Cannot run GlobalProtect Portal on preferred IP address

[cstech]

Please correct any wrong statements:

1. I connect my PA to the "untrust internet" via ethernet 1/1

2. My ISP assigned me 164.67.80.0/24 block of IPV4 addresses (actually this is a lie...)

3. I assigned 164.67.80.2/24 to ethernet 1/1

4. The PA is capable of running NAT on any of the addresses in the entire 164.67.80.0/24 subnet using Proxy ARP

5. I want to run a GlobalProtect HTTPS server on 164.67.80.3

6. The GlobalProtect Portal will not allow (5).

7. The reason for (6) is that 164.67.80.3 is not bound to ethernet 1/1.  The GlobalProtect HTTPS portal cannot use Proxy ARP.

7. I cannot bind 164.67.80.3/24 to ethernet 1/1 as a subinterface because it is on the same subnet as 164.67.80.1/24

8. I cannot run my GlobalConnect portal on 164.67.80.3, my preferred IP address

9. I must run GlobalConnect HTTPS Portal on the un-preferred IP address 164.67.80.2.

Thank you,

Chris

[bat · Accepted solution]

Hi Chris Stankevitz

For this: I cannot bind 164.67.80.3/24 to ethernet 1/1 as a subinterface because it is on the same subnet as 164.67.80.1/24

Have you tried configuring this IP as 164.67.80.3/32 on that interface

Alternate solution:

You can terminate the portal on loopback interface

Give any IP say 1.1.1.1 on loopback

Create a NAT policy to NAT requests coming on IP 164.67.80.3 port 443 to loopback IP.

I tried both the above solutions in my lab and both worked.

Let me know if you face any issues.

Thanks

[cstech]

csharma,

Thank you for the suggestions.  I used option 2 and it works great.  I was a little worried about which zone the loopback should live in.  I put it in the DMZ but I don't know why.

Thanks again,

Chris

[reaper]

Hi

you can also create a loopback interface and give it a public IP, then put it in the external zone. This will allow you to go without NAT

regards

Tom