topic Re: GlobalProtect Gateway on Different IP address in General Topics

GlobalProtect Gateway on Different IP address

travisj — Wed, 22 Oct 2014 18:10:39 GMT

Let's say we have an external facing interface Ethernet1/3 with Ip address of 1.1.1.14/28. The upstream isp router is 1.1.1.1 all other addresses (1.1.1.2-1.1.1.14) are routed to the Palo Alto and in use for various web services, etc..

Per the documentation I can find it looks like you have to set the Global Protect gateway IP address to the address you have set on the interface. Is there a way to use one of the other addresses in the range we have assigned? e.g. 1.1.1.10

mdl: PA-2050

Pan-OS 6.0.4

Re: GlobalProtect Gateway on Different IP address

bat — Wed, 22 Oct 2014 18:12:03 GMT

travisj

You can configure that IP address as /32 i.e. 1.1.1.10/32 on that interface and then should be able to use it for GP.

You can also terminate the gateway on loopback,, configure any IP address on loopback and NAT 1.1.1.10 to that IP address.

Hope it helps !

Re: GlobalProtect Gateway on Different IP address

hshah — Wed, 22 Oct 2014 18:32:44 GMT

Hi Travisj,

Global Protect has to be configured on specific interface and its IP address.

Hence you can not terminate GP on Untrust interface with 1.1.1.10/32.

As above suggested only way is to create loopback interface with 1.1.1.10/32, put it in untrust interface[depends on requirement]. And terminate GP on it.

Regards,

Hardik Shah

Re: GlobalProtect Gateway on Different IP address

dreputi — Wed, 22 Oct 2014 18:33:07 GMT

Hello Travisj,

You can create a loopback IP with that address and NAT that IP address so that the request actually goes to PAN GP on the interface IP 1.1.1.1/32. You can also NAT it using a port, you may refer to this document for the steps:

Can GlobalProtect Portal Page be Configured to be Accessed on any Port?

Regards,

Dileep

Re: GlobalProtect Gateway on Different IP address

travisj — Wed, 22 Oct 2014 18:36:30 GMT

thanks. dreputi that's exactly what I needed, the issue I was facing was that I already had something on 443 of the interfaces IP address. I didn't even consider nat'ing different port to a loopback deal.