GlobalProtect Domain-based split tunneling works intermittently on Windows hosts

GlobalProtect Domain-based split tunneling works intermittently on Windows hosts

788
Created On 06/09/25 03:04 AM - Last Modified 12/12/25 21:29 PM


Symptom


  • On Windows GP Agent v6.0.7, Intermittently domain based split tunnel does not work.
  • Rebooting laptop fix issue. but issue happen again.


Environment


  • Window OS
  • GlobalProtect Agent v6.2.6 or earlier version 


Cause


  • createfile fails to be created.
  • If createfile fails, filter driver will not work as expected.
  • The issue can be seen in the PanGPS.log where the createfile is unsccessful.
  • The PanGPS.log on working hosts indicate the createfile is successfully created.
(P5388-T11008)Dump (2164): 05/08/25 17:15:03:248 ST,remote ip address is x.x.x.65, port=0, bind local address is 10.231.0.62
(P5388-T11008)Debug(2427): 05/08/25 17:15:03:248 ST,service status is 00000004, ret = 1
(P5388-T11008)Debug(2432): 05/08/25 17:15:03:248 ST,service already started
(P5388-T11008)Debug( 526): 05/08/25 17:15:03:248 ST,CreateFile failed, last error=00000005
(P5388-T11008)Dump (2209): 05/08/25 17:15:03:248 ST,new domain port is 0, 35 ip set
(P5388-T11008)Debug( 772): 05/08/25 17:15:03:248 ST,Error! CreateFile not successful!
(P5388-T11008)Dump (2228): 05/08/25 17:15:03:248 ST,create time task 36, delay 117 seconds
(P5388-T11008)Dump (2237): 05/08/25 17:15:03:248 ST,task for x.x.x.65 already exist, increase counter
(P5388-T11008)Dump ( 294): 05/08/25 17:15:03:248 iTimeOut=117
(P5388-T11008)Dump (1588): 05/08/25 17:15:03:248 ST,argc=6, remote-bind
(P5388-T11008)Dump (2931): 05/08/25 17:15:03:248 ST,shouldCacheCommand return false
(P5388-T11008)Dump (2164): 05/08/25 17:15:03:248 ST,remote ip address is m,n.q.234, port=0, bind local address is 10.231.0.62
(P5388-T11008)Debug(2427): 05/08/25 17:15:03:248 ST,service status is 00000004, ret = 1
(P5388-T11008)Debug(2432): 05/08/25 17:15:03:248 ST,service already started
(P5388-T11008)Debug( 526): 05/08/25 17:15:03:248 ST,CreateFile failed, last error=00000005
(P5388-T11008)Dump (2209): 05/08/25 17:15:03:248 ST,new domain port is 0, 36 ip set
(P5388-T11008)Debug( 772): 05/08/25 17:15:03:248 ST,Error! CreateFile not successful!
(P5388-T11008)Dump (2228): 05/08/25 17:15:03:248 ST,create time task 37, delay 117 seconds
(P5388-T11008)Dump (2237): 05/08/25 17:15:03:248 ST,task for m,n.q.234 already exist, increase counter
(P5388-T11964)Dump (3066): 05/08/25 17:15:04:194 ST,remove TTL timer cookie->hTimer 0000018F88A8C4F0 with 0 returned, cookie=0000018F89132910
(P5388-T11964)Dump (3097): 05/08/25 17:15:04:194 ST,ExpireTTLTask called, remove this now, because the counter is 0
(P5388-T11964)Dump (3107): 05/08/25 17:15:04:194 ST,ExpireTTLTask called, cookie ip address is a.b.c.42, port=0
(P5388-T11964)Debug(2427): 05/08/25 17:15:04:194 ST,service status is 00000004, ret = 1
(P5388-T11964)Debug(2432): 05/08/25 17:15:04:194 ST,service already started
(P5388-T11964)Debug( 526): 05/08/25 17:15:04:194 ST,CreateFile failed, last error=00000005
(P5388-T11964)Debug( 772): 05/08/25 17:15:04:194 ST,Error! CreateFile not successful!


Resolution


  1. The issue has been resolved internally in GlobalProtect Agent v6.2.8-h3 or later. 
  2. Upgrade will resolve the issue.


Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA1Ki000000TNL5KAO&lang=en_US&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail