topic Re: GlobalProtect on DHCP Interface in General Topics

GlobalProtect on DHCP Interface

nabokih — Sun, 01 Nov 2015 14:15:36 GMT

Hi,

I have configured GlobalProtect on DHCP interface, but for some reason I can't make it work. I don't see GP web page and I cannot connect to it using GP client.
I tried same config, but with static address and it works perfectly.

Can somebody help me to troubleshoot this?

Thank you.

Re: GlobalProtect on DHCP Interface

pankaku — Sun, 01 Nov 2015 18:38:16 GMT

A few questions:

1> How are you tring to access the page with domain name or ip address?

2> Do you have default route pointing towards your gateway?

3> Are you able to ping to the ip address that you got on interface from DHCP server?

4> Do you have the dns entry for that domain name?

If you are able to connect with static ip address then the only change in the GP configuration will be you will not get any ip address in the drop down list while configuring ip address under portal and gateway.

If you are able to get the portal page then Check the following link

https://live.paloaltonetworks.com/t5/General-Topics/PAN-OS-and-Global-Protect-software/m-p/65670#M39162

Lets us know if that solved the issue or not.

Re: GlobalProtect on DHCP Interface

nabokih — Mon, 02 Nov 2015 06:13:01 GMT

Hi Pakumar,

>1> How are you tring to access the page with domain name or ip address?

I use ip address that I receive from ISP DHCP server on untrusted interface.

2> Do you have default route pointing towards your gateway?

Yes, I have default route for that interface. I use internet from this interface and it works fine.

3> Are you able to ping to the ip address that you got on interface from DHCP server?

No I don't, even If I put management profile with ping-enable settings on it. But I can ping it if I use another router (not-palo alto).

Re: GlobalProtect on DHCP Interface

pankaku — Mon, 02 Nov 2015 13:49:11 GMT

From firewal are you able to ping from ISP interface to internet?

ping source x.x.x.x host 8.8.8.8

Are you using some destination NAT for the IP address that is provided by the ISP? If yes then that traffic will go inside your network.

Re: GlobalProtect on DHCP Interface

axtiooon — Tue, 03 Nov 2015 08:22:04 GMT

Hi, i had - seams you are talking about - the same issue, i've used die version 7.0.3. It was not possible to select the IP-address of the DHCP interface in the Portal and Gateway configuration.

To solve the issue i created a 1:1 of the DHCP interface to a loopback interface. Portal and Gateway running at this IP address.

Hope this is the problem u mentioned.

Those guides were very helpfully:

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-Global-Protect-Gateway-on-Loopback-Interface/ta-p/56866

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-GlobalProtect-Portal-Page-to-be-Accessed-on-any/ta-p/53460

Regards

Andre