top of page
Search

Palo Alto GlobalProtect Portal Up, Gateway Down: CLI Split That Saves an Hour

  • Aug 15
  • 2 min read
Palo Alto network security troubleshooting lab
Palo Alto · Techclick CLI troubleshooting lab
Users authenticate to the portal, then hang on Connecting to gateway. Helpdesk already reinstalled the client twice.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

  • Name the first CLI command to run on Palo Alto for this ticket

  • Separate the layer that is actually broken from the layer people blame

  • Apply one scoped fix instead of a global disable

  • Prove the ticket closed with a session, log, or counter

Quick answer

Portal and gateway are different listeners. Prove portal auth, then test the gateway IP, SSL profile, and client IP pool separately.

Why this ticket shows up

A healthy portal only proves SAML or LDAP. The gateway can fail on certificate SAN, split-tunnel access routes, or an empty IP pool while the portal page still looks perfect.

Symptoms operators actually see

  • Portal page works, gateway stays Connecting

  • Only one ISP or only mobile users fail

  • Gateway SSL profile uses a cert without the gateway FQDN

  • show global-protect-gateway current-user is empty

CLI first — copy this block

Run these on the Palo Alto device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

show global-protect-gateway current-user
show global-protect-gateway statistics
show global-protect-gateway flow
show running global-protect-gateway-crypto
show log system query equal "( description contains GlobalProtect )"
test authentication authentication-profile GP-AUTH username jsmith password

How to read that output

current-user empty with portal successes means the gateway never finished tunnel setup. Check gateway certificate SAN versus the FQDN in the portal agent config. Then check the client IP pool and access routes.

Triage order

  1. Confirm portal auth works with test authentication.

  2. Resolve the gateway FQDN from the failing laptop and compare it to the certificate SAN.

  3. Check the gateway IP pool is not exhausted.

  4. Look at system logs for ssl-vpn or hip errors.

  5. Fix the gateway object, not the portal, unless both share a broken auth profile.

Classic traps

What you see

Real cause

Fix

Reinstall client

Gateway cert SAN is the portal name

Issue a cert with both names

SAML is down

Portal already succeeded

Do not rebuild SAML first

Split tunnel empty

Access route is 0.0.0.0/0 missing

Add the routes the laptop needs

Proof the ticket is closed

  • show global-protect-gateway current-user lists the test user

  • Laptop gets a tunnel IP

  • Internal app ping works

Say this in an interview

I split portal and gateway. Portal success only proves identity. Gateway success proves the tunnel.

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/

Comments

bottom of page