topic Re: Experience with GlobalProtect during Corona pandemic time in General Topics

Experience with GlobalProtect during Corona pandemic time

JoergSchuetter — Wed, 25 Mar 2020 11:50:37 GMT

I would like to share issues with GlobalProtect, and what was done to fix it.

QoS with loopback interface
Due to high network load on the Internet line, we wanted to priorize (or limit) some traffic. It took several hours (testing, reading documents, having a PA supporter analyzing the issue, ...) until the root cause was identified. Applying QoS on a loopback interface is simply not supported. So we had to migrate the GP gateway from a loopback to a secondary IP (you can have more than one secondary IP) on the physical interface. The secondary IP was added with netmask /32. We had to update our security policy due to the interface of the gateway is now part of a different zone.

Limit bandwidth of SMB traffic
A good amount of traffic sent to the clients is caused by our software deployment (and patch management). The files/packages are provided on SMB-fileshares. By limiting this traffic (QoS policy based on the servers, regardless of the application) we ran into unexpected side effects with our fileservices (which is served by other servers, not related to the ones limited). There is only one "SMB-process" on the client machine. If a SMB connection to server A (our software deployment server), then this process chokes on SMB connections with server B. Luckily we are able to shift software deployment from SMB to http(s).

Re: Experience with GlobalProtect during Corona pandemic time

ZachBiles — Wed, 25 Mar 2020 14:18:47 GMT

How are you identifying SMB traffic in your QoS rule? Is it blanket all SMB traffic, or from specific "servers/hosts"?

Re: Experience with GlobalProtect during Corona pandemic time

JoergSchuetter — Thu, 26 Mar 2020 13:41:32 GMT

The majority of QoS rules ignore the application.

They simply match the destination server (which is used for software deployment only) and are put in class 7 (which has a max bandwidth configured).

The "normal" fileserver traffic is listed in the QoS policy, hence put in class 4.

Re: Experience with GlobalProtect during Corona pandemic time

ZachBiles — Thu, 26 Mar 2020 14:38:38 GMT

Maybe a dumb question, but are the "more specific" rules for your app deployment servers higher in your QoS ruleset? Those are processed in order and exit on first match.

Also, are your rules configured bi-directional? I found that I had to list source and destination zones and IP's in both the source and destination field for it to catch the traffic. I'm guessing since it's the clients that initiate the transfer after the server instructs the client to do so.