topic GLOBALPROTECT WITH AN INTERNAL IP BEHIND INTERNET DEVICE in GlobalProtect Discussions

GLOBALPROTECT WITH AN INTERNAL IP BEHIND INTERNET DEVICE

spiyaa — Sun, 21 Mar 2021 15:14:16 GMT

GlobalProtect set up on a firewall with an internal IP address sitting behind an edge Internet device

Internet Router (2.2.2.2/24) > Internal Network > PAN ( 192.168.0.2/24)

I'm using OS 9.0.13

internally i can connect (for testing purpose), but externally I get error server certificate error. I have associated certificate with FQDN but still not working.

Any help please ?

Re: GLOBALPROTECT WITH AN INTERNAL IP BEHIND INTERNET DEVICE

BPry — Tue, 23 Mar 2021 13:30:40 GMT

@spiyaa,

Since you're getting a certificate error, what does your actual certificate look like? My guess is you likely haven't setup SANs correctly

Re: GLOBALPROTECT WITH AN INTERNAL IP BEHIND INTERNET DEVICE

spiyaa — Tue, 23 Mar 2021 15:01:32 GMT

@BPry

Thanks for looking into it

My screenshots below, though i can connect using 192.168.0.199, but error when using public ip or DDNS fqdn cert

Re: GLOBALPROTECT WITH AN INTERNAL IP BEHIND INTERNET DEVICE

spiyaa — Tue, 23 Mar 2021 15:06:17 GMT

@BPry

I found this link to assign "Server certificate", maybe this the problem but i cannot see this option in version 9.x

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClHyCAK