Experience with GlobalProtect during Corona pandemic time

Reply
Highlighted
L3 Networker

Experience with GlobalProtect during Corona pandemic time

I would like to share issues with GlobalProtect, and what was done to fix it.

 

QoS with loopback interface
Due to high network load on the Internet line, we wanted to priorize (or limit) some traffic. It took several hours (testing, reading documents, having a PA supporter analyzing the issue, ...) until the root cause was identified. Applying QoS on a loopback interface is simply not supported. So we had to migrate the GP gateway from a loopback to a secondary IP (you can have more than one secondary IP) on the physical interface. The secondary IP was added with netmask /32. We had to update our security policy due to the interface of the gateway is now part of a different zone.

 

Limit bandwidth of SMB traffic
A good amount of traffic sent to the clients is caused by our software deployment (and patch management). The files/packages are provided on SMB-fileshares. By limiting this traffic (QoS policy based on the servers, regardless of the application) we ran into unexpected side effects with our fileservices (which is served by other servers, not related to the ones limited). There is only one "SMB-process" on the client machine. If a SMB connection to server A (our software deployment server), then this process chokes on SMB connections with server B. Luckily we are able to shift software deployment from SMB to http(s).

Highlighted
L1 Bithead

Re: Experience with GlobalProtect during Corona pandemic time

How are you identifying SMB traffic in your QoS rule? Is it blanket all SMB traffic, or from specific "servers/hosts"?

 

Zach Biles -
https://www.linkedin.com/in/zachary-biles-a5097532/
Highlighted
L3 Networker

Re: Experience with GlobalProtect during Corona pandemic time

The majority of QoS rules ignore the application.

They simply match the destination server (which is used for software deployment only) and are put in class 7 (which has a max bandwidth configured).

The "normal" fileserver traffic is listed in the QoS policy, hence put in class 4.

Highlighted
L1 Bithead

Re: Experience with GlobalProtect during Corona pandemic time

Maybe a dumb question, but are the "more specific" rules for your app deployment servers higher in your QoS ruleset? Those are processed in order and exit on first match.

 

Also, are your rules configured bi-directional? I found that I had to list source and destination zones and IP's in both the source and destination field for it to catch the traffic. I'm guessing since it's the clients that initiate the transfer after the server instructs the client to do so.

 

Zach Biles -
https://www.linkedin.com/in/zachary-biles-a5097532/
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!