@cmaulding To confirm, when you have the Netskope Client enabled, your VPN will not connect to its intended destination?  Can you share what type of VPN and also, are you using the Client for Netskope Private Access or CASB/SWG or both?

Hey Bob that is correct. We are using the PaloAlto Global protect, and we are using it for SWG/CASB and NPA. Currently. We have the agent on Windows Machine with the global Protect VPN and those were just fine. It is only the Mac's that do not work. 

Hi @cmaulding are you running on Catalina?  If so there is a PAN bug with Catalina and GlobalProtect, where split-tunneled domains/IPs are not functioning when running GlobalProtect 5.1 or 5.2.

You can read more on PAN's website: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HBqECAW&lang=en_US%E2%80%A9

Hey @bob

We are actually running on macOS 11.3.1 BigSur and having the same issue. 

@cmaulding feel free to send me a private message here and we can take a look at this together.  Can you also please confirm the version of GP client you're running?

@mkoyfman we are running GP 5.2.3-22 and I sent you an email per the private message. I appreciate your help. 

@cmaulding the bug in Big Sur GP client is not address until 5.2.5.  I have verified that on 5.2.5-66 things are running just fine.

@mkoyfman I have upgraded to the latest client version 5.2.6-87. Now I am able to get the VPN to connect but as soon as it does the Netskope agent goes Red. Disconnect the VPN and it comes back online.  Would this have to do with the bypass configuration that I mentioned before? 

Also confirmed that 5.2.6.-87 works fine.

I have this same exact issue on Windows machines.  The guidance for adding split tunneling via IP addresses have been done as well.  

On Windows, we are experiencing the same exact issue where when we connect to VPN, the Netskope agent goes red and then a disconnect/reconnect fixes the issue for a period of time.  It's very intermittent.  I have a ticket opened with Netskope Support but no clear fix.
GP Version:  5.2.6

@ddrake DM me the case number and I will take a look into what's going on there.

We had this exact same issue. I had to add the addresses of our GlobalProtect gateways into a Network Location group. I then added that group as an exception in our Steering Configuration. After that, everything was stable.

thanks for sharing, @jeremywc . @ddrake did you also read and follow this article? https://support.netskope.com/hc/en-us/articles/360023155053-Best-Practice-for-coexistence-of-Netskope-client-and-third-party-VPN-clients-on-Windows-and-Mac-endpoints

This is what @jeremywc is talking about

Sorry @mkoyfman  - I apparently don't get notifications on comments I make.  I'll DM you the ticket number.

Hey there @ddrake! Normally you would receive notifications on comments if you were the original conversation author, but in this case, if you are interested in a conversation you can subscribe to the RSS Feed to receive email updates on further comments.

Check out our resource on Subscribing to Community Boards & Labels, if you ever have any questions or need help please reach out to me directly!

Happy posting! 🖖