topic A global protect connected client machine access a resource(behind Cisco router) that is connected to the host PA 800 Firewall via IPsec in GlobalProtect Discussions

A global protect connected client machine access a resource(behind Cisco router) that is connected to the host PA 800 Firewall via IPsec

SisayFekadu — Mon, 17 Jul 2023 12:37:57 GMT

Hello Everyone,

I have a Palo Alto 820 Firewall locally and it has been licensed and configured with global protect for the remote mobility of our users. And It also has a Site-to-Site IPsec connectivity to a remote location of a different organization and the remote end of that organization has a Cisco router to configure the IPsec. There are existing successful connections of resources/end-point through the IPsec between the two sites and it is currently operational.
So now this new requirement come up where the global protect client users in remote locations be able to access resources behind the remote site with the Cisco router through the IPsec tunnel. We have completed the required configuration and it was supposed to be working as we did a similar set up as the existing operational connection via the IPsec. Is there any extra configuration I need to add? Does it even work that way? #IPsec #Site-to-site #Cisco-to-PaloAlto

Re: A global protect connected client machine access a resource(behind Cisco router) that is connected to the host PA 800 Firewall via IPsec

GOMEZZZ — Thu, 20 Jul 2023 22:58:21 GMT

Hi SisayFekadu,

As i understand correctly you want. your mobile users connected via global protect to access resources over the IPSec tunnel you have with remote site. First thing to check of course is the routing.

1. Is your global protect client configured for split tunneling or is everything send over the tunnel (default route over tunnel). If split tunneling is used you will need to add routes to reach the remote destination.

2. If you have the above sorted out , your site to site VPN tunnel is this a route base or policy based VPN if it is policy base you might need to also adjust proxy ID's on both sides. Also check your routing on the remote site that it knows the mobile users subnet is to be routed over the tunnel.

3. Of course you will also need firewall policies to allow the traffic to flow.

So in short I see no reason why this requirement would not work it just needs the correct configuration steps.

Tackle it one by one.