topic Re: Problems with GlobalProtect from China? in General Topics

Problems with GlobalProtect from China?

hklygre — Thu, 03 Sep 2015 08:01:52 GMT

Hi,

we have a user who spends a lot of time in China, but is having major problems getting GlobalProtect working while there. Does anyone else have any experience running GlobalProtect out of China (to Norway, in our case), either positive or negative?

We're seeing tunnels sometimes going down for no apparent reasons, "Failed to connect to remote host" messages on reconnect, and generally poor performance. Most of the time the user isn't able to use GlobalProtect.

- Håvard

Re: Problems with GlobalProtect from China?

Hithead — Thu, 03 Sep 2015 09:41:10 GMT

hi,

we also have remote users in china. they don't having problems at all...

If (just sometimes) they have problems to conntect is because of the china great firewall: - latency issue and trying to decrypt SSL connections.

Workaround: waiting or try another portal.

check how the latency is from the client is, use a newer version of GP and ensure a none decrypted connection...

Re: Problems with GlobalProtect from China?

hklygre — Tue, 08 Sep 2015 10:46:53 GMT

We currently have only one portal (and one gateway), so trying another isn't an option. However, it was suggested to me to try running a PAN-OS VM in AWS (Singapore), which might bypass some of the issues with the chinese firewall. I'll see if I can try it this month.

Re: Problems with GlobalProtect from China?

goran.katava — Tue, 11 Feb 2020 14:01:27 GMT

I notice this old thread, but would like to comment on it and maybe get more replies.

We have hosted Global Protect in China with mixed results. It used to work on Verizon line, but since we switched to China telecom it is not working. It seems like the problem is ssl connection, and that ssl requests are not even reaching the portal/gateway.

Re: Problems with GlobalProtect from China?

aleksandar.astardzhiev — Wed, 12 Feb 2020 13:15:52 GMT

Hi @goran.katava,

Are you sure that you are using the GlobalProtect in SSL mode and not in IPsec mode?

In the past I had issues with IPsec based RA VPN (on another firewall vendor) for users connecting from China and the solution was to switch from IPsec to SSL for the RA VPN. This was few years ago and I am surprise to hear that the SSL based VPN is having issues.

Re: Problems with GlobalProtect from China?

SutareMayur — Wed, 12 Feb 2020 15:14:19 GMT

Hello All,

We had also faced issues with IPSEC from China. Most of the times, there were huge latency and drops too.

- Mayur

Re: Problems with GlobalProtect from China?

goran.katava — Wed, 01 Apr 2020 13:36:54 GMT

Yea, I am sure, IPSEC mode.

All sudden it started working. It was most probably blocked by ISP.