Multiple disconnect

[Mistouf]

Hello,

I have a problem with newest version about Pulse Secure (9.1R15, 9.1R14.(1), etc)

We have the 9.1R13 version in production, and we don't have this problem.

When we go into the logs, we can see that the Pulse client disconnects very regularly (0 to 150 seconds).

In reality, the user does not perceive an interruption every X seconds. We started a TSE connection and the connection ended after about 25 minutes.

Why do we have this issue? This problem prevents us from updating the production platform.

Spoiler

2022-06-10 11:10:48 - ive - [192.168.220.239] Default Network::Toto(XXX)[XXXX] - Closed connection to 192.168.15.209 after 0 seconds, with 0 bytes read and 0 bytes written

2022-06-10 11:10:48 - ive - [192.168.220.239] Default Network::Toto(XXX)[XXXX] - VPN Tunneling: Session ended for user (session: sid1feb202ecaeb6d1e27647dd5f0307ed36b7b06da00000000) with IPv4 address 192.168.15.209

2022-06-10 11:10:48 - ive - [127.0.0.1] Default Network::System()[] - VPN Tunneling: Optimized ACL count = 0.

2022-06-10 11:10:48 - ive - [127.0.0.1] Default Network::System()[] - VPN Tunneling: ACL count = 0.

2022-06-10 11:10:48 - ive - [127.0.0.1] Default Network::System()[] - Radius Accounting: Successfully sent radius accounting NC session start request for 3642

2022-06-10 11:10:48 - ive - [192.168.220.239] Default Network::Toto(XXX)[XXXX] - VPN Tunneling: User with IP 192.168.15.209 connected with SSL transport mode.

2022-06-10 11:10:48 - ive - [192.168.220.239] Default Network::Toto(XXX)[XXXX] - VPN Tunneling: Session started for user (session: sid1feb202ecaeb6d1e27647dd5f0307ed36b7b06da00000000) with IPv4 address 192.168.15.209, hostname PC-18197

2022-06-10 11:10:48 - ive - [127.0.0.1] Default Network::System()[] - VPN Tunneling: Optimized ACL count = 57.

2022-06-10 11:10:48 - ive - [127.0.0.1] Default Network::System()[] - VPN Tunneling: ACL count = 62.

2022-06-10 11:10:48 - ive - [127.0.0.1] Default Network::System()[] - Radius Accounting: Successfully sent radius accounting NC session stop request for 3642

2022-06-10 11:10:48 - ive - [192.168.220.239] Default Network::Toto(XXX)[XXXX] - Closed connection to 192.168.15.209 after 123 seconds, with 415618 bytes read and 305426 bytes written

[zanyterp]

it shouldn't be indicative of a problem

[Mistouf]

Why is this not indicative of a problem?

I cannot put this version in production if there are multiple disconnections which are non-existent with the old versions (9.1R13).

What other logs should I provide?

[zanyterp]

it could be that the users are disconnecting or having an interruption in their session. what logs has your support engineer requested for investigation with? if you have not opened a case yet, a good place to start will be the following:
the events & user access logs; a tcp dump on the port that users connect against will be needed; a system snapshot with debug logging enabled for the following events will be needed: dsagentd,ifttls,sbr,SBR,radius,eap-o-http; any process snapshots at Maintenance>Troubleshooting>System Snapshot; tcp dump on the pulse adapter on the client; tcp dump on the physical adapter on the client; pulse client logs set to detailed level with an annotation when the login happens (save immediately) and then when the disconnect occurs (save immediately). does this occur when using esp transport or only ssl? if the latter, can you test with esp?

[Ho Ru]

We have the same error since update to 9.1R15.
The interruptions only happen in ESP mode - mostly around the time of a Key Exchange. Many users have interruptions after 15 to 2500 seconds, mostly around 500 - 800 seconds.
Some have to redial, others don't notice it - depending on how long the interruption lasts (> 4-6 seconds mostly redial).
For some users working with WLAN, there are entries in the Windows event log that WLAN security has been terminated and that the WLAN connection will be disconnected.
Whether this is a consequence of the VPN interruption, or whether the VPN connection is disconnected due to the termination of the WLAN security, I could not determine yet.
It is often difficult to isolate the problem because the users have little PC experience and I cannot access the client logs.
SSL connections run without errors.

[zanyterp]

did you deploy your pulse config with 802.1x or other wireless control config?

[C_J]

I am facing multiple disconnect as mentined on this topic, but only happens under Hotspot or 5G mode.  And usually its every 180 seconds exactly.

But using the 9.1.11

[zanyterp]

thank you for the update, @C_J
what company are you using for your hotspot/5g connection? if it is t-mobile, that sounds similar to something we are investigating; can you open a case with our support team, please?

[C_J]

Hello,

I am using 5G from Three:  using the ZTE 5G router: Discover 5G with Three

I tried doing Hotspot with the phone, with Smarty 5G company, and same issue.   

Can I open a case with your support team as a normal user or should I be from the IT team on my company?

[zanyterp]

i believe it needs to be from your IT team as customer care needs to confirm that a support contract is in place