topic Re: Palo Alto global Protect setup issue in General Topics

Palo Alto global Protect setup issue

Jasoncull365 — Thu, 03 Aug 2017 04:33:20 GMT

Hi All,

I'm currently trying to set up an SSL VPN using the global protect client on a Palo Alto FW.

I have:-

- issue a self signed root CA and CA to the palo

- set up VPN tunnel

- created VPN zone

- setup an authentication profile using RADIUS and directed it to our NPS server which currently policy to allow access to an AD group "VPN Users"which i am the only member of.

- setup portal access

- created a virtual gateway

- applied policy to allow users contacting the palo from the outside to connect to the portal

- I have also setup policy to allow VPN users to access certain routes.

I am not able to access the portal, I type https://gateway-address and it sends me to the IIS7 page.

I'm not to sure where I've gone wrong or how to locate any errors etc to resolve this issue.

any advise will be much appreciated.

Thanks

Re: Palo Alto global Protect setup issue

abjain — Thu, 03 Aug 2017 08:50:31 GMT

Do you mean you are setting up GlobalProtect on Palo Alto Firewall, and when you try to access the page: https://<ip-address-of-portal> you get a IIS7 Page?

Firewall will not return a IIS7 page. Maybe you have a port forwarding configured which is forwarding your connection to a Windows Server.

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-GlobalProtect/ta-p/58351

Please make sure that your connection is terminating on the firewall.

You can check your session on CLI:

show session all filter source <ip of your client> (use public IP if accessing from outside)

See if there is any NAT happening here.

Re: Palo Alto global Protect setup issue

ansharma — Thu, 03 Aug 2017 12:58:46 GMT

I suspect there is some Destination NAT is causing this.

Please check the session details either from the Traffic logs or via 'show session all filter source <User's public IP> destination <Portal's public IP>

Regards,

Anurag

Re: Palo Alto global Protect setup issue

Jasoncull365 — Thu, 10 Aug 2017 23:36:41 GMT

Turns out the SSL CA we were using was redirecting us to another server.