topic Re: DNS routing issue - OpenVPN inside GlobalProtect VPN in Next-Generation Firewall Discussions

DNS routing issue - OpenVPN inside GlobalProtect VPN

NisseNilson — Mon, 09 Oct 2023 11:55:22 GMT

Hi,

We are running on a setup today where the client connects through L2TP to a Mikrotik-router and then connects with OpenVPN to the next environment.

Just now we are switchning to PA440 and GlobalProtect VPN IPSec instead of L2TP, and we have a problem now that the DNS lookup is not working when on the OpenVPN-tunnel inside the GlobalProtect VPN-tunnel (it was working out of the box in the L2TP and OpenVPN setup).

What am I missing? Some kind of static route in the GlobalProtect settings?

I can see on the client when I compare the different routing tables, that the traffic for the environment on the OpenVPN side is differently routed than before.

Thanks for the help!

Re: DNS routing issue - OpenVPN inside GlobalProtect VPN

reaper — Wed, 11 Oct 2023 13:58:30 GMT

you may need to configure split tunneling so the subnets reached through openvpn are not routed to globalprotect, else you'll get conflicts

Re: DNS routing issue - OpenVPN inside GlobalProtect VPN

NisseNilson — Thu, 12 Oct 2023 06:40:38 GMT

Hi Reaper,

Thanks for the reply.

Will that work, since we are whitelistening the IP on the GlobalProtect VPN-tunnel end site in the next environment, to be able to OpenVPN there? Maybe I lack a bit of knowledge here.

IP xxx.xxx.xxx.xxx => GP VPN yyy.yyy.yyy.yyy => OpenVPN zzz.zzz.zzz.zzz (yyy.yyy.yyy.yyy whitelisted)

Re: DNS routing issue - OpenVPN inside GlobalProtect VPN

ozheng — Fri, 13 Oct 2023 03:48:47 GMT

Hello NisseNilson,

At that point, I think you need to play directly with the routing on the OS client.

Otherwise, you can set a VM in the host machine : the host machine with the GP client, the VM with the openVPN client and set the VM network to use the GP interface.

Olivier

Re: DNS routing issue - OpenVPN inside GlobalProtect VPN

NisseNilson — Mon, 16 Oct 2023 07:01:30 GMT

Hi,

Thanks for the reply!

That's interesting, but maybe you are right about the routing table on the OS client. It is not that user friendly, but maybe I am able to find a way.
Do you have any insights or examples?