GlobalProtect with NATet interface

[tormodhope]

I have a PA200, and is using eth1 for outside (internet) and eth2 for inside. I'm NATing from eth2 to eth1, as normal.

Now i want to have the management https address on the eth1 for several reasons.

At home its just for testing, but at my office i have PA200 between subnets that is duplicate, and not nessesary to route to.

When i use a management profile with access to ping and https on eth1, it wont't work.

I suspect the NAT rule has something to do with it. Cause when i set it up in my lab with no NAT, it works.

Any tips for me please?

[tormodhope]

I got it working with a DNAT against the outside ip address. But is this needed?

Is there another way doing it? The IP is public and facing internet, i though a management profile would open anyway.

[JimS2]

This is working as expected.  If you are NATing 443 from the outside to an inside server you loose access to the management page.  You can set up a loopback and NAT another port to 443 on the loopback with an management profile that allows HTTPS.

[Phoenix · Accepted solution]

tormodhope

May be you are experiencing the land attack. When we access the external interface from outside the source will be external host public IP and destination will be your external interface IP. When the return traffic is sent out ( server to client s2c ) it exchanges the source and destination and gets stuck seeing the source and destination the same considers a land attack and drops.

If you do

"show counter global filter delta yes | match land"

If the counters are seen then that would prove it. We will have to change the nat slightly and it should start to work.

Details are mentioned in the below doc:

Unable to Connect to or Ping a Firewall Interface

Hope this helps !

[panos]

How to Access the WebUI when GlobalProtect Is Enabled

Your subject is about GP so just to remind you.