topic Re: Global protect error message in General Topics

Global protect error message

darren_g — Thu, 11 Oct 2012 22:39:08 GMT

Hi.

I've got a user trying to connect to my PA through a Global protect VPN, and the firewall is giving me the following error message

GlobalProtect gateway client configuration failed. User name: <xxxx>, error: Assign private IP address failed.

I know the pool for the configured GP gateway is large enough (/24) for her to be assigned an IP out of it - we don't have *that* many concurrent sessions running through the gateway at once - but I can't figure out why it's not assigning a remote IP.

Can anyone shed any light on what may be causing this?

PanOS 4.1.7, GP client 1.1.6, if it's relevant.

Thanks.

Re: Global protect error message

ppatel — Thu, 11 Oct 2012 22:43:54 GMT

Darren,

Is the Ip-pools assigned to the Global protect gateway overlapping the Local LAN?

If that is the case, It is recommended to have ip-pool as a completely different subnet that the Local LAN -trust network.

Regards

Re: Global protect error message

darren_g — Thu, 11 Oct 2012 22:46:18 GMT

Thanks.

That was my first thought - I'm trying to get a remote user to work through running "ipconfig" and get the results. It promises to be a whole new adventure in troubleshooting pain! 🙂

I'll update once (if) I get a result.

Re: Global protect error message

darren_g — Thu, 11 Oct 2012 22:55:47 GMT

Oh My.

I managed to get her to run an "ipconfig".

Her local segment is configured thusly

IP : 10.1.1.4

Router : 10.1.1.1

Mask : 255.0.0.0

Yup, she's got her local router configured to allocate a whole class "A" subnet!

Of course, this overlaps my 10.10.0.0/24 VPN network quite nicely, so I'd guess that's exactly why it's failing.

Thanks for confirming what I thought was the problem.

Re: Global protect error message

santonic — Mon, 23 Sep 2013 11:06:50 GMT

I've just encountered this problem as well. Is there a way to fix this issue? Apart from changing IP pool for all users or asking remote user to change hotel

Re: Global protect error message

darren_g — Mon, 23 Sep 2013 22:41:47 GMT

santonic wrote:

I've just encountered this problem as well. Is there a way to fix this issue? Apart from changing IP pool for all users or asking remote user to change hotel

Unfortunately not.

If the network used by the remote end (hotel) overlaps with either the subnet used for your VPN, or one of the networks you split-tunnel to VPN clients, then Global Protect is unable to create the "virtual" interface used for the VPN, and will fail.

The only thing I can suggest is that you change your VPN range to something "out of the ordinary" - I would recommend something like 172.29.131.0/24, for example - the chances of a Hotel using *that* for its guest WiFi are pretty slim.

Re: Global protect error message

gwesson — Mon, 23 Sep 2013 22:56:32 GMT

I recommend adding several ranges to satisfy these conditions. The IP ranges are attempted in a top-down order, so for the IP pool you might set:

10.125.15.0/24

172.20.120.0/24

192.168.200.0/24

Explore more options, and you should find a solution that works for the majority of your clients. Each range is added to the firewall's routing table so there is nothing you need to add to the Virtual Router to get it to work correctly. Give that a shot, and you should be in good shape.

Hope this helps!

Greg Wesson

Re: Global protect error message

santonic — Tue, 24 Sep 2013 08:22:54 GMT

There is a way, but I found it after posting ofc

How can IP Overlaps be Prevented with GlobalProtect

As long as you set 2 segments, which can't overlap, you won't have any problems.

Re: Global protect error message

Oleksandr — Fri, 25 Apr 2014 14:49:23 GMT

I created 2 pools (10.0.0/24 and 172.30.0/24), but it starts to ignore first one! Always assign from second one

Ver 6.0.0

Any ideas?

Thank you!

Re: Global protect error message

_slv_ — Sat, 26 Apr 2014 07:35:16 GMT

Recently published 6.0.2 has huge list of fixes, I don't know is Your problem on this list but i could help You in this and other problem. 6.0.0 isn't a good version IMHO.

Regards

SLawek

Re: Global protect error message

Retired Member — Sat, 26 Apr 2014 07:42:38 GMT

Did you try to change their order and see if release changes or not ?

Re: Global protect error message

Oleksandr — Mon, 28 Apr 2014 14:05:19 GMT

Yes, i used different laptops and tried to change the order. Always assigned from 172.30.0/24

Re: Global protect error message

Oleksandr — Mon, 28 Apr 2014 14:06:17 GMT

today i will upgrade the OS to 6.0.2

we'll see