GlobalProtect on HA

[gabe]

We get

SSL connect select error: 0(Resource temporarily unavailable), time left: 0
P26083-T33415 08/07/2025 00:31:33:272 Debug( 468): SSL connect failed
P26083-T33415 08/07/2025 00:31:33:272 Debug( 66): detailed SSL error info:
P26083-T33415 08/07/2025 00:31:33:272 Debug( 956): connect() failed
P26083-T33415 08/07/2025 00:31:33:272 Debug(3388): ConnectSSL: Failed to connect to 'gw1.vpn.ourdomain.com:443'. Disconnect ssl.

and the same for gw2 on our HA PA-1410 pair when trying to connect to ssl.vpn.ourdomain.com using the GlobalProtect client, but when we are connected to our "for emergencies" VPN to our network using OpenVPN, GlobalProtect client connects.

here are some of the settings but i may miss list something:

ssl.vpn.ourdomain.com is having xxx.xxx.17.20 on our dns server. gw1.vpn.ourdomain.com is 17.17, gw2 is 17.18 all internet facing dnschecker.com sees them (ssl pings gw1 gw2 do not)

i set up a virtual router on 'default' / static routes with xxx.xxx.17.16/29 as destination and the interface to our downstream. no next hop. this may be incorrect.

i have changed the object ip of xxx.xxx.17.20 to xxx.xxx.17.20/29 and i got a new message in the log saying "network is reachable" 2x but after that the same ol' ssl connect failed.

what should i modify/set?

if this helps at all, in monitor / traffic i see this:

(both to xxx.xxx.17.17 and xxx.xxx.17.18 aged-out with 0 bytes of traffic)

[gabe]

whellllh

i fixed it by using either 2 loopbacks one for portal floating that syncs to active primary, and one on each for the gateways, then we went forward not messing around with loopback ip but we now use floating loopback without loopback ip only ip for the floating ip and the south facing interface ip for both gateways.

seems to be working however since it's an active-active setup, gw2 (active-secondary) is not reachable from the outside world. port 443 in particular which needs to be opened and accessible.

tonight we will fail over and see if this is an expected behavior or we just set up something wrong in our bgp/ospf/routing whatever, but it seems like both devices are configured the same way. so my theory is that this is how it should be.