topic Re: SSL VPN DMZ access issue in General Topics

SSL VPN DMZ access issue

Satish — Wed, 24 Dec 2014 18:36:30 GMT

Hi Friends,

I have configured SSL vpn with AD integration but i am not able to ping DMZ. i have all ready configure access route. please suggests what i need to do in configuration. or where i am missing.

Regards

Satish

Re: SSL VPN DMZ access issue

bat — Wed, 24 Dec 2014 18:37:30 GMT

Hi Satish

Do you have policy from the zone (your tunnel interface is) to your DMZ zone ?

Also check if you have route for the GP pool on your intermediary devices after the packet leaves Palo Alto to the destination in DMZ.

Re: SSL VPN DMZ access issue

Satish — Wed, 24 Dec 2014 18:50:36 GMT

Hi Bat Dud..,

I have already created policy for that but till is not working.

Thnx

Satish

Re: SSL VPN DMZ access issue

HULK — Wed, 24 Dec 2014 18:52:21 GMT

Did you check traffic logs, in case it's getting dropped.

Thanks

Re: SSL VPN DMZ access issue

bat — Wed, 24 Dec 2014 18:55:09 GMT

Also check if you have route for the GP pool on your intermediary devices after the packet leaves Palo Alto to the destination in DMZ.

Re: SSL VPN DMZ access issue

Satish — Wed, 24 Dec 2014 18:55:25 GMT

Hi Hulk,

How are you ?? yes i am getting drop but rule is allow pls suggest.

Regards

Satish

Re: SSL VPN DMZ access issue

Satish — Wed, 24 Dec 2014 18:57:50 GMT

Hi Bat,

GP pool is like 172.16.1.X or DMZ 10.10.1.X. i have configure in GP access route like 0.0.0.0/0, 10.10.1.0/X

Thanks

Satish

Re: SSL VPN DMZ access issue

HULK — Wed, 24 Dec 2014 18:58:52 GMT

Hello Satish,

I am doing well and thank you for asking. Could you please expand the traffic logs ( monitor > logs > traffic) and share a snapshot of that logs here.

Thanks

Re: SSL VPN DMZ access issue

Satish — Wed, 24 Dec 2014 19:01:04 GMT

Hi Hulk,

Right now, i dont have access but i will share with you tomorrow.

Satish

Re: SSL VPN DMZ access issue

HULK — Wed, 24 Dec 2014 19:06:18 GMT

Thanks for your quick reply. Could you please also check: (tomorrow )

--whetherthe traffic is leaving the firewall inright direction(from Monitor> traffic logs)

-- Try to ping the destination(DMZ),sourceas the PAN interface IP (connected towards DMZ).

Thanks