topic Can't get traffic to GP VPN clients in General Topics

Can't get traffic to GP VPN clients

s.Konowalchuk — Mon, 16 Mar 2020 15:24:18 GMT

I'm trying to figure out how to get traffic from my internal network to my GP VPN clients. At the moment I can't even ping the remote users. They can access all corporate resources without issue I just can't seem to get any traffic out to them. It seems I have this issue with any tunnel.xx interface. Is there something obvious here that I'm missing?

I'm running an 820 with 8.1.6.

Re: Can't get traffic to GP VPN clients

S.Cantwell — Mon, 16 Mar 2020 17:57:29 GMT

You may want to confirm that the virtual pool of addresses that the GP users are getting is an UNKNOWN/un-used range from your internal network. Too often I see customers using a subnet that is internal to the network, and then the L3 switch does not know how to get them to the users. So routing/subnet is one issue.

Let us know how this works.. provide other detials.

Re: Can't get traffic to GP VPN clients

s.Konowalchuk — Mon, 16 Mar 2020 18:10:54 GMT

Hi Steve,

Yes I can confirm that the virtual pool definitely is not used anywhere else in my network. I've also got a static route setup for it same as I do my other networks that terminate on the PA.

Re: Can't get traffic to GP VPN clients

Mick_Ball — Mon, 16 Mar 2020 19:35:17 GMT

Every setup is different but for me i just have a policy to allow all from trusted zone to vpn tunnel zone.

Re: Can't get traffic to GP VPN clients

s.Konowalchuk — Tue, 17 Mar 2020 18:09:54 GMT

I have a similar policy that basically allows my entire IT zone to access any on my Global Protect zone. I don't think its a policy issue so much as a routing issue as I can ping the tunnel gateway but not the individual clients that are remoting in.

Re: Can't get traffic to GP VPN clients

jlittle — Sat, 20 Feb 2021 00:17:19 GMT

I was wondering if you ever found a solution to this?

Re: Can't get traffic to GP VPN clients

S.Cantwell — Sat, 20 Feb 2021 00:27:11 GMT

Howdy, there really could only be 2 potential reasons..... security policy to allow the traffic and routing table to permit the traffic.

You MUST see traffic in your logs from your inside zone to your globalprotect zone (or whatever)

If you do not see this traffic, then you are not displaying your logs properly, or you are using intrazone policy (without logging) or you are not logging the rule that it would be hitting... once you see this, then you can confirm in your logs, that you see traffic from the inside interface (whatever that would be) destined to the tunnel interface for GP (whatever that is..)