver Problems

Driver problems may show up in the PanGPS.log.  In this log, search for errors. If you see something like “start driver failed” or “EnableVIF failed”, try reinstalling the VPN client from scratch.

To collect logs on the GlobalProtect client:

1. Click Settings in the top right corner.
2. Select the Troubleshooting Tab.
3. Ensure the Logging Level is set to Debug.
4. Click “Collect Logs.”

This will download a zipped directory of files. If opening a ticket with ISC, please attach this zip file to the ticket.

Note: Make sure to reboot first, then attempt connection, then collect logs.

Useful Log Files

• Systeminfo.txt: Tells you information about the local system.
• PanGPS.log: Tells you client events on the local system.
• PanGPHip.log: Shows HIP events. Note: There have been problems with Windows Defender that show up here.
• PanGPA.log: Shows logical event problems.
• Debug.log: Can also be helpful.