Pulse Secure client connects but can't ping anything for 1 minute

[ColonelSarge]

We have a PSA 3000 running 8.2R1, and we are using Pulse Secure client 5.2.1.227 on Windows 7/8.1/10. The client connects quickly and successfully. At that point, "ipconfig /all" shows the correct IP information, but the connected Windows system cannot ping anything on the internal network for 60-70 seconds. After 60-70 seconds have passed, ping and nslookup succeed and resources on the internal network are accessible.

Is this behavior normal?

The client logs seem to show the necessary routes being created for the virtual adapater almost immediately after the connection is formed, but the routes do not seem to work until after a minute has passed.

[zanyterp]

It is not expected on the versions you are using. To help narrow down potential issues, can you let me know the following:
does it happen at all sites?
do you have a proxy? if yes, does it happen without the proxy enabled & does it happen with the "preserve client-side proxy" option on the configuration profile?
if you pull up the Pulse UI, right-click on the connection and "view advanced connection details" (enable automatically refresh), do you see data sent but none coming back?
in the same screen, is your connection ESP or SSL? if it is SSL, does the behavior persist if you enable the option for only SSL? [this would indicate that the required port is not open on a firewall/router; default is UDP 4500].

Thanks!

[ColonelSarge]

Hi zanyterp,
We have one site/connection, and we do not use a proxy. The advanced connection details showed 0 incoming bytes, but bytes were going out. You were correct that the issue was with the ESP/SSL setting. Once I corrected that, I saw bytes incoming and outgoing as soon as the connection was established, and ping worked immediately to our internal LAN.

Thanks for the help!

[ColonelSarge]

In case anyone needs to reference this in the future, the relevant ESP/SSL settings are located in Users > Resource Policies > VPN Tunneling > Connection Profiles > .

[zanyterp]

You are welcome; glad to hear it is working successfully for you.
Thank you for updating us with the solution

[ruc]

Glad to know it is working with 'SSL' mode.

Do you have a firewall that blocks ESP traffic to your PSA? If yes you may want to consider allowing that traffic and switching to ESP mode. In general (in most environments) ESP mode should yield better performance which is why the default is set to ESP mode and then fallback to SSL if ESP communication cannot be established.

[Dexter]

Hey i seem to be having this same issue but i am trying to find users to make the adjustments as you were saying but cannot find it anywhere on the pulse