topic Re: SSL VPN with Global Protect Agent 1.2.0 on different port in General Topics

SSL VPN with Global Protect Agent 1.2.0 on different port

LCMember17002 — Tue, 20 Nov 2012 15:00:02 GMT

Hello there,

on a PA-500 we're running our Global Protect portal and gateway on port 8443 according to https://live.paloaltonetworks.com/docs/DOC-3457 .

This worked well up to agent version 1.7.0. Since version 1.2.0 the agent ignores to port configuration and always tries to connect to port 443.

I've seen numerous log entries on the webserver running on port 443 like "/ssl-vpn/prelogin.esp" and "/ssl-vpn/login.esp" with UserAgent "PAN+GlobalProtect".

Going back to version 1.1.7. solved this.

Is there anybody else who can confirm this, or did I miss a new configuration option in PANOS 5.0?

Thanx

Re: SSL VPN with Global Protect Agent 1.2.0 on different port

LCMember17002 — Thu, 22 Aug 2013 12:21:27 GMT

Any updates on this?

Re: SSL VPN with Global Protect Agent 1.2.0 on different port

Retired Member — Thu, 22 Aug 2013 12:30:12 GMT

you can see on doc comments there is a bug has not been fixed .you cannot write port inside client configuration gateway tab.so maybe for agent version also there is something wrong.but after 5.0.2 I could not use that port option.Waiting for fix.Opened a case.Support told they will fix that.

(learned that this bug fixed with 5.0.6)

Re: SSL VPN with Global Protect Agent 1.2.0 on different port

emr_1 — Thu, 22 Aug 2013 12:47:14 GMT

If you are talking about bug#50133, it was fixed on v5.0.6.

50133—When configuring a GlobalProtect portal and adding an external gateway address for GlobalProtect clients, the IP format ip-address:port could not be added. Update made to allow this format.

Regards

Re: SSL VPN with Global Protect Agent 1.2.0 on different port

Retired Member — Thu, 22 Aug 2013 12:51:21 GMT

yes this one.if this works with 5.0.6 then admin@peri what is your version ?

Re: SSL VPN with Global Protect Agent 1.2.0 on different port

Retired Member — Fri, 23 Aug 2013 20:25:16 GMT

I replicated this with version 1.2.4 and 1.2.5(using a local interface)

you are right it still tried to connect for ssl 443 port and it gave certification error( because port 443 is busy for another service in our test lab)

so I installed 1.1.7 and it worked !!!

After that I tried with loopback interface.And it is working.I tried with ppoe interface.I don't know why we could not connect with Lan interface instead of loopback but that is working fine.

Re: SSL VPN with Global Protect Agent 1.2.0 on different port

LCMember17002 — Tue, 10 Sep 2013 10:33:45 GMT

I'm on version 5.0.6 since a few weeks. Is it fixed with the latest 5.0.7 version? According to this post (Can GlobalProtect Portal Page be Configured to be Accessed on any Port?) yes, but can someone verify?

Re: SSL VPN with Global Protect Agent 1.2.0 on different port

Retired Member — Tue, 10 Sep 2013 10:40:16 GMT

with loopback interface it is working fine.I am using with 5.0.6