topic multi-vpn in General Topics

multi-vpn

jdprovine — Fri, 02 Dec 2016 17:15:08 GMT

Is it possible to use a single install of globalprotects with multi vpn connections? I know you can set it up on a cisco vpn client but I don't see a way to do it on the GP client except for manualy changing the portal and lately that hasn't worked and say there is a cert mismatch, it seems to only want to read one cert

Re: multi-vpn

BPry — Fri, 02 Dec 2016 18:11:20 GMT

I'm not positive if this is possible without manually entering in the address on GP as we still primarly use anyconnect for VPN. As far as the cert mismatch error I imagine that it's holding it's config file and trying to use the cert that it already negotiated for the other portal. Deleting out the PanPortalCfg.dat file in AppData will likely allow you to connect to another Portal again.

Re: multi-vpn

jdprovine — Fri, 02 Dec 2016 19:09:52 GMT

Thats good information thanks

Re: multi-vpn

jdprovine — Fri, 02 Dec 2016 19:23:20 GMT

I deleted call of these PanPortalCfg.dat and it still gave me the same error

Re: multi-vpn

BPry — Fri, 02 Dec 2016 20:10:11 GMT

Did you restart after you deleted that file, if you didn't i've had it still stay in a locked position?

Re: multi-vpn

jdprovine — Fri, 02 Dec 2016 20:38:00 GMT

Yup restarted multiple times, uninstalled the gp client, went into cert management and deleted all the the globalprotect certs and it still says its there in the global protect client. I used to be able to manually put the portal in and get it to work for any vpn as long as I put my user in the security group associated with the portal but now it won't work

Re: multi-vpn

BPry — Fri, 02 Dec 2016 21:10:00 GMT

If you look at this link at step 8 it walks you through defining the gateways. Someone in your organization didn't enable this with just one gateway strictly allowed id they? That's actually how you would properly setup mulitiple gateways to all of your clients.

Little rusty on GlobalProtect configuration; we don't use it outside of on-demand connections for when we update the ASAs that sit behind the firewalls and I haven't touched the config of it for a while.

Re: multi-vpn

jdprovine — Mon, 05 Dec 2016 13:52:54 GMT

It appears that the palo is trying to match the certificate for our staff VPN with the contractor vpn. This vpn has been working for the last three months but I did upgrade the PA from 7.0.8 to 7.010 just last week but I don't remember seeing anything inthe release notes that said anything about this.