topic Re: GlobalProtect IPSec configuration in GlobalProtect Discussions

GlobalProtect IPSec configuration

HeathRamos — Mon, 26 Apr 2021 17:35:54 GMT

We have been using GlobalProtect for awhile but I just became aware that none of our clients are connected using IPSec even though the option is checked.

I can't see anything being blocked so I am wondering if it is a configuration issue of some kind.

Note: we are using loopback interfaces and both the gateway and portal use the same loopback

Re: GlobalProtect IPSec configuration

ShaiW — Tue, 27 Apr 2021 06:01:05 GMT

Start on the client, check the \Program Files\Palo Alto Networks\GlobalProtect\PANgps.log - you should see if the client is (or not) trying to connect via IPsec, or falling back to SSL.

You can also check if the client does not have anything blocking outgoing IPSEC from his location/s.

On the firewall - kind reminder that this traffic usually is source=internet zone; destination=internet zone and that the default rule here is Intrazone default (2nd from last rule). Also these rules by default do NOT have log at session end enabled so this could be why you do not see logs. You have not written the loopback assigned zone name - this will impact which rule is being hit.

You can also try a packet capture on the firewall - filter by a single test client source IP and see what ports exactly are being received.

If you are using a loopback because you want GP to listen on a different IP than the Interface default, for example the Interface is 203.0.113.20/24 and you want GP to listen on 203.0.113.55 - just add this IP in the IPv4 tab of the ethernet1/x (which will now show 203.0.113.20/24 and 203.0.113.55). This way you will be able to select this IP and Ethernet in the GP configuration pages and not use a loopback at all.

Hope this help,

Shai

Re: GlobalProtect IPSec configuration

HeathRamos — Tue, 27 Apr 2021 14:09:46 GMT

Thanks for the feedback

I looked at the logs on one of the clients and it can see it trying to connect using ipsec but failing.

Logs:

- Trying to do ipsec connection to IP_Address [4501]

- Network is reachable

- Connected to: IP_Address [4501], Sending keep alive to ipsec socket

- failed to receive keep alive

- IPSec anti-replay statistics: outside window count 0, replay count 0

- Disconnect udp socket

This happens with every client (all Windows 10 clients with standard configurations, including mine), so I am leaning toward it being a firewall issue. Pan-OS is 9.1.8 and GP Client is 5.2.5-c84.

I was thinking of trying to add a 2nd external ip address and bypassing loopback set up as well as creating a test environment separate from what's being used in production but I wasn't sure how. Sounds like if my external interface was an ip address of 1.1.1.1/29, I can add 1.1.1.2 as a 2nd ip address, create a new tunnel and VPN security zone, use the same authentication, certificate profiles and test the set up.

I will update this post if I see anything else in the logs

Re: GlobalProtect IPSec configuration

HeathRamos — Tue, 27 Apr 2021 14:21:22 GMT

I have a Deny All rule for all source and destination zones with the log at end of session enabled so I believe the firewall should log all blocked traffic, hopefully.

Re: GlobalProtect IPSec configuration

HeathRamos — Tue, 27 Apr 2021 14:26:08 GMT

is there supposed to be a specific policy or NAT rule that allows UDP 4501?

Re: GlobalProtect IPSec configuration

HeathRamos — Tue, 27 Apr 2021 18:22:48 GMT

well...I added a 2nd ip to external interface, created new tunnel, security zone, gateway, portal, added new security policy and altered the local host file on my laptop and was able to connect using IPSec.

at least I know it is a firewall issue and not a client side issue.

now to see if I can get it to work using loopback interface.

Re: GlobalProtect IPSec configuration

HeathRamos — Wed, 28 Apr 2021 13:46:15 GMT

Talked to PAN tech support and they weren't able to get ipsec to work with the loopback set up. still looking into it.

in the meantime, I have looked at various documents on setting up GP but none of them had info on any policies needed to allow traffic.

What traffic needs to be allowed? I don't want to anything that could lead to security issues if it is on the external interface.

Keep in mind, I created a security zone for VPN. not sure if that changes things.

Re: GlobalProtect IPSec configuration

DaveHatch — Mon, 14 Feb 2022 23:22:05 GMT

Are you NATing your client IP? NAT is not supported to the IPSEC GlobalProtect Gateway.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000001VK8CAM&lang=en_US%E2%80%A9