For details on cookie usage on our site, read our Privacy Policy
Global Protect on overlapping networks
- LIVEcommunity
- Discussions
- General Topics
- Global Protect on overlapping networks
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Printer Friendly Page
- Mark as New
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
10-11-2011 06:20 AM
Hello everybody!
I have a big problem with Global Protect and overlapping networks.
I make you an example.
-------------
My local network is 192.168.10.x
My Global Protect Network is 172.16.x.x
The external network has the same class of my local network
--------------
If I connect my lapton in any networks everything works good but if the network has the same class of my local network Global Protec Client on my laptop discover the "outside network" like extenal network (perfect thing) but if I try to access some service like webserver or Exchange I encounter connection error.
Can I resolve this specific situation? How?
Another think ... I can resolve and ping for example my internal DNS
Help me please ....
Accepted Solutions
- Mark as New
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
10-17-2011 03:28 AM
This is by design: if the GP client is located in a network that is identical to the one used in the VPN tunnel (let's call it localnet vs officenet) all traffic will be pushed into the tunnel
If the localnet is a subnet of officenet (so localnet/24 vs officenet/21) the more specific network will "win" the route so local resources remain reachable
In this case if there is an IP overlap where a local resource uses the same IP as a remote resource, the local resource will be reachable and the remote not.
In case of an identical subnet (/24 vs/24) remote resources will be available while local ones will not be
PANgurus - (co)managed services and consultancy
- Mark as New
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
10-11-2011 06:31 AM
You are hitting your external gateway fine, but are unable to access internal resources? Is this correct?
- Mark as New
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
10-11-2011 06:37 AM
A couple places to look for a problem.
- Check to make sure that you have a security rule in place from inside to outside with your IP range for the GP pool. And vice versa.
- Check that you have a route in place on your vrouter to allow you to stay inside once you have connected to the GP client.
Could you upload images of your vrouter and interfaces?
Also, make sure that your IP pool that you are assigning clients from GP is not the same network as your internal resources. It has to be something different.
- Mark as New
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
10-11-2011 06:47 AM
Yes ... but only some address. For Example the DNS server works good.
I think I've find the error. I've missed the Access Route in Gateway configuration.
- Mark as New
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
10-11-2011 06:48 AM
That'll do it. Let me know if that fixes it. If you just enter 0.0.0.0 in the access routes for the Gateway, that will take care of it.
- Mark as New
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
10-11-2011 07:20 AM
If I use 0.0.0.0/0 or leave everything blank I have the overlapping problem.
If I submit my network class everything works but I cannot block for example the web-browsing because I bypass my firewall for navigation.
- Mark as New
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
10-11-2011 08:23 AM
Does your vrouter have a route to internal resources?
- Mark as New
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
10-11-2011 08:41 AM
Do you mean I have to create I single route for I single resource in VR?
- Mark as New
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
10-11-2011 08:45 AM
No not necessarily. For instance, I have 2 rules on my Vrouter for 172 and 192 addresses that point them from my external interface to my internal gateway.
- Global Protect 6.0.1 dropping network in Modern Standby (W10 21H2) in GlobalProtect Discussions
- Global Protect VPN Disconnects Local Network Resources After 4 Hours in GlobalProtect Discussions
- VPN Global Protect Portal - two VR and one VR environments in General Topics
- New GP Client Install in GlobalProtect Discussions
- Global Protect VPN not showing in Win7 in GlobalProtect Discussions
Show your appreciation!
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
