GP Access Routes

cancel
Showing results for 
Search instead for 
Did you mean: 

GP Access Routes

L4 Transporter

Is there any way to negate adding a prefix to the GP Access Routes? We have an app that we don't want to change the communication path when a machine connects with GP. So if it was accessing this app through an external method it should remain that way.

If the app is using address 1.1.1.1 prior to connecting with GP, then the access routes would be 0/0 but not 1.1.1.1. 

Negation is possible in other places on the PA but I don't see a way to do it with the access routes.

1 ACCEPTED SOLUTION

Accepted Solutions

Cyber Elite
Cyber Elite

@rmfalconer,

If you are running anything above 8.0 then you can add an excluded access route so that the address isn't passed through the tunnel, prior to that you do not have that ability. 

 

View solution in original post

5 REPLIES 5

L3 Networker

May I please know what PAN-OS version and GP -version are you using..

Cyber Elite
Cyber Elite

@rmfalconer,

If you are running anything above 8.0 then you can add an excluded access route so that the address isn't passed through the tunnel, prior to that you do not have that ability. 

 

View solution in original post

We are running 7.1.9 and GP 3.1.6 so it looks like it's not supported yet.

Yes negate option is added only if you use 8.0.x +4.0.x. 

It doesnt work with 8.0.x and 3.x.x versions. 

 

Hope this helps. 

It is (a lot) more awful, but it is also possible with your software versions. You "simply" have to add all IP subnets except the one IP ...

 

0.0.0.0/8

1.0.0.0/16

1.1.0.0/24

1.1.1.0/32

1.1.1.2/31

1.1.1.4/30

1.1.1.8/29

1.1.1.16/28

1.1.1.32/27

1.1.1.64/26

1.1.1.128/25

1.1.2.0/23

1.1.4.0/22

1.1.8.0/21

1.1.16.0/20

1.1.32.0/19

1.1.64.0/18

1.1.128.0/17

1.2.0.0/15

1.4.0.0/14

1.8.0.0/13

1.16.0.0/12

1.32.0.0/11

1.64.0.0/10

1.128.0.0/9

2.0.0.0/7

4.0.0.0/6

8.0.0.0/5

16.0.0.0/4

32.0.0.0/3

64.0.0.0/2

128.0.0.0/1

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!