topic Re: VPN SSL traffic in General Topics

VPN SSL traffic

God — Fri, 12 Jul 2013 19:32:56 GMT

We have a SSL VPN setup through the Global Protect Gateway. The SSL-VPN tunnel is in its own zone and I have an any - any rule for this zone to my trusted zone. I am able to pass traffic to one interface in a trusted zone but I am not able to pass traffic to another interface in the trusted zone. What am I missing?

Re: VPN SSL traffic

Retired Member — Fri, 12 Jul 2013 19:40:01 GMT

are you sure you configured an unused pool for vpn clients ?

can you share interface ip's of Trust and VR table

Re: VPN SSL traffic

God — Fri, 12 Jul 2013 19:53:35 GMT

We are using an unused pool for vpn clients. interface eth1/2, eth1/2.161, and eth1/4 are all in the trust network. I can get to eth2 but not the others.

interface id vr address

- --------- -- -- -------

* tunnel 4 default

* ethernet1/1 16 default 199.96.116.59/28

* ethernet1/2 17 default 192.168.11.4/24

* ethernet1/4 19 default 10.2.100.255/16

* ethernet1/2.161 259 default 192.168.161.6/24

* default/i3 61441 default

Re: VPN SSL traffic

Retired Member — Fri, 12 Jul 2013 20:02:36 GMT

so you mean although you have interface management profile with ping(if not do that for troubleshoot)

you can not ping any except eth1/2

Re: VPN SSL traffic

God — Fri, 12 Jul 2013 20:12:38 GMT

Ok, We are getting somewhere. I can ping eth1/2 and eth1/4 but I cannot ping anything else on the eth1/4 network but I can on the eth1/2 network. Seems like a routing issue somewhere but I don't know where. I added 10.2.0.0/16 to the access route list in the GlobalProtect Gateway client config. I also added 10.2.0.0/16 to the static route table of the tunnel interface.

Re: VPN SSL traffic

Retired Member — Fri, 12 Jul 2013 20:15:33 GMT

what is the vpn pool ?

Re: VPN SSL traffic

God — Fri, 12 Jul 2013 20:18:05 GMT

The VPN pool is: 192.168.251.250-192.168.251.252. (I am keeping it small for now).

Re: VPN SSL traffic

Retired Member — Fri, 12 Jul 2013 20:23:49 GMT

"I also added 10.2.0.0/16 to the static route table of the tunnel interface." what do you mean with that

look for traceroute on the vpn client

Re: VPN SSL traffic

God — Fri, 12 Jul 2013 20:59:40 GMT

In the GUI, Virtual Router --> Static Routes

Destination 10.2.0.0/16 and the tunnel interface, metric 10, next hop none.

Traceroute times out without a list of hops.

Re: VPN SSL traffic

God — Fri, 12 Jul 2013 21:31:06 GMT

Problem resolved. Using multiple gateways outbound to the internet. Thank you for your responses.