topic Re: GlobalProtect, enabling ipsec from outside in General Topics

GlobalProtect, enabling ipsec from outside

BTS_MS — Tue, 09 Oct 2012 02:27:38 GMT

Hi all,

I am trying to enable Global Protect. So far I've been able to connect the client to the firewall successfully. However the remote VPN client cannot talk to inside hosts. But the inside hosts can ping the remote client.

After troubleshooting, I found IPSec traffic is blocked at the outside interface (which blocks everything). When I enable all incoming traffic on the outside interface the remote client is able to talk to the inside zone.

I've now enabled "IPSec" application group to be passed through the outside interface, however the remote client is still unable to talk to the inside zone. Is there a standard set of applications/services that needs to be allowed on the outside interface for GlobalProtect clients?

Many thanks.

Re: GlobalProtect, enabling ipsec from outside

ssharma — Tue, 09 Oct 2012 03:39:02 GMT

On the rule that you have enabled "IPSec", please go ahead and add following as well " panos-global-protect, ike, ipsec-esp-udp, panos-web-interface, ssl". This should resolve the issue.Thanks.

Re: GlobalProtect, enabling ipsec from outside

sdurga — Tue, 09 Oct 2012 04:02:48 GMT

you can allow the above said applications, alternatively you can place the tunnel interface in the internal zone that way you need not create any security policies.

Re: GlobalProtect, enabling ipsec from outside

ssharma — Wed, 10 Oct 2012 22:13:03 GMT

Did that resolved your issue? Please do let us know. Thanks.

Re: GlobalProtect, enabling ipsec from outside

BTS_MS — Fri, 12 Oct 2012 04:25:29 GMT

Putting the tunnel interface on the inside zone fixed the problem.

Opening up the apps on the outside interface did not, however I didn't have much time to troubleshoot this scenario, so it is possible I missed something.

Thanks for the help guys.