topic Connection Issue With F5 - Makes No Sense in GlobalProtect Discussions

Connection Issue With F5 - Makes No Sense

Frootloops — Tue, 04 Apr 2023 16:08:32 GMT

I have been in a rabbit hole for a bit now, and have tried everything that i could find here, for the fix, with no success. This is only happening on one box, and the only thing different between that box and others, is the user needs to use F5 for one task, and does not look/feel like that is the root cause.

The box is running Win 10 22H2, so it is not the issue i have seen with the 21H2 issue. Oddly, when i install and run GP over the wired connection, it will not download the certs (2 "CC", and maybe "TPN"?) if i connect via wireless, it will then download them. Once i have the certs, it still has an issue of not finding the PA IP, the logs also show that, but the IP is good, and is the only box. To eliminate a switch port, and such, i am able to connect with my laptop, using that drop.

At some point, one of the people who worked here, told the user, the issue is with F5 and GP being on the same box, but makes zero sense, since F5 is more browser based, than software/install, and it is not running, when connecting with GP.

Can someone confirm that F5 and GP will not get along?

Thanks,

Dave

Re: Connection Issue With F5 - Makes No Sense

aleksandar.astardzhiev — Fri, 07 Apr 2023 09:07:34 GMT

Hi @Frootloops ,

Without proper understanding what F5 agent is doing and if it is running on the endpoint we cannot tell for sure. BUT!

Have in mind that when GlobalProtect establish connection it is actually generating HTTPS traffic, over TCP/443 port. GP client will try to authenticate and get config from firewall over this HTTPS connection. It then will generate another HTTPS connection to GP gateway again first to authenticate and get instructions how to connect. Only after that it will try to establish IPsec (ESP) connection to GP gateway.

When you say "F5 is more browser base" it could probably means that F5 agent could be acting as SSL proxy for any HTTP/HTTPS traffic, which will also try to proxy the traffic from GP agent.

With limited knowledge of F5 agent I would say it is very plausible that F5 agent is breaking GP connection and you may need to apply some exceptions/exclusions on F5 agent for the GP traffic

@nikoolayy1 is amazing F5 expert and I hope he can provide better assistance than me on this topic.