I am trying to enable Global Protect. So far I've been able to connect the client to the firewall successfully. However the remote VPN client cannot talk to inside hosts. But the inside hosts can ping the remote client.
After troubleshooting, I found IPSec traffic is blocked at the outside interface (which blocks everything). When I enable all incoming traffic on the outside interface the remote client is able to talk to the inside zone.
I've now enabled "IPSec" application group to be passed through the outside interface, however the remote client is still unable to talk to the inside zone. Is there a standard set of applications/services that needs to be allowed on the outside interface for GlobalProtect clients?
Solved! Go to Solution.
On the rule that you have enabled "IPSec", please go ahead and add following as well " panos-global-protect, ike, ipsec-esp-udp, panos-web-interface, ssl". This should resolve the issue.Thanks.
Putting the tunnel interface on the inside zone fixed the problem.
Opening up the apps on the outside interface did not, however I didn't have much time to troubleshoot this scenario, so it is possible I missed something.
Thanks for the help guys.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!