Practical troubleshooting for GlobalProtect issues

When you're troubleshooting connectivity issues, there are several places where information can be gathered to try and determine the cause of a user not being able to connect. Starting from PAN-OS 9.1, most of the useful GlobalProtect logs can be found in Monitor > Logs > GlobalProtect, while the authentication logs can still be found in Monitor > Logs > System, as shown in the following screenshot. Before PAN-OS 9.1, all these logs were contained in the system log. Common issues such as a missing client certificate, a wrongly entered username or password, or an agent that tries to authenticate with an expired cookie can be found here so that the user can be directed accordingly:

Figure 2.38 – GlobalProtect and system logs

The currently connected users can be accessed from the portal and gateway pages via Network > GlobalProtect. The Current User section of the portal will show which...