topic Re: Unable to reach GP Portal while on internal network in General Topics

Unable to reach GP Portal while on internal network

ce1028 — Fri, 06 Mar 2020 01:25:26 GMT

Hi All,

I was working with a site that has a PA firewall with a GP Portal and Gateway. Some time ago, I had an issue where my users couldn't upgrade their globalprotect version while in the office. I was able to resolve this issue by creating a No NAT rule where if the source was internal and the destination was the IP of the portal. That works as expected.

I'm now working with another site that has a GP Portal/Gateway on the firewall, I created the same No Nat rule, but these users are still not able to upgrade internally, they are not prompted. They are not even able to hit the web portal. The difference in this site is they are using a dual ISP setup. This is setup using PBF. e1/1 is the primary ISP, so there is the typical PBF rule for external traffic to forward out e1/1. I'm not sure if the issue is related to PBF. Has anyone come across this issue?

Re: Unable to reach GP Portal while on internal network

Chacko42 — Fri, 06 Mar 2020 09:28:49 GMT

Hi,

please make sure, that the users have a exception in the pbf rule, so they will led to the public interface with the gp portal.

Otherwise they will be forced to the wrong public interface.

Regards

Chacko

Re: Unable to reach GP Portal while on internal network

ce1028 — Fri, 06 Mar 2020 18:23:27 GMT

@Chacko42

Not sure I'm clear what you mean? The GP Portal is the IP of the e1/1 interface. The PBF rule states if you from source internal to external, forward to e1/1

I tried creating a no PBF rule for the specific GP IP, but then that made things worse

Re: Unable to reach GP Portal while on internal network

OwenFuller — Fri, 06 Mar 2020 21:39:46 GMT

Is there a security policy allowing ssl and panos-global-protect from your inside zone to the zone/address of the portal?

Re: Unable to reach GP Portal while on internal network

ce1028 — Mon, 23 Mar 2020 17:16:25 GMT

I was able to resolve this by excluding the GP portal from the PBF rule and then create a static route on the VR