topic Re: Question about Global Protect and ip pools in General Topics

Question about Global Protect and ip pools

Alex_Samad — Fri, 03 May 2019 05:42:54 GMT

Can any one explain the difference between the ip pools

a) Global protect / gateways ... external gateway / agent / Client ip pool

b) Global protect / gateways ... external gateway / agent / client setting / ip pool

so for

a) I can't reference an object .. thats annoying

b) I get the pool is just for that setup, I do like having 1 pool of the gateway.

Currently I have a object defined which is a range which is attached to b), but I am thinking of moving to a) so that I can have different configs but just 1 ip pool

whats the use case for these different setups

Re: Question about Global Protect and ip pools

Mick_Ball — Fri, 03 May 2019 08:44:18 GMT

@Alex_Samad , Hi.

I can reference a) Global protect / gateways ... external gateway / agent / Client ip pool

/Network/GlobalProtect/Gateways/Agent/Client settings/Configs/IP pools

But I cannot find b) Global protect / gateways ... external gateway / agent / client setting / ip pool

Re: Question about Global Protect and ip pools

Alex_Samad — Fri, 03 May 2019 22:09:14 GMT

click network on top tab

global / protect

gateways

Select agent on the left

across the top you should have

Client IP Pool <<< This is A

Client setting

Select client setting

you have a table of configs

across the top is ip pools << This is B

Re: Question about Global Protect and ip pools

Mick_Ball — Sun, 05 May 2019 08:26:49 GMT

@Alex_Samad ,I cant find "A"

What version are you running.

Re: Question about Global Protect and ip pools

Remo — Sun, 05 May 2019 18:23:25 GMT

Hi @Alex_Samad

There are two options so that you can either specify a general IP pool for the GP gateway or specific IP pools for example for different OS, user(groups) and/or source IPs/regions.

As long as a general IP pool is configured the IP pool option in the client setting is greyed out.

@Mick_Ball what version are you running? According to the documentation it is already possible as described by @Alex_Samad since PAN-OS 8.0. Right now I had only a PAN-OS 9.0 firewall in my homelab.

Re: Question about Global Protect and ip pools

Alex_Samad — Mon, 06 May 2019 09:17:39 GMT

@Mick_Ball sorry I didn't orignally see the SS, wasn't using the web interface.

I'm on 8.1.5

@Remo so which is the prefered ?

I do like at the gateway level not the config level

Re: Question about Global Protect and ip pools

Remo — Mon, 06 May 2019 10:48:03 GMT

@Alex_Samad wrote:
@Remo so which is the prefered ?

I don't know. I personally prefer the general IP pool as I have multiple gateways för different use cases - so I don't need specific client settings based on the possible attributes.

Re: Question about Global Protect and ip pools

Mick_Ball — Mon, 06 May 2019 10:58:32 GMT

yes can see it now, lab was 8.08...

Re: Question about Global Protect and ip pools

RamBista1 — Tue, 14 Apr 2020 00:45:11 GMT

Is there a limit on how many GP IP Pools we can configure on PA-5250s on PAN-OS 9.0 ? I am looking for 50 IP Pool subnets. Is that possible?