Troubleshooting VPN

Summary

GlobalProtect VPN not working? This article lists some of the common issues experienced with GlobalProtect, and how to fix them.

NOTE: Before opening a ticket with IT, please try the steps outlined in this article.

Sections in this article

• Connecting to GlobalProtect VPN
• Not Receiving DUO Push
• "Authentication Failed" or "Invalid Credentials" Error
• Clear Cache or Reinstalling Global Protect
• Extension Blocked
• HIP Alert Notification
• Stuck on Connecting..
• Error: "Could Not Connect to the GlobalProtect Gateway" OR "Portal Not Found"
• Internet Connection is Slow
• Unable to Reach Resources when on VPN

Connecting to GlobalProtect VPN

If you haven't already, review How To Connect to GlobalProtect VPN:

• Article for Mac
• Article for Windows PC

Not Receiving DUO Push 

The first step when you connect to GlobalProtect is to accept the DUO push on your mobile phone.

If the DUO push is not coming to your device, please try the following:

• Restart your mobile phone
• Check your network/internet connection
• Uninstall/Reinstall the DUO Mobile App

"Authentication Failed" or "Enter Login Credentials" Error

If you receive "Authentication Failed" it is usually due to your login credentials (user name and password) being incorrect.

User Name

Your GlobalProtect user name is your email prefix (without the @office.com)

Password

Your GlobalProtect password is the same as your Okta password.

To validate that you are trying the correct password:

• Navigate to itdesk.okta.com and sign out.
• Then sign back in to Okta.
• If you sign in successfully, please try this same password in GlobalProtect again.
  • Remember: You may need to accept a DUO push when connecting to VPN.

TIP: If you are still unable to sign in, try Clear Cache & Reinstalling GlobalProtect below. You may also need to reset your Okta password at itdesk.okta.com

If you are still receiving "Authentication Failed" (or a similar message) after trying these steps, please contact IT for additional assistance.

Clear Cache & Reinstalling GlobalProtect

Most of the time, a simple "Clear GlobalProtect Cache" OR a Remove/Install GlobalProtect fixes it. First start with "Clear Global Cache".
If that doesn't fix it, Uninstall and reboot your laptop. After rebooting reinstall.

You can find the Uninstall, Reinstall and Clear Cache items in Self Service on your Mac.

• Search "GlobalProtect" in the search field.

You can also Reinstall GlobalProtect from Self Service on a Windows PC

After reinstalling following these instructions on how to Reconnect

Extension Blocked

During the Installation / Reinstallation of GlobalProtect, the following window might pop-up providing a shortcut to the "Open Security Preferences" because macOS does not want to run the GlobalProtect client without permission.

To resolve this:

• Open System Preferences > Security & Privacy
• Open the General tab and look near the bottom of the window for an alert:

System software from a developer... was blocked from loading.

• Choose Allow

HIP Alert Notification

Some users may receive the following message on their computer when connecting to the VPN:

"Alert! Your machine has failed our security compliance check. Please send an email to [e-mail] informing them you have received this message when connecting to GlobalProtect. You will be able to connect to GlobalProtect, but it will not allow you to reach sites that it protects.  More information >...

Refer to the following; What to Do When You Receive a HIP Check Alert on Your Computer

 

Stuck on Connecting...

 If your GlobalProtect client is stuck on Connecting, either of the following should fix it;

On the GlobalProtect client click on the 3 lines (top right), and select Refresh Connection. Click OK when prompted that this will disconnect GlobalProtect and establish a new connection. If the above fails, then clear cache should resolve it. Select Clear GlobalProtect Cache from Self Service Portal. You will have to re-authenticate.

Error: "Could Not Connect to the GlobalProtect Gateway" OR "Portal Not Found"

If Clear Cache or Reinstalling Global Protect didn't fix this issue, you could have an underlying DNS issue. You can confirm this by trying to resolve sec.zdcorp.com from terminal by executing;

nslookup sec.zdcorp.com

If you get a timeout or an error, then DNS is an underlying issue.

This could be the result of IPv6 operating on the home network. Try disabling IPV6 with the following command and then restarting your computer.

Internet Connection is Slow

There is a speed limitation on VPN of 70-100Mbps, so if you are expecting more, then that's the best that you will get.

At times we do get reports of VPN being even slower, especially on RFA. Most of the time this is a result of latency or packet loss to the VPN endpoint. This is especially common with Manila.

Latency

Using Manila as an example, the closest VPN endpoint is Singapore. But at times, ISPs route to the US, then Japan finally arriving at Singapore. This extends the round trip to 400ms. If it was to go direct (which it should), the round trip will be ~45ms.

Unable to Reach Resources on VPN

When connected to GlobalProtect, your internet connection may appear to stop working.

This can be confirmed using the following command. Note the timeout:

Anything being routed over through gpd0 is timing out.

It does this across every endpoint, with the exception of AMER WEST (non RFA). Also when tethering with your phone, the issue goes away.

Please refer to this article for additional troubleshooting and support.