topic Cannot run GlobalProtect Portal on preferred IP address in General Topics

Cannot run GlobalProtect Portal on preferred IP address

cstech — Tue, 09 Sep 2014 16:23:26 GMT

Please correct any wrong statements:

1. I connect my PA to the "untrust internet" via ethernet 1/1

2. My ISP assigned me 164.67.80.0/24 block of IPV4 addresses (actually this is a lie...)

3. I assigned 164.67.80.2/24 to ethernet 1/1

4. The PA is capable of running NAT on any of the addresses in the entire 164.67.80.0/24 subnet using Proxy ARP

5. I want to run a GlobalProtect HTTPS server on 164.67.80.3

6. The GlobalProtect Portal will not allow (5).

7. The reason for (6) is that 164.67.80.3 is not bound to ethernet 1/1. The GlobalProtect HTTPS portal cannot use Proxy ARP.

7. I cannot bind 164.67.80.3/24 to ethernet 1/1 as a subinterface because it is on the same subnet as 164.67.80.1/24

8. I cannot run my GlobalConnect portal on 164.67.80.3, my preferred IP address

9. I must run GlobalConnect HTTPS Portal on the un-preferred IP address 164.67.80.2.

Thank you,

Chris

Re: Cannot run GlobalProtect Portal on preferred IP address

bat — Tue, 09 Sep 2014 16:34:33 GMT

Hi Chris Stankevitz

For this: I cannot bind 164.67.80.3/24 to ethernet 1/1 as a subinterface because it is on the same subnet as 164.67.80.1/24

Have you tried configuring this IP as 164.67.80.3/32 on that interface

Alternate solution:

You can terminate the portal on loopback interface

Give any IP say 1.1.1.1 on loopback

Create a NAT policy to NAT requests coming on IP 164.67.80.3 port 443 to loopback IP.

I tried both the above solutions in my lab and both worked.

Let me know if you face any issues.

Thanks

Re: Cannot run GlobalProtect Portal on preferred IP address

cstech — Thu, 11 Sep 2014 22:52:43 GMT

csharma,

Thank you for the suggestions. I used option 2 and it works great. I was a little worried about which zone the loopback should live in. I put it in the DMZ but I don't know why.

Thanks again,

Chris

Re: Cannot run GlobalProtect Portal on preferred IP address

reaper — Fri, 12 Sep 2014 06:43:37 GMT

you can also create a loopback interface and give it a public IP, then put it in the external zone. This will allow you to go without NAT

regards

Tom