Global protect IPsec retry
cancel
Showing results for 
Search instead for 
Did you mean: 

Global protect IPsec retry

L4 Transporter

Hi Community,

 

I am trying to figure out how the GP Ipsec connection behaves, if the IPsec fails to connect at the time of initial GP connection and the GP falls back to SSL, will GP retry IPsec after any specific interval? is this configurable ?. Also is there any way I can move the Ipsec connection from UDP/4501 to any other ports?

 

Thanks in advance.

3 REPLIES 3

L4 Transporter

Try using the workaround with loopback addresses and destination NAT (I have not tested this for IPSEC but you can say if it worked for you). Test with a nat rule that forwards from 7000 to 4501 and enable IPSEC (https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-web-interface-help/globalprotect/network-globalp...

 

 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGKCA0

 

 

 

About if the IPSEC fails if the GP will try again IPSEC I don't think so, only if the VPN tunnel stops and it is strated again as switching between SSL to IPSEC will cause client traffic to be dropped.

hi @NikolayDimitrov , this will not help me as I have already one GP running. I am trying to have multiple GP gateways using the same public IP, SSL tunnel I moved to other ports, but looking for an option to move IPsec as well.

It is a strange setup you have. You don't have enough public ip addresses and this is why you want to use 1 public ip address for all gateways in other words anycast ip?

 

 

How did you redirect the SSL traffic, did you use the loopback way and destination nat?

 

https://live.paloaltonetworks.com/t5/general-topics/changing-the-globalprotect-portal-gateway-ports/...

 

 

 

 

Otherwise the globalprotect app selects a gateway for you and may use geolocation (user location) to make so that best gateway is selected and this is why each gateway can have its own public ip address:

 

https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-new-features/globalprotect-features/user-locatio...

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!