topic Re: Global protect with DHCP client on WAN interface in General Topics

Global protect with DHCP client on WAN interface

torm — Wed, 25 Jan 2012 09:19:31 GMT

I have a PA-200 which is configured with DHCP-client on the WAN interface.

When configuring Global Protect, I'm not able to configure the gateway address. When I choose the WAN interface as the gateway address interface, I'm not able to choose the IP-address currently on that interface(because of the DHCP Client setting I guess). The same apply to the Global Protect Portal configuration. I can not set the Portal Address. (see attached picture)

Is there anyway around this, or is it impossible to setup Global Protect gateway and portal on a DHCP client interface?

I have dyn-dns running. Is it possible to somehow set the portal and gateway address to a FQDN?

Re: Global protect with DHCP client on WAN interface

jdelio — Wed, 25 Jan 2012 19:43:33 GMT

I am sorry for the inconvenience, this is actually a UI issue, bug #33914.

The workaround is that you can actually set this from CLI with the following command:

set network tunnel global-protect-gateway <name> local-address interface e1/1

Version 4.1.2 documents this issue, Please see the release notes here:

https://support.paloaltonetworks.com/index.php?option=com_pan&task=view_releasenotes&vn=4.1.2&ut=sw&ct=&prod=panos&plat=200

Will this be resolved in 4.1.3? I hope so, but cannot answer that until that versio is released and that bug # is shown as a resolved issue.

Kind Regards

Re: Global protect with DHCP client on WAN interface

michael_schumak — Wed, 29 Feb 2012 20:47:46 GMT

Hey Joe,

is there a command line for the "GP portal" part as well? There has to be the interface and IP defines as well.

Mike

Re: Global protect with DHCP client on WAN interface

torm — Thu, 01 Mar 2012 10:24:58 GMT

I think the command for setting the GP portal address to the interface address is the following:

set global-protect global-protect-portal "portal name" portal-config local-address interface ethernet1/X

Re: Global protect with DHCP client on WAN interface

michael_schumak — Thu, 01 Mar 2012 20:37:51 GMT

Thanks, I will try it!

Re: Global protect with DHCP client on WAN interface

michael_schumak — Fri, 02 Mar 2012 21:27:48 GMT

Works like a charm!

Re: Global protect with DHCP client on WAN interface

mikaelwitt — Thu, 30 Jul 2015 19:01:57 GMT

Hmm, interesting. I´m having the exact same problem running version 7.01, so the bugfixing seem to be a bit off for this one (3 years or so). Can you elaborate a bit on the command line stuff, as I´m not so savvy in that area?

Best regards

/Micke

Re: Global protect with DHCP client on WAN interface

torm — Wed, 05 Aug 2015 11:36:25 GMT

Hi,

I have not had any problem with this i 7.0. I just choose the WAN interface, which is configured with DHCP client, as my Portal and Gateway interface. IP-address is just set to "none" in the webui. Have you tried just doing that?

Looking at the config in the CLI, I see the same thing with the command "show global-protect global-protect-portal <Portal-name>" in configure mode. Local-address is just the interface (no ip-address).

If I run "show global-protect-gateway gateway" in opreation mode in CLI, I do see the ip-address I get from DHCP under local address, as expected.

- Tor

Re: Global protect with DHCP client on WAN interface

brunomason — Tue, 11 Aug 2015 04:13:16 GMT

This is how mine is setup and works fine since 5.x Select the WAN interface and leave address to none.

Re: Global protect with DHCP client on WAN interface

mikaelwitt — Thu, 13 Aug 2015 11:47:36 GMT

Managed to solve my problem. Had nothing to do with the DHCP on the external interface:-). It turned out to be a policy problem. I had to add an ESP service to the policy for tunneling to work. For some reason the denied traffic was not logged and the only thing I could see was the 443 session initiating the VPN and just failure on the client. I think there is probably some stuff that should be added to the 7.0 Global Protect set-up guide, for example what policy you should set for the external - external traffic for initiation of the tunnel.

Best regards

/Micke

Re: Global protect with DHCP client on WAN interface

nabokih — Sat, 31 Oct 2015 14:33:26 GMT

Can somebody help me with this?

I tried to configure ip address manually from CLI, but I got error message:
Server error : portal-config -> local-address -> ip '<my ip address>' is not a valid reference
portal-config -> local-address -> ip is invalid