How to check the reason submitted by users for disconnecting GlobalProtect
2565
Created On 08/20/21 21:46 PM - Last Modified 05/09/25 19:49 PM
Objective
- GlobalProtect (GP) is configured with Always On configuration.
- The configuration is allowing users to disconnect the connection as per the configuration set as below.
- Network -> GlobalProtect -> Portal -> Agent- > App -> Allow user to disconnect GlobalProtect App (Always-on mode) : Allow with Comment
- GP users disconnect the App by providing a reason.
- The article helps to find the reason /comment submitted by the remote GP users.
Environment
- Palo Alto Firewalls
- Supported PAN-OS
- GlobalProtect (GP) App
Procedure
- The reason can be found under Monitor > Logs.
- Check Monitor -> Logs -> GlobalProtect with the filter "( opaque contains 'Message: Agent Disable' )" as shown below.
- The statement following "comment:" provides the comment provided by GP Users.