topic GlobalProtect don't access LAN in GlobalProtect Discussions

GlobalProtect don't access LAN

Amaro123 — Thu, 21 Jan 2021 17:57:08 GMT

Hi all,

I'm relatively new to Palo Alto solutions and I run into a problem that I can't find which may be causing the connection to fail.

I have a configured GP gateway and in it I have 3 pools with different subnets. One of these networks cannot access services on the LAN. I see in the logs the access being accepted in the policies but the connection is not established.
I revalidated the settings and didn't find what could be a failure. Any idea what it might be?

Re: GlobalProtect don't access LAN

MikeC — Fri, 22 Jan 2021 04:43:00 GMT

Does the LAN have a route to that GP subnet?

Re: GlobalProtect don't access LAN

Amaro123 — Fri, 22 Jan 2021 12:44:56 GMT

Hi MikeC,

Describing the settings a little more, the 3 networks I have configured in the GP are 10.x.x.x / 24, / 25 and / 27. In the routing table I have a route for 10.0.0.0/8 and that route points to one of the ethernet interfaces and not to the tunnel.

Re: GlobalProtect don't access LAN

Amaro123 — Fri, 22 Jan 2021 12:48:13 GMT

Hi Connelly,

I find it strange as it is because there have been no changes in the firewall since December and this problem arose yesterday, in addition other networks in the pool of the same GP gateway are working perfectly.

Re: GlobalProtect don't access LAN

Amaro123 — Wed, 17 Feb 2021 14:23:46 GMT

Still in this investigation I noticed a strange new behavior.

This is the scenario:
- I have gateways 01 and 02 for the GP.
- AD groups called Grupo1 and Grupo2.
- Test user named Fred.

When user Fred is in Group1 he has normal access to the environment through the two gateways.
When that same user is in Group2 he has normal access only through gateways 01. If you use 02 he does not access anything.

I reviewed the LDAP settings but did not find any unique references to the groups I have.

What can I not be seeing?