GlobalProtect, enabling ipsec from outside

[BTS_MS]

Hi all,

I am trying to enable Global Protect. So far I've been able to connect the client to the firewall successfully. However the remote VPN client cannot talk to inside hosts. But the inside hosts can ping the remote client.

After troubleshooting, I found  IPSec traffic is blocked at the outside interface (which blocks everything). When I enable all incoming traffic on the outside interface the remote client is able to talk to the inside zone.

I've now enabled "IPSec" application group to be passed through the outside interface, however the remote client is still unable to talk to the inside zone. Is there a standard set of applications/services that needs to be allowed on the outside interface for GlobalProtect clients?

Many thanks.

[ssharma]

On the rule that you have enabled "IPSec", please go ahead and add following as well " panos-global-protect, ike, ipsec-esp-udp, panos-web-interface, ssl". This should resolve the issue.Thanks.

[sdurga · Accepted solution]

you can allow the above said applications, alternatively you can place the tunnel interface in the internal zone that way you need not create any security policies.

[ssharma]

Did that resolved your issue? Please do let us know. Thanks.

[BTS_MS]

Putting the tunnel interface on the inside zone fixed the problem.

Opening up the apps on the outside interface did not, however I didn't have much time to troubleshoot this scenario, so it is possible I missed something.

Thanks for the help guys.