topic Re: Troubleshooting GlobalProtect in General Topics

Troubleshooting GlobalProtect

Nathan.S — Mon, 11 Jun 2018 15:36:54 GMT

PA220, 8.1.1, GPClient 4.1.1, GP license activated.

Connecting to the GPportal/gateway works fine. Traffic routes as expected.
We're still testing, so access is severly limited and policies wide open once connected. Literally, everything is allowed for GP users.
However, when i attempt to access an internal SSL-protected site, the traffic is denied.
I can even change the rule to expressly allow SSL & web-browsing to that device and it still hits the DenyAll rule at the bottom.

What am I missing in my setup?

Re: Troubleshooting GlobalProtect

Raido_Rattameister — Mon, 11 Jun 2018 15:38:49 GMT

Can you share screenshot of permit rule and denied log entry.

Most likely zone or user/group mismatch.

Re: Troubleshooting GlobalProtect

BPry — Mon, 11 Jun 2018 18:18:21 GMT

@Nathan.S,

Aside from what @Raido_Rattameister already mentioned I would also look at the logs and verify that it's being seen on a default port and that the application is getting identified. There's a lot of little gotcha's here that can get in the way of this working properly.

Re: Troubleshooting GlobalProtect

Nathan.S — Mon, 11 Jun 2018 18:35:00 GMT

RuleUnifiedLog

Re: Troubleshooting GlobalProtect

Nathan.S — Mon, 11 Jun 2018 18:35:55 GMT

It's showing on the correct port (443 and 8443 is what I was looking at) and being IDd as SSL traffic.

Re: Troubleshooting GlobalProtect

BPry — Mon, 11 Jun 2018 18:51:03 GMT

@Nathan.S,

Looking at your screenshot it looks like the log in question is being identified as looking for dst port 7443 right? Regardless the application-default port for SSL identified traffic is only 443; so if you want to allow it on 8443/7443 or whatever you need to actually specify that. As your current security policy is written this traffic doesn't match your policy.

Re: Troubleshooting GlobalProtect

Nathan.S — Mon, 11 Jun 2018 18:53:48 GMT

Even though I have the apps set to 'any'?
huh.
Let me look at the logs again, I'm pretty sure 443 traffic was failing too

Re: Troubleshooting GlobalProtect

BPry — Mon, 11 Jun 2018 18:55:28 GMT

@Nathan.S,

Yes; this is due to specifying the service as application-default. Since the app-id is being identified as 'ssl' the only default service that is going to be allowed is 443.

Re: Troubleshooting GlobalProtect

Nathan.S — Mon, 11 Jun 2018 18:56:42 GMT

Hmm, okay. I'll test further and will update.

Thank you for your help!