Global Protect and IPSEC Crypto with SSL Fallback

[RobinNicholson]

I was looking at some of the comments/questions on the PaloAlto community board trying to figure this out. But I've confused myself. IPSEC is a layer 3 protocol and SSL operates at layers 5 and 6. As a “fall back” protocol for GP – is that in case if there are problems with establishing the tunnel through the end user’s ISP (as one comment indicated) or is it in case of authentication problems due to  latency and degradation of the tunnel as it passes from inside to outside. I can see the L3 IPSEC tunnel being best for outside endpoint connections. And as far as SSL, since it works more at an application layer, using it for navigating the internal network, such as file shares and applications that aren’t web-based. (Can there be a mid-transmission switch like that?)  So, in essence running both protocols being dependent on type of data access. But wouldn’t that kind of transition cause latency against wire speed transmissions?

I just don’t understand the “fall back” aspect. Are we expecting that in some circumstances IPSEC will fail?

[SteveCantwell · Accepted solution]

Hello there!

I have always understood that the failback functionality, is in case that IPSec cannot be established for whatever reason.

Maybe port 4501 is being blocked upstream, or your GP user is at a customer/vendor location and they do not allow IPsec on port 4501 outbound through their environment.  I am sure there could be other reasons why IPsec would fail.

So, if IPSec is not available, the solution is engineered to use SSL.

Thanks.