topic Re: GP Access Routes in General Topics

GP Access Routes

rmfalconer — Tue, 06 Jun 2017 17:29:56 GMT

Is there any way to negate adding a prefix to the GP Access Routes? We have an app that we don't want to change the communication path when a machine connects with GP. So if it was accessing this app through an external method it should remain that way.

If the app is using address 1.1.1.1 prior to connecting with GP, then the access routes would be 0/0 but not 1.1.1.1.

Negation is possible in other places on the PA but I don't see a way to do it with the access routes.

Re: GP Access Routes

SuryaR — Tue, 06 Jun 2017 17:33:13 GMT

May I please know what PAN-OS version and GP -version are you using..

Re: GP Access Routes

BPry — Tue, 06 Jun 2017 18:24:29 GMT

@rmfalconer,

If you are running anything above 8.0 then you can add an excluded access route so that the address isn't passed through the tunnel, prior to that you do not have that ability.

Re: GP Access Routes

rmfalconer — Tue, 06 Jun 2017 18:30:01 GMT

We are running 7.1.9 and GP 3.1.6 so it looks like it's not supported yet.

Re: GP Access Routes

SuryaR — Tue, 06 Jun 2017 18:46:23 GMT

Yes negate option is added only if you use 8.0.x +4.0.x.

It doesnt work with 8.0.x and 3.x.x versions.

Hope this helps.

Re: GP Access Routes

Remo — Tue, 06 Jun 2017 19:31:15 GMT

It is (a lot) more awful, but it is also possible with your software versions. You "simply" have to add all IP subnets except the one IP ...

0.0.0.0/8

1.0.0.0/16

1.1.0.0/24

1.1.1.0/32

1.1.1.2/31

1.1.1.4/30

1.1.1.8/29

1.1.1.16/28

1.1.1.32/27

1.1.1.64/26

1.1.1.128/25

1.1.2.0/23

1.1.4.0/22

1.1.8.0/21

1.1.16.0/20

1.1.32.0/19

1.1.64.0/18

1.1.128.0/17

1.2.0.0/15

1.4.0.0/14

1.8.0.0/13

1.16.0.0/12

1.32.0.0/11

1.64.0.0/10

1.128.0.0/9

2.0.0.0/7

4.0.0.0/6

8.0.0.0/5

16.0.0.0/4

32.0.0.0/3

64.0.0.0/2

128.0.0.0/1