topic Re: Global Protect unable access certain vm behind firewall in GlobalProtect Discussions

Global Protect unable access certain vm behind firewall

vtlikinio — Wed, 03 Jun 2020 17:46:12 GMT

Hello Folks.

So we have configured GP in one VM-Series in a Cloud Community. We are experiencing unusual behavior. I do not know whether it was the GP configuration or it is in the VM. So sample VM 1 has an IP of 192.168.14.X and VM 2 has an IP of 192.168.14.X when connected in GP I can ping VM1 also the traceroute is complete but when trying to reach VM 2 is shows RTO and it is not reachable via traceroute. When looking into the firewall logs it show that the the traceroute is allowed going to VM 2 with an application of traceroute, also it hits the right rule.

Thank you for your answers if you replied.!

Re: Global Protect unable access certain vm behind firewall

BPry — Thu, 04 Jun 2020 02:21:23 GMT

@vtlikinio,

Does the other VM have a route back to whatever IP space you are using for GlobalProtect clients? If you take a packet capture on the unreachable VM does it show traffic hitting the VM from GlobalProtect clients?

Re: Global Protect unable access certain vm behind firewall

vtlikinio — Thu, 04 Jun 2020 06:36:49 GMT

@BPry

Yep, just took PCAP just now the GP reaches the ping but the server does not response back.

Re: Global Protect unable access certain vm behind firewall

vtlikinio — Thu, 11 Jun 2020 07:19:53 GMT

Found the problem here. Never assign any network for GP that has the same segment as an interface of a vm that is behind the firewall.