GlobalProtect
Troubleshoot Clientless VPN
Table of Contents
Expand All
|
Collapse All
GlobalProtect Docs
-
- 10.1 & Later
- 9.1 (EoL)
-
- 6.3
- 6.2
- 6.1
- 6.0
- 5.1
-
- 6.1
- 6.0
- 5.1
-
- 6.3
- 6.2
- 6.1
- 6.0
- 5.1
Troubleshoot Clientless VPN
Because this feature involves dynamic re-writing of
HTML applications, the HTML content for some applications may not
re-write correctly and break the application. If issues occur, use
the commands in the following table to help you identify the likely
cause:
Action | Command |
|---|---|
CLI Commands | |
List the version of Clientless VPN dynamic
content being used You can also view the dynamic update version
from the Device Dynamic Updates GlobalProtect Clientless VPN |
In
this example, the current dynamic update is version 61-62, and the
last installed dynamic update is version 60-47. |
List active (current) users of Clientless
VPN |
|
Show DNS resolution results This can
be useful to determine if there are DNS issues. If there is a DNS issue,
you will notice querying against an FQDN that was not resolvable
in the CLI output. |
|
Show all Clientless VPN user sessions and
cookies stored |
|
Show rewrite-stats This is useful
to identify the health of the Clientless VPN rewrite engine. Refer
to Troubleshoot Clientless VPN for
information on rewrite statistics and their meaning or purpose. |
|
Debug Commands | |
Enable debug logs on the firewall running
Clientless VPN Portal |
|
Enable packet capture on the
firewall running the Clientless VPN Portal |
When
you execute packet capture commands, a consent page appears after
end users log in to the Clientless VPN portal, informing them that
the packets captured during their user session will contain unencrypted
(clear-text) data. If users consent to the packet capture session,
they then proceed to the applications landing page, where packet
capture begins. If users do not consent to the packet capture session,
they are logged out of the Clientless VPN portal and must contact
an administrator to proceed with a regular user session (without packet
capture). If you execute packet capture commands for user
sessions that are already in progress, those users are automatically
logged out of the Clientless VPN portal and must log back in to
accept or decline the packet capture session. |
Show packet capture files |
|
Export packet capture files to a Secure
Copy (SCP) server |
|
Statistic | Description |
|---|---|
initiate_connection_failure | Connection initiation failed to back-end
host |
setup_connection_failure | Connection setup failed |
setup_connection_duplicate | Duplicate peer session exists |
session_notify_mismatch | Mostly invalid session |
packet_mismatch_session | Failed to find right session for incoming
packet |
peer_queue_update_rcvd_failure | Session was invalid when packet update received
by peer |
peer_queue_update_sent_failure | Failed to send packet updates to peer or
failed to send packet queue length updates to peer |
exceed_pkt_queue_limit | Too many packets queued |
proxy_connection_failure | Proxy connection failed |
setup_connection_r | Installing the peer session to the application
server. This value should match the values for initiate_connection and setup_connection . |
setup_connection_duplicate_r | Duplicate sessions already in proxy |
setup_connection_failure_r | Failed to set up the peer session |
session_notify_mismatch_r | Peer session not found |
packet_mismatch_session_r | Peer session not found when trying to get
the packet |
exceed_pkt_queue_limit_r | Too many packets held |
unknown_dest | Failed to find destination host |
pkt_no_dest | No destination for this packet |
cookie_suspend | Suspended session to fetch cookies |
cookie_resume | Received response from MP with updated cookies.
This value generally matches the value of cookie_suspend. |
decompress_failure | Failed to decompress |
memory_alloc_failure | Failed to allocate memory |
wait_for_dns_resolve | Suspended session to resolve DNS requests |
dns_resolve_reschedule | Rescheduled DNS query due to no response
(retry before timeout) |
dns_resolve_timeout | DNS query timeout |
setup_site_conn_failure | Failed to setup connection to site (proxy,
DNS) |
site_dns_invalid | DNS resolve failed |
multiple_multipart | Multi-part content-type processed |
site_from_referer | Received the back-end host from referrer.
This can indicate failed rewrite links from flash or other content
which Clientless VPN does not rewrite. |
received_fin_for_pending_req | Received FIN from server for pending request
from client |
unmatched_http_state | Unexpected HTTP content. This can indicate
an issue parsing the http headers or body. |