Global Protect firewall allowed rule

momoo168 — Fri, 29 Dec 2023 02:38:52 GMT

Hi,

I'm creating a firewall rule to allow TCP 443/UDP 4501 (Global Protect) to go through the firewall, and I want to know if I need to allow bidirectional for the UDP 4501?

Thank you,

Re: Global Protect firewall allowed rule

reaper — Fri, 29 Dec 2023 22:47:06 GMT

firewalls are bidirectional, you never need a 'return' rule

To go "through" the firewall you need app-id 'ipsec-esp-udp' and 'ssl', with service application-default (or other ports if it's running on a different port)

To terminate GP on the firewall use 'ssl', panos-global-protect' and 'ipsec-esp-udp' app-id with service 'application-default'

instead of portbased

topic Re: Global Protect firewall allowed rule in GlobalProtect Discussions

Global Protect firewall allowed rule

Re: Global Protect firewall allowed rule