topic Re: Global Protect Client IP Range not able to get to internal resources in GlobalProtect Discussions

Global Protect Client IP Range not able to get to internal resources

Brett-Welch — Wed, 07 Apr 2021 20:29:50 GMT

Hi All,

I recently configured an HA pair of 3220s for Global Protect. I have the firewalls handing out IPs from the 192.168.124.0/22 network. The clients can connect and get the correct IPs but are not able to reach internal resources. This same IP range had been setup on a pair of 5250s and I believe I had everything setup for this to work on the new 3220s but for some reason it is not working.

I can see that the 3220s have routes for everything on our network and can reach them as well as the outside world. I'm not sure what else to check on the Global Protect gateway. Any ideas?

Re: Global Protect Client IP Range not able to get to internal resources

JoergSchuetter — Wed, 07 Apr 2021 20:38:33 GMT

Hello @Brett-Welch

Do you have a route on your internal network for 192.168.124.0/22 pointing to the firewall?

Re: Global Protect Client IP Range not able to get to internal resources

Brett-Welch — Wed, 07 Apr 2021 21:55:00 GMT

So that was a partial solution to the problem. I didn't realize that there had been some static routes that had been set to point to the 5250s where this was previously set up. I adjusted the static routes to point to the new 3220s and I am now able to ping the internal DNS and do NS Lookups via the internal DNS but cannot resolve over http to internal sites it seems and when I set a static on the VPN adapter, I can no longer ping the internal DNS or do nslookups.