Global Protect and IPSEC Crypto with SSL Fallback

Reply
Highlighted
L0 Member

Global Protect and IPSEC Crypto with SSL Fallback

I was looking at some of the comments/questions on the PaloAlto community board trying to figure this out. But I've confused myself. IPSEC is a layer 3 protocol and SSL operates at layers 5 and 6. As a “fall back” protocol for GP – is that in case if there are problems with establishing the tunnel through the end user’s ISP (as one comment indicated) or is it in case of authentication problems due to  latency and degradation of the tunnel as it passes from inside to outside. I can see the L3 IPSEC tunnel being best for outside endpoint connections. And as far as SSL, since it works more at an application layer, using it for navigating the internal network, such as file shares and applications that aren’t web-based. (Can there be a mid-transmission switch like that?)  So, in essence running both protocols being dependent on type of data access. But wouldn’t that kind of transition cause latency against wire speed transmissions?

 

I just don’t understand the “fall back” aspect. Are we expecting that in some circumstances IPSEC will fail?

Tags (3)

Accepted Solutions
Highlighted
Cyber Elite

Re: Global Protect and IPSEC Crypto with SSL Fallback

Hello there!

 

I have always understood that the failback functionality, is in case that IPSec cannot be established for whatever reason.

Maybe port 4501 is being blocked upstream, or your GP user is at a customer/vendor location and they do not allow IPsec on port 4501 outbound through their environment.  I am sure there could be other reasons why IPsec would fail.

 

So, if IPSec is not available, the solution is engineered to use SSL.

 

Thanks.

Help the community: Like helpful comments and mark solutions

View solution in original post


All Replies
Highlighted
Cyber Elite

Re: Global Protect and IPSEC Crypto with SSL Fallback

Hello there!

 

I have always understood that the failback functionality, is in case that IPSec cannot be established for whatever reason.

Maybe port 4501 is being blocked upstream, or your GP user is at a customer/vendor location and they do not allow IPsec on port 4501 outbound through their environment.  I am sure there could be other reasons why IPsec would fail.

 

So, if IPSec is not available, the solution is engineered to use SSL.

 

Thanks.

Help the community: Like helpful comments and mark solutions

View solution in original post

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!