Global Protect issue with BGP routing configuration

[a.jones]

Hi All,

I have configured Global Protect and I can successfully connect. My Palo Altos are configured to peer and route via BGP which is working without issue.

My problem is I cannot reach anything once I am connected. I need at access two address ranges. From the CLI of the Palo I can ping the gateways of the networks I need to reach via the GlobalProtect connections. I cannot ping when connected via global protect.

What I have noticed is that if I look at the more runtime stats in the virtual routers I can see the client pool subnet in the route table on interface Tunnel but not in the Forwarding table.

Any ideas?

Regards

Adrian

[gwesson]

Routing is the most common issue I see for this symptom. Are you doing source-NAT for your GlobalProtect clients?

Recall that the gateway config on the firewall defines the source IP pools for your clients, and assigns them based on that. If you are not doing NAT, then you'll just need to ensure that the networks you're trying to reach understand that they have to send the replies back to the firewall. If there's a more general/broad route on those networks' gateways, you'll need to use a more specific route for your GP clients source pool.

[a.jones · Accepted solution]

Thanks. After a weekend of looking I resolved this on the connecting router. It seems there was some diverse routing going on so the default gateway was pointing to another path. Once I removed this other path and tidied the config the expected default route displayed as expected and I had routing.

Nothing as good as taking over someones configuration it seems.

Thanks for the advice.

Regards

Adrian