topic Re: GlobalProtect Port 80 ,443 Incomplete in General Topics

GlobalProtect Port 80 ,443 Incomplete

ShayBar — Wed, 24 Apr 2013 19:41:09 GMT

I'm Trying to set an enviorment to my mobile users (Laptops of Salesman), I used the Globalprotect to provide a secure tunnel to the office Firewall and

then gave the users access to terminal server, and it worked fine.

last week we installed a new SharePoint Server, I need to give the users with laptops direct access to my SharePoint Server

I used the same method to access the Server , meening

I opened Port 80 to the server through GlobalProtect access, with no luck - the monitor shows incomplete in the application section.

whan i open ping to the server, i recive an answer, the same issue happens with https.

now, I do have web servers in the DMZ that works fine, the only exception is that they are wide open to the world

and in this senario I'm tring to give access only through VPN.

This is a panos 5.0.4 version with GlobalProtect 1.2.2

any sugestions?

Re: GlobalProtect Port 80 ,443 Incomplete

Retired Member — Wed, 24 Apr 2013 19:49:51 GMT

is this sharepoint server have both public and private ip address ?

or just ip with 20.x.x.x

Re: GlobalProtect Port 80 ,443 Incomplete

ShayBar — Wed, 24 Apr 2013 19:52:57 GMT

its only a private network with 20.1.1.16 address , i can ping him and remote access him through GlobalProtect client

but no access with http or https, the SharePoint Windows firewall is off

Re: GlobalProtect Port 80 ,443 Incomplete

Retired Member — Wed, 24 Apr 2013 19:56:07 GMT

You mean RDP with remote access ?

Re: GlobalProtect Port 80 ,443 Incomplete

ShayBar — Wed, 24 Apr 2013 19:59:30 GMT

Yes RDP with remote access, i even accessed his harddrive throuth network access (ms-ds-smb 445) and was able to copy files from his share folders

Re: GlobalProtect Port 80 ,443 Incomplete

Retired Member — Wed, 24 Apr 2013 20:09:46 GMT

if you can do RDP than this is not a session issue.There is somehting special for sharepoint server than.

And incomplete means

1- syn ack not coming (but this fails because you can make RDP)

2- 3way handshake complete but after than not any packets coming(maybe timeout)

Re: GlobalProtect Port 80 ,443 Incomplete

ShayBar — Wed, 24 Apr 2013 20:21:38 GMT

I tried to access another server with http , same problem.

if it's a timeout issue, what can i change to make it work?

Re: GlobalProtect Port 80 ,443 Incomplete

Retired Member — Wed, 24 Apr 2013 20:32:27 GMT

Try do add an application with port 80 and timeout values big

Then write app override rule for that traffic(you attached its picture) with this app.

Let's see if something will change when disabling inspection

Re: GlobalProtect Port 80 ,443 Incomplete

ShayBar — Wed, 24 Apr 2013 20:41:17 GMT

I disabled Policy base forwarding, and it's working......

We configured a police to push all the youtube ,facebook ,etc through ADSL line,

when disabling this police the sites work with GlobalProtect access.

Now I will try to understand what was misconfigured in the Policy base forwarding

Re: GlobalProtect Port 80 ,443 Incomplete

Retired Member — Wed, 24 Apr 2013 20:47:52 GMT

Wauvvv I have not known you have pbf rules.

what rules of pbf you have

Re: GlobalProtect Port 80 ,443 Incomplete

ShayBar — Wed, 24 Apr 2013 21:00:42 GMT

Tnx 4 all the help,

I have found the problem

if yor tring to "talk" to a computer in the network that has a PBF rule redirecting it to another route - it wont work.....

I excluded the servers from the ip range I used to redirect to ADSL with PBF , now everything WORK!!!

here is the rule

Thanks again,

Shay

Re: GlobalProtect Port 80 ,443 Incomplete

Retired Member — Wed, 24 Apr 2013 21:03:27 GMT

That's fine.

I'm Glad that it is solved.