Override url ocsp and responder ocsp global protect VPN

HAINVH — Mon, 29 Jun 2026 14:56:38 GMT

Hi everyone,

present, i have VPN global protec

Authentication two factor with certificate and radius, by interface management

The current setup is as follows:

The Palo Alto firewall acts as both the gateway and the OCSP responder.
The OCSP responder is configured to use the management IP address, and the OCSP Override URL also points to the management IP.

Because certificate validation relies on the management IP, a failover to the HA peer causes certificate validation to fail. In addition, having only a single management link creates a potential single point of failure.

To improve resiliency, I would like to use either a data-plane IP address or a loopback IP address as the OCSP responder, and configure the OCSP Override URL to point to that loopback or data-plane IP instead.

However, I’ve tried several configurations without success.

Could you please help me understand how to achieve this?

with 1000user i dont want create new all

Re: Override url ocsp and responder ocsp global protect VPN

JayGolf — Tue, 30 Jun 2026 01:18:10 GMT

Hi @HAINVH ,

What have you tried so far?

You should be able to host OCSP on an alternate interface instead of tying it to the management IP.

A few things I would be mindful of:

The interface should have an Interface Management Profile applied with HTTP OCSP enabled.
The OCSP responder hostname/IP should resolve to the data-plane or loopback interface.
Routing and security policy need to allow the OCSP traffic.

topic Re: Override url ocsp and responder ocsp global protect VPN in Next-Generation Firewall Discussions

Override url ocsp and responder ocsp global protect VPN

Re: Override url ocsp and responder ocsp global protect VPN