topic Re: Reach Management Interface via SSL-VPN in General Topics

Reach Management Interface via SSL-VPN

triitech — Thu, 24 Mar 2011 09:25:28 GMT

Hi all,

I have a little problem, I've installed a PA-500 and configured SSL-VPN, it works fine, I can reach the internal network correctly but I can't reach the management Interface.

This is the scenario:

VPN Clients:

IP: 10.31.31.10-10.31.31.254

Management Interface:

IP: 10.7.10.251

Gateway: 10.7.10.3

The gateway already knows the routes to reach 10.31.31.0/24 via Ethernet1/2 of PAN.

I can see in Traffic Log that packets pass through Interface tunnel.1 to Ethernet1/2 (Trust to Trust), but nothing came back.

Have you any idea about?

Re: Reach Management Interface via SSL-VPN

mharding — Thu, 24 Mar 2011 13:24:38 GMT

Do you have the management interface locked down to certain IP addresses?

Re: Reach Management Interface via SSL-VPN

dagibbs — Thu, 24 Mar 2011 23:33:50 GMT

triitech wrote:

Hi all,

I have a little problem, I've installed a PA-500 and configured SSL-VPN, it works fine, I can reach the internal network correctly but I can't reach the management Interface.

This is the scenario:

VPN Clients:

IP: 10.31.31.10-10.31.31.254

Management Interface:

IP: 10.7.10.251

Gateway: 10.7.10.3

The gateway already knows the routes to reach 10.31.31.0/24 via Ethernet1/2 of PAN.

I can see in Traffic Log that packets pass through Interface tunnel.1 to Ethernet1/2 (Trust to Trust), but nothing came back.

Have you any idea about?

What security policy do you have on your SSL VPN? Does it allow https to the network range (or specific IP address) your management interface is connected to?

Re: Reach Management Interface via SSL-VPN

triitech — Fri, 25 Mar 2011 09:02:13 GMT

Thanks for all replies,

the problem was that was missing the correct policy to permit traffic from tunnel to management interface for class 10.31.31.0/24.

Now I can reach the managemente interface without problems.

Regards

Alessio